# Clusra waitlist (PHP)

The `/waitlist` page on the Next.js site posts here. This folder saves each signup in MySQL, emails the team and sends the person a confirmation.

## Set up (cPanel or any PHP 8+ host with MySQL)

1. **Database.** In cPanel → MySQL Databases, create a database and a user, and give the user all privileges on it. Open phpMyAdmin, pick the database and run `schema.sql`.
2. **Mailbox.** In cPanel → Email Accounts, create the sending address (e.g. `hello@clusra.com`). `mail()` mail is often rejected when the From address isn't a real mailbox on the domain.
3. **Config.** Copy `config.example.php` to `config.php` and fill in the database details, `allowed_origins`, the mail settings and a long random `export_token`. Don't commit `config.php`.
4. **Upload.** Upload `waitlist.php`, `export.php` and `config.php` to a folder on the host, e.g. `public_html/waitlist/`. The endpoint is then `https://<your-host>/waitlist/waitlist.php`.
5. **Point the site at it.** Set `NEXT_PUBLIC_WAITLIST_ENDPOINT` to that URL in the Next.js environment (Vercel → Settings → Environment Variables, and `.env.local` for local dev), then redeploy.

## Check it works

```bash
curl -i -X POST https://<your-host>/waitlist/waitlist.php \
  -H 'Content-Type: application/json' -H 'Origin: https://clusra.com' \
  -d '{"full_name":"Test User","email":"you@example.com","persona":"startup","company_name":"Acme","team_size":"2-5","hosting":"both","country":"Nigeria"}'
```

You should get `{"ok":true,...}`, a row in the `waitlist` table, an email to the `notify` address and a confirmation to `you@example.com` (check spam the first time).

## Reading the list

- `export.php?token=<export_token>` downloads everything as CSV.
- `export.php?token=<export_token>&persona=startup` downloads one group. Startups and agencies are saved with `plan_hint = studio`, so they're the people to contact when Studio opens.

## Notes

- Signing up again with the same email updates the row and doesn't send the emails twice.
- Max `rate_limit_per_hour` new signups per IP address per hour.
- A hidden `hp` field catches bots: anything filled in there is silently ignored.