# ToolFox Independent — cPanel setup

**No MySQL, SQLite, Composer, Node, or API key is needed for the core application.**

Use a clean domain/subdomain and PHP **8.2 or later**. The ZIP is source code for a fresh installation; it does not include accounts or preview data.

## Five steps

1. **Select PHP.** In cPanel → MultiPHP Manager / Select PHP Version, choose PHP 8.2+. Enable **DOM/XML, mbstring, OpenSSL, session, JSON**. Enable **cURL** only if you want Stripe, genuine AI, or authorized page collection. Those integrations also need outbound HTTPS access.
2. **Upload the two folders to your account home**, not both into the website folder:
   ```text
   /home/YOUR_CPANEL_USER/
   ├── public_html/
   │   ├── index.php
   │   ├── .htaccess
   │   └── assets/
   └── toolfox_private/          ← MUST stay outside public_html
       ├── app/
       ├── storage/
       ├── tests/
       ├── cron.php
       └── .htaccess
   ```
   Merge the delivered `public_html` files into a **clean** domain document root. Back up any existing site before replacing an index.php. Use cPanel File Manager → Settings → Show Hidden Files to see `.htaccess`.
3. **Visit `https://your-domain.com/`.** ToolFox creates a random `toolfox_private/setup.key`. Open that file in cPanel File Manager and copy the key into the installer. Set your real site URL (no `/index.php`), admin name, email, and strong password. Installation cannot be claimed without the private key, and locks itself once completed.
4. **Sign in and configure the essentials.** Admin → Platform settings: set your business details and manual payment instructions. Your manual-payment subscription platform now works without any external API. Users create invoices, submit transfer references, and receive access **only after you verify and approve payment**.
5. **Add one cron job for background work.** cPanel → Cron Jobs → every 5 minutes. Example command:
   ```sh
   /opt/cpanel/ea-php82/root/usr/bin/php /home/YOUR_CPANEL_USER/toolfox_private/cron.php
   ```
   Ask your host for the actual PHP 8.2+ CLI path. Cron sends queued email, creates daily private snapshots, sends manual renewal reminders, expires manual memberships, and reconciles configured Stripe subscriptions.

### Email notifications

In Platform settings, enter the domain mailbox SMTP details provided by cPanel (TLS on port 465 or STARTTLS on port 587). Set a valid sender address and configure SPF/DKIM/DMARC. Admin → Email log → **Send test & process queue**. In-app notifications work even without email. Password-reset and verification emails require working mail delivery and cron.

### Optional Stripe

See `README.md` for Stripe setup. Stripe needs provider credentials and an eligible Stripe account; automatic recurring card charges cannot work without a payment provider. Manual payments remain independent of Stripe.

### Addon domains or nonstandard document roots

Place `toolfox_private` outside **all public document roots**. Edit `public_html/index.php` to load its actual absolute path, for example:

```php
require '/home/YOUR_CPANEL_USER/toolfox_private/app/bootstrap.php';
require PRIVATE_PATH.'/app/router.php';
```

The default relative loader works for the standard sibling-folder layout. The installer rejects a private folder detected inside the active document root. Never fix a missing path by moving private storage into a public folder.

### Permissions

PHP must be able to write inside `toolfox_private/` for the one-time setup/encryption keys, and inside `toolfox_private/storage/` for state, locks, sessions, logs and backups. Use your hosting account’s ownership and restrictive permissions (private storage 0700, state/key files 0600). **Do not use 0777.** No private files or directories should be directly downloadable over HTTP.

### Before taking real money

Test a complete payment/refund/support flow; confirm Stripe webhook delivery if enabled; confirm email and cron; back up both state and `encryption.key`; supply your own legal policies and tax-compliant invoicing process. Read the production limitations in the README. This is software—not a promise that every shared host, mail server, payment account, or Quora page will work unchanged.