# CloudAudit production deployment checklist

## Server requirements

- PHP 8.2+ with `pdo_mysql`, `curl`, `openssl`, `mbstring`, and `bcmath` enabled.
- MySQL 8.0+ or a current MariaDB build with JSON, foreign key, and check-constraint support.
- HTTPS certificate, outbound HTTPS access for Paystack/Twilio, and outbound SMTP access.
- Web root must point to `public/`, never the project root.

## Before upload

1. Copy `.env.example` to `.env` on the server and replace every placeholder.
2. Use a long unique `APP_KEY`; never upload `.env`, session files, `vendor/`, or local design references.
3. Create the MySQL database/user with least privilege, then run `composer install --no-dev --optimize-autoloader` and `composer run migrate`.
4. Configure the virtual host to route non-files to `public/index.php`; Apache uses the included `public/.htaccess`.
5. Set writable ownership only for `storage/sessions`, `storage/logs`, and `storage/cache`.

## Provider validation after deployment

- Send a test email: confirm SMTP delivery first, then deliberately test PHP mail fallback only if your host supports it.
- Send a Twilio test SMS to an E.164 number.
- Use Paystack test keys, initialize a test transaction, return through the callback, and confirm server-side amount/currency verification.
- Record a manual payment and confirm it remains `under_review` until an authorised administrator approves it.

## Production controls

- Configure recurring database backups and a tested restore procedure.
- Restrict database access to the application host; never expose MySQL publicly.
- Rotate SMTP, Twilio, and Paystack credentials through the server secret store/environment.
- Monitor failed notification deliveries, Paystack verification failures, unauthorised API attempts, and PHP error logs.