SINGH.HELP · CPANEL EDITION

Your private daily planner

Upload-ready for PHP hosting. One authorized username. No default password.

Four steps to get started

1. Set up singh.help and HTTPS in cPanel. Use PHP 8.2+ and enable PDO SQLite.
2. Upload the web and private folders separately. The private folder must stay outside public_html and every website directory. Set its actual path in _bootstrap.php.
3. Protect the whole domain directory. In Directory Privacy, create your sole user sarj and a strong password. Confirm cPanel has written its authentication settings before removing the marked setup-lock line.
4. Check access in a new private browser window. The page, records and attachment links must require your login.

Read the full instructions below for the exact locations, setup-lock removal and verification steps.

Full installation guide

# Sarj Daily Planner for singh.help — cPanel edition

This edition runs on PHP 8.2+ with PDO SQLite on ordinary Apache/LiteSpeed cPanel hosting. You do not need Node.js, Docker, a VPS, ChatGPT sign-in or a separate MySQL database to host it. The frontend is already built. This replaces the earlier Node/VPS deployment instructions.

The planner requires the ONE username you authorize in cPanel Directory Privacy. There is no public registration form, preset password or password-reset email endpoint. You create the password inside cPanel; never send it through chat.

**This download does not enable protection on your live domain. Complete the setup below before adding private records.**

## 1. Prepare singh.help in cPanel

- Add singh.help under cPanel → Domains if needed. Note its exact **Document Root**. Use a separate directory for this planner, not an existing WordPress/application directory.
- Point the domain to this hosting account using your hosting provider's instructions. Keep unrelated website and mail records intact. The earlier VPS IP instructions do not apply to this shared-hosting edition.
- Ensure a valid SSL certificate covers singh.help and enable Force HTTPS Redirect for this domain. Always open **https://singh.help**; do not enter your planner password on an HTTP page.
- Select PHP 8.2 or later for this domain and enable `pdo` and `pdo_sqlite`. The upload settings should permit 10 MB files (`upload_max_filesize=10M`, `post_max_size=12M`). The included `.user.ini` requests these limits, but your host's PHP selector may take priority.

## 2. Put the two folders in the right places

Use cPanel → File Manager. Enable **Show Hidden Files** so the `.htaccess` files are included.

| Package folder | Where its contents go |
| --- | --- |
| `upload-to-domain/` | Inside the exact document root for singh.help. Upload the contents, including `.htaccess`, not an extra nested folder. |
| `upload-outside-public_html/singh-planner-private/` | As a directory named `singh-planner-private` in your account's home folder, OUTSIDE public_html and OUTSIDE every website's document root. |

For example, if your account home directory is `/home/myaccount`, private storage would be `/home/myaccount/singh-planner-private`. The real home path might differ; use the path shown by cPanel. Do not put this private directory under a domain, public_html, www, assets, or uploads. It contains the backend code and will hold the database, session files and all attachments.

In the domain folder, edit `_bootstrap.php`. Replace `/home/CPANEL_USERNAME/singh-planner-private` with the actual private path. Leave the rest unchanged. PHP needs read/write access to the private directory. Restrict private files to your hosting account; do not use world-writable permissions.

Do not upload the whole export ZIP into the public domain folder. Do not upload README files, tests, source folders or backup archives there. If you extracted the export into a public directory temporarily, remove that archive and the extracted extra folders before opening the site for use.

## 3. Set your sole username and password

1. Open cPanel → **Files → Directory Privacy**.
2. Select **Edit** for the exact document root of singh.help. Protect the root, not just an API or attachment subfolder.
3. Tick **Password protect this directory**, give it a label such as “Sarj Private Planner”, and click **Save**.
4. Under **Create User**, create the username **sarj** and a unique strong password. Use cPanel's Password Generator and save the result in your password manager.
5. In **Authorized Users**, ensure only your chosen account is listed for this directory. Do not create accounts for others if the planner is to remain yours alone.
6. The PHP backend also expects the exact username `sarj`. If you chose a different username, edit `owner_username` in the private folder's `config.php` to match, including case. Keep `site_origin` as `https://singh.help`.
7. Open the domain folder's `.htaccess`. Confirm that cPanel has added its authentication configuration: `AuthType Basic`, `AuthUserFile` pointing to the password file, and `require valid-user` (case may differ).
8. Only after that configuration and your user exist, remove the **single `Require all denied` line immediately below `# SETUP LOCK`** near the top of the supplied `.htaccess`. Keep cPanel's authentication block and every other protection directive. In particular, keep the separate denial inside `<FilesMatch>`.

