Configuration Guide

Configure Scriptlog using config.php, .env files, and the dynamic SMTP system for flexible deployment.

Home / Documentation / Configuration Guide

Configuration Files

Scriptlog supports both config.php and .env files for configuration. Both are auto-generated during installation.

config.php

Main configuration file with $_ENV fallback pattern:

PHP config.php 
<?php

return [
    'db' => [
        'host' => $_ENV['DB_HOST'] ?? 'localhost',
        'user' => $_ENV['DB_USER'] ?? '',
        'pass' => $_ENV['DB_PASS'] ?? '',
        'name' => $_ENV['DB_NAME'] ?? '',
        'port' => $_ENV['DB_PORT'] ?? '3306',
        'prefix' => $_ENV['DB_PREFIX'] ?? '',
    ],

    'app' => [
        'url'   => $_ENV['APP_URL'] ?? 'https://example.com',
        'email' => $_ENV['APP_EMAIL'] ?? '',
        'key'   => $_ENV['APP_KEY'] ?? '',
        'defuse_key' => $_ENV['DEFUSE_KEY_PATH'] ?? '/var/www/your-project/storage/keys/[random_filename].php',
    ],

    'mail' => [
        'smtp' => [
            'host' => $_ENV['SMTP_HOST'] ?? '',
            'port' => $_ENV['SMTP_PORT'] ?? 587,
            'encryption' => $_ENV['SMTP_ENCRYPTION'] ?? 'tls',
            'username' => $_ENV['SMTP_USER'] ?? '',
            'password' => $_ENV['SMTP_PASS'] ?? '',
        ],
        'from' => [
            'email' => $_ENV['MAIL_FROM_ADDRESS'] ?? '',
            'name' => $_ENV['MAIL_FROM_NAME'] ?? 'Blogware'
        ]
    ],

    'os' => [
        'system_software' => $_ENV['SYSTEM_OS'] ?? 'Linux',
        'distrib_name'    => $_ENV['DISTRIB_NAME'] ?? 'Linux Mint'
    ],

    'api' => [
        'allowed_origins' => $_ENV['CORS_ALLOWED_ORIGINS'] ?? ''
    ],
];

.env File

Auto-generated environment file:

ENV .env 
# --- DATABASE CONFIGURATION ---
DB_HOST="localhost"
DB_USER="blogwareuser"
DB_PASS="yourpassword"
DB_NAME="blogwaredb"
DB_PORT="3306"
DB_PREFIX=""

# --- APPLICATION CONFIGURATION ---
APP_URL="https://example.com"
APP_EMAIL="[email protected]"
APP_KEY="XXXXXX-XXXXXX-XXXXXX-XXXXXX"
DEFUSE_KEY_PATH="/var/www/your-project/storage/keys/[random_filename].php"

# --- MAIL / SMTP CONFIGURATION ---
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_ENCRYPTION=tls
MAIL_FROM_ADDRESS="[email protected]"
MAIL_FROM_NAME=Blogware

# --- SYSTEM ---
SYSTEM_OS="Linux"
DISTRIB_NAME="Linux Mint"

# --- API SECURITY ---
CORS_ALLOWED_ORIGINS="https://example.com"

Application Constants

Defined in lib/common.php:

Constant Value Description
DS DIRECTORY_SEPARATOR Directory separator
APP_TITLE 'Scriptlog' Application name
APP_CODENAME 'Maleo Senkawor' Release codename
APP_VERSION '1.8.1' Application version
API_VERSION 'v1' REST API version segment
APP_ROOT dirname(dirname(__FILE__)) . DS Absolute application root (trailing separator)
APP_ADMIN 'admin' Admin directory name
APP_PUBLIC 'public' Public directory name
APP_LIBRARY 'lib' Library directory name
APP_THEME public/themes/ Themes directory (relative to APP_ROOT)
APP_PLUGIN admin/plugins/ Plugins directory
APP_IMAGE public/files/pictures/ Images directory (plus APP_IMAGE_LARGE, APP_IMAGE_MEDIUM, APP_IMAGE_SMALL)
APP_VIDEO public/files/video/ Videos directory
APP_AUDIO public/files/audio/ Audio directory
APP_DOCUMENT public/files/docs/ Downloadable documents directory
APP_CACHE false Page cache master switch
APP_CACHE_DIR public/cache/ Page cache directory
APP_CACHE_LIFETIME 3600 Cache lifetime in seconds
APP_FILE_SIZE 1048576 Maximum upload size in bytes (1 MB)
APP_DEVELOPMENT true Development mode flag
APP_PROTOCOL 'http' or 'https' Detected request protocol
APP_HOSTNAME HTTP_HOST / SERVER_NAME Detected hostname
SCRIPTLOG HMAC-SHA256 hash Security constant used to guard direct file access

Database Configuration

Configure database connection settings:

Setting Environment Variable Default
Host DB_HOST localhost
Username DB_USER -
Password DB_PASS -
Database DB_NAME -
Port DB_PORT 3306
Table Prefix DB_PREFIX (empty)

Dynamic SMTP System

Scriptlog features a database-driven SMTP configuration system that allows real-time updates without manual file modification.

