# MediBook AI — Deployment Guide (MVP, web-only)

A practical guide for launching on a VPS (recommended) or shared cPanel host.
Stack: Laravel 12, PHP 8.3, MySQL 8, Redis (recommended for queue/cache).

## 0 · DNS & domains
- Point the apex + `www` to the server.
- Add a **wildcard** record `*.medibookai.com` → server (clinic subdomains).
- Set `MEDIBOOK_CENTRAL_DOMAIN=medibookai.com` in `.env`.

## 1 · Provision (Ubuntu VPS)
```
apt install php8.3-{cli,fpm,mysql,mbstring,xml,curl,zip,gd,bcmath} \
            mysql-server redis-server nginx composer unzip
```
Create the database and a least-privilege user.

## 2 · Deploy the app
```
git clone <repo> /var/www/medibook && cd /var/www/medibook
composer install --no-dev --optimize-autoloader
cp .env.example .env && php artisan key:generate
# edit .env: DB_*, MEDIBOOK_CENTRAL_DOMAIN, MAIL_*, WHATSAPP_*, PADDLE_*
php artisan migrate --force
php artisan db:seed --class=RoleSeeder
php artisan db:seed --class=PlanSeeder
php artisan storage:link
php artisan config:cache route:cache view:cache
```
Create the first super-admin (tinker): a `User` with `tenant_id = null` and
`assignRole('super_admin')`.

Optionally build the demo clinic: `php artisan medibook:demo`.

## 3 · Web server (Nginx)
Server block with `server_name medibookai.com *.medibookai.com;`, root
`/var/www/medibook/public`, standard Laravel `try_files` + php-fpm. Install TLS
with a **wildcard** certificate (Let's Encrypt DNS-01) so every clinic
subdomain is covered.

## 4 · Queue worker + scheduler (required)
WhatsApp sends and notifications are queued; lifecycle/notifications are
scheduled.
```
# Cron (every minute):
* * * * * cd /var/www/medibook && php artisan schedule:run >> /dev/null 2>&1

# Supervisor worker:
[program:medibook-worker]
command=php /var/www/medibook/artisan queue:work --sleep=3 --tries=1 --max-time=3600
numprocs=2 autostart=true autorestart=true
```
Set `QUEUE_CONNECTION=redis` (or `database`) and `CACHE_STORE=redis`.

## 5 · Storage & PHI
Patient files and payment proofs live on the **private** disk
(`storage/app`), served only through authenticated, tenant-scoped routes —
never the public webroot. Ensure `storage/` is writable and **excluded from
public access**. Back it up alongside the database.

## 6 · Integrations
- **WhatsApp**: set `WHATSAPP_DRIVER=meta` (or `twilio`), fill credentials, and
  point the Meta webhook at `https://medibookai.com/whatsapp/webhook` with
  `WHATSAPP_META_VERIFY_TOKEN`.
- **Paddle**: set `PADDLE_CHECKOUT_URL`; manual Zain Cash / SuperQi works with
  no external setup.
- **Mail**: configure `MAIL_*` (e.g. a transactional provider) for expiry
  emails.

## 7 · Backups (recommended)
Nightly `mysqldump` + `storage/app` to off-site storage; keep 7–30 days. Test a
restore before launch.

## 8 · Shared cPanel notes
The single-DB, shared-schema tenancy and subdomain routing work on cPanel:
add a wildcard subdomain pointing at `public/`, run the scheduler via cPanel
Cron, and use the `database` queue driver with a frequent `queue:work`
cron if Supervisor is unavailable. PHP 8.3 must be selected for the domain.