Ship the admin panel with the build, where the host actually serves from

niteshacars.in/admin returned the site's own "page not found" while the
panel sat perfectly well in the repository. The reason took all day to find
and is embarrassing in hindsight: Hostinger deploys this repository by
running npm run build and serving my-app/dist. dist is the document root.
Anything outside it does not exist as far as the web is concerned.

Everything built today -- the FTPS pipeline, the config.php generator, the
panel-finding search -- wrote to a folder nobody serves. The site has been
deploying automatically from main the whole time. The Deployments panel said
so plainly and I inferred from file listings instead.

copy-admin-panel.mjs copies the panel into dist/admin after the Vite build,
so /admin ships with the site and deploys the same automatic way. Vite would
copy public/ verbatim and that would have been less code, but burying a PHP
application inside the website's asset folder is a surprise to whoever reads
the tree next.

config.php is never copied, and config() had to change to match. It looked
in one fixed place, beside the panel -- which is inside dist, recreated from
scratch on every deploy, so the database password would need re-uploading
after every push. It now also searches upward for a nitesha-config/
directory. Outside the document root, that survives deploys and cannot be
fetched over HTTP even if a rule is wrong, which is where a database
password belongs. The old path is still checked first, so an install that
predates this is untouched.

Six cases covered against real layouts: config above dist, several levels
up, beside the panel, beside winning over the outward search, absent
entirely, and beyond the search depth so it gives up rather than walking to
the filesystem root.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0128YzbhrfGdegUSc9RrARRf

Author: claude

my-app/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "node scripts/photo-manifest.mjs && node scripts/fetch-content.mjs && vite",
-    "build": "node scripts/photo-manifest.mjs && node scripts/fetch-content.mjs && tsc -b && vite build && node scripts/prerender-seo.mjs",
+    "build": "node scripts/photo-manifest.mjs && node scripts/fetch-content.mjs && tsc -b && vite build && node scripts/copy-admin-panel.mjs && node scripts/prerender-seo.mjs",
     "lint": "oxlint",
     "preview": "vite preview"
   },

my-app/scripts/copy-admin-panel.mjs

@@ -0,0 +1,52 @@
+// Copies the PHP admin panel into the build output, so it ships with the site.
+//
+// Hostinger deploys this repository by running `npm run build` and serving
+// my-app/dist. That means dist is the document root: anything not in it does
+// not exist as far as the web is concerned, which is why niteshacars.in/admin
+// returned the site's own "page not found" while the panel sat perfectly well
+// in the repository.
+//
+// Vite copies public/ verbatim into dist/, so the panel could simply live
+// there -- but public/ is for the website's own assets, and burying a PHP
+// application inside it would be a surprise to anyone reading the tree. This
+// copies it explicitly instead, after the build, where the intent is visible.
+//
+// config.php is never copied. It holds the database password, it is gitignored,
+// and dist is rebuilt from scratch on every deploy -- so anything written into
+// it is temporary by construction. The panel finds its configuration outside
+// the build output; see config() in the panel's src/db.php.
+
+import { cp, mkdir, rm, stat } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const source = join(dirname(root), 'public_html', 'admin.niteshacars.in', 'admin');
+const target = join(root, 'dist', 'admin');
+
+// Never ship these. The test tooling is not a security boundary, but it is
+// noise on a public server and some of it takes arguments.
+const SKIP = new Set(['config.php', '.ftp-deploy-sync-state.json', '.ftp-deploy-admin-state.json']);
+
+try {
+  await stat(source);
+} catch {
+  console.error(`copy-admin-panel: no panel at ${source}`);
+  process.exit(1);
+}
+
+await rm(target, { recursive: true, force: true });
+await mkdir(dirname(target), { recursive: true });
+
+let copied = 0;
+await cp(source, target, {
+  recursive: true,
+  filter: (src) => {
+    const name = src.slice(src.lastIndexOf('/') + 1);
+    if (SKIP.has(name)) return false;
+    copied += 1;
+    return true;
+  },
+});
+
+console.log(`copy-admin-panel: ${copied} entries into dist/admin`);

public_html/admin.niteshacars.in/admin/src/db.php

@@ -15,6 +15,58 @@ function config_set(array $values): void
     $GLOBALS['__config_override'] = $values;
 }
 
+/**
+ * Finds config.php.
+ *
+ * It used to be one fixed path, next to the panel. That stopped working when
+ * the host began deploying this repository by building it: the build output is
+ * the document root and it is recreated from scratch every time, so anything
+ * written beside the panel is erased on the next push. Keeping the file there
+ * would mean re-uploading the database password after every deploy.
+ *
+ * So the panel looks outward instead. A directory named nitesha-config,
+ * anywhere above the panel, holds the file; being outside the document root it
+ * survives deploys and cannot be fetched over HTTP even if a rule is
+ * misconfigured, which is where a database password belongs anyway.
+ *
+ * The old location is still checked first, so an install that predates this
+ * keeps working untouched.
+ *
+ * Returns null when there is nothing to load; the caller decides what to say.
+ */
+function config_path(): ?string
+{
+    $explicit = getenv('NITESHA_CONFIG');
+    if (is_string($explicit) && $explicit !== '' && is_file($explicit)) {
+        return $explicit;
+    }
+
+    // Beside the panel: how this has always worked, and still right for an
+    // install that is uploaded rather than built.
+    $beside = __DIR__ . '/../config.php';
+    if (is_file($beside)) {
+        return $beside;
+    }
+
+    // Then upwards. Six levels is past the account root on every layout this
+    // has run on, and stopping at the filesystem root keeps it terminating on
+    // any layout it has not.
+    $dir = dirname(__DIR__);
+    for ($i = 0; $i < 6; $i++) {
+        $candidate = $dir . '/nitesha-config/config.php';
+        if (is_file($candidate)) {
+            return $candidate;
+        }
+        $parent = dirname($dir);
+        if ($parent === $dir) {
+            break;
+        }
+        $dir = $parent;
+    }
+
+    return null;
+}
+
 function config(?string $key = null): mixed
 {
     static $config = null;
@@ -24,8 +76,8 @@ function config(?string $key = null): mixed
     }
 
     if ($config === null) {
-        $path = __DIR__ . '/../config.php';
-        if (!is_file($path)) {
+        $path = config_path();
+        if ($path === null) {
             http_response_code(500);
             exit('Not set up yet. Open install.php in your browser to get started.');
         }