# Deploying to cPanel

This app is plain PHP + MySQL — no Composer, no Node, no build step. It needs
nothing beyond what every cPanel shared-hosting account already has.

## 1. Requirements

- PHP 8.0 or later (check under cPanel → **Select PHP Version**)
- Required extensions: `pdo_mysql`, `mbstring`, `fileinfo`, `openssl`
- Optional extensions: `zip` (native Excel report export — falls back to CSV
  without it), `imap` (email-to-ticket intake)
- MySQL or MariaDB database
- Cron job access (standard on cPanel)

## 2. Directory layout — keep the app code out of the web root

cPanel serves whatever is in `public_html/`. Everything else in your account
home directory is private. This matters here because `config/config.php`
holds your database password and SMTP credentials — it must **not** be
downloadable by URL.

```
/home/yourcpaneluser/
├── app/            ← upload the repo's app/ folder here
├── config/         ← upload config/ here (install.php writes config.php for you)
├── database/       ← schema.sql / core_setup.sql / demo_data.sql (used once, by the installer)
├── cron/           ← the three cron scripts
├── storage/        ← attachments + logs (must be writable)
└── public_html/    ← upload the CONTENTS of the repo's public_html/ folder here
```

If your hosting only lets you serve from `public_html/` and nothing above it
(rare, but some resellers lock this down), see §7 for the fallback.

## 3. Create the database

cPanel → **MySQL® Databases** → create a database and a user, add the user to
the database with **all privileges**. Note the full names — cPanel prefixes
both with your account username, e.g. `myuser_support`. You don't need to
import anything by hand — the installer does that next.

## 4. Upload

Via **File Manager** or FTP/SFTP:

- Upload the *contents* of the repo's `public_html/` folder into your cPanel
  `public_html/` (or a subdomain's document root) — this includes `install.php`.
- Upload `app/`, `config/`, `database/`, `cron/`, `storage/` into your account
  home directory, as siblings of `public_html/` (not inside it).
- Make `storage/attachments/`, `storage/logs/` and `config/` writable (755, or
  775 if your host's PHP runs as a different user than file ownership) — the
  installer needs to write `config/config.php`.

## 5. Run the installer

Visit `https://your-domain/install.php`. It will:

1. Check PHP version, extensions, and folder permissions.
2. Connect to the database you created in step 3 (it connects to an existing
   database — cPanel database users normally can't create new ones).
3. Create every table and load essential reference data (roles, priorities,
   the SLA business calendar, notification templates) — offering an optional
   checkbox for sample demo customers/tickets/agents, so you can try the
   system immediately if you want to.
4. Create your own admin account (name, email, password — this is your real
   login, not a shared default).
5. Write `config/config.php` for you, including a fresh random security key.

**When it finishes, click "Delete install.php" on the success screen** (or
delete the file yourself via File Manager/FTP). Leaving a working installer
on a live site is a standing security risk — anyone who finds the URL could
attempt to run it.

After installing, open `config/config.php` and fill in `smtp.*` (outgoing
mail — cPanel → Email Accounts, or your own relay) and, if you want
email-to-ticket intake, `imap.*`.

### If you'd rather set it up by hand

cPanel → **phpMyAdmin** → select your database → **Import** → upload
`database/schema.sql`, then `database/core_setup.sql` (essential reference
data — always needed), then optionally `database/demo_data.sql` (fictional
sample content). Copy `config/config.sample.php` to `config/config.php`,
fill in `db.*`/`app.url`/`security.app_key` yourself, and create your first
admin account directly in phpMyAdmin — insert a row into `users` with
`password_hash` generated by
`php -r "echo password_hash('yourpassword', PASSWORD_DEFAULT);"` and
`role_id` set to the `ADMIN` role's id.

## 6. Set up cron jobs

cPanel → **Cron Jobs**. Use the full path to PHP shown by
`cPanel → Select PHP Version` (usually `/usr/local/bin/php` or similar) and
the full path to your account:

| Job | Schedule | Command |
|---|---|---|
| SLA warnings & escalation (NFR-04) | every 5 minutes | `/usr/local/bin/php /home/USER/cron/sla_engine.php >> /home/USER/storage/logs/sla_engine.log 2>&1` |
| Email-to-ticket (NFR-03, optional) | every 1–2 minutes | `/usr/local/bin/php /home/USER/cron/email_ingest.php >> /home/USER/storage/logs/email_ingest.log 2>&1` |
| Notification retry (FR-SUP-086) | every 15–30 minutes | `/usr/local/bin/php /home/USER/cron/notification_retry.php >> /home/USER/storage/logs/notifications.log 2>&1` |

Replace `USER` with your cPanel username throughout.

## 7. If you can't place app/ outside public_html

Some restricted accounts only let you upload into `public_html/`. In that
case, upload everything there but add this to `public_html/.htaccess`
(above the existing rewrite rules) to block direct access to the private
folders:

```apache
RewriteRule ^(app|config|database|cron|storage)/ - [F,L]
```

This is a weaker guarantee than keeping the folders outside the web root —
prefer §2's layout whenever your hosting allows it.

## 8. First login

- Agent console: `https://your-domain/login` — the admin account you created
  during install.
- Customer portal: `https://your-domain/portal/login` — if you loaded demo
  data, try `nasrin@meghnatextiles.example` / `Passw0rd!`, then change it via
  Admin → Customers & Contracts (and change every other demo agent's password
  too, or just delete the demo accounts once you're done evaluating).

## 9. SSL

Use cPanel's free AutoSSL (or your own certificate) and force HTTPS — the
app marks its session cookies `Secure` automatically once it detects
`$_SERVER['HTTPS']`, and NFR-11 requires TLS for all portal/API traffic.
