# Production Deployment Checklist

1. Provision PHP-FPM 8.1+ with `mbstring`, `intl`, `mysqli`, `curl`, `openssl`, `fileinfo`, XML and OPcache.
2. Provision MySQL 8+ with a dedicated least-privilege application user.
3. Set the virtual-host/web-server root to the project `public/` directory.
4. Copy `.env.example` to `.env`, set production values and restrict file permissions.
5. Run `composer install --no-dev --optimize-autoloader`.
6. Run `npm install && npm run css:build`; deploy the compiled Tailwind file.
7. Run `php spark migrate`.
8. Do **not** seed demo users on production; create the first admin through a controlled deployment/admin bootstrap process.
9. Configure cron/scheduler for `tibaleta:dispatch` and `tibaleta:maintenance`.
10. Configure SMTP, maps, payment, video and partner credentials as required.
11. Configure TLS, HSTS, reverse proxy trusted IPs, centralized logs and error monitoring.
12. Configure encrypted database/file backups and test restore procedures.
13. Configure WAF/rate controls at the edge in addition to application rate limits.
14. Run security, privacy and clinical-governance reviews before serving real patients.

## Suggested Nginx shape

```nginx
server {
    listen 443 ssl http2;
    server_name example.com;
    root /var/www/tibaleta/public;
    index index.php;

    location / { try_files $uri $uri/ /index.php?$query_string; }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }
    location ~ /\. { deny all; }
}
```

Adjust the PHP socket/version and proxy headers to your infrastructure.
