INA postaje – static station finder + PHP/SQL CMS

A searchable list of all INA petrol stations in Croatia: working hours, which fuels each station sells (with prices), services, contact details and an "open now" bubble. Everything is pulled automatically from ina.hr/trazilica-benzinskih-postaja by a cron job.

• Public site = static HTML + CSS (generated by the CMS) with a light/dark switcher. A little vanilla JS only filters, sorts and computes "open now"; without JS every station is still there, fully readable, and the page follows the device's light/dark setting.
• CMS = PHP 8.2+ + MySQL/MariaDB (SQLite for local dev), one administrator, password + mandatory TOTP 2FA.
• Design and architecture follow plava-nafta.crodesign93.eu / idzanhr/plavi_diesel-php-cms-rebuild (same palette, cards, security model, deploy), extended from 129 blue-diesel stations to the whole INA network and every fuel.

<repo root> = web root
  index.html (+ .gz)          ← GENERATED: price overview + every station card pre-rendered
  privatnost.html, kolacici.html, 404.html, data/stations.json   ← GENERATED
  assets/css/site.css         ← light-dark() colour tokens (WCAG AA checked in both themes)
  assets/js/theme-init.js     ← applies a saved light/dark choice before the first paint
  assets/js/site.js, hours.js ← theme toggle, search/filters/sorting, "Sada radi"
  customer-gas-updater/       ← hidden admin: index.php (login → 2FA → editor), api.php, assets/
  app/src/                    ← InaSource (ina.hr parsers), InaSync, Stations, Render, Fuels, Auth, Totp…
  app/templates/              ← page templates
  sql/  bin/  deploy/  tests/

What the public page shows

• Cijene goriva – one tile per INA product: Eurosuper 95 Class Plus, Eurosuper 95, Eurosuper 95 Class Plus Premium, Eurosuper 100 Class Plus Premium, Eurodiesel Class Plus, Eurodiesel, Eurodiesel Class Plus Premium, Autoplin, Eurodiesel plavi, Eurodiesel Class Plus Expert (the list and order live in Fuels::CATEGORIES). Each shows the lowest and highest price on INA stations at the last refresh from ina.hr (motorway / transit stations are usually the highest), with the date of that refresh; one price when every station charges the same. Each station's own price, with "nova cijena, prije …" for a week after a change, is on its card.
• AdBlue: listed on every station that has it, always without a price, and in the fuel filter. A station has it if ina.hr lists it (under Goriva u ponudi, Usluge or Ostalo, where ina.hr usually puts "Ad Blue"), or if the admin ticked "Ima AdBlue", by hand or through an import (adblue_have column). Whether AdBlue can be dispensed from a pump nozzle is not on ina.hr, only in the INA Loyalty app (tap the station). The admin ticks "Moguće istakanje AdBlue iz pištolja" on the station. The card then says "moguće istakanje iz pištolja", and the filter gets "AdBlue – istakanje iz pištolja". The sync never changes this checkbox.
• Filters: free text (place, name, address, phone, fuel, service, nickname), county, fuel type, service, Sada rade / Bez privremeno zatvorenih. Order: A–Ž, Ž–A, by county, cheapest selected fuel, Najbliže meni (browser geolocation; distance computed in the browser, the position is never sent anywhere). Every filter is kept in the URL (?gorivo=lpg&zupanija=…&prikaz=sada), so a search can be shared.
• Card: county, closure badge, "Sada radi · do 22:00" / "Non-stop" / "Sada ne radi · otvara sutra u 06:00", address (+ distance), fuels with prices ("nova cijena, prije 1,73 €"), services, working hours incl. holidays, call button per phone number, links to the station's ina.hr page and Google Maps.
• Light/dark: follows the system by default. The toggle overrides it for this site only (stored in localStorage, applied before first paint); toggling back to what the system shows removes the override.

