# Production readiness checklist (ProInvoice)

Use this before **staging** or **live** deployment and after each **update**.

---

## Environment (`.env`)

| Setting | Production value |
|---------|------------------|
| `APP_ENV` | `production` |
| `APP_DEBUG` | `false` |
| `APP_URL` | Full `https://your-domain.com` (no trailing slash unless you always use one) |
| `LOG_LEVEL` | `error` or `warning` |
| `SESSION_ENCRYPT` | `true` (recommended with HTTPS) |
| `DB_*` | Production database credentials only |

After changes: run `php artisan config:clear` then deploy step below for caching.

---

## Build assets

```bash
npm ci
npm run build
```

Confirm `public/build` contains compiled Vite assets (not empty).

---

## Composer (server)

```bash
composer install --no-dev --optimize-autoloader
```

Do **not** deploy `vendor/` from a machine that only ran `composer install` with dev packages if your CI differs.

---

## Laravel optimization (after `.env` is correct on server)

```bash
composer run production:optimize
```

This runs: `config:cache`, `route:cache`, `view:cache`, `event:cache`.

**Local development:** run `composer run production:clear` so `.env` changes apply immediately.

---

## Database

```bash
php artisan migrate --force
```

Run from project root on the server. **Backup first.**

---

## Storage & bootstrap

```bash
php artisan storage:link
```

Ensure `storage/` and `bootstrap/cache/` are writable by the web user.

---

## Scheduler & queue

1. Cron (every minute): `php artisan schedule:run`  
2. If `QUEUE_CONNECTION=database` (or not `sync`): run a **queue worker** (e.g. `php artisan queue:work`) or supervisor.

See `REMINDER_SYSTEM_README.md` for reminder email modes.

---

## Automated verify script (local CI)

From project root:

```bash
chmod +x scripts/production-verify.sh
./scripts/production-verify.sh
```

Optional: `RUN_OPTIMIZE=1 ./scripts/production-verify.sh` to test caching (then `composer run production:clear` locally).

Composer shortcut:

```bash
composer run production:verify
```

---

## Security quick checks

- [ ] HTTPS enabled  
- [ ] `APP_DEBUG=false`  
- [ ] Strong admin passwords  
- [ ] `.env` not web-accessible (`public` is document root)  
- [ ] Installer disabled / removed per author post-install notes  

Full detail: **SECURITY.md** (in this folder).

---

## Envato ZIP build

```bash
./scripts/build-envato-release.sh [version]
```

Produces `dist/ProInvoice-{version}.zip` with Documentation, Application, License trees. Buyers run `composer install --no-dev` inside Application.

---

*Keep this file with your release process.*
