2026-05-23 21:30:54 +00:00
5 changed files with 32 additions and 9 deletions
@@ -1,4 +0,0 @@
-#KONSOLEH AREA START - PLEASE DO NOT EDIT MANUALLY BETWEEN THESE LINES
-DirectoryIndex index.php
-#KONSOLEH AREA END - PLEASE ADD MANUAL CHANGES BELOW
-SetEnv FLIXCOOKS_ADMIN_KEY "vFDH.N_tVLEKNdR3fhLs"
@@ -7,13 +7,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    && a2enmod rewrite headers \
    && rm -rf /var/lib/apt/lists/*

-# Apache: document root + AllowOverride for .htaccess
+# Apache: document root, no per-directory overrides in production
 ENV APACHE_DOCUMENT_ROOT=/var/www/html
 RUN sed -ri 's!/var/www/html!${APACHE_DOCUMENT_ROOT}!g' /etc/apache2/sites-available/*.conf \
    && sed -ri 's!/var/www/!${APACHE_DOCUMENT_ROOT}!g' /etc/apache2/apache2.conf /etc/apache2/conf-available/*.conf \
    && printf '%s\n' \
        '<Directory /var/www/html>' \
-        '    AllowOverride All' \
+        '    AllowOverride None' \
        '    Require all granted' \
        '</Directory>' \
        > /etc/apache2/conf-available/flixcooks.conf \
@@ -128,7 +128,7 @@ http://localhost:8000
 #### Option B: Local Apache (XAMPP / MAMP / WAMP)
 If you prefer running a full local stack:
 1. Move or link the project directory inside your local server's document root (e.g., `htdocs` or `www`).
-2. Ensure URL rewriting is enabled (the included `.htaccess` file handles caching and custom redirections).
+2. Configure the virtual host to serve `index.php` as the directory index.
 3. Access the site via your custom local virtual host (e.g., `http://localhost/flixcooks-website`).

 ---
@@ -2,9 +2,36 @@
 session_start();
 require __DIR__ . '/helpers.php';

-$ADMIN_KEY = getenv('FLIXCOOKS_ADMIN_KEY') ?: 'vFDH.N_tVLEKNdR3fhLs';
+$ADMIN_KEY = getenv('FLIXCOOKS_ADMIN_KEY') ?: '';
 $authed = isset($_SESSION['fc_admin']) && $_SESSION['fc_admin'] === true;

+if ($ADMIN_KEY === '') {
+    http_response_code(503);
+    ?>
+    <!doctype html>
+    <html lang="en">
+    <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>FlixCooks Admin Unavailable</title>
+      <link rel="stylesheet" href="/assets/style.css">
+      <style>
+        body { display: grid; place-items: center; min-height: 100vh; }
+        .login-card { background: #fff; padding: 24px; border-radius: 16px; box-shadow: var(--shadow); width: min(420px, 90vw); }
+        .error { color: #b00020; margin: 0; }
+      </style>
+    </head>
+    <body>
+      <div class="login-card">
+        <h1>Admin unavailable</h1>
+        <p class="error">FLIXCOOKS_ADMIN_KEY is not configured.</p>
+      </div>
+    </body>
+    </html>
+    <?php
+    exit;
+}
+
 if (!$authed && isset($_POST['password'])) {
    if (hash_equals($ADMIN_KEY, $_POST['password'])) {
        $_SESSION['fc_admin'] = true;
@@ -130,7 +130,7 @@ curl http://127.0.0.1:8080/health.php
 ## 6. Sicherheit

 - `.env` wird **nicht** ins Image kopiert (`.dockerignore`).
- Admin-Key **nur** über `FLIXCOOKS_ADMIN_KEY` in Coolify, nicht in `.htaccess` für Production verlassen.
+- Admin-Key **nur** über `FLIXCOOKS_ADMIN_KEY` in Coolify setzen. Ohne diese Variable ist `/admin.php` deaktiviert.
 - Postgres nicht öffentlich exponieren, wenn nicht nötig (nur interne URL).

 ---