# Production deployment checklist

## Platform

- PHP 8.3+ and Composer 2
- MySQL 8+ or compatible MariaDB
- Node.js version compatible with Next.js 16 for frontend builds
- HTTPS on both frontend and API
- Queue worker process (Supervisor/systemd or equivalent)
- Cron/scheduler entry for Laravel scheduler

## Laravel API

```bash
composer install --no-dev --prefer-dist --optimize-autoloader
cp .env.example .env
php artisan key:generate
# configure database / domains / mail before migrating
php artisan migrate --force
php artisan storage:link
php artisan swagger:sync
php artisan optimize
```

Run a worker such as:

```bash
php artisan queue:work --sleep=2 --tries=3 --timeout=120
```

Scheduler:

```cron
* * * * * cd /path/to/backend && php artisan schedule:run >> /dev/null 2>&1
```

Required domain alignment for cookie authentication includes `APP_URL`, `FRONTEND_ORIGINS`, `SANCTUM_STATEFUL_DOMAINS`, `SESSION_DOMAIN`, secure cookies and HTTPS.

The `public` filesystem disk serves website media through `storage:link`. The `private` disk is rooted under `storage/app/private` and must **not** be exposed directly by the web server.

Configure SMTP in environment/site settings and restart queue workers after mail configuration changes so long-running workers load the new settings.

## Next.js frontend

```bash
npm ci
cp .env.example .env.local
npm run build
npm run start
```

Set:

```env
NEXT_PUBLIC_SITE_URL=https://www.example.com
NEXT_PUBLIC_API_URL=https://api.example.com/api
NEXT_PUBLIC_BACKEND_URL=https://api.example.com
```

`NEXT_PUBLIC_BACKEND_URL` is used to resolve public Laravel storage media. Do not expose server secrets through any `NEXT_PUBLIC_*` variable.

## Before first production login

The development seeder creates `admin@bioluminux.com` with password `ChangeMe!123456`. Replace/remove that seeded credential before public exposure and use a unique strong password. Enable 2FA for privileged users according to organisational policy.

## Scale / reliability

Database queues work for an initial single-site deployment. Redis is recommended for cache/session/queues at higher concurrency. Use database indexes already included in the schema, run queue workers independently from web workers, and place public images behind a CDN/object store when traffic grows.


## Swagger on cPanel

Set `SWAGGER_ENABLED=true`, ensure `APP_URL`/`SWAGGER_SERVER_URL` use the HTTPS API domain, then run `php artisan swagger:sync`. Swagger UI is available at `/api/documentation`. See `docs/SWAGGER-CPANEL.md` for document-root, permissions and troubleshooting details.