How data comes from ina.hr (bin/sync-ina.php)

1. The finder (one request): every entry of div#mdata[stations] is matched to a station by its ina.hr link. New ones are added automatically. Name, phone and coordinates are updated. Address, city and postcode are only filled while empty, so addresses checked by hand or imported stay as they are. A missing county is taken from the finder or guessed from the postcode (10xxx → Grad Zagreb or Zagrebačka). Stations the finder no longer lists are flagged, never deleted ("Više nisu u tražilici ina.hr" in the editor).
2. Each station page: the working-hours table, the "Goriva u ponudi" list (every fuel with its price), the lists under "Usluge" and "Ostalo" (shown as services on the card), the contact box ("Mob", "Adresa" when the station has none yet, and "Regija", INA's organisational unit such as ZAPAD), coordinates if the finder lacked them, and closure wording. The INA region is stored apart from the county (županija) and shown only in the editor.
   • A changed price keeps the old one and the date → card/overview "nova cijena", a price_history row and an entry in the Dnevnik. A fuel listed without a price keeps its last known price; a page that cannot be read changes nothing.
   • Hours table saying PRIVREMENO ZATVORENO every day → the station is closed automatically and reopened when real hours return ('ina_auto_close' => false to only flag it). Other closure wording is only flagged. Closures the admin sets are never touched.
3. The site is re-published after any change.

What you control in the editor (never overwritten by the sync): nicknames, a public note on the card, Ima AdBlue, AdBlue iz pištolja, county, address/city/postcode once set, temporary closures with dates, Sakrij s javne stranice, and Zaključaj ručne izmjene (the sync then keeps your name/address/phone/hours/services; fuels and prices still come from ina.hr). Prices cannot be entered by hand. Stations still listed on ina.hr can only be hidden, not deleted (the sync would add them back).

Check the parsers against the live site once after deploying. This code was written without access to ina.hr from the build machine: the hours table, div#mdata and the "Goriva u ponudi" list follow the structure the previous project already parses successfully, while the finder's extra keys (name, address, coordinates…) and the services list are read defensively under several likely names. Run

php bin/ina-probe.php                                       # finder: first raw entry + what was read
php bin/ina-probe.php https://www.ina.hr/station/murter/    # one page: hours, fuels, services, details

If a field comes back empty everywhere, adjust the key list in InaSource::parseDirectory() or the heading pattern in parseServices() – the tests in tests/run.php show the expected shapes.

Deploy (CloudPanel or any nginx + PHP-FPM)

1. Create a MySQL database and a PHP site (PHP 8.2+ with pdo_mysql, curl, dom, mbstring, intl recommended).
2. As the site user, in the (empty) domain folder:

   git clone https://github.com/idzanhr/ina_mpm_statonfinder-gas_prices.git .
   cp app/config.example.php app/config.php
   php -r 'echo base64_encode(random_bytes(32)), PHP_EOL;'   # → app_key
   nano app/config.php                                        # dsn, user, pass, app_key
   chmod 600 app/config.php
   php bin/install.php                                        # tables, admin, station list from ina.hr, public pages
   php bin/sync-ina.php --all                                 # hours, fuels, prices, services (several minutes)
   

3. Bunny CDN + vhost: follow Bunny CDN below. The vhost is locked to Bunny, so the site only answers once Bunny sends its secret header.
4. Open https://lokator-benzinskih.crodesign93.eu/customer-gas-updater/, log in, scan the QR code, save the 8 recovery codes.
5. Cron (php = the site's PHP version):

   * 0,4 * * *  php /path/to/bin/sync-ina.php     # each minute of 00:xx and 04:xx: 1/60 of the stations → two full rounds a day
   5 0 * * *    php /path/to/bin/publish.php      # closures that start/end today are right even without JS
   

   Add more hours (e.g. * 0,4,12 * * *) for fresher prices. Requests are spaced by ina_delay_ms.

Updating later: git pull && php bin/upgrade.php. Generated files are git-ignored, so pulls never conflict.

Importing a checked list (Excel)

Uvoz / izvoz → Uvoz takes a CSV saved from Excel ("CSV UTF-8", ; or ,) with a header row. Any subset of the export's columns works, e.g. name;address;city;county;adblue_have.

• A row finds its station by ina_url, then by name + city, then by name alone when exactly one station has it. Case, spaces around "-" and č/ć/đ/š/ž don't matter, and the station keeps its own spelling of the name.
• Counties may be written without "županija" (Vukovarsko-srijemska).
• Only existing stations are updated. Rows that match nothing (or match two stations) are listed after the import instead of being added; tick Dodaj i nove postaje to add them.
• Columns not in the file are left alone. Imported addresses, cities and postcodes are not overwritten by the sync.

