MyChat — Setup Guide

A self-hosted PHP chat application with SQLite storage, Mailgun email, and a full admin panel.

Requirements

• PHP 7.4+ with extensions: pdo_sqlite, curl, openssl
• A web server with .htaccess support (Apache) or equivalent Nginx config
• A Mailgun account (free tier works fine)

---

1. Upload Files

Upload the entire chatapp/ directory to your web server. Rename the folder if you like (e.g., chat/).

---

2. Edit config.php

Open config.php and update every value:

define('APP_URL',  'https://yourdomain.com/chat');   // path to this app
define('SECRET_KEY', 'generate-32-random-chars-here');

define('ADMIN_USERNAME', 'admin');
// Generate a new hash:  php -r "echo password_hash('yourpassword', PASSWORD_BCRYPT);"
define('ADMIN_PASSWORD_HASH', 'paste-bcrypt-hash-here');

define('MAILGUN_API_KEY',  'key-xxxx');
define('MAILGUN_DOMAIN',   'mg.yourdomain.com');
define('MAILGUN_FROM',     'noreply@yourdomain.com');

---

3. Set Permissions

The data/ directory must be writable by the web server. It is created automatically, but if needed:

mkdir -p data
chmod 750 data

Important: Keep the data/ folder outside your webroot if possible. If it must stay inside, the .htaccess blocks direct access to .db files.

---

4. Mailgun Setup

1. Sign up at https://mailgun.com
2. Add and verify your sending domain
3. Copy your Private API Key into config.php
4. Set MAILGUN_DOMAIN to your verified Mailgun domain (e.g., mg.yourdomain.com)

---

5. First Login

• Visit https://yourdomain.com/chat/auth/login.php
• Log in with your admin username and password from config.php
• You'll be redirected to the Admin Dashboard

---

File Structure

chatapp/
├── config.php          ← ⚠ Edit this first
├── db.php              ← SQLite bootstrap
├── helpers.php         ← Auth, CSRF, email helpers
├── index.php           ← Chat room
├── .htaccess           ← Security rules
├── data/               ← Auto-created; holds chat.db
├── auth/
│   ├── login.php
│   ├── register.php
│   ├── verify.php
│   ├── forgot.php
│   ├── reset.php
│   └── logout.php
├── admin/
│   └── dashboard.php   ← User + message management
├── api/
│   └── messages.php    ← JSON API (send/poll/delete)
├── assets/css/
│   └── main.css
└── layout/
    ├── header.php
    └── footer.php

---

Security Notes

• Passwords are hashed with bcrypt (PHP password_hash)
• All forms are CSRF-protected
• Email tokens are stored as SHA-256 hashes (raw token only travels in email)
• SQL injection prevented via PDO prepared statements
• XSS prevented via htmlspecialchars() on all output
• Admin credentials are never stored in the database
• The data/ and layout/ directories are blocked from direct browser access

---

Nginx (if not using Apache)

Add to your server block:

location ~* /chatapp/(data|layout)/ { deny all; }
location ~* \.(db|sqlite)$ { deny all; }
location ~* ^/chatapp/(config|db|helpers)\.php$ { deny all; }

---

Customization

• App name: Change APP_NAME in config.php
• Colors/fonts: Edit assets/css/main.css (CSS variables at the top)
• Poll interval: Change POLL_INTERVAL in config.php (milliseconds)
• Message history: Change MSG_HISTORY in config.php