url shortener config / grants

backend/url-shortener/DEPLOY.md

@@ -10,6 +10,29 @@
 | FE TLS cert | `/etc/letsencrypt/live/s.f0xx.org/` |
 | Git remote | `git://f0xx.org/androicast_project/url-shortener` |
 | MariaDB schema `url_shortener` | `sql/schema.mariadb.sql` |
+| DB app user | **`androidcast`** (shared with crash reporter; same password as `androidcast_crashes` in crashes `config.php`) |
+
+## MariaDB (BE)
+
+**Database:** `url_shortener`  
+**App user:** `androidcast` @ `localhost` + `127.0.0.1` — **same password** as crash reporter (`examples/crash_reporter/backend/config/config.php` → `db.mysql.password`).
+
+```bash
+# 1) Schema (root)
+mysql -u root -p < sql/schema.mariadb.sql
+
+# 2) Grants for existing androidcast user (root) — skip if already granted
+./scripts/init-mariadb-grants.sh
+
+# 3) Config on BE
+cp config/config.example.php config/config.php
+# edit password to match crashes config (do not commit config.php)
+
+# 4) Smoke
+mysql -u androidcast -p -h 127.0.0.1 url_shortener -e 'SHOW TABLES;'
+```
+
+Template: [config/config.example.php](config/config.example.php)
 
 ## FE (Gentoo)
 

backend/url-shortener/README.md

@@ -38,5 +38,7 @@ backend/url-shortener/
   sql/schema.mariadb.sql
   scripts/demo_curl.sh
   scripts/smoke_shorten.sh
-  public/index.php      # stub router (health only until impl)
+  scripts/init-mariadb-grants.sh
+  config/config.example.php   # DB url_shortener, user androidcast (same pwd as crashes)
+  public/index.php            # stub router until impl
 ```

backend/url-shortener/config/config.example.php

@@ -0,0 +1,20 @@
+<?php
+/**
+ * URL shortener — BE config (copy to config.php on Alpine).
+ * DB user: reuse crash reporter app user (same password as androidcast_crashes in crashes config.php).
+ */
+return [
+    'db' => [
+        'driver' => 'mysql',
+        'mysql' => [
+            'host' => '127.0.0.1',
+            'port' => 3306,
+            'socket' => '/run/mysqld/mysqld.sock',
+            'database' => 'url_shortener',
+            'username' => 'androidcast',
+            'password' => 'change-me-same-as-crashes-config',
+            'charset' => 'utf8mb4',
+        ],
+    ],
+    'public_base' => 'https://s.f0xx.org',
+];

backend/url-shortener/scripts/init-mariadb-grants.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+# Grant existing androidcast app user access to url_shortener (after schema import as root).
+# Password is NOT stored here — same as examples/crash_reporter/backend/config/config.php db.mysql.password
+#
+# Usage (on BE):
+#   mysql -u root -p < sql/schema.mariadb.sql
+#   ./scripts/init-mariadb-grants.sh
+set -eu
+
+DB_NAME="${URL_SHORTENER_DB_NAME:-url_shortener}"
+DB_USER="${URL_SHORTENER_DB_USER:-androidcast}"
+
+echo "Granting ${DB_USER}@localhost and @127.0.0.1 on ${DB_NAME}.* ..."
+mysql -u root -p <<EOF
+GRANT SELECT, INSERT, UPDATE, DELETE ON ${DB_NAME}.* TO '${DB_USER}'@'localhost';
+GRANT SELECT, INSERT, UPDATE, DELETE ON ${DB_NAME}.* TO '${DB_USER}'@'127.0.0.1';
+FLUSH PRIVILEGES;
+EOF
+
+echo "Smoke: mysql -u ${DB_USER} -p -h 127.0.0.1 ${DB_NAME} -e 'SHOW TABLES;'"