`config.inc.php` in depth¶

web/config.inc.php is the installation-owned configuration file for MRBS. It contains site-specific behavior and usually contains secrets. Treat it as production configuration, not as an application source file.

Create the file¶

MRBS ships web/config.inc.php-sample, but deliberately does not ship an active config.inc.php.

cd /var/www/mrbs
cp config.inc.php-sample config.inc.php

Start with the sample from the same MRBS release. Do not carry an old sample forward unchanged.

How configuration is loaded¶

The shared bootstrap loads configuration in this order:

systemdefaults.inc.php
areadefaults.inc.php
config.inc.php
site_config.inc
internal validation and compatibility handling

Later assignments override earlier ones. This is why a short config.inc.php can replace application defaults without modifying release files.

flowchart LR
  System[System defaults] --> Area[New-area defaults]
  Area --> Local[config.inc.php]
  Local --> Site[Site-specific config]
  Site --> Check[Validation and compatibility]

Important

Area values already stored in the database are edited through Rooms. Changing areadefaults.inc.php or an override in config.inc.php does not rewrite existing areas.

PHP syntax¶

The configuration is executable PHP. Every statement ends with a semicolon. Strings can use single or double quotes:

$timezone = 'Europe/Berlin';
$default_view = "week";
$kiosk_mode_enabled = false;
$search["count"] = 30;

Use real PHP booleans, not strings:

$mail_settings['disabled'] = false;   // Correct
$mail_settings['disabled'] = "false"; // Wrong: this is a non-empty string

Arrays can use either supported PHP syntax:

$auth['admin'] = array('alice', 'bob');
$report_open_areas = [1, 3];

Do not add a closing ?> tag. It can introduce accidental output and break headers or cookies.

Minimum settings¶

A new site normally needs a room timezone and database connection:

$timezone = 'Europe/Berlin';

$dbsys = 'mysql';
$db_host = 'localhost';
$db_database = 'mrbs';
$db_login = 'mrbs';
$db_password = 'replace-this-password';
$db_tbl_prefix = 'mrbs_';
$db_persist = false;

Use the timezone where the rooms are located. It can differ from the server timezone.

Database configuration¶

Select the database¶

$dbsys = 'mysql'; // MySQL or MariaDB

or:

$dbsys = 'pgsql'; // PostgreSQL

Connection behavior¶

localhost can select a Unix socket depending on the driver. Use 127.0.0.1 to force TCP for MySQL. A non-standard port can be specified separately:

$db_host = '127.0.0.1';
$db_port = 3306;

PostgreSQL installations with several schemas can set:

$db_schema = 'public';

The table prefix must match the installed schema:

$db_tbl_prefix = 'mrbs_';

Persistent connections are disabled by default. Enable them only after measuring a real need and understanding their interaction with transactions and locks.

URL and reverse proxy settings¶

MRBS usually derives its URL from the request. When a reverse proxy, path prefix, or unusual virtual-host setup makes this unreliable, copy the relevant URL settings from systemdefaults.inc.php and set an explicit public base.

The external URL must use the scheme and host seen by users. Configure the proxy to pass trusted scheme and host information, and reject untrusted host headers.

After changing URL behavior, test:

redirects after login;
links in email;
iCalendar URLs;
kiosk exit links;
multisite links; and
HTTP-to-HTTPS redirects.

Authentication and sessions¶

Authentication verifies identity; the session method obtains and retains it.

$auth["type"] = "db";
$auth["session"] = "php";

External systems add their own settings, for example:

$auth["type"] = "ldap";
$auth["session"] = "php";

Do not copy sample users or passwords into production. Map administrator access explicitly and test a normal user as well as an administrator. See Authentication.

Access control¶

Settings under $auth control public visibility and privileged booking behavior:

$auth['deny_public_access'] = true;
$auth['only_admin_can_book'] = false;
$auth['admin_must_obey_policies'] = true;

Review related settings together. A public calendar, public report, kiosk, and private booking can expose different information.

Calendar and interface¶

Common global overrides include:

$default_view = 'week';
$weekstarts = 1;                 // Monday
$display_mincals = true;
$show_timeline = true;
$kiosk_mode_enabled = false;

Date and time formatting is locale-aware. Copy the complete relevant $datetime_formats entry when overriding a format rather than partially reconstructing it.

