CryptoGate is already installed

Delete install.php from your server to keep it locked.

Open dashboard '; cg_page_bottom(); exit; } $step = (int)($_GET['step'] ?? 1); $errors = []; $selfLocked = false; if ($step === 3) { if (!$justInstalled) { cg_redirect('install.php?step=1'); } unset($_SESSION['cg_just_installed']); // Disable this installer automatically (the current request keeps running). $selfLocked = @rename(__FILE__, __FILE__ . '.locked'); } if ($step < 1 || $step > 3) { $step = 1; } if ($step === 2 && !cg_install_verified()) { cg_redirect('install.php?step=1'); } /* ============================================================ HANDLE STEP 1 SUBMIT (install key) ============================================================ */ $keyError = null; if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'verify_key') { if (!cg_csrf_check()) { $keyError = 'Your session expired. Please try again.'; } else { $given = is_string($_POST['install_key'] ?? null) ? trim($_POST['install_key']) : ''; if ($given !== '' && hash_equals(cg_install_key(), $given)) { session_regenerate_id(true); $_SESSION['cg_install_ok'] = 1; cg_redirect('install.php?step=2'); } $keyError = 'That key does not match the one in inc/install.key.'; usleep(400000); // slow down guessing } $step = 1; } /* ============================================================ REQUIREMENTS ============================================================ */ function cg_requirements(): array { $lockDir = CG_ROOT . '/inc'; return [ ['label' => 'PHP 8.0 or newer', 'ok' => PHP_VERSION_ID >= 80000, 'value' => PHP_VERSION], ['label' => 'PDO MySQL extension', 'ok' => extension_loaded('pdo_mysql'), 'value' => extension_loaded('pdo_mysql') ? 'loaded' : 'missing'], ['label' => 'cURL extension', 'ok' => extension_loaded('curl'), 'value' => extension_loaded('curl') ? 'loaded' : 'missing'], ['label' => 'JSON extension', 'ok' => extension_loaded('json'), 'value' => extension_loaded('json') ? 'loaded' : 'missing'], ['label' => 'BCMath or GMP', 'ok' => extension_loaded('bcmath') || extension_loaded('gmp'), 'value' => extension_loaded('bcmath') ? 'bcmath' : (extension_loaded('gmp') ? 'gmp' : 'missing')], ['label' => 'inc/ folder writable', 'ok' => is_writable($lockDir), 'value' => is_writable($lockDir) ? 'writable' : 'not writable'], ]; } function cg_requirements_pass(array $reqs): bool { foreach ($reqs as $r) { if (!$r['ok']) { return false; } } return true; } /* ============================================================ DATABASE CONNECTION TEST ============================================================ */ function cg_test_db(): ?string { // Deliberately NOT using cg_db(): that helper exits on failure, // which would break the installer's friendly error display. try { $dsn = sprintf('mysql:host=%s;dbname=%s;charset=%s', CG_DB_HOST, CG_DB_NAME, CG_DB_CHARSET); $pdo = new PDO($dsn, CG_DB_USER, CG_DB_PASS, [ PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_TIMEOUT => 5, ]); $pdo->query('SELECT 1'); return null; } catch (Throwable $e) { return 'Cannot connect to the database. Check CG_DB_NAME / CG_DB_USER / CG_DB_PASS in inc/db.php'; } } /* ============================================================ HANDLE STEP 2 SUBMIT ============================================================ */ if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'install') { if (!cg_install_verified()) { cg_redirect('install.php?step=1'); } if (!cg_csrf_check()) { $errors[] = 'Your session expired. Please submit the form again.'; } $str = static function (string $key, string $default = ''): string { $v = $_POST[$key] ?? $default; return is_string($v) ? trim($v) : $default; }; $username = $str('username'); $password = is_string($_POST['password'] ?? null) ? (string)$_POST['password'] : ''; $password2 = is_string($_POST['password2'] ?? null) ? (string)$_POST['password2'] : ''; $email = $str('email'); $mode = $str('address_mode', 'shared') === 'hd' ? 'hd' : 'shared'; $walletValue = $str('wallet'); $tronKey = $str('tron_api_key'); $brand = $str('brand_name', 'CryptoGate'); /* -------- validation -------- */ if ($username === '' || !preg_match('/^[A-Za-z0-9_]{3,64}$/', $username)) { $errors[] = 'Username must be 3-64 characters (letters, numbers, underscore).'; } if (strlen($password) < 8) { $errors[] = 'Password must be at least 8 characters.'; } if ($password !