# GLETRA Deployment Guide

Production deployment for VPS, dedicated server, or cloud (AWS, DigitalOcean, Hetzner, etc.).

## Architecture

```
Browser (HTTPS)
    ├── Laravel (PHP-FPM + Nginx/Apache)
    ├── Laravel Reverb (WebSocket, port 8080)
    ├── Redis (cache + queue)
    ├── MySQL
    └── Queue worker (php artisan queue:work)
```

## Pre-deploy checklist

- [ ] SSL certificate installed (Let's Encrypt)
- [ ] MySQL database created
- [ ] Redis running
- [ ] Node.js 18+ for asset build (build step only)
- [ ] FFmpeg installed (optional, for video processing)
- [ ] Firewall: 80, 443 open; 8080 internal or proxied

## Deploy steps

```bash
cd /var/www/gletra
git pull origin main
composer install --no-dev --optimize-autoloader
npm ci && npm run build
php artisan migrate --force
php artisan config:cache
php artisan route:cache
php artisan view:cache
php artisan storage:link
```

Set permissions:

```bash
chown -R www-data:www-data storage bootstrap/cache
chmod -R 775 storage bootstrap/cache
```

## Nginx configuration

```nginx
server {
    listen 443 ssl http2;
    server_name your-domain.com;
    root /var/www/gletra/public;
    index index.php;

    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;

    client_max_body_size 512M;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Laravel Reverb WebSocket proxy
    location /app {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://127.0.0.1:8080;
    }
}
```

Set in `.env`:

```env
REVERB_HOST=your-domain.com
REVERB_PORT=443
REVERB_SCHEME=https
```

## Supervisor processes

`/etc/supervisor/conf.d/gletra.conf`:

```ini
[program:gletra-reverb]
command=php /var/www/gletra/artisan reverb:start
directory=/var/www/gletra
user=www-data
autostart=true
autorestart=true
redirect_stderr=true

[program:gletra-queue]
command=php /var/www/gletra/artisan queue:work redis --sleep=3 --tries=3 --max-time=3600
directory=/var/www/gletra
user=www-data
autostart=true
autorestart=true
redirect_stderr=true
```

```bash
supervisorctl reread && supervisorctl update
supervisorctl start gletra-reverb gletra-queue
```

## Cron

```cron
* * * * * cd /var/www/gletra && php artisan schedule:run >> /dev/null 2>&1
```

## Security hardening

- Set `APP_DEBUG=false` in production
- Use strong `APP_KEY`, Reverb secrets, and VAPID keys
- Enable rate limiting (built into routes)
- Keep `storage/` and `.env` outside web root (Laravel default)
- Run `composer audit` periodically

## Monitoring

- Admin panel: `/admin` — users, chats, calls, storage, analytics
- Logs: `storage/logs/laravel.log`
- Reverb: check Supervisor status
- Queue: monitor failed jobs with `php artisan queue:failed`

## Rollback

```bash
git checkout <previous-tag>
composer install --no-dev
npm ci && npm run build
php artisan migrate --force
php artisan config:cache
supervisorctl restart gletra-reverb gletra-queue
```