# Deploying MIS-CODING to cPanel shared hosting

One Node.js app serves the whole platform: the website plus the API at `/sfapi`.

## Before you start: what the host must have

- cPanel with **Setup Node.js App** (Phusion Passenger) and **Node.js 18.18 or newer** (20 or 22 recommended).
- MySQL or MariaDB with phpMyAdmin.
- HTTPS (AutoSSL / Let's Encrypt) on the domain.
- Outbound HTTPS from the server to `*.epicorsaas.com`.

If the plan only offers PHP (there is no "Setup Node.js App" icon), this platform **will not run**. In that case use a VPS or a Node-capable host instead (for example a cPanel plan that includes Node.js, a small VPS, Render, or Railway).

## 1. Create the database

1. Go to cPanel > **MySQL Databases**.
2. Create a database (for example `cpuser_EPC`).
3. Create a user with a strong password.
4. Add the user to the database with **ALL PRIVILEGES**.
5. Open **phpMyAdmin**, select the new database, then go to **Import** and choose `database/EPC.sql` from the zip. Leave the defