# Go-live checklist — drideasstudyhub.com

Work through this top to bottom on the real hosting. Tick each box.

## 1. Server
- [ ] PHP 8.1+ with `pdo_mysql`, `fileinfo`, `mbstring` (cPanel → Select PHP Version).
- [ ] Domain's **document root points at `public/`** (not the project root). This keeps `config/`, `includes/`, `database/`, `storage/` and `scripts/` unreachable from the web.
- [ ] HTTPS certificate installed (cPanel → SSL/TLS Status → AutoSSL). `.htaccess` already forces HTTPS.
- [ ] `storage/receipts/` and `storage/notes/` writable by PHP (permissions 750 or 755).
- [ ] `upload_max_filesize` and `post_max_size` ≥ 16M (lesson notes are up to 15 MB).

## 2. Database
- [ ] Create database + user in cPanel (MySQL® Databases), grant ALL on that database only.
- [ ] Import `database/schema.sql` (fresh install — **do not** run the files in `database/migrations/`; they are only for upgrading older installs).
- [ ] `cp config/config.sample.php config/config.php`, fill in DB details, keep `'env' => 'production'`.
- [ ] Generate the encryption key for stored SMTP passwords and put it in `config/config.php` as `'app_key'`: `php -r "echo bin2hex(random_bytes(32)), PHP_EOL;"` — **keep a copy**; if it is lost you must re-enter the SMTP password.
- [ ] Create the admin: `php database/create_admin.php "Dr. Ideas" admin@drideasstudyhub.com 'a-long-unique-password'`
- [ ] Never leave a default or shared admin password. Use a different password from every other account.

## 3. Content and payment settings
- [ ] Admin → Settings: enter the real MoMo/bank details, account name, and a support contact.
- [ ] Admin → Settings → **Email (SMTP) settings**: enter the SMTP host, port, encryption, username, password and "from" address, save, then press **Send test email** and confirm it arrives. Until this works, the "Forgot password?" page tells students to contact the tutor.
  - cPanel mailbox: host `mail.drideasstudyhub.com`, port 465 + SSL/TLS (or 587 + STARTTLS), username = the full email address.
  - Gmail: `smtp.gmail.com`, 587 + STARTTLS, username = your Gmail, password = a 16-character **App Password** (needs 2-Step Verification).
  - Use a "from" address on your own domain, and add SPF/DKIM in your DNS if your host offers it, so reset emails don't land in spam.
- [ ] Create one low-price **test course**, publish it, add a topic with an **unlisted** YouTube video.
- [ ] Register a test student, submit a payment, approve it as admin, open the lesson, mark it done, send a question, reply to it. Then delete the test student's data or set the course to draft.

## 4. Scheduled jobs (cPanel → Cron Jobs)
| When | Command |
|---|---|
| Daily 02:00 | `/usr/local/bin/php /home/USER/drideas/cron/expire_access.php` |
| Daily 02:30 | `/bin/bash /home/USER/drideas/scripts/backup.sh` |

- [ ] Run each once by hand and confirm it prints its success line.
- [ ] Backups land in `~/drideas-backups` (outside the web root). **Copy them off the server regularly** (Google Drive, another host). A backup on the same server is not a backup if the server fails.
- [ ] Do a test restore once: `zcat db_*.sql.gz | mysql -u USER -p DBNAME` into a scratch database.

## 5. Final security checks (do these in a private/incognito window)
- [ ] Visit `/admin/` logged out → redirected to login.
- [ ] Visit `/config/config.php`, `/includes/db.php`, `/database/schema.sql`, `/storage/` → must not download or show anything.
- [ ] Log in as the test student → `/admin/` shows "Forbidden".
- [ ] Open a lesson URL as a student who has **not** paid → redirected to the course page.
- [ ] Try someone else's receipt link (`/receipt.php?id=N`) as a different student → "Not found".
- [ ] Check the site on a real phone (catalogue, login, payment form, lesson player).

## 6. Operating rules for the tutor
- Approve a payment **only after** seeing the money in the actual MoMo/bank record. A screenshot is not proof.
- Reject with a clear reason so the student can fix and resubmit.
- Use "Grant access" with a reason for scholarships and cash payments; every change is logged.
- Unlisted YouTube videos can be shared by anyone who has the link. This is acceptable for a low-cost start, but it is not secure video hosting. If piracy becomes a problem, move to a paid video host later.
- Change prices freely: past payments keep the price they were made at.

## 7. Known limits of this version
- Password reset by email works through the SMTP relay the admin configures. It was tested against a local fake SMTP server (login, message format, token rules). **TLS/STARTTLS and your real provider have not been tested**, so use the "Send test email" button after setup.
- Tailwind is loaded from its CDN, which is fine for an MVP but adds a third-party dependency and a console warning. For heavier traffic, build the CSS once and serve it locally.
- Sessions are the standard PHP file sessions; with many concurrent students on shared hosting this is fine, but note it for scaling.