docs: document configuration

[blaipr]

ConfigDataInterface declares 96 setting constants and the code reads thirteen environment variables. None of it was documented: install.md covers installing, not operating.

The three places

Configuration lives in three, and which one holds a value follows from when it has to be known. The environment carries paths and database credentials — everything needed beforeconfig.xml can be read, since that file's own location comes from it. config.xml holds the settings an administrator sets. The Config table holds what the application maintains itself, including the master password hash.

Environment variables

All thirteen, with their real defaults, read out of the getFromEnv() call sites rather than from the example file.

Two behaviours are documented because they are easy to trip over: .env is loaded with Dotenv::createImmutable(), which populates $_ENV/$_SERVER but notgetenv(); and a boolean default is parsed rather than cast, since (bool)"false" is true in PHP and DEBUG=false would otherwise enable debug mode.

.env.example is out of step with the code, which the page says plainly. It documents BACKUP_PATH, TMP_PATH and MIMETYPES_FILE — none of which appear in any getFromEnv() call — and gives ACTIONS_FILE="actions.xml" where the default is actions.yaml. Correcting that file is a separate change; this one documents what is true.

Settings

All 96 are named, grouped by area, so the page works as something to grep against. Coverage was checked programmatically against the constants in ConfigDataInterface, which is how the one initially missing (debug, the config-file setting, distinct from the DEBUG environment variable) was found.

The defaults table carries only values verified against ConfigData: accountCount 12, sessionTimeout 300, publinksMaxViews 3, accountExpireTime 10368000 — which is 120 days, computed rather than asserted — and the rest.

Three settings that look like defects

accountFullGroupAccess widens secondary-group access beyond a user's main group, which is often the real reason a colleague can see an account you cannot. accountCount is an unbounded free number that sets how much work a listing does. And maintenance closes the application.

That last one was wrong on the first pass: described as locking out everyone but administrators, which is what the name suggests. checkMaintenanceMode() gates on the application lock holding a specific user id — the person who enabled it — and only for AJAX requests; ordinary page requests are refused for everyone, that user included. Corrected here, along with the note that clearing the flag is not enough if the lock outlives it.