Verified foundation and early domain slices: Docker runtime, MariaDB schema, secure session authentication, environment-based Administrator bootstrap, role-aware navigation/dashboard, CSRF protection, password hashing, audit events, client/contact validation, client search/detail views, jobcard creation/listing, jobcard references and status rules, time-entry validation/aggregation, SLA calculations/classification, and safe internal versus client-facing reporting contracts.

Requirements

Docker Engine with Compose v2
A .env file copied from .env.example with unique values filled in

Run locally

cp .env.example .env
# Replace every placeholder in .env with unique local values.
docker compose up --build

Open http://localhost:8082. The first application boot creates the Administrator user from ADMIN_EMAIL and ADMIN_PASSWORD; the password is hashed with PHP's password API and is never stored in configuration or SQL.

Verification

docker compose config
find app config database public -type f -name '*.php' -print0 | xargs -0 -n1 php -l

Security notes

Do not commit .env or production credentials.
Set APP_KEY to a long random value and keep it in a secrets manager in production.
Credential vault encryption and the remaining domain modules are scheduled in later phases.
The initial schema is delivered as a Docker bootstrap SQL file. Apply it once to a new database; later releases should use versioned migrations.