# Deployment — Current Target

## Current hosting decision

The current target is **Namecheap Shared Hosting / cPanel** using:

`invest.azcodehost.com`

The architecture remains portable to VPS later, but the current release does not require Docker, a permanent Redis worker or systemd daemons.

## cPanel application model

One Node.js application serves both surfaces:

- `/` → Next.js web/PWA UI
- `/api/*` → NestJS API
- `/api/docs` → OpenAPI/Swagger UI

The root startup file is `server.cjs`. It also applies baseline security headers and a bounded per-IP API rate limit before forwarding `/api` to NestJS.

## Runtime path

```text
Browser / PWA
   ↓ HTTPS
invest.azcodehost.com
   ↓
server.cjs
   ├─ Next.js
   └─ NestJS /api
          ↓
      PostgreSQL

cPanel Cron every 5 min
   ↓ authenticated request
/api/internal/cron/run
```

## Required environment variables

- `NODE_ENV=production`
- `APP_BASE_URL=https://invest.azcodehost.com`
- `DATABASE_URL=...`
- `DEFAULT_PROJECT_ID=...` after the real project exists
- `CRON_SECRET=...`
- `INTERNAL_API_SECRET=...` (different from Cron secret)
- `API_RATE_LIMIT_5M=300`
- `ENABLE_HSTS=true` only after HTTPS is confirmed working
- `PRIVATE_STORAGE_PATH=...` outside public web root
- `LIVE_INVESTMENT=false`
- `COLLECT_FUNDS=false`
- `LIVE_PAYMENTS=false`

Provider settings for email/SMS/push/AI remain mock/configurable until real providers are connected.

## Build

```bash
npm install
npm run build
npm run preflight:cpanel
```

The API must compile to `apps/api/dist` and the Next.js production build must exist in `apps/web/.next` before `server.cjs` starts.

## Database

PostgreSQL remains the production target. Migrations are under `database/migrations/` and must be applied in numeric order. If the exact hosting package does not provide usable PostgreSQL connectivity, use an approved managed PostgreSQL service or move the runtime to VPS rather than silently changing the platform to SQLite.

## Cron

`scripts/cpanel-cron.mjs` loads `APP_BASE_URL` and `CRON_SECRET` from the process environment or, by default, from:

`~/.config/farm-platform/cron.env`

This allows cPanel Cron to run without embedding the secret in the Cron command or Git repository.

Recommended cadence: every 5 minutes, subject to the hosting account's policy.

## Interim mutation protection

Full user authentication/RBAC is still a dedicated phase. New operational mutation endpoints are therefore protected with `INTERNAL_API_SECRET` at the backend during this checkpoint. This is an interim protection, not a replacement for full authentication, 2FA and RBAC.

## Shared-hosting constraints

Deferred until VPS/managed services are needed:

- permanent Redis/BullMQ workers;
- Docker runtime;
- WebSocket-heavy workflows;
- high-volume background jobs.

Bounded Cron jobs and request-time services are used in the current cPanel architecture.

## Financial/compliance safety

Deployment does not activate financial activity. These remain disabled by default:

- `LIVE_INVESTMENT=false`
- `COLLECT_FUNDS=false`
- `LIVE_PAYMENTS=false`