Booking rules¶

Many booking rules belong to an area and are administered in the database. Global settings can impose limits across areas or restrict capabilities.

Keep policy overrides in one clearly labelled section and document the business reason:

// Facilities policy: every user may hold at most 20 future bookings.
$max_per_interval_global_enabled['future'] = true;
$max_per_interval_global['future'] = 20;

Test recurring, multiday, and administrator bookings at the policy boundary.

Email¶

Choose a backend and configure sender, recipients, events, and transport:

$mail_settings['admin_backend'] = 'smtp';
$mail_settings['from'] = 'mrbs@example.org';
$mail_settings['booker'] = true;

$smtp_settings['host'] = 'mail.example.org';
$smtp_settings['port'] = 587;
$smtp_settings['auth'] = true;
$smtp_settings['secure'] = 'tls';
$smtp_settings['username'] = 'mrbs@example.org';
$smtp_settings['password'] = 'replace-this-password';

Keep certificate verification enabled. See Email notifications.

Language and local wording¶

Set a fixed default language only when browser negotiation is unsuitable:

$default_language_tokens = 'de';

Override individual labels without editing web/lang/lang.*:

$vocab_override['en']['mrbs'] = 'Resource Booking';
$vocab_override['de']['mrbs'] = 'Ressourcenbuchung';
$vocab_override['fr']['mrbs'] = 'Réservation de ressources';
$vocab_override['es']['mrbs'] = 'Reserva de recursos';

Using $vocab_override preserves local wording during upgrades. The complete workflow is covered in Text and translations.

Custom fields¶

Custom database columns can be labelled and shaped through configuration:

$vocab_override['en']['room.coffee_machine'] = 'Coffee machine';
$select_options['entry.catering'] = array(
    'c' => 'Coffee',
    's' => 'Sandwiches',
    'h' => 'Hot lunch'
);
$is_mandatory_field['entry.catering'] = true;
$is_private_field['entry.refreshments'] = true;

Database changes must be completed first. An entry custom column requires an identical column in repeat. See Custom fields for supported types, schema examples, validation, privacy, field order, and testing.

Include secrets from another file¶

config.inc.php can include another file, but the path must be absolute:

require '/etc/mrbs/database-secrets.php';

The included file should return or assign only the expected values and be readable by the PHP runtime. Keep it outside the web root.

Environment variables can also be read explicitly:

$db_password = getenv('MRBS_DB_PASSWORD');

Validate that a required value exists instead of silently accepting an empty secret.

Multisite¶

Multisite uses global configuration plus a site-specific configuration under sites/<site>/. At minimum, every site needs an isolated table prefix:

$multisite = true;
$db_tbl_prefix = 'berlin_';

Authentication, mail, theme, and other settings can differ by site. See Multisite.

Debugging¶

Enable debug behavior only temporarily and never expose it to untrusted users. Integration-specific debug output can contain directory data, headers, mail server details, or personal information.

Keep credential logging disabled:

$auth['log_credentials'] = false;

Upgrade-safe maintenance¶

For every MRBS upgrade:

Back up the active configuration.
Start from the new release's config.inc.php-sample.
Compare old overrides with new defaults.
Transfer only intentional settings.
Remove obsolete variables reported by compatibility checks.
Run syntax validation and functional tests.

Avoid copying the complete old defaults into the new configuration; that hides new defaults and makes later upgrades difficult.

Validation checklist¶

php -l /var/www/mrbs/config.inc.php

Then verify:

application and database versions on Help;
database connection and table prefix;
room timezone and daylight-saving behavior;
login, logout, expiry, and administrator mapping;
public and private views;
create, edit, delete, recurrence, and policy boundaries;
email sender, recipients, and TLS;
reports, exports, kiosk, and multisite where used; and
logs without passwords or private data.

Recommended file layout¶

Keep the file short and grouped:

<?php
declare(strict_types=1);
namespace MRBS;

// Timezone
$timezone = 'Europe/Berlin';

// Database
$dbsys = 'mysql';
// ...

// Authentication
$auth['type'] = 'db';
$auth['session'] = 'php';

// Site-specific overrides
// ...

Every non-obvious override should explain why the installation needs it.

config.inc.php in depth¶