# Deploying StudentOrbit to cPanel shared hosting

The app has **no build step** — you upload PHP files and point the web server at
the `public/` folder. Secrets live in a git-ignored `config/config.local.php` you
create **on the server**. There is no SSH requirement; a one-time web installer
(`public/setup.php`) creates the database tables and your login.

---

## 1. Create the database (cPanel » MySQL Databases)

1. Create a database, e.g. `studentorbit` → real name becomes `cpuser_studentorbit`.
2. Create a database user with a strong password.
3. **Add the user to the database** with **ALL PRIVILEGES**.
4. Note the final DB name, user name, password, and host (almost always `localhost`).

> The app user does **not** need permission to `CREATE DATABASE` — the installer
> only creates tables inside the DB you made here.

## 2. Upload the files

Upload the whole project with FTP. **Recommended secure layout** (keeps secrets
and source out of the web root):

```
/home/cpuser/studentorbit/        <- upload the repo here (NOT inside public_html)
    config/  src/  install/  public/ ...
```

Then in cPanel, point the domain/subdomain **Document Root** at:

```
/home/cpuser/studentorbit/public
```

(cPanel » Domains → set Document Root, or create a subdomain with that root.)

**If you cannot change the Document Root** and must upload into `public_html`:
upload so the files sit at `public_html/studentorbit/...` and browse to
`https://your-domain/studentorbit/public/`. Either way, the `.htaccess` files we
ship in `config/`, `src/`, and `install/` block those folders from the web as a
safety net.

## 3. Create config/config.local.php (secrets)

On the server, copy the template and fill in real values:

```
config/config.local.php.example   ->   config/config.local.php
```

Set the `db` block to the cPanel values from step 1, set a strong `admin.password`,
fill in `smtp` (Gmail needs an **App Password**), keep `debug => false`, and set
`install_token` to a long random string. This file is git-ignored — it is never
committed and must be created directly on the server.

## 4. Run the one-time installer

Over HTTPS, visit (replace the token with your `install_token`):

```
https://your-domain/setup.php?token=YOUR_TOKEN&seed=1
```

- `&seed=1` loads the demo content (phases, verticals, sample tasks/leads).
  Omit it for an empty dashboard. **Re-running with `seed=1` wipes existing data.**
- You should see `DONE.` with "admin login ready".

## 5. Lock it down

1. **Delete `public/setup.php`** (or blank `install_token` in `config.local.php`).
2. Confirm `https://your-domain/config/config.local.php` is **not** downloadable
   (should be 403/404).
3. Make sure the site is served over **HTTPS** (session cookies are marked Secure).

## 6. Log in

Open the site root and sign in with the `admin.email` / `admin.password` you set.
"Forgot password" emails a 6-digit OTP via your SMTP settings.

---

### Before going public (security follow-ups)
- **Rotate** any DB / mail passwords that were shared in chat, then update
  `config.local.php` with the new values.
- Keep `debug => false` in production (PHP errors are logged, not shown).