# ForexBot2 web dashboard (LAMP)

Numbers-only live dashboard: latest XAU/USD price plus each timeframe's
signal, indicator values, and a plain-English reading of every one.

## How it flows

```
telegram_bot.py (owns the single Twelve Data WebSocket)
   ├─ every tick  ──►  POST ingest.php  ──►  MySQL live_price   (throttled 1/s)
   └─ every scan  ──►  POST ingest.php  ──►  MySQL signal_reports
                                                    │
browser  ──►  index.html + app.js  ──►  GET api.php ┘
             (price poll 2 s · reports poll 15 s)
```

The dashboard needs **no Python on the web server** — only PHP + MySQL.
The bot can run anywhere with outbound HTTPS to the site.

## Server setup (once)

1. Copy this directory to the web root, e.g. `/var/www/html/webapp/`.
2. Create DB + tables: `mysql -u root -p < schema.sql`
   (also create the app user — commands at the bottom of schema.sql).
3. `cp config.sample.php config.php` and fill in DB credentials and a
   fresh `ingest_token` (`openssl rand -hex 32`).
4. Apache must allow `.htaccess` (`AllowOverride FileInfo Limit` or
   `All`) so config/schema stay unreachable — or copy those deny rules
   into the vhost. Verify: `curl -I https://site/webapp/config.php`
   must return 403.

## Bot setup

Set two environment variables where `telegram_bot.py` runs:

```bash
export WEBAPP_INGEST_URL="https://your-site/webapp/ingest.php"
export WEBAPP_INGEST_TOKEN="<same token as config.php>"
```

Unset = publishing is disabled and the bot behaves exactly as before.
Publishing is fire-and-forget (bounded queue + daemon thread): a dead
web server can never block or slow the bot.

## Security notes (public access)

- `api.php` is read-only and public by design; `ingest.php` requires the
  shared token (use HTTPS so it isn't sent in the clear).
- `config.php` / `schema.sql` are denied by `.htaccess`.
- Optional hardening: rate-limit `api.php` (mod_evasive/fail2ban), and
  restrict `ingest.php` to the bot host's IP in the vhost.

## Data growth

- `live_price`: 1 row per symbol (upserted in place).
- `signal_reports`: ~400 rows/day for XAU (M5+M15+H1+H4) — ~150k
  rows/year, no retention job needed. It doubles as a durable log of
  every signal the engine produced (the `payload` column holds the full
  report JSON).

## Local smoke test (no Apache needed)

```bash
php -S 127.0.0.1:8090 -t webapp/   # then open http://127.0.0.1:8090/
```