# EXOLINK SMP/MTs — Shared Hosting deployment

## Recommended filesystem
Keep the application outside the public document root, for example:
`/home/klit5889/apps/exolink-smp/`

Set a cPanel subdomain/document root (example `smp.viramedia.id`) to:
`/home/klit5889/apps/exolink-smp/web`

Do not expose the application root (`src`, `public`, `prompts`, `storage`, `database`, `config.php`) as the domain document root.

## Database
Database: `klit5889_exolinksmp`
User: `klit5889_exolinksmp`
Import: `database/INSTALL_MARIADB_11_4.sql`

## Config before first live request
Edit `config.php`:
- replace `CHANGE_ME_DATABASE_PASSWORD`
- replace `CHANGE_ME_WITH_LONG_RANDOM_SECRET_BEFORE_GO_LIVE` with a long random secret
- keep `demo_mode=false`
- keep AI `enabled=false` until separate API validation

## Permissions
Directories must be readable by PHP. `storage/uploads` and `storage/ocr` must be writable by the PHP process/account. Prefer 0755/0775 according to the hosting account model; do not use 0777 unless the host explicitly requires it.

## URLs when `web/` is document root
- `/smp/sekolah/`
- `/smp/keluarga/`
- `/smp/dtw/`

## Go-live order
1. Import database installer successfully.
2. Configure `config.php`.
3. Set domain/subdomain document root to `web/`.
4. Confirm HTTPS.
5. Test each portal login and role isolation.
6. Test one CRUD workflow, one evidence import, one report, and one upload.
7. Take a DB backup and verify restore on staging/temporary database.
8. Enable AI only after its own API/configuration gate passes.