# ACS Diagnose — cPanel Deployment Checklist

The current package is suitable for staging preparation, not for receiving real customer
diagnostic data until the production identity, database and encryption adapters are complete.

## Hosting structure

Create a separate cPanel Node.js 22 application:

```text
Application root: /home/<user>/acs-diagnose-api
Application URL:  https://api.ammancarservices.com
Startup file:     backend/server.mjs
```

Create a private directory outside `public_html`:

```text
/home/<user>/acs-diagnose-private/uploads
```

Do not upload `.env`, `backend/data`, `backend/private`, customer scans or photographs through
the website's public folder.

## Before first staging start

1. Upload and extract `backend/deploy/acs-diagnose-api.tar.gz` into the separate application root.
2. Confirm Node.js 22 and force HTTPS on the API subdomain.
3. Add a long random `TOKEN_SECRET`; never reuse website, FTP or Zoho credentials.
4. Set `NODE_ENV=production`, the private upload path, size limits and allowed website origin.
5. Create a dedicated MariaDB database/user and apply `backend/migrations/001_initial_mysql.sql`.
6. Install/enable the production MariaDB repository before accepting customer traffic.
7. Add application-layer field-encryption and lookup-HMAC keys.
8. Configure the selected OTP token verifier and carrier-test Bahrain delivery.
9. Add the OpenAI key/model only after the structured-output adapter and eval gate pass.
10. Configure a five-minute worker cron and log rotation.
11. Verify backups restore both database records and private files.
12. Run health, ownership, idempotency, staff-audit and deletion checks against staging.

## WhatsApp

No WhatsApp credentials are needed. The API returns a URL to
`https://wa.me/97339680866` with a minimal prefilled message. The customer sends the message
from their device. Do not configure a WhatsApp webhook or access token for the MVP.

## FTP status

No FTP host, username or reusable deployment configuration exists in this workspace. The
website's existing Zoho configuration is unrelated and cannot provide FTP access. Deployment
can proceed when separate FTP/SFTP or cPanel file access to the API application directory is
provided.

Prefer SFTP or cPanel's file manager over unencrypted FTP. Restrict the account to the ACS
Diagnose application directory if the host supports it.