# Nexa AI — cPanel / SSH deployment guide

This package is a Laravel 12 **source starter**, not a finished commercial AI suite. It includes registration/login, dashboard, saved chat, an OpenAI chat service, migrations and a credit ledger. Image/video generation, payments, subscriptions, voice, PDF processing, admin controls and mobile apps are not implemented. Do not advertise those tools as working until they have been built and tested.

## 0. Protect your current site first

1. In cPanel, make a full account backup if your host provides it. Separately download the existing website files and export its MySQL database.
2. Do **not** overwrite the current Nexa AI/domain folder or import the old SQL file into the new database. Keep the existing site untouched until the new installation is tested.
3. Prefer a staging subdomain such as `staging.example.com` or a separate folder/domain for the first deployment.

## 1. Check server requirements

In cPanel Terminal / SSH, run:

```bash
php -v
composer --version
php -m
```

Use PHP 8.2 or newer and Composer 2. Required PHP extensions include `ctype`, `curl`, `fileinfo`, `mbstring`, `openssl`, `pdo`, `pdo_mysql`, `tokenizer`, `xml`, and `json`. Select the correct PHP version in cPanel MultiPHP Manager if available. Do not continue if Composer or required extensions are missing; ask the hosting provider to enable them.

## 2. Upload and install outside the public web root

Recommended layout (replace example paths with the real cPanel account paths):

```text
/home/CPANELUSER/nexa-app/             # Laravel project root, not directly public
/home/CPANELUSER/public_html/          # web document root, ideally Laravel's public/ contents
```

Upload and extract the ZIP into `nexa-app`. Ensure `artisan`, `composer.json`, `app/`, `bootstrap/`, `config/`, `database/`, `public/`, `resources/`, `routes/` and `storage/` are in the project root. If the domain must use `public_html`, configure the domain's document root to `/home/CPANELUSER/nexa-app/public` if your host allows it. Otherwise, ask the host to set the document root to Laravel's `public` directory. Do not expose `.env`, `vendor`, `storage`, or the project root through a public document root.

From the project root run:

```bash
composer install --no-dev --optimize-autoloader
cp .env.production.example .env
```

If the host doesn't allow `cp`, create `.env` by copying `.env.production.example` in File Manager. Never paste secrets into public files or send them in chat.

## 3. Create a new production MySQL database

In cPanel → MySQL Database Wizard, create a **new** database and database user; grant only the required privileges to that database. Put the actual host, database name, username and password into `.env`:

```dotenv
APP_ENV=production
APP_DEBUG=false
APP_URL=https://your-domain.example
DB_CONNECTION=mysql
DB_HOST=localhost
DB_PORT=3306
DB_DATABASE=cpanelprefix_nexa
DB_USERNAME=cpanelprefix_user
DB_PASSWORD=replace_with_your_real_password
```

Also configure `OPENAI_API_KEY` and `OPENAI_MODEL` if you want AI chat. Keep all secrets in `.env`, never in Blade templates or JavaScript. Generate a fresh key for this installation:

```bash
php artisan key:generate
```

Do not change `APP_KEY` after real user data has been stored; changing it can invalidate encrypted data and sessions.

## 4. Run migrations and secure permissions

```bash
php artisan migrate --force
php artisan storage:link
php artisan optimize:clear
php artisan config:cache
php artisan route:cache
```

If `storage:link` is unsupported or fails on shared hosting, follow the host's documented alternative; don't make the whole project writable. `storage/` and `bootstrap/cache/` must be writable by the PHP process, but avoid `777` permissions. Commonly directories are `755` or `775`, depending on host configuration.

## 5. Verify before directing real users

- Open the HTTPS domain and check the landing page.
- Register a test account, sign out, and sign back in.
- Send a small AI chat request only after setting an API key and checking provider billing/limits.
- Inspect `storage/logs/laravel.log` if errors occur. Never enable `APP_DEBUG=true` on the public production site.
- Test database backups and restore steps.
- Add rate limits, abuse prevention, email verification, password reset delivery, privacy policy, terms, account deletion, monitoring, and spending caps before launch.

## Important limitations

This source archive does not include Composer's `vendor/` dependencies; `composer install` must succeed on the server. It has not been tested on your specific cPanel account, and PHP syntax checks alone do not prove the application runs. Do not consider it activated until the installation and smoke tests above pass. AI video generation and payment/credit purchases are not implemented; do not take customer payments for unavailable features.