# Easy production deployment

This application needs PHP 8.2+, MySQL/MariaDB, Apache or Nginx, HTTPS, and no Composer or Node.js runtime.

## Shared hosting or cPanel

1. Create a MySQL database and user, then grant that user all privileges on the database.
2. Upload the repository outside `public_html` where possible. Point the domain document root to the repository's `public` folder. If your host cannot change the document root, ask support to do it; do not expose `.env`, `raw`, `database`, or `storage` publicly.
3. Copy `.env.example` to `.env` and set `APP_URL`, database values, a unique `APP_KEY`, a private admin email/password, `APP_DEBUG=false`, and `ADMIN_REQUIRE_2FA=true`.
4. Generate `APP_KEY` locally:

   ```powershell
   C:\xampp\php\php.exe -r "echo 'base64:'.base64_encode(random_bytes(32)), PHP_EOL;"
   ```

5. Run once through cPanel Terminal (adjust the PHP binary if required):

   ```bash
   php database/install.php
   ```

6. Make `storage/logs` and `storage/framework/raw-sessions` writable by the web-server user, normally permissions `775` (avoid `777`).
7. Enable a free Let's Encrypt certificate, force HTTPS, sign in at `/login`, change the seeded password, and verify `/up` returns JSON with `status: ok`.

## VPS with Apache

Set the virtual-host `DocumentRoot` to `/var/www/niyomito/public`, enable `mod_rewrite`, and allow overrides for that directory. Keep the rest of the repository outside the public web root. Use PHP-FPM with Nginx and route missing files to `/index.php` if Apache is not used.

Deploy updates by backing up the database and files, uploading the new release, running `php database/install.php` without `--fresh`, and checking `/up`, `/en`, `/bn`, `/login`, and `/control`. The installer now preserves the existing admin password.

## Production checklist

- Replace placeholder company copy, hotline, addresses and external URLs in the control center.
- Connect password resets, invitations and 2FA to real email/SMS delivery; the local log transport is not production delivery.
- Deny web access to `.env`, `storage`, `database`, and backup files.
- Schedule encrypted off-server database and upload backups and test restoration.
- Use a restricted database user, firewall the database, keep PHP patched, and review `storage/logs/raw-php.log` without exposing it publicly.