Configuration Keys (tbl_settings)

Key Description
smtp_host SMTP server hostname (e.g., smtp.gmail.com)
smtp_port SMTP server port (587, 465)
smtp_encryption Encryption method (tls, ssl, none)
smtp_username SMTP authentication username
smtp_password SMTP authentication password
smtp_from_email Default "From" email address
smtp_from_name Default "From" name

Core Components

Component Location Purpose
NotificationService lib/service/NotificationService.php Email delivery with database fallback
ConfigurationController lib/controller/ConfigurationController.php Handles SMTP setting updates
MAIL_CONFIG lib/core/ActionConst.php Action constant for mail config

Configuration Priority

NotificationService prioritizes settings from the database. If a setting is missing, it falls back to config.php values.

Security Configuration

Cookie Encryption

Authentication cookies are encrypted using Defuse/php-encryption. During installation a random key file is generated and its path is stored in three places so it can be resolved at runtime:

  • config.php — app.defuse_key (via the DEFUSE_KEY_PATH fallback)
  • .env — DEFUSE_KEY_PATH
  • tbl_settings — defuse_key_path

The key is written outside the web root when possible, with an in-tree fallback:

TEXT key location 
# Primary (recommended) - outside web root
/var/www/your-project/storage/keys/[random_filename].php

# Fallback - inside web root, protected by a generated .htaccess
/var/www/your-project/public_html/lib/utility/.lts/[random_filename].php

Generated with Defuse\Crypto\Key::createNewRandomKey() by generate_defuse_key() in install/include/setup.php.

CSRF Protection

All forms use CSRF tokens generated via CSRFGuard class. Token validation is required for POST requests.

Installation Settings

Installer-created key/value records stored in tbl_settings (see install/include/setup.php and install/include/dbtable.php):

Group Key Description
Site & Identity app_key Application HMAC key (used to sign the SCRIPTLOG constant)
app_url Site base URL
site_name Site title (default Scriptlog 1.0)
site_tagline Site tagline (default Blog engine)
site_description Site meta description
site_keywords Site meta keywords
site_email Site contact email
tbl_prefix Table prefix chosen during installation
defuse_key_path Absolute path to the Defuse encryption key file
Content & Display post_per_page Posts per page on the blog index
post_per_rss Posts per RSS feed
post_per_archive Posts per archive page
comment_per_post Comments shown per post
writing_scheduled_post_enabled 1/0 - enable scheduled publishing
JSON Settings permalink_setting JSON { rewrite, server_software } for SEO-friendly URLs
timezone_setting JSON { timezone_identifier }
membership_setting JSON { user_can_register, default_role }
Localization lang_default Default language code (default en)
lang_available Comma-separated available language codes
lang_auto_detect 1/0 - detect browser language
lang_prefix_required 1/0 - require a language prefix in URLs
Mail / SMTP smtp_host SMTP server hostname
smtp_port SMTP server port
smtp_encryption Encryption method (tls, ssl, none)
smtp_username SMTP authentication username
smtp_password SMTP authentication password
smtp_from_email Default "From" email address
smtp_from_name Default "From" name
API Rate Limiting api_rate_limit_enabled 1/0 - enable API rate limiting
api_rate_limit_read Read requests allowed per minute (default 60)
api_rate_limit_write Write requests allowed per minute (default 20)
Cache cache_enabled 1/0 - page cache (disabled by default)
cache_lifetime Cache lifetime in seconds (default 3600)
Downloads download_allowed_mime_types JSON array of permitted MIME types
download_expiry_hours Download grant lifetime in hours (default 8)
download_hotlink_protection yes/no - hotlink protection
download_allowed_domains JSON array of allowed referrer domains
download_support_url Support URL shown on the download page
download_support_label Label for the download support link (default Support)

The active theme is not a setting key: it is stored in tbl_themes with theme_status = 'Y'.

Environment Variables

Complete list of supported environment variables:

ENV variables 
# Database
DB_HOST, DB_USER, DB_PASS, DB_NAME, DB_PORT, DB_PREFIX

# Application
APP_URL, APP_EMAIL, APP_KEY, DEFUSE_KEY_PATH

# SMTP
SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS, SMTP_ENCRYPTION
MAIL_FROM_ADDRESS, MAIL_FROM_NAME

# System
SYSTEM_OS, DISTRIB_NAME

# API / CORS
CORS_ALLOWED_ORIGINS

Best Practices

Follow these recommended practices for secure and maintainable configuration:

Environment Variables

Use .env for environment-specific values. Never hardcode sensitive data.

Version Control

Never commit secrets to version control. Add .env to .gitignore.

Encryption Keys

Store encryption keys outside web root. Use the auto-generated Defuse key path.

Database Security

Use table prefixes for multi-tenant setups. Use prepared statements to prevent SQL injection.

Dynamic SMTP

Use dynamic SMTP settings for flexible email configuration without code changes.

Configuration Fallback

Use $_ENV fallback pattern in config.php for default values.

Security Checklist

Use strong database passwords (16+ characters)
Enable SSL/TLS for database connections
Restrict config.php permissions (chmod 600)
Store session data outside web root
Use HTTPS for all production connections
Related Documentation
Installation Guide Initial configuration and setup
Architecture Bootstrap initialization flow
Architecture
Database Schema