Bunny CDN

Visitors → Bunny → this server. deploy/nginx-vhost.conf is already set up for that (domain lokator-benzinskih.crodesign93.eu):

• Origin lock. Every request must carry the header X-Inapostaje-Origin: <secret>, which only Bunny adds. Anything else (someone calling the server's IP directly) gets 403. Let's Encrypt renewals (/.well-known/acme-challenge/) are the only exception.
• Real visitor IPs. nginx takes the visitor's address from the last X-Forwarded-For entry, the one Bunny adds. The admin lockout, the POST rate limit and the Dnevnik therefore see real people, not Bunny servers. This is safe only because of the lock above. Keep 'trust_proxy' => false in app/config.php.
• Caching. Pages and data/stations.json are no-cache (Bunny revalidates, a cheap 304). CSS/JS have a content hash in the URL (site.css?v=…) and are cached for a year. The admin is no-store.

Do these once, in this order (setting names as in the Bunny dashboard):

1. Secret: on the server run openssl rand -hex 24 and keep the value.
2. Origin certificate first: in CloudPanel install the Let's Encrypt certificate for lokator-benzinskih.crodesign93.eu before DNS points to Bunny. Renewals keep working through Bunny later.
3. Pull zone → General
   • Origin URL: https://<server IP> (the IP, not the domain, which would loop back through Bunny).
   • Forward Host Header: ON. nginx only answers for lokator-benzinskih.crodesign93.eu.
   • Hostnames: add lokator-benzinskih.crodesign93.eu and enable its free SSL certificate.
4. Edge rule "Origin secret": condition Request URL matches *. Action Add Request Header (the one marked Origin; Set Response Header would send it to the visitor instead and the server would answer 403), name X-Inapostaje-Origin, value = the secret from step 1.
5. Edge rule "Admin – never cache": condition Request URL matches */customer-gas-updater*. Action Bypass Cache (or Override Cache Time 0 + Override Browser Cache Time 0).
6. Caching
   • Cache Expiration Time: Respect Origin Cache-Control. Browser Cache Expiration Time: Match Server.
   • Query String: not ignored / Vary by query string on. Otherwise a new site.css?v=… is served stale.
   • Disable Cookies: OFF. Otherwise the admin session cookie is stripped and login loops.
   • Optimizer and Perma-Cache: OFF. The Optimizer rewrites HTML/JS, which the strict CSP blocks.
7. Vhost: CloudPanel → Site → Vhost: paste the file, replace CHANGE-ME-BUNNY-SECRET with the secret from step 1 and keep the regex around it: "~^<your secret>$" 1;. Then save. The regex form matters, because a long plain key fails with "could not build map_hash". Never leave the placeholder: it is public in this repo.
8. DNS: point (CNAME) to the pull zone's hostname.

Emergency (Bunny down, the site must be reachable directly): in the vhost, put # in front of the five lines under # --- BUNNY CDN (the if and the four real_ip lines) and save. Remove the # again afterwards.

Admin security

One admin (admin.id pinned to 1, created only from the CLI) · bcrypt password (min. 12) · mandatory TOTP 2FA (RFC 6238, AES-256-GCM encrypted secret, replay protection, 8 one-time recovery codes) · 3 failures per IP / 20 overall → 15 min lockout · __Host- cookie, HttpOnly, SameSite=Strict, 30 min idle / 8 h max · CSRF token + Origin check · strict CSP without inline scripts · audit log (Dnevnik) of every change and every sync event.

Command
php bin/sync-ina.php [--all | --directory | --minute=N | --station="Murter"] [--verbose]	sync with ina.hr
php bin/ina-probe.php [url]	show what the parsers read from ina.hr (writes nothing)
php bin/publish.php	regenerate all public files
php bin/set-admin.php [--email=…] [--temporary]	change admin e-mail/password
php bin/reset-2fa.php [--print]	lost phone and recovery codes
php bin/upgrade.php	after git pull
php bin/bunny-purge.php [--zone]	clear Bunny's cache

Local development

cp app/config.example.php app/config.php   # dsn: 'sqlite:' . __DIR__ . '/../var/ina-postaje.sqlite', app_key
mkdir -p var && php bin/install.php        # add --no-sync without internet access
php -S 127.0.0.1:8000 -t . bin/dev-router.php   # same whitelist as production; admin at /customer-gas-updater/
php tests/run.php            # 46 tests: TOTP, crypto, ina.hr parsers, sync (add/flag/prices/closures/locks), rendering, import
node tests/hours.test.js     # 18 tests: "Sada radi" – formats, overnight, non-stop, holidays
node tests/contrast.test.js  # 44 checks: WCAG AA contrast of every token pair, light + dark

Contributors

• idzanhr – owner, product direction, design (plava-nafta.crodesign93.eu)
• Claude (Anthropic), via Claude Code – AI pair programmer: wrote the code, tests and docs with the owner; listed as Co-Authored-By on its commits