# EdumacFlo Multi-Tenant SaaS — Production Deployment Checklist

Complete this checklist prior to launching your multi-tenant SaaS platform in production.

---

## 1. Master Database Setup (`edumacflo_master`)

- [ ] Import control plane schema from `database/saas_master.sql`:
  ```bash
  mysql -u root -p < database/saas_master.sql
  ```
- [ ] Change the default Super-Admin password in `saas_admins` (default: `superadmin` / `admin123`):
  ```sql
  UPDATE edumacflo_master.saas_admins 
  SET password_hash = '$2y$10$YourNewBcryptHashHere', email = 'superadmin@yourdomain.com' 
  WHERE id = 1;
  ```
- [ ] Verify that table `saas_migration_logs` and `saas_cron_logs` exist.

---

## 2. Configuration & Secrets Hardening

- [ ] Copy `saas_master_config.sample.php` to `saas_master_config.php` at the project root.
- [ ] Configure database connection credentials (`host`, `username`, `password`, `dbname`).
- [ ] Configure Payment Gateway credentials:
  - Paystack live secret key & public key (`sk_live_...`, `pk_live_...`).
  - Toggle `payment_simulation => false` for live billing.
- [ ] Update Bank Wire details with your official corporate bank account.
- [ ] Verify that `saas_master_config.php` has permissions `0600` or `0640` and is not publicly accessible via HTTP.

---

## 3. Web Server & Wildcard DNS Configuration

- [ ] Add Wildcard DNS Record at your domain registrar / Cloudflare:
  - **Type**: `A`
  - **Name**: `*`
  - **Value**: `Your Server Public IP`
- [ ] Install Web Server VirtualHost:
  - **Apache**: Copy `deploy/apache/vhost.conf` to `/etc/apache2/sites-available/edumacflo.conf` and run `a2ensite edumacflo && systemctl reload apache2`.
  - **Nginx**: Copy `deploy/nginx/edumacflo_saas.conf` to `/etc/nginx/sites-available/edumacflo.conf` and symlink to `sites-enabled/`.
- [ ] Issue Wildcard SSL Certificate using Certbot with DNS-01 Challenge:
  ```bash
  certbot certonly --manual --preferred-challenges=dns \
    -d edumacflo.com -d *.edumacflo.com
  ```

---

## 4. File Permissions & Directory Security

- [ ] Ensure PHP process owns writable directories:
  ```bash
  chown -R www-data:www-data uploads/
  chown -R www-data:www-data public/cache/
  ```
- [ ] Verify permissions:
  - Directories: `find . -type d -exec chmod 755 {} \;`
  - Files: `find . -type f -exec chmod 644 {} \;`
- [ ] Verify `.htaccess` exists and prevents directory listing and direct PHP execution in:
  - `public/cache/tenants/.htaccess`
  - `uploads/tenants/.htaccess`
  - `uploads/tenants/*/backups/.htaccess`

---

## 5. Automated Background Operations (Cron Setup)

- [ ] Configure server cron to run every 15 minutes:
  - **Linux (`crontab -e`)**:
    ```text
    */15 * * * * /usr/bin/php /var/www/edumacflo/cron/tenant_cron_runner.php >/dev/null 2>&1
    ```
  - **Windows (PowerShell)**:
    ```powershell
    schtasks /create /tn "EdumacFlo_SaaS_Cron" /tr "php.exe C:\path\to\cron\tenant_cron_runner.php" /sc minute /mo 15 /ru "SYSTEM"
    ```
- [ ] Verify initial execution by running manually:
  ```bash
  php cron/tenant_cron_runner.php
  ```

---

## 6. Seed Migration Verification Across All Tenants

- [ ] Run migration status check:
  ```bash
  php saas/migrate_tenants.php --status
  ```
- [ ] Apply all pending migrations:
  ```bash
  php saas/migrate_tenants.php
  ```

---

## 7. Disaster Recovery & Snapshot Backups

- [ ] Confirm automated snapshots are generated in `uploads/tenants/{slug}/backups/`.
- [ ] Configure off-site backup (e.g. AWS S3 / rsync / Backblaze) for `uploads/tenants/` and `edumacflo_master`.
- [ ] Test restoring a single tenant database from a `.sql` snapshot file to verify data integrity.

---

## 🎉 Launch Sign-Off

When all items above are checked, your EdumacFlo Multi-Tenant SaaS platform is ready for production onboarding of schools!
