# Deployment on 20i reseller hosting

1. Build the Laravel application locally on a computer with Composer. Do not try to run `composer install` on the phone.
2. Set production environment values: `APP_ENV=production`, `APP_DEBUG=false`, a strong `APP_KEY`, HTTPS `APP_URL`, and database credentials.
3. In the 20i control panel, create the central MySQL database and user. Grant only the required privileges.
4. Upload the Laravel project outside the public web root where the hosting plan permits it. Point the domain document root to Laravel's `public` directory. If the plan does not allow changing the document root, use the host's documented secure public-folder deployment layout; never expose `.env`, `vendor`, `storage`, or application source through public HTTP.
5. Set writable permissions for `storage` and `bootstrap/cache`.
6. Create the database tables and run migrations using SSH/terminal if enabled. If SSH is unavailable, use a secure, temporary deployment procedure and remove it immediately after use; never leave a public migration URL.
7. Configure HTTPS, cron/scheduler, queue worker strategy, mail, backups and log rotation according to the exact hosting plan.
8. Test a school domain and tenant database. Confirm the host supports wildcard DNS/SSL if using `school.yourdomain.co.za`.
9. Test login, student creation, attendance, file uploads, locale switching, and cross-tenant isolation.
10. Keep the Laravel app and dependencies patched.

## 20i tenancy decision
Database-per-school tenancy requires database creation privileges and may run into reseller account limits. Confirm database count, database naming rules, wildcard subdomain support, cron access, SSH/Composer availability, PHP version and document-root control with 20i before going live. If unavailable, choose a central database with strict tenant scoping or a VPS/cloud host that supports database provisioning.


## e-MaaS expanded modules checklist
- Configure private disk for assignment uploads and authorized download routes.
- Set `PAYFAST_WEBHOOK_SECRET` and `PEACH_WEBHOOK_SECRET` only after implementing the exact merchant-provider signature contract.
- Do not enable payment callbacks against production until sandbox tests, replay/idempotency tests and reconciliation are complete.
- Create a least-privilege DB user; do not grant global database privileges unless your hosting provider explicitly requires and approves it.
- The `emaas:school-create` command creates central tenant/domain metadata; test actual tenant database creation separately.