# Ajo Money deployment

## Required services

- PHP 8.3+ with OpenSSL, PDO MySQL, Mbstring, Fileinfo, GD, XML and ZIP
- MySQL 8+
- Redis is recommended for cache, sessions and queues
- A process supervisor for `php artisan queue:work`
- A cron entry running `php artisan schedule:run` every minute

## Production setup

### Web installer (shared hosting)

Upload the application, point the domain document root to `public`, copy `.env.example` to `.env`, and visit `/install`. The wizard checks PHP extensions and permissions, tests MySQL, runs migrations, seeds plans, creates the first owner, and writes `storage/app/installed` to permanently disable itself.

Do not delete the installation lock on a live system. If the installer cannot write `.env`, `storage`, or `bootstrap/cache`, correct ownership/permissions in the hosting panel before continuing.

### Command-line setup

1. Configure `.env`, including `APP_URL`, MySQL, mail, queue, cache and Paystack keys.
2. Run `composer install --no-dev --optimize-autoloader` and `npm ci && npm run build`.
3. Run `php artisan migrate --force` and `php artisan db:seed --class=PlanSeeder --force`.
4. Run `php artisan storage:link` and `php artisan optimize`.
5. Start durable queue workers with retries and a sensible timeout.
6. Configure the Paystack webhook as `https://your-domain.example/api/paystack/webhook`.

## Background work

The scheduler creates due contribution periods at 00:05 in the application timezone. Contribution receipts and external notifications use the queue. Deployments must restart workers with `php artisan queue:restart`.

## Notification providers

Email and database notifications are operational through Laravel. SMS and WhatsApp use `SmsGateway` and `WhatsAppGateway` contracts. The default adapters write structured messages to the application log; bind production provider adapters in `AppServiceProvider` before enabling those channels.

## Paystack

Transactions are initialized only on the server. Both callbacks and `charge.success` webhooks verify status, amount, currency and reference before activating a subscription. Webhook bodies are authenticated with the `x-paystack-signature` HMAC-SHA512 header.

Use test keys and Paystack's test environment before switching to live keys. Never expose `PAYSTACK_SECRET_KEY` to browser code or commit `.env`.

## Security checklist

- Set `APP_ENV=production`, `APP_DEBUG=false`, HTTPS-only cookies and a strong `APP_KEY`.
- Use separate database credentials with minimum required privileges.
- Keep queues and the scheduler running; monitor failed jobs.
- Back up MySQL and uploaded business assets.
- Run `composer audit`, `php artisan test`, and the production asset build during CI.