== $password2) { $errors[] = 'The two passwords do not match.'; } if ($username !== '' && strcasecmp($password, $username) === 0) { $errors[] = 'Password must be different from the username.'; } if ($email !== '' && !filter_var($email, FILTER_VALIDATE_EMAIL)) { $errors[] = 'Invalid email address.'; } if ($walletValue === '') { $errors[] = $mode === 'hd' ? 'Please enter your extended public key (xpub).' : 'Please enter your USDT (TRC20) wallet address.'; } if ($mode === 'shared' && $walletValue !== '' && !preg_match('/^T[A-Za-z0-9]{33}$/', $walletValue)) { $errors[] = 'That does not look like a valid TRON (TRC20) address. It should start with T and be 34 characters long.'; } if ($mode === 'hd' && $walletValue !== '' && !preg_match('/^xpub[1-9A-HJ-NP-Za-km-z]{100,115}$/', $walletValue)) { $errors[] = 'That does not look like a valid extended public key. It should start with "xpub" (about 111 characters).'; } if ($dbErr = cg_test_db()) { $errors[] = $dbErr; } /* -------- run the install -------- */ if (!$errors) { try { $pdo = cg_db(); foreach (cg_schema_sql() as $sql) { $pdo->exec($sql); } $defaults = cg_schema_defaults(); $defaults['brand_name'] = $brand !== '' ? $brand : 'CryptoGate'; $defaults['address_mode'] = $mode; $defaults['tron_api_key'] = $tronKey; $defaults['ipn_secret'] = cg_token(24); $defaults['installed_at'] = cg_now(); if ($mode === 'hd') { $defaults['xpub'] = $walletValue; } else { $defaults['shared_address'] = $walletValue; } foreach ($defaults as $k => $v) { cg_query( 'INSERT INTO cg_settings (k, v) VALUES (?, ?) ON DUPLICATE KEY UPDATE v = VALUES(v)', [$k, (string)$v] ); } cg_query( 'INSERT INTO cg_admins (username, password_hash, email, created_at) VALUES (?, ?, ?, ?)', [ $username, password_hash($password, PASSWORD_DEFAULT), $email !== '' ? $email : null, cg_now(), ] ); // First API key, ready to use straight away. cg_query( 'INSERT INTO cg_api_keys (label, api_key, api_secret, created_at) VALUES (?, ?, ?, ?)', ['Default key', 'cg_' . cg_token(16), cg_token(24), cg_now()] ); file_put_contents( CG_ROOT . '/inc/installed.lock', 'installed ' . cg_now() . PHP_EOL ); @unlink(CG_INSTALL_KEY_FILE); session_regenerate_id(true); unset($_SESSION['cg_install_ok']); $_SESSION['cg_just_installed'] = 1; cg_redirect('install.php?step=3'); } catch (Throwable $e) { cg_log('Install failed: ' . $e->getMessage()); $errors[] = 'Installation failed: ' . $e->getMessage(); } } if ($errors) { $step = 2; } } /* ============================================================ PAGE CHROME ============================================================ */ function cg_page_top(string $title, int $step = 1): void { $steps = [ 1 => ['Server check', 'Requirements & database'], 2 => ['Your details', 'Admin account & wallet'], 3 => ['Ready', 'Sign in and start'], ]; ?> <?= cg_e($title) ?> - CryptoGate setup

CryptoGate

Self-hosted crypto payment gateway

CryptoGate ' . cg_e(CG_APP_VERSION) . ' · Your keys stay with you.
'; } /* ============================================================ RENDER ============================================================ */ cg_page_top('Install', $step); $ok_svg = ''; $bad_svg = ''; ?> 'Database connection', 'ok' => $dbErr === null, 'value' => $dbErr ? 'failed' : 'connected']; $allOk = $pass && $dbErr === null; ?>

Server check

Making sure this hosting can run CryptoGate before anything is written.

All checks passed
To confirm you own this server, open the file below and paste its contents. This stops anyone else from running the installer.
Run the check again
Fix these to continue

Your admin account

This is how you sign in to the dashboard.

At least 8 characters.

Where payments go

Customers pay straight into your wallet. Nothing is held by this server.

Starts with T and is 34 characters long.
Lets the gateway check the blockchain more often.
Your private keys are never entered here and never stored on this server. CryptoGate can only watch for incoming payments - it cannot spend.

You're set up

CryptoGate is installed. Sign in to create your first invoice.

The installer has locked itself (renamed to install.php.locked). You can delete that file at any time.
Delete install.php from your server now - it's no longer needed.
Open dashboard