From ec84b3da44a2e6c9bf23be73e04a5f610640fa71 Mon Sep 17 00:00:00 2001
From: Anton Afanasyeu <a.afanasieff@gmail.com>
Date: Thu, 11 Jun 2026 22:31:14 +0200
Subject: [PATCH] url shortener config / grants

---
 backend/url-shortener/DEPLOY.md               | 23 +++++++++++++++++++
 backend/url-shortener/README.md               |  4 +++-
 .../url-shortener/config/config.example.php   | 20 ++++++++++++++++
 .../scripts/init-mariadb-grants.sh            | 20 ++++++++++++++++
 4 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 backend/url-shortener/config/config.example.php
 create mode 100755 backend/url-shortener/scripts/init-mariadb-grants.sh

diff --git a/backend/url-shortener/DEPLOY.md b/backend/url-shortener/DEPLOY.md
index d37563e..496c9ec 100644
--- a/backend/url-shortener/DEPLOY.md
+++ b/backend/url-shortener/DEPLOY.md
@@ -10,6 +10,29 @@
 | FE TLS cert | `/etc/letsencrypt/live/s.f0xx.org/` |
 | Git remote | `git://f0xx.org/androicast_project/url-shortener` |
 | MariaDB schema `url_shortener` | `sql/schema.mariadb.sql` |
+| DB app user | **`androidcast`** (shared with crash reporter; same password as `androidcast_crashes` in crashes `config.php`) |
+
+## MariaDB (BE)
+
+**Database:** `url_shortener`  
+**App user:** `androidcast` @ `localhost` + `127.0.0.1` — **same password** as crash reporter (`examples/crash_reporter/backend/config/config.php` → `db.mysql.password`).
+
+```bash
+# 1) Schema (root)
+mysql -u root -p < sql/schema.mariadb.sql
+
+# 2) Grants for existing androidcast user (root) — skip if already granted
+./scripts/init-mariadb-grants.sh
+
+# 3) Config on BE
+cp config/config.example.php config/config.php
+# edit password to match crashes config (do not commit config.php)
+
+# 4) Smoke
+mysql -u androidcast -p -h 127.0.0.1 url_shortener -e 'SHOW TABLES;'
+```
+
+Template: [config/config.example.php](config/config.example.php)
 
 ## FE (Gentoo)
 
diff --git a/backend/url-shortener/README.md b/backend/url-shortener/README.md
index e3d3b7b..ec2f6d5 100644
--- a/backend/url-shortener/README.md
+++ b/backend/url-shortener/README.md
@@ -38,5 +38,7 @@ backend/url-shortener/
   sql/schema.mariadb.sql
   scripts/demo_curl.sh
   scripts/smoke_shorten.sh
-  public/index.php      # stub router (health only until impl)
+  scripts/init-mariadb-grants.sh
+  config/config.example.php   # DB url_shortener, user androidcast (same pwd as crashes)
+  public/index.php            # stub router until impl
 ```
diff --git a/backend/url-shortener/config/config.example.php b/backend/url-shortener/config/config.example.php
new file mode 100644
index 0000000..db82927
--- /dev/null
+++ b/backend/url-shortener/config/config.example.php
@@ -0,0 +1,20 @@
+<?php
+/**
+ * URL shortener — BE config (copy to config.php on Alpine).
+ * DB user: reuse crash reporter app user (same password as androidcast_crashes in crashes config.php).
+ */
+return [
+    'db' => [
+        'driver' => 'mysql',
+        'mysql' => [
+            'host' => '127.0.0.1',
+            'port' => 3306,
+            'socket' => '/run/mysqld/mysqld.sock',
+            'database' => 'url_shortener',
+            'username' => 'androidcast',
+            'password' => 'change-me-same-as-crashes-config',
+            'charset' => 'utf8mb4',
+        ],
+    ],
+    'public_base' => 'https://s.f0xx.org',
+];
diff --git a/backend/url-shortener/scripts/init-mariadb-grants.sh b/backend/url-shortener/scripts/init-mariadb-grants.sh
new file mode 100755
index 0000000..87a8124
--- /dev/null
+++ b/backend/url-shortener/scripts/init-mariadb-grants.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+# Grant existing androidcast app user access to url_shortener (after schema import as root).
+# Password is NOT stored here — same as examples/crash_reporter/backend/config/config.php db.mysql.password
+#
+# Usage (on BE):
+#   mysql -u root -p < sql/schema.mariadb.sql
+#   ./scripts/init-mariadb-grants.sh
+set -eu
+
+DB_NAME="${URL_SHORTENER_DB_NAME:-url_shortener}"
+DB_USER="${URL_SHORTENER_DB_USER:-androidcast}"
+
+echo "Granting ${DB_USER}@localhost and @127.0.0.1 on ${DB_NAME}.* ..."
+mysql -u root -p <<EOF
+GRANT SELECT, INSERT, UPDATE, DELETE ON ${DB_NAME}.* TO '${DB_USER}'@'localhost';
+GRANT SELECT, INSERT, UPDATE, DELETE ON ${DB_NAME}.* TO '${DB_USER}'@'127.0.0.1';
+FLUSH PRIVILEGES;
+EOF
+
+echo "Smoke: mysql -u ${DB_USER} -p -h 127.0.0.1 ${DB_NAME} -e 'SHOW TABLES;'"