# Production Readiness

## Runtime

- PHP 8.4 or newer
- PostgreSQL
- Redis for cache, sessions, queues, and maintenance mode
- A queue worker running `php artisan queue:work --tries=3`
- A scheduler entry running `php artisan schedule:run` every minute when scheduled jobs are added

## Deployment

1. Copy `.env.production.example` to `.env` on the server.
2. Set `APP_KEY` with `php artisan key:generate --show`.
3. Set strong database, Redis, mail, and admin credentials.
4. Set `APP_URL` to the HTTPS production URL.
5. Set `ADMIN_WIDGET_PUBLIC_KEY` once if you want a fixed first widget key, or let the seeder generate one.
6. Keep `APP_FORCE_HTTPS=true`, `APP_DEBUG=false`, `SESSION_ENCRYPT=true`, and `SESSION_SECURE_COOKIE=true`.
7. Run `php composer.phar install --no-dev --optimize-autoloader`.
8. Run `php artisan migrate --force`.
9. Run `php artisan config:cache`, `php artisan route:cache`, and `php artisan view:cache`.
10. Point the load balancer at `/health` for a lightweight liveness check.
11. Point release readiness checks at `/ready` to confirm database connectivity.

## Operational Notes

- Use `/dashboard` for operations metrics.
- Use `/conversations` as the shared support inbox.
- Use `/chat-widget` to copy website, Android, iOS, Flutter, React Native, and REST implementation snippets.
- Android and iOS starter clients are included under `sdk/`.
- The public widget script is served from `/widget.js` and SDKs send messages to `/api/widget/messages`.
- Unknown questions become the training queue for new intents and responses.
- Callback requests track human follow-up work and phone-number collection.
- Keep seed credentials out of production by replacing all `ADMIN_*` values before running `php artisan db:seed`.

## Security Baseline

- Authenticated dashboard routes are session protected.
- Message and callback write actions authorize against the signed-in user's organization membership.
- CSRF protection is enabled on all dashboard forms.
- Widget API calls require an enabled organization widget key.
- Set widget allowed origins before production when web widgets should only run on approved domains. Native Android/iOS clients can call the same API without browser CORS.
- Production sessions should be encrypted, HTTPS-only, and backed by Redis.
- Database credentials, app key, and admin password must be delivered through the hosting platform's secret manager.