The supplied setup lock intentionally prevents an unconfigured public launch. Depending on server authorization merging, valid-user authentication may already work while the initial denial line remains; that is not a reason to remove any of cPanel's authentication directives.

Never remove password protection to work around an error. If the PHP page says owner authentication is required after successful cPanel login, ask Namecheap support to confirm that the authenticated username is passed to PHP as `REMOTE_USER` or `REDIRECT_REMOTE_USER`. The app deliberately does not trust `PHP_AUTH_USER` alone or arbitrary HTTP headers as proof of a verified password.

## 4. Verify before using it

- In a new private/incognito browser window, visit https://singh.help. It must ask for your username and password. Cancel the prompt: the planner must not appear.
- In that same unauthenticated window, visit `https://singh.help/api.php?route=planner`. It must not return records without authentication.
- Sign in as your sole authorized user. Add a test deadline and a harmless file, refresh, then complete the task and confirm its dated record appears.
- Copy that attachment's download link to a new unauthenticated private window. It must be blocked until authentication succeeds.
- Check that private database and attachment files are not inside ANY public document root. Check that no export ZIP or backup copy was left publicly accessible.
- Confirm the address bar shows HTTPS with no certificate warning. Test a phone or second browser as well before relying on reminders.

cPanel's protection applies to the site directory and its subdirectories. The PHP backend independently checks the exact authenticated username on every request, uses CSRF tokens for changes, and serves file bytes only after authorization. Attachments are stored with random internal names outside the public web root and are downloaded as attachments rather than executed.

This controls website visitor access. Your hosting account and the hosting provider can still administer server files; protect your cPanel account too. Browser Basic authentication can retain credentials until the browser fully exits, so use your own Windows account/browser profile. There is no misleading “log out” button that promises to erase the browser's cached password.

## Windows automatic opening

The `windows-setup/` folder and the download in Settings both point to **https://singh.help/**. Once the hosted planner works, extract the Windows setup and run `Install-Planner.cmd`. Select your daily time. It adds a sign-in shortcut, a daily Windows task and a desktop shortcut. Sign in with your Directory Privacy credentials when the browser asks; it may ask again after the browser restarts.

The installer does not store your password. It does not run on your PC automatically from this download. Windows must be signed in, awake and connected to show the window. Closing the window does not complete or remove a task. Uninstall-Planner.cmd removes automatic opening without deleting online data.

## Changing your password

Use the same Directory Privacy screen and update the existing user's password. Keep the username the same unless you also update `owner_username` in the private `config.php`. Your planner data is not tied to the display username and remains present. Do not disable Directory Privacy or remove the authentication directives.

## Data and backups

This export contains code, not the hosted planner's existing records or attachments. If you have entered data in the original hosted planner, export its records and download documents before a migration. Automatic migration from the earlier hosted or Node edition is not included. Keep the original available until migration is complete.

Runtime data is in `singh-planner-private/data/`. Back up the complete private directory with the hosting account's backup tools, including planner.sqlite and data/files/. Use a consistent database backup or stop writes while copying it. Keep encrypted off-server copies and test a restore. Do not put backups in the web folder. Browser JSON export contains record and file metadata, not the document bytes.

## Updating or editing

Keep your existing private config.php, runtime data/, the edited _bootstrap.php and cPanel-generated .htaccess authentication configuration when updating. Overwriting those files blindly can break access or remove protection.

The editable frontend is included in frontend/. A developer can run `npm install` and `npm run build` locally to rebuild the assets and protected PHP entry point. Node is a development dependency only; the hosting server runs PHP. The build removes the intermediate index.html to preserve the PHP entry point and CSRF token. Do not deploy tests/ or source folders into the public root.

## Verification performed

Tested with PHP 8.3 and PDO SQLite: PHP syntax; unauthenticated, wrong-owner, forged-header and HTTP request rejection; secure session-cookie attributes; CSRF and origin checks; task saving and settings; attachment upload/download authorization; dated completion history; duplicate completion protection; month-end recurrence; archive/restore; one-off completion. The frontend build also succeeded.

The tests simulate authenticated server variables in a temporary test router. They do not verify your actual cPanel password checker, TLS certificate, file placement or directory permissions. Complete the live checks above. The Windows installer has not been run on your computer.

## Official references

- Namecheap password-protected directories: https://www.namecheap.com/support/knowledgebase/article.aspx/9767/29/how-to-password-protect-files-and-directories/
- cPanel Directory Privacy: https://docs.cpanel.net/cpanel/files/directory-privacy/
- Namecheap PHP modules: https://www.namecheap.com/support/knowledgebase/article.aspx/9697/2219/php-modules-limits-and-extensions-on-shared-hosting-servers/