Production Deployment & Hosting Guide¶

Comprehensive production guide for packaging, deploying, and hardening TidyFactor-Go on WHM/cPanel, VPS (AlmaLinux/Ubuntu), Shared Hosting, and Subfolder environments.

1. Target Environment & Server Prerequisites¶

TidyFactor-Go requires zero complex external service dependencies and is 100% self-contained.

Software Stack Requirements¶

Web Server: Apache 2.4+ / Nginx / LiteSpeed (LSAPI)
PHP Version: PHP 8.2 or PHP 8.3 (PHP >= 8.1 minimum)
Database Engine: SQLite 3 (built-in via PDO extension)

Required PHP Extensions¶

pdo_sqlite: SQLite database connectivity
mbstring: Multi-byte string handling for Arabic RTL and Unicode
openssl: Secure TLS/SSL communication
curl: Communication with external APIs
zip: Archive extraction during setup wizard installation
json: Native JSON decoding/encoding
session: Administrator session management

MultiPHP INI Recommendations¶

upload_max_filesize = 20M
post_max_size = 20M
memory_limit = 256M
expose_php = Off
session.cookie_secure = On
session.cookie_httponly = On
session.cookie_samesite = Strict

2. Release Packaging Pipeline¶

To package a ready-to-deploy ZIP archive for production:

Verify TypeScript Declarations:
```
npm run lint
```
Build Production Assets:
```
npm run build
```

Install Backend Dependencies:

cd backend/cms-api
composer install --no-dev --optimize-autoloader
cd ../..

Execute Packaging Script:
```
node package-release.js
```
This generates a clean production archive under dist-release/ (e.g. tidyfactor-go-v1.6.0.zip).

3. Automated Web Setup Wizard Installation¶

TidyFactor-Go features an automated setup wizard (/install/index.php):

Upload & Extract: Upload tidyfactor-go-v1.6.0.zip to your target directory (root public_html/ or a subfolder like public_html/demos/TidyFactor-Go/) and extract it.
Launch Setup Wizard: Navigate to https://yourdomain.com/install/ in your browser.
System Health Check: The wizard automatically verifies PHP version, required extensions, write permissions, and SQLite support.
Configuration Form: Enter your Brand Name, Admin Password, and optional Gemini AI API Key.
Initialization & Lock: The installer populates database.sqlite from database-baseline.sqlite, sets up admin credentials, and creates install.lock to permanently secure the setup process.

[!IMPORTANT] For production security, delete the /install directory from your server immediately after completing installation.

4. Web Server Rewrite Rules (.htaccess)¶

Root `.htaccess` (React Router SPA & Security Headers)¶

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # 1. Enforce HTTPS
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # 2. Subfolder Bypass Rules
  RewriteRule ^(agency|demos|TidyFactor)($|/.*) - [L]

  # 3. Ignore /api from React Router rewrites
  RewriteRule ^api/ - [L]

  # 4. Serve existing files/directories directly
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # 5. Fallback all other requests to index.html
  RewriteRule ^ index.html [L]
</IfModule>

# Security Hardening
Options -Indexes
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-XSS-Protection "1; mode=block"
Header set Referrer-Policy "no-referrer-when-downgrade"

Backend API `.htaccess` (`backend/cms-api/public/.htaccess`)¶

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /api/

  RewriteCond %{REQUEST_FILENAME} -f
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  RewriteRule ^(.*)$ index.php [QSA,L]
</IfModule>

5. File Permissions & Security Hardening Matrix¶

Path	Recommended Permission	Explanation
`public_html/`	`0755`	Standard web root directory
`public_html/index.html`	`0644`	Public HTML entry point
`backend/cms-api/`	`0750`	Private PHP backend folder
`backend/cms-api/storage/`	`0770`	SQLite database directory (Requires write access)
`public_html/uploads/`	`0775`	User uploaded media directory

Hardening Console Commands¶

find /home/username/public_html -type d -exec chmod 755 {} \;
find /home/username/public_html -type f -exec chmod 644 {} \;
chmod -R 770 /home/username/public_html/backend/cms-api/storage
chmod -R 775 /home/username/public_html/uploads

6. Post-Deployment Verification Checklist¶

SSL Certificate: Verify HTTPS padlock is active on https://yourdomain.com.
API Health Endpoint: Confirm https://yourdomain.com/api/health returns {"status":"ok"}.
SPA Navigation: Navigate to /pricing, /about, /content and refresh the page to verify deep path subfolder routing.
Admin Authentication: Log into /admin using your configured password.
CMS Update Test: Make a draft edit in Admin, save, and verify instant site update.
Contact Lead Test: Submit a contact form lead and verify reception in Admin Inbox.