# cPanel Deployment

## Recommended method — everything in `public_html`

Extract `dist/venue-events-manager-cpanel.zip` **directly into** the domain’s `public_html` folder.

```
public_html/
  index.php          ← front controller (usePublicPath = this folder)
  .htaccess          ← routes + blocks app/vendor/storage/…
  install/           ← web installer (delete after install)
  assets/
  app/
  bootstrap/
  config/
  database/
  resources/
  routes/
  storage/
  vendor/
  …
```

Steps for hosting users: see [CPANEL_INSTALLATION.md](../CPANEL_INSTALLATION.md).

### Security on a flat deploy

When Laravel lives inside the web root:

1. Root `.htaccess` returns **403** for `app`, `bootstrap`, `config`, `database`, `resources`, `routes`, `storage`, `vendor`, `.env`, `artisan`, Composer files.
2. Each sensitive directory also contains a deny-all `.htaccess`.
3. Private attachments stay under `storage/app/attachments` and are streamed by an authorised controller (no `storage:link` required).

### Public path

Release `index.php` sets:

```php
$app->usePublicPath(__DIR__);
```

so CSS/JS under `/assets` resolve correctly without a nested `/public` directory.

## Alternate methods (developers)

### Document root = Laravel `public/`

Upload the full project elsewhere and point the domain document root at the project’s `public` folder. Use the project’s normal `public/index.php` (paths use `../vendor`).

### Split layout (legacy)

Older releases used `application/` beside `public_html/`. The current builder no longer produces that layout; use the flat package instead.

## Permissions

| Item | Mode |
|------|------|
| Directories | 755 |
| Files | 644 |
| `storage`, `bootstrap/cache` | 755 or 775 |

Avoid 777 unless the host leaves no alternative.

## Building the release

```bash
php scripts/build_cpanel_release.php
```

Creates: `dist/venue-events-manager-cpanel.zip` (ZIP root = files to drop into `public_html`).

## Troubleshooting 500 errors

1. MultiPHP = 8.2+  
2. `storage` and `bootstrap/cache` writable  
3. `.htaccess` / `mod_rewrite` enabled  
4. Check `storage/logs/laravel.log` (keep `APP_DEBUG=false` in production)
