# Environment Requirements

## PHP

Minimum: PHP 8.0 or newer. A maintained PHP 8.x release is recommended.

The codebase uses PHP 8 functionality including `str_starts_with()`.

Required/used capabilities include:

- PDO
- `pdo_mysql`
- cURL
- JSON
- mbstring
- OpenSSL
- PHP sessions
- standard filesystem functions

Commonly useful packages/extensions for the supplied code include XML, ZIP, Intl and BCMath.

## Web server

Apache 2.4+ is a suitable reference. Equivalent PHP-capable hosting may be used at the appointed developer's discretion.

The destination must support two separate application document roots/hosts if the current V1/V2 operating model is retained.

## Database

MySQL/MariaDB-compatible server with `utf8mb4` support.

V1 and V2 must point to the same standalone RBE database.

## PHP session requirement

For seamless V1 -> V2 login/session continuity:

- both hostnames must share a parent domain;
- both apps must use session name `RBESESSID`;
- both must use the same shared cookie domain and `/` path;
- the PHP session backend/save path must be shared/compatible on the host.

On a single server using the same PHP runtime, the normal PHP session save path typically satisfies the last point. If the two apps are placed on separate servers, a shared PHP session store or another deliberate session architecture is required.

## Composer

Both versions declare:

```text
phpmailer/phpmailer ^6.10
```

Composer manifests and locks are supplied.

## Node/npm

Both versions declare:

```text
mqtt ^5.13.0
```

Node/npm is required only if the retained MQTT listener is intentionally operated.

## Outbound network access

Where enabled, the host requires outbound access to configured IAMMETER/Flecto/SMTP/MQTT services.

## Permissions

A conventional Linux starting point is:

- directories `755`;
- files `644`;
- application files readable by the web/PHP process;
- any destination-created runtime log directories writable by the relevant cron/runtime user.

## HTTPS

Production use should use HTTPS. The supplied `.user.ini` template expects secure session cookies in production.

DNS, certificates, TLS policy and security hardening remain destination responsibilities.