# Production Deployment Baseline

## Web server
Point Apache/Nginx/cPanel document root to `/public`. Deny web access to `.env`, `storage`, `database`, `vendor` indexes and repository metadata. Force HTTPS and secure cookies.

## Commands

```bash
composer install --no-dev --classmap-authoritative
php artisan migrate --force
php artisan config:cache
php artisan route:cache
php artisan view:cache
npm ci
npm run build
php artisan storage:link
php artisan accounting:integrity-check
```

Run `php artisan queue:work --sleep=1 --tries=3 --timeout=120` under Supervisor/systemd and run `php artisan schedule:run` every minute through cron.

## Release safety
Take encrypted database and attachment backups before migrations. Test restore separately. Run the full test suite, integrity check and health endpoint before switching traffic. Never enable production e-invoicing merely by changing an environment flag; a real provider adapter and acceptance checklist are also required.