# Deployment Runbook — 8 Messy Kitchen Order Management System ## Hostinger Shared Hosting This is a step-by-step deployment walkthrough. For reference documentation (structure, permissions, security checklist), see `README.md`. This document covers the *procedure* specifically. --- ## Before You Start Confirm these are true before beginning deployment: - [ ] Local testing (Steps 1–48 of development) is complete and passing - [ ] No `test_*.php` files remain anywhere in the project folder - [ ] You have Hostinger hosting purchased and access to hPanel - [ ] You have a domain (or subdomain) pointed at your Hostinger hosting --- ## Step A — Prepare the Project Folder Locally 1. Make a clean copy of your project folder (don't deploy directly from your active development copy, in case something needs to be re-tested locally afterward). 2. In that copy, open `config/config.php` and change: ```php define('APP_ENV', 'development'); ``` to: ```php define('APP_ENV', 'production'); ``` **Do not do this yet if HTTPS isn't confirmed working on the live domain — see Step D below.** If you're uploading everything at once, it's fine to do this now as long as you complete Step D (SSL) before real users log in; just be aware sessions will not work correctly over plain HTTP once this flag is set, since `FORCE_HTTPS_COOKIE` will require HTTPS for cookies to be sent at all. 3. Review `data/users.xml` — remove or disable the demo `admin`/`staff` accounts (or plan to do this immediately after first login, per Step F). 4. Zip the entire project folder for upload (or prepare to use Hostinger's Git/FTP upload method instead — either works). ## Step B — Upload to Hostinger 1. Log into **hPanel** (Hostinger's control panel). 2. Navigate to **Files → File Manager**. 3. Navigate into `public_html/` (or a subfolder of it, if this site should live at a sub-path rather than the domain root). 4. Upload your zipped project and extract it there — OR use hPanel's **FTP Accounts** section to get FTP credentials and upload via an FTP client (FileZilla, etc.) if you prefer, which is often faster for many small files like this project has. 5. Confirm the result: `login.php`, `dashboard.php`, `config/`, `includes/`, `data/`, etc. should all sit directly inside `public_html/` (or your chosen subfolder) — the same relative structure as your local XAMPP setup. ## Step C — Set PHP Version 1. In hPanel, navigate to **Advanced → PHP Configuration** (exact menu wording may vary slightly by Hostinger's current interface). 2. Set PHP version to **8.0 or higher** (this project was built and tested against 8.2). 3. Save changes. ## Step D — Enable HTTPS/SSL 1. In hPanel, navigate to **Security → SSL** (or similar — Hostinger typically offers a free SSL certificate, often auto-provisioned). 2. Enable/issue the SSL certificate for your domain. 3. Wait for it to activate (can take a few minutes). 4. Visit `https://[yourdomain]/login.php` and confirm the browser shows a secure padlock, no certificate warnings. 5. **Only after this is confirmed working:** if you hadn't already set `APP_ENV` to `'production'` in Step A, do so now via hPanel's File Manager (edit `config/config.php` directly) or re-upload the corrected file. ## Step E — Set File Permissions 1. In File Manager, right-click the `data/` folder → **Permissions** (or **Change Permissions**). 2. Set to `755` (or `775` if writes fail — see troubleshooting below). 3. Ensure this applies to the folder and, ideally, its existing contents. ## Step F — Create the Real First Administrator 1. Decide on a real administrator username, email, and a strong password. 2. Generate a password hash. Hostinger's hPanel may offer SSH access (**Advanced → SSH Access**) — if so, connect via SSH and run: php -r "echo password_hash('YourRealPasswordHere', PASSWORD_DEFAULT) . PHP_EOL;" If SSH isn't available on your plan, generate the hash locally on your XAMPP machine instead (same command), then just copy the resulting hash value into the live `users.xml` — the hash itself contains no reference to *where* it was generated, so this is safe to do locally and transfer. 3. In File Manager, open `data/users.xml`, add a new `` block with this hash, `Administrator`, `1`, and `1` (see README Section 13 for what this means). 4. Save the file. 5. Log in at `https://[yourdomain]/login.php` with the new real administrator account to confirm it works. ## Step G — Remove/Disable Demo Accounts 1. While logged in as the new real administrator, go to **User Management**. 2. Disable (or directly remove from `users.xml`) the `admin`/`staff` demo accounts. 3. **Important:** if the demo `admin` account currently holds `is_owner=1`, move that flag to the new real owner account **first** (directly in `users.xml`), before disabling/removing the demo account — otherwise no account will be marked as the protected owner. ## Step H — Full Post-Deployment Verification Run through this quickly on the live site before considering deployment complete: - [ ] `https://[yourdomain]/data/users.xml` returns 403, not raw XML - [ ] `https://[yourdomain]/data/orders.xml`, `menu.xml`, `logs.xml`, `login_attempts.xml` all return 403 too - [ ] Login works with the new real administrator account - [ ] Demo accounts can no longer log in - [ ] Creating a test order works, and its price matches the real menu (confirms `data/` write permissions are correct) - [ ] Dashboard shows live data, not zeros/errors - [ ] Staff account (a real one, once created) is correctly blocked from User Management - [ ] Mobile view works correctly on an actual phone, not just DevTools emulation, if convenient to check - [ ] Delete/clean up the test order created above, once verified --- ## Troubleshooting **"Unable to process the request" errors after upload, especially when creating/updating orders or users:** Almost always a file permissions issue. Re-check Step E; try `775` on `data/` if `755` doesn't resolve it. Some hosts also require the specific uploaded files (not just the folder) to have correct ownership — Hostinger's File Manager uploads should set this automatically, but if problems persist, contact Hostinger support about the correct user/group for PHP write access on your specific plan. **Blank white page anywhere:** A PHP fatal error is occurring but suppressed (`display_errors` should be `Off` in production, per the security checklist). Check hPanel's **Advanced → Error Logs** or File Manager for the site's PHP error log — Hostinger typically provides one even without SSH access. **Session/login doesn't persist, constantly logged out:** Usually means `APP_ENV` was set to `'production'` (enabling the `Secure` cookie flag) before HTTPS was actually confirmed working — browsers refuse `Secure` cookies over plain HTTP. Re-check Step D completed successfully first. **`data/*.xml` files ARE publicly downloadable after deployment:** Means `.htaccess` isn't being honored. Check with Hostinger support whether `AllowOverride` is enabled for your hosting plan — this is standard on Hostinger's shared hosting, but worth confirming if the block isn't working.