# Deploying MMF Invest to lesago.co.ke (cPanel-style shared hosting)

This assumes cPanel hosting where your MySQL database/user are already
created (`jymydusf_mmf_app` / `jymydusf_lanmurithi`) — which matches the
credentials you gave me. `.env` in this zip is already filled in with
them, `APP_ENV=production`, `APP_DEBUG=false`, `APP_URL=https://lesago.co.ke`,
and a freshly generated `SESSION_SECRET`.

**Since that DB password was pasted directly into our chat, treat it as
seen — if you have any doubt about who has access to this conversation,
rotate it in cPanel → MySQL® Databases before going live.**

## 1. Requirements

- PHP 8.2+ — in cPanel, **MultiPHP Manager** → select 8.2 or newer for
  lesago.co.ke.
- MySQL 8.0+/MariaDB 10.5+ (already have this, since the DB exists).
- **Note on `DB_HOST`:** `.env` uses `127.0.0.1` as given. Some cPanel
  setups only allow the MySQL socket via the literal host `localhost`
  and reject `127.0.0.1`. If you get a "connection failed" error after
  deploying, edit `.env` and change `DB_HOST=127.0.0.1` to
  `DB_HOST=localhost` and retest.

## 2. Upload the files

Only **one** folder from this zip (`mmf-app/`) matters. Two ways to lay
it out — pick based on what your host allows:

### Option A — custom document root (preferred, most secure)

If cPanel's **Domains** page lets you set a custom "Document Root" for
lesago.co.ke:

1. Upload/extract the whole `mmf-app` folder to your home directory,
   e.g. `/home/jymydusf/mmf-app`.
2. Set lesago.co.ke's document root to `/home/jymydusf/mmf-app/public`.
3. Everything else (`app/`, `config/`, `database/`, `.env`) stays
   **outside** the web-accessible folder — nobody can ever request
   `.env` directly over HTTP.

### Option B — fixed document root at public_html (fallback)

If your host won't let you change the document root:

1. Upload the **contents of `mmf-app/public/`** directly into
   `public_html/` (so `public_html/index.php`, `public_html/login.php`,
   `public_html/assets/`, etc. sit right there).
2. Upload the **rest** of `mmf-app/` (`app/`, `config/`, `database/`,
   `resources/`, `storage/`, `.env`) one level **above** `public_html`,
   i.e. straight into `/home/jymydusf/`, so the folder structure next to
   `public_html` looks like:
   ```
   /home/jymydusf/
     app/
     config/
     database/
     resources/
     storage/
     .env
     public_html/   <- former public/ contents
   ```
   This works unmodified because every page already uses
   `__DIR__ . '/../config/...'`-style paths, and this layout keeps that
   `..` pointing at the right place — the app code, DB credentials, and
   schema are never inside the web root.

Either way, **do not** put `app/`, `config/`, `database/`, or `.env`
anywhere under `public_html`.

## 3. Import the database

`jymydusf_mmf_app` already exists, so just import the schema — via
**phpMyAdmin** (cPanel → phpMyAdmin → select the database → Import →
choose `database/schema.sql`), or via SSH if you have it:

```bash
mysql -u jymydusf_lanmurithi -p jymydusf_mmf_app < database/schema.sql
```

## 4. Seed packages, fund_info, and your admin account

Edit `.env` and set:
```
SEED_ADMIN_EMAIL=you@example.com
SEED_ADMIN_PASSWORD=a-strong-password-12-chars-or-more
```
Then run the seeder once (via SSH, or cPanel's "Terminal"/cron "Run
once" if you don't have SSH):
```bash
php database/seeders/seed.php
```
**Immediately after it succeeds, delete `SEED_ADMIN_PASSWORD` (and
ideally `SEED_ADMIN_EMAIL`) from `.env`.**

## 5. Configure the real fund rate

Packages will show "rate not configured" until you do this. Via
phpMyAdmin or SSH:
```sql
UPDATE fund_info SET fund_manager_name = 'Your Fund Manager Ltd',
                      fund_name = 'Your Money Market Fund',
                      is_configured = 1
WHERE id = 1;

INSERT INTO fund_rate_history (annual_yield_percent, source_reference, effective_date, entered_by_admin_id)
VALUES (14.25, 'Fund factsheet 2026-09-20', CURDATE(), 1);
```

## 6. Enable HTTPS

Turn on AutoSSL for lesago.co.ke in cPanel (**SSL/TLS Status** →
**Run AutoSSL**) if it isn't already. `public/.htaccess` in this zip
force-redirects HTTP → HTTPS, and session cookies are already set to
`secure` automatically whenever the request is HTTPS.

## 7. Writable storage folder

The app writes error logs to `storage/logs/`. Make sure the folder
(wherever it ends up per option A/B above) is writable by the web
server user — `chmod 755 storage` is usually enough on cPanel; if you
see 500 errors, try `chmod 775`.

## 8. Verify

- Visit `https://lesago.co.ke` — should load the branded landing page
  over HTTPS with no PHP warnings on screen (`APP_DEBUG=false` hides
  them; check `storage/logs/php_errors.log` if something looks wrong).
- Register a test account, confirm the packages page shows your real
  rate.
- Confirm `/deposit.php`, `/withdraw.php`, `/wallet.php` load — these
  stay non-functional placeholders until `app/Services/MpesaService.php`
  is implemented against Safaricom's Daraja API (see `README.md`).

## 9. M-Pesa (still pending)

`MPESA_CALLBACK_URL` is pre-set to
`https://lesago.co.ke/mpesa/callback.php` for when you build that
endpoint. Fill in `MPESA_CONSUMER_KEY` / `MPESA_CONSUMER_SECRET` /
`MPESA_SHORTCODE` / `MPESA_PASSKEY` / `MPESA_INITIATOR_NAME` /
`MPESA_SECURITY_CREDENTIAL` from your Daraja app once you implement
`MpesaService`. Nothing in production will move real money until that's
done — that's intentional.