# Namecheap cPanel Quick Start

Target: `invest.azcodehost.com`

> This is a deployment checklist. Account-specific filesystem paths, Node binary paths, database credentials and secrets must be taken from the actual cPanel account; do not invent them.

## 1. Create the subdomain

1. Open Namecheap hosting cPanel.
2. Open **Domains**.
3. Choose **Create A New Domain**.
4. Enter `invest.azcodehost.com`.
5. Disable shared document root if cPanel shows that option.
6. Give it a dedicated application root.

## 2. Create the Node.js application

1. Open **Setup Node.js App**.
2. Create a new application.
3. Application mode: `Production`.
4. Pick a Node version satisfying the repository engine (`>=22`) if available on the account.
5. Application root: the uploaded repository root.
6. Startup file: `server.cjs`.
7. Application URL: `invest.azcodehost.com`.

## 3. Configure environment variables

Add these in cPanel's application environment settings:

```text
NODE_ENV=production
APP_BASE_URL=https://invest.azcodehost.com
DATABASE_URL=<real PostgreSQL connection string>
DEFAULT_PROJECT_ID=<UUID after the real project is created>
CRON_SECRET=<long random secret>
INTERNAL_API_SECRET=<different long random secret>
API_RATE_LIMIT_5M=300
ENABLE_HSTS=true
PRIVATE_STORAGE_PATH=<real private path outside public web root>
LIVE_INVESTMENT=false
COLLECT_FUNDS=false
LIVE_PAYMENTS=false
```

`CRON_SECRET` and `INTERNAL_API_SECRET` must be different values. Do not paste real secrets into Git or source files.

## 4. Install and build

From the cPanel Node application environment / terminal:

```bash
npm install
npm run build
npm run preflight:cpanel
```

`npm run preflight:cpanel` should show required files as `PASS`. The three compliance gates must remain `false` unless separately and intentionally enabled after the relevant review.

## 5. PostgreSQL migrations

Run migrations in numeric order against the intended staging/production database:

```text
0001_initial.sql
0002_security_and_scheduler.sql
0003_legal_ownership_records.sql
0004_operations_intelligence_and_health.sql
```

Back up an existing database before applying migrations. These migrations are written but have not been executed inside the ChatGPT coding environment.

After creating the real project, set its UUID as `DEFAULT_PROJECT_ID` so the dashboard reads live operational data.

## 6. Start / restart and smoke-check

Restart the Node application from **Setup Node.js App**.

Check:

```text
https://invest.azcodehost.com/
https://invest.azcodehost.com/dashboard
https://invest.azcodehost.com/api/health
https://invest.azcodehost.com/api/system/health
https://invest.azcodehost.com/api/docs
```

## 7. Cron Job — safe secret handling

cPanel Cron may not inherit the Node App environment variables. The included script supports a protected env file outside the public app directory.

Create:

```text
/home/CPANEL_USER/.config/farm-platform/cron.env
```

with:

```text
APP_BASE_URL=https://invest.azcodehost.com
CRON_SECRET=<same CRON_SECRET configured in the Node App>
```

Set restrictive permissions if the cPanel terminal allows it:

```bash
chmod 600 /home/CPANEL_USER/.config/farm-platform/cron.env
```

Then open **cPanel → Advanced → Cron Jobs** and use the real paths shown on the account:

```cron
*/5 * * * * /REAL/NODE/PATH /REAL/APP/PATH/scripts/cpanel-cron.mjs >> /REAL/LOG/PATH/cron.log 2>&1
```

The Cron runner calls the protected endpoint:

```text
POST /api/internal/cron/run
```

Current bounded tasks:

- expired session cleanup;
- OTP cleanup;
- expiring-document scan;
- queued-report scan;
- farm-task reminder scan;
- system-health snapshot.

## 8. Verify Cron

After the first run, inspect the Cron log. When PostgreSQL is connected, the endpoint returns individual task statuses and records the run in `cron_runs`.

If the database is not configured, the endpoint intentionally reports the database-dependent work as skipped rather than claiming it ran.

## 9. PWA / phone install

The site includes a manifest and service worker. After HTTPS deployment, compatible Android/iPhone browsers can add the web app to the home screen. API responses are excluded from the service-worker cache.

## 10. Premium visual assets

Premium assets are under:

```text
apps/web/public/assets/
```

The farm backgrounds include 3840×2160 SVG and PNG assets. Mobile layouts reduce visual load automatically and respect reduced-motion preferences.