# cPanel and VPS deployment

This application is a CodeIgniter 4 PHP/MySQL app. It is intended for **cPanel shared hosting** (Apache + PHP-FPM + MySQL) and remains portable to a VPS (Apache or Nginx + PHP-FPM).

It is **not** a Vercel/serverless app.

## Requirements

- PHP 8.2 or newer (8.3 tested) with extensions: `intl`, `mbstring`, `json`, `mysqlnd`, `curl`, `bcmath`, `zip`
- MySQL **8.0.16** or newer (CHECK constraints + generated columns). InnoDB. `utf8mb4` / `utf8mb4_0900_ai_ci`
- Composer (run locally or on a VPS; on cPanel use the built-in Composer or upload `vendor/`)
- Document root must be the `public/` directory, not the repository root

## cPanel

1. Create a MySQL database and user. Grant the user only the rights the app needs (`SELECT`, `INSERT`, `UPDATE`, `DELETE`, `CREATE`, `ALTER`, `INDEX`, `REFERENCES`, `TRIGGER` during migrate; production can drop `CREATE`/`ALTER` after migrate). Prefer INSERT+SELECT only on `audit_event` if the host allows per-table grants.
2. Copy `.env.example` (or `env`) to `.env` in the project root (one level above `public/`). Never commit `.env`.
3. Set environment-specific values only in that file:

   ```
   CI_ENVIRONMENT = production
   app.baseURL = 'https://your-domain.example/'
   app.forceGlobalSecureRequests = true
   cookie.secure = true
   database.default.hostname = localhost
   database.default.database = ...
   database.default.username = ...
   database.default.password = ...
   encryption.key = hex2bin:...
   ```

   `cookie.secure = true` must be used only on HTTPS. Leave `cookie.secure = false` for local HTTP so the session cookie is stored.

4. Point the subdomain/addon domain document root at `public/`.
5. `composer install --no-dev --optimize-autoloader` (or upload `vendor/` from a matching PHP version).
6. Run migrations. **Do not seed demonstration users in production:**

   ```
   php spark migrate
   ```

   `php spark db:seed DatabaseSeeder` throws when `CI_ENVIRONMENT=production`. Create operators through IAM. If a non-production database was copied forward, rotate every password immediately. Sample credentials must never appear in logs, UI, or deploy output.
7. `php spark design:compile-tokens` if you change `design/*.json`. Committed `public/css/tokens.css` is already the build output.
8. Install cron via cPanel “Cron Jobs” using the entries in `deploy/cron.example`.
9. Ensure `writable/` is writable by the PHP user (`cache`, `logs`, `session`, `uploads`).

`public/.htaccess` ships with the CI4 rewrite rules. If `mod_rewrite` is off, keep `app.indexPage = 'index.php'` in `.env`.

## VPS

Same application. Typical layout:

- Nginx or Apache vhost `root` / `DocumentRoot` → `public/`
- PHP-FPM 8.2+
- MySQL 8.0.16+ on localhost or a private host
- systemd timer or crontab for the Spark commands in `deploy/cron.example`

No extra process (queue worker, Node, Redis) is required for Phase 0.

## What is deliberately absent

- No IRN queue, IRN cron, or IRN retry job
- No JWT, no Shield
- No PostgreSQL