Foundation is a single-use web installer for new deployments. Extract the Jyavani package so that the document root points to the public directory containing the router, temporarily cfg, dashboard, app, plugins, And private_files stay outside the web root.
Prerequisites and database
- Prepare PHP and MariaDB/MySQL according to the package version and extensions required.
- Open
/pondasi/, fill in the host, port, database name, user, and password. - Foundation creates/executes the default schema, translation seeds, and marks migration packages as applied.
- Fill in the site identity and initial owner account; demo content is optional.
Site Owner and initial grant
The initial account is written as legacy admin, is_site_owner=1, not locked, then accept the system Administrator role. Core records owner installation events. The Author, Editor, Administrator and grant Core system roles come from the schema; do not make a manual initial grant.
Paths and masking
The installer sets defaults /dashboard/, /login/, And /register/. The dashboard resides outside the web root; requests that do not match the configuration path are given a frontend 404. Registration is not enabled simply because the path is available. The default is disabled; If the administrator activates it, the registrant gets an Author and can be locked if approval is active.
Configuration files and operational locks
Writing foundations cfg/.env, random secrets, session settings, and PUBLIC_PATH absolute to the detected root web. If writing fails, the installer displays the contents for manual installation. After success, delete or disable the folder public/pondasi; existence .env just change the normal bootstrap, not a replacement for removing the installer.
First verification
- Make sure the frontend, login, dashboard, logout, and 404 masking are working.
- Check that the Site Owner has an Administrator and the Roles/Update page can be opened.
- Create a draft, upload test assets, then delete test data.
- Verify HTTPS, Secure cookies, email/site URL, and backup.
The deployment owner must set file ownership/permissions so that the web process can only write to the required locations. Think of the extracted file mode as a package condition that must be audited, not a Core security policy that intentionally makes all files private.