PHP App for Managing a Google Cloud Bucket

PHP application for managing files in Google Cloud Storage, with email/password authentication and Google OAuth.

PHP application for managing files in Google Cloud Storage, with email/password authentication and Google OAuth.

Requirements

• PHP 8.1+
• Composer
• The PHP pdo_sqlite extension
• A Google Cloud Platform account (for GCS and/or OAuth)

Composer dependencies

Installation

1. Clone the repository

git clone <repo-url> /var/www/html/bucket.webrt.eu
cd /var/www/html/bucket.webrt.eu

2. Install dependencies

composer install

3. Configure .env

cp .env.example .env

Edit .env with your own values:

APP_URL=http://localhost:8000
APP_SECRET=a_long_random_secret

# ABSOLUTE path to the SQLite file
DB_PATH=/var/www/html/bucket.webrt.eu/database/database.sqlite

GOOGLE_CLIENT_ID=your_google_client_id
GOOGLE_CLIENT_SECRET=your_google_client_secret
GOOGLE_CLIENT_CALLBACK=http://localhost:8000/auth/google/callback

GCS_BUCKET_NAME=your-bucket-name
GCS_KEY_FILE=config/gcs-service-account.json

# Optional (for sending email)
MAIL_MAILER=smtp
MAIL_HOST=mail.example.com
MAIL_PORT=465
MAIL_USERNAME=no-reply@example.com
MAIL_PASSWORD=password
MAIL_ENCRYPTION=ssl
MAIL_FROM_ADDRESS=no-reply@example.com
MAIL_FROM_NAME=GCS Browser

Important: DB_PATH must be an absolute path. A relative path will cause a 500 error if the server doesn't start from the project directory.

4. Initialize the database

php database/init.php

Creates the users table and the initial admin user:

Change the admin password after the first login!

5. Start the (development) server

php -S localhost:8000 -t public/

Google OAuth setup

1. Create a project in Google Cloud Console

1. Go to console.cloud.google.com
2. Create a new project or select an existing one

2. Create OAuth 2.0 credentials

1. APIs & Services → Credentials → Create Credentials → OAuth 2.0 Client ID
2. Application type: Web application
3. Add Authorized redirect URIs:
   • http://localhost:8000/auth/google/callback (development)
   • https://bucket.webrt.eu/auth/google/callback (production)
4. Copy the Client ID and Client Secret into .env as GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET

Google Cloud Storage setup

1. Install the gcloud CLI

curl https://sdk.cloud.google.com | bash
exec -l $SHELL
gcloud init

2. Create a bucket

gcloud storage buckets create gs://BUCKET_NAME \
  --project=PROJECT_ID \
  --location=EU \
  --uniform-bucket-level-access

Options for --location: EU, US, ASIA, europe-central2, europe-west4.

3. Create a Service Account

gcloud iam service-accounts create bucket-app \
  --display-name="Bucket App Service Account" \
  --project=PROJECT_ID

4. Grant permissions on the bucket

gcloud storage buckets add-iam-policy-binding gs://BUCKET_NAME \
  --member="serviceAccount:bucket-app@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/storage.objectAdmin"

5. Download the JSON key

gcloud iam service-accounts keys create config/gcs-service-account.json \
  --iam-account=bucket-app@PROJECT_ID.iam.gserviceaccount.com

6. Update .env

GCS_BUCKET_NAME=BUCKET_NAME
GCS_KEY_FILE=config/gcs-service-account.json

Warning: Never commit gcs-service-account.json or .env to git! If you've already committed gcs-service-account.json, remove it from tracking: git rm --cached config/gcs-service-account.json

Apache configuration (production)

DocumentRoot must point to the public/ folder:

<VirtualHost *:80>
    ServerName bucket.webrt.eu
    DocumentRoot /var/www/html/bucket.webrt.eu/public

    <Directory /var/www/html/bucket.webrt.eu/public>
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

Enable mod_rewrite:

a2enmod rewrite
systemctl restart apache2

Available routes

Project structure

public/
  index.php              # entry point, routing
  .htaccess              # mod_rewrite for Apache
src/
  Auth/
    AuthController.php       # login/logout with email+password
    GoogleOAuthController.php # Google OAuth
  Controllers/
    FileController.php        # GCS list, upload, download, delete
    ProfileController.php     # user profile
    AdminController.php       # user management (admin)
  Core/
    Router.php                # simple router with dynamic parameter support
    Database.php              # PDO / SQLite singleton
    Session.php               # sessions, CSRF, flash messages
  Middleware/
    AuthMiddleware.php        # checks authentication
    AdminMiddleware.php       # checks the admin role
  Models/
    User.php                  # user CRUD
  Services/
    GCSService.php            # Google Cloud Storage API wrapper
views/
  auth/login.php
  files/index.php
  profile/edit.php
  admin/users.php
  admin/user_form.php
  layout/header.php
  layout/footer.php
database/
  init.php                   # schema init + admin seed
  database.sqlite            # SQLite file (not in git)
config/
  app.php                    # loads .env and returns config
  gcs-service-account.json   # GCS service account key (not in git)
.env                         # environment variables (not in git)
.env.example                 # template for .env
composer.json

User roles

Security

• CSRF protection on all POST forms
• Passwords stored with password_hash() (bcrypt)
• Session regenerated on login
• .env and gcs-service-account.json excluded from git via .gitignore

GitHub: https://github.com/BrTDevil/bucket.webrt.eu