# Plenvo

A self-hosted, web-based project management tool. Manage tasks on Kanban boards, Gantt charts, and list views — with team roles, external collaborators, AI assistant integration, and e-mail notifications.

## Requirements

- PHP **8.1** or higher
- Apache with **mod_rewrite** enabled (and `mod_headers` for the security headers shipped in `.htaccess`)
- PHP extensions:
  - `pdo`, `pdo_sqlite` — database
  - `mbstring` — multibyte string handling
  - `openssl` — random key generation, AES-256-GCM at-rest encryption (TOTP secrets), SHA-256 token hashing
  - `fileinfo` — MIME validation on uploads (TOCTOU-safe)
  - `dom` — HTML sanitizer (Symfony HtmlSanitizer for user-supplied HTML)
  - `zip` — auto-updater (extracts release ZIPs)
  - `curl` (optional) — HIBP password-leak check + AI provider HTTP calls

The setup wizard automatically verifies all of these on first launch and refuses to install if any required extension is missing.

## Installation

### 1. Download

Download the latest release ZIP — all dependencies are already bundled, no Composer required.

### 2. Configure your web server

Point your Apache virtual host document root to the project directory. The included `.htaccess` handles URL routing automatically. Make sure `AllowOverride All` is set for the directory.

Example virtual host (HTTPS recommended):

```apache
# Redirect HTTP to HTTPS
<VirtualHost *:80>
    ServerName example.com
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>

# HTTPS virtual host
<VirtualHost *:443>
    ServerName example.com
    DocumentRoot /var/www/plenvo

    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

    # Recommended TLS settings
    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    SSLHonorCipherOrder     off
    SSLSessionTickets       off

    # Security headers
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    <Directory /var/www/plenvo>
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>
```

> **Let's Encrypt** is the easiest way to get a free TLS certificate: `certbot --apache -d example.com`

> If you are running Plenvo behind a reverse proxy (nginx, Traefik, etc.), you can omit the SSL block and handle TLS termination at the proxy level. Make sure the proxy forwards `X-Forwarded-Proto: https` so Plenvo generates correct HTTPS links.

Make sure the web server user has write access to the project directory so the installer can create the `data/` folder:

```bash
chown -R www-data:www-data /var/www/plenvo   # adjust to your web server user
```

### 4. Run the setup wizard

Open your browser and navigate to your domain. You will be automatically redirected to `/install` where you can set up the admin account. The installer creates the `data/` directory, database, and admin account automatically.

---

## Cron jobs

For e-mail reminders and overdue notifications, set up a cron job to run `cron.php` every minute:

```
* * * * * php /var/www/plenvo/cron.php
```

---


## Privacy notice — automatic update checks

Plenvo includes a built-in update checker. Once installed, the application contacts the central update server at **plenvo.gp-server.com** approximately once per hour to check whether a newer version is available. This request includes:

- The current installed version number (e.g. `Plenvo/1.5.19`)
- The IP address of your server (as part of any outbound HTTP request)

No user data, account information, or usage statistics are transmitted.

**Why this exists:** The update checker allows administrators to be notified in-app when a new release is available and to apply it with a single click. It reduces the risk of running outdated software with known security issues.

**How to disable it:** Update checks can be turned off in the admin settings under *System → Updates*. When disabled, no outbound requests are made to plenvo.gp-server.com.

## License

GNU Affero General Public License v3

Plenvo is released under the GNU Affero General Public License v3. The software may be used, operated and inspected free of charge. Redistribution or modification of the source code is only permitted under the same license terms. Installations must visibly retain the "Powered by Plenvo" notice linking to plenvo.gp-server.com.
