Highclere Castle Ticketing & Commerce · Disaster Recovery Programme Updated: October 2026 · Status: Phase 0 & Component 1 Ready
Highclere Castle Commerce & Ticketing DR Plan
Disaster Recovery & Modernisation

Contain the risk immediately.
Restore customer service component by component.

The legacy highclerecastleshop.co.uk application runs on end-of-life PHP 7.4 and CodeIgniter 3 with 118 unindexed/MyISAM database tables and plaintext customer passwords. Rather than attempting a risky in-place upgrade of unmaintainable legacy code, we are isolating the legacy environment behind our NetBird VPN immediately and launching a clean, modern replacement in revenue-prioritised stages.

Why We Are Acting Immediately — Forensic Findings from Legacy Backup
  • End-of-Life Runtime Exposure: PHP 7.4 and CodeIgniter 3 are exposed to active public CVE exploitation and lack modern request validation or CSRF/SQLi guardrails.
  • Plaintext Customer Passwords: Despite a December 2018 code comment intending to hash passwords, Customers_model::getUserLogin() and Coachvisits still store and compare passwords in plaintext across users (~515k rows) and coach_companies.
  • Zero Database Transactions (MyISAM): Core commercial tables (users, orders, order_item, user_info) use the legacy MyISAM storage engine—meaning no ACID transactions, no foreign-key integrity, and duplicate customer accounts sharing the same email address.
  • Silent Logic Bugs in Legacy Code: For example, Coachvisits::_calculate_penalty() (line 2257) contains an assignment bug (if ($order_id = 3649) { $penalty = 0; }) that silently zeroes out cancellation penalties for every coach booking.
View Component 1 Blueprint → See Full 5-Component Roadmap Architecture & ADRs
Phase 0 · Immediate Action

Operational Continuity via NetBird VPN Containment

Taking the vulnerable public website offline does not mean blinding office staff or Castle gate operations. By decoupling public customer access from internal back-office access, we eliminate public risk on Day 1 without disrupting daily operations.

Step 1 · Public Ingress Cut

Remove Public PHP Routing

Drop all public internet routing to the PHP 7.4 / Apache web server immediately. Restrict outbound traffic from the legacy VM so only required internal services remain reachable.

Step 2 · NetBird Staff Access

Keep Legacy /admin Internal

Office staff continue accessing the legacy /admin portal exclusively over the private NetBird VPN to answer customer queries, process date transfers, void tickets, and export daily Gate Lists for admission scanners.

Step 3 · Clean Public Launch

Deploy Component 1 + ETL Sync

Point public highclerecastleshop.co.uk traffic to the new Astro SSR + Node.js application backed by a clean PostgreSQL database, kept in sync with staff changes in legacy MariaDB via an idempotent 1–2 minute ETL pipeline.

Delivery Sequence

Revenue-Ordered Component Rollout

Instead of a "big bang" rewrite that delays launch for months, we ship one self-contained capability at a time, ordered strictly by customer urgency and commercial revenue impact:

Stage Component Primary Audience Business Goal & Scope Status
Phase 0 NetBird Isolation & DB Sync IT / Office Staff Remove public routing to PHP 7.4; restrict legacy /admin to NetBird VPN; stand up clean PostgreSQL database and idempotent MariaDB → Postgres ETL sync. Immediate
Component 1 Customer Portal & Ticket Retrieval Existing Ticket Holders Branded maintenance/holding page, Passwordless Email OTP login (via Postmark) + Quick Single-Order Lookup, Order History, Gift Voucher balance banner, dynamic SVG Code 128B Ticket barcodes, and printable VAT Invoices. Spec Complete · Next Up
Component 2 Public Admission & Event Ticket Sales New Visitors Public event & timed-entry catalogue, live capacity calendar with PostgreSQL row-level locking, dietary menu selection, Gift Voucher redemption, gateway-agnostic checkout, and automated Postmark ticket dispatch. Priority 2
Component 3 Staff Back-Office (/admin) Office & Gate Staff Order lookup, date transfers, ticket voiding, and direct Gate List scanner exports in the new app. Retires the MariaDB customer/order ETL sync. Priority 3
Component 4 Coach Visits Portal & Coach Admin Coach Companies & Group Staff Full vertical slice cutover of coach_* tables to PostgreSQL. Modernised Coach Company login, per-season policy acceptance, slot requests, staff approval/rejection UI, deposit/balance payments, corrected cancellation penalty logic, and final legacy PHP 7.4 decommission. Priority 4
Component 5 Gift Shop Merchandise & Lodge Bookings Shoppers & Overnight Guests Physical gift shop catalogue/shipping calculation and London/Grotto Lodge reservation calendars (lowest revenue share, safely deferred until core ticketing and back-office are complete). Deferred