bak

README.md

@@ -87,9 +87,12 @@ hyprcrd/
 ├── config.php              # App constants (auto-configured)
 ├── Dockerfile
 ├── docker-entrypoint.sh
+├── dist.sh                 # Build distribution ZIP
 ├── src/
 │   ├── bootstrap.php       # Initialization
-│   └── Database.php        # SQLite schema & migrations
+│   ├── Database.php        # SQLite schema & migrations
+│   ├── CalDavClient.php    # CalDAV HTTP client + iCal parser
+│   └── CalDavSync.php      # Bidirectional CalDAV sync engine
 ├── public/                 # Document root
 │   ├── index.php           # Entry point & API
 │   ├── .htaccess           # URL rewriting
@@ -104,6 +107,11 @@ hyprcrd/
 │   │   ├── modules/        # Feature modules
 │   │   └── vendor/         # marked.js, DOMPurify
 │   └── uploads/            # User media (writable)
+├── relay/                  # Relay service (mobile inbox + card sharing)
+│   ├── index.php           # Single-file API + Mobile UI
+│   ├── .htaccess           # URL rewriting + data protection
+│   ├── Dockerfile
+│   └── dist.sh             # Build relay distribution ZIP
 └── data/
     └── hyprcrd.db          # SQLite database (auto-created)
 ```
@@ -123,6 +131,11 @@ hyprcrd/
 - **CalDAV sync** with ownCloud/Nextcloud (bidirectional, `#termin` tagged cards)
 - **Inline calculator** (`?3+5` → `8`, `34+56?` → `34+56=90`)
 - **Snippets** (`?dat`, `?time`, `?now`, `?todo`, `?table`, `?code`, ...)
+- **Due dates** with overdue notifications and pulsing cards
+- **Relay** for mobile note capture and card sharing between instances
+- **Notification banner** for upcoming events, birthdays, overdue tasks
+- **Board split view** with side-by-side preview
+- **Superview** compact multi-column list with hover cards
 - **Keyboard shortcuts**: `Ctrl+K` search, `F1` help, `Shift+scroll` zoom, arrow keys in autocomplete
 
 ## Data & Backup
@@ -204,6 +217,99 @@ The built-in calendar shows cards on their dates:
 - Appointment template includes Zeit, Ort, Teilnehmer, Notizen fields
 - Navigate months with arrow buttons, **today** jumps to current date
 
+## Vault Key (Multi-Instance Encryption)
+
+When running multiple hyprcrd instances that share CalDAV credentials, you need a shared encryption key.
+
+### Setup
+
+1. Go to **Settings > Account > Vault Key**
+2. Enter the same key (min 8 characters) on all instances
+3. Click **save**
+
+### How it works
+
+- The vault key encrypts/decrypts CalDAV credentials stored in the database
+- Key derivation: `SHA-256(vault_key)` → deterministic, same on all instances
+- Without a vault key, encryption falls back to the login password hash (single-instance only)
+- Changing the vault key automatically re-encrypts CalDAV credentials
+- Changing the login password does NOT affect encryption when a vault key is set
+
+### Important
+
+- The vault key is stored in plaintext in each instance's database — it is NOT synced
+- You must enter it manually on each connected instance
+
+## Relay
+
+A minimal web service for mobile note capture and card sharing between hyprcrd instances.
+
+### Architecture
+
+```
+[Phone/Browser] → https://relay.example.com → [Relay Service]
+                                                     ↓ poll
+                                               [hyprcrd (local)]
+
+[hyprcrd A] → push card → [Relay] ← poll ← [hyprcrd B]
+```
+
+### Deploy to Webspace
+
+```bash
+cd relay
+./dist.sh
+```
+
+Upload the resulting `hyprcrd-relay.zip` to your webspace and extract it. The SQLite database is created automatically on first request. Open the URL and set a password + shared secret.
+
+Requirements: PHP 8.3+ with `pdo_sqlite`, Apache with `mod_rewrite`.
+
+### Deploy with Docker
+
+```bash
+cd relay
+docker build -t hyprcrd-relay .
+docker run -d -p 8081:80 -v relay-data:/var/www/html/data hyprcrd-relay
+```
+
+### Development (both together)
+
+```bash
+./dev.sh
+```
+
+Starts hyprcrd on `http://localhost:8088` and the relay on `http://localhost:8081` in the same Docker network. Source files are bind-mounted — changes are live without rebuilding.
+
+From inside the hyprcrd container, the relay is reachable at `http://relay:80`.
+
+### Setup
+
+1. Open the relay URL, set a **password** (for UI login) and a **shared secret** (for encryption)
+2. In hyprcrd: **Settings > Relay** — enter the relay URL and the same shared secret
+3. Click **save**
+
+### How it works
+
+- **Mobile inbox**: type a note on the relay UI, it arrives as a card with `#inbox` tag
+- **Push to relay**: right-click any card → "push to relay" — other instances pick it up on next poll
+- Messages are encrypted client-side (AES-256-CBC) before sending to the relay
+- The relay only stores ciphertext — it cannot read your messages
+- hyprcrd polls the relay every 45 seconds in the background
+- Messages are kept on the relay for 24 hours, then auto-deleted
+- Cards pushed from the same instance are not re-imported
+- Enter to send, Shift+Enter for newline
+
+### Relay Security
+
+- Separate password (UI login) and shared secret (API + encryption)
+- Bcrypt hashing for both credentials
+- Rate-limited login (5 attempts/minute)
+- AES-256-CBC client-side encryption — relay never sees plaintext
+- Security headers (X-Frame-Options, HSTS, X-Content-Type-Options)
+- SQLite database blocked from direct download via `.htaccess`
+- Request size limited to 256KB
+
 ## Rebuilding Tailwind CSS
 
 After changing Tailwind utility classes in HTML or JS files:
@@ -224,6 +330,9 @@ curl -sL https://github.com/tailwindlabs/tailwindcss/releases/latest/download/ta
 - Upload directory blocks PHP execution
 - DOMPurify sanitizes all rendered markdown
 - Security headers (X-Frame-Options, HSTS, etc.)
+- AES-256-CBC encryption for CalDAV credentials and Relay messages
+- Vault key system for multi-instance CalDAV encryption (independent of login password)
+- Relay: separate password + shared secret, rate-limited, client-side encryption
 
 ## License