NOVAMAIL - PHP SMTP EMAIL SENDER
=================================

Requirements
------------
- PHP 8.1 or newer
- PHP extensions: openssl, mbstring, iconv
- Composer
- SMTP account authorized to send from your domain
- HTTPS certificate

Install dependencies
--------------------
In the project directory run:
    composer install --no-dev --optimize-autoloader

Set configuration
-----------------
Edit config.php for your brand name, logo URL, business address and support email.

Set these environment variables in your hosting control panel if supported:
    ADMIN_USERNAME
    ADMIN_PASSWORD_HASH
    SMTP_HOST
    SMTP_PORT
    SMTP_USERNAME
    SMTP_PASSWORD
    SMTP_ENCRYPTION
    MAIL_FROM_EMAIL
    MAIL_FROM_NAME
    MAIL_REPLY_TO

Generate a password hash locally:
    php -r "echo password_hash('Use-A-Long-Unique-Password', PASSWORD_DEFAULT), PHP_EOL;"

Set the resulting hash as ADMIN_PASSWORD_HASH. Do not use the example password.
If your hosting panel cannot set environment variables, edit config.php and set
admin_password_hash to the generated hash and smtp_password to the SMTP password.
Protect config.php with filesystem permissions and .htaccess; placing config.php
outside public_html is safer if your hosting layout permits it.

SMTP settings
-------------
For port 587 use SMTP_ENCRYPTION=tls (STARTTLS).
For port 465 use SMTP_ENCRYPTION=ssl (implicit TLS).
Use the exact hostname and settings supplied by your email provider.

cPanel deployment
-----------------
1. Enable HTTPS for the domain.
2. Upload this folder to a location such as public_html/novamail/.
3. Ensure the folder's .htaccess file is uploaded.
4. Install Composer dependencies locally or through cPanel Terminal:
       composer install --no-dev --optimize-autoloader
5. Set PHP version to 8.1 or newer.
6. Configure environment variables in your hosting control panel, or update
   config.php with the correct values and a generated password hash.
7. Open https://yourdomain.com/novamail/login.php
8. Sign in with the configured admin username and password.
9. Send a test message only to an address you control.

Security notes
--------------
- Keep this page behind admin authentication.
- Never publish SMTP credentials or password hashes in a public repository.
- Use a strong unique admin password and HTTPS.
- Back up config securely; don't expose errors or SMTP debug output publicly.
- This app sends one message per submission. It does not implement mailing lists.
- Send only to people who expect your email. For marketing, include a valid
  unsubscribe mechanism and follow applicable email laws.
- SPF, DKIM and DMARC improve authentication, but inbox placement is not guaranteed.
