# Nexa AI deployment checklist

## Before uploading
- [ ] Download a full backup of the existing cPanel site and database.
- [ ] Deploy to a staging subdomain or isolated directory first.
- [ ] Confirm the hosting PHP version is 8.2 or newer and required PHP extensions are enabled.
- [ ] Confirm Composer 2 is available in Terminal/SSH.
- [ ] Create a dedicated MySQL database and database user with only the privileges required by the app.

## Deployment
- [ ] Upload/extract the project outside the public web root where possible.
- [ ] Run `composer install --no-dev --optimize-autoloader` in the project root.
- [ ] Copy `.env.production.example` to `.env`; set APP_ENV=production and APP_DEBUG=false.
- [ ] Set APP_URL to the HTTPS domain and configure database credentials.
- [ ] Run `php artisan key:generate` only for a brand-new installation. Never regenerate the key on an existing installation without a planned key rotation.
- [ ] Run `php artisan migrate --force` after verifying the database name and taking a backup.
- [ ] Ensure `storage` and `bootstrap/cache` are writable by the PHP process; avoid broad 777 permissions.
- [ ] Point the domain document root to the project's `public` directory. Do not expose `.env`, `vendor`, `storage`, or the project root.
- [ ] Enable HTTPS, then run `php artisan config:cache` and `php artisan view:cache`.

## After deployment
- [ ] Register a test account and test login/logout.
- [ ] Test chat with a small, low-cost request and a valid server-side API key.
- [ ] Confirm API keys never appear in HTML, browser JavaScript, logs, or error pages.
- [ ] Confirm errors do not expose stack traces to visitors.
- [ ] Test database persistence and backup/restore procedure.
- [ ] Monitor provider usage and set provider-side spending limits where available.
- [ ] Do not advertise image, video, voice, payment, or subscription features until each is implemented and tested.

## Rollback
If a deployment fails, put the site into maintenance mode if possible, restore the previous code and database backup together, and review `storage/logs/laravel.log` privately. Never publish the log file.