# Production Deployment & Infrastructure Guide

This document details the containerization architecture, production hosting on Render, Cloudflare R2 / AWS S3 storage, and operational runbooks for Eniceberny Bakery and Culinary Hub.

---

## 1. Production Architecture Overview

The production infrastructure is orchestrated via Docker containers running on Render PaaS backed by managed PostgreSQL:

```mermaid
graph TD
    subgraph Public Web Traffic
        DNS[Cloudflare / Custom Domain enicebakerygh.com] -->|HTTPS 443| LB[Render Load Balancer]
    end
    subgraph Container Services
        LB --> Web[eniceberny-web: Apache + PHP 8.4]
        Web -->|Dispatch Async Jobs| Queue[(Redis / Database Queue)]
        Queue --> Worker[eniceberny-worker: php artisan queue:work]
        Cron[eniceberny-scheduler: php artisan schedule:run] --> Web
    end
    subgraph Data & Storage
        Web --> DB[(Managed PostgreSQL 16)]
        Worker --> DB
        Web --> Storage[Cloudflare R2 / S3 Media Bucket]
    end
```

---

## 2. Multi-Stage Dockerfile Architecture

The production image is built using a clean two-stage Dockerfile to minimize attack surface and image size:

### Stage 1 — Node 20 Builder
- Base image: `node:20-alpine`.
- Copies `package.json`, `package-lock.json`, and installs production dependencies.
- Compiles frontend assets with Vite: `npm run build`.
- Outputs optimized bundles to `public/build/`.

### Stage 2 — PHP 8.4 Apache Runtime
- Base image: `php:8.4-apache`.
- Installs system libraries and compiled extensions: `pdo`, `pdo_pgsql`, `pgsql`, `mbstring`, `exif`, `pcntl`, `bcmath`, `gd` (with FreeType and JPEG support), `zip`, `opcache`.
- Configures Apache `mod_rewrite`, sets document root to `/var/www/html/public`, and enforces `AllowOverride All`.
- Injects Composer, installs production PHP dependencies (`composer install --no-dev --optimize-autoloader`).
- Copies compiled assets from Stage 1.
- Implements healthcheck probe targeting `/up`.

---

## 3. Infrastructure as Code (`render.yaml`)

The platform includes an automated Render blueprint (`render.yaml`) defining all components:

| Service Name | Type | Environment | Plan | Key Responsibilities |
| :--- | :--- | :--- | :--- | :--- |
| **`eniceberny-web`** | Web Service | Docker | Starter / Standard | Serves HTTP/HTTPS storefront, admin portal, POS counter, and API endpoints. Health check at `/up`. |
| **`eniceberny-worker`** | Background Worker | Docker | Starter | Processes asynchronous email dispatches (`OrderPlacedReceiptMail`, `VerifyEmailOtpMail`), PDF generation jobs. |
| **`eniceberny-scheduler`** | Cron Job | Docker | Free / Starter | Executes `php artisan schedule:run` every minute to process inventory alerts and cache purges. |
| **`eniceberny-db`** | Managed Database | PostgreSQL 16 | Starter | Relational storage with automated daily snapshots and encrypted storage. |

---

## 4. Environment Variables Directory

The following environment variables must be configured in production:

| Variable | Description | Recommended Setting |
| :--- | :--- | :--- |
| **`APP_ENV`** | Application environment mode | `production` |
| **`APP_DEBUG`** | Debug stack traces | `false` (Never set `true` in production) |
| **`APP_KEY`** | 32-character AES encryption key | Auto-generated via `php artisan key:generate` |
| **`APP_URL`** | Canonical application domain | `https://enicebakerygh.com` |
| **`DB_CONNECTION`** | Database driver | `pgsql` |
| **`DB_HOST`**, **`DB_DATABASE`**, **`DB_USERNAME`**, **`DB_PASSWORD`** | PostgreSQL credentials | Injected automatically from `eniceberny-db` |
| **`MEDIA_DISK`** | Storage driver for user uploads | `s3` (or `public` if using persistent disk) |
| **`AWS_ENDPOINT`** | Cloudflare R2 / S3 endpoint | `https://<account-id>.r2.cloudflarestorage.com` |
| **`AWS_BUCKET`** | Storage bucket name | `eniceberny-media-prod` |
| **`PAYSTACK_PUBLIC_KEY`** | Paystack public key | `pk_live_...` |
| **`PAYSTACK_SECRET_KEY`** | Paystack secret key | `sk_live_...` |
| **`MAIL_MAILER`** | Email driver | `smtp` |
| **`MAIL_HOST`**, **`MAIL_PORT`**, **`MAIL_USERNAME`**, **`MAIL_PASSWORD`** | SMTP credentials | Configured via SendGrid, Mailgun, or Postmark |

---

## 5. Post-Deployment Runbook

On initial launch or subsequent database schema updates:

1. **Execute Database Migrations**:
   ```bash
   php artisan migrate --force
   ```
2. **Seed Default Catalog & Operational Sample Data**:
   ```bash
   php artisan db:seed --class=DatabaseSeeder --force
   ```
3. **Verify Super Admin Access**:
   ```bash
   php artisan auth:ensure-admin
   ```
4. **Optimize Caches**:
   ```bash
   php artisan config:cache
   php artisan route:cache
   php artisan view:cache
   ```
5. **Verify Public Probes**:
   - Check `GET https://enicebakerygh.com/up` returns HTTP 200 OK.
   - Verify XML sitemap at `GET https://enicebakerygh.com/sitemap.xml`.
   - Verify robots rules at `GET https://enicebakerygh.com/robots.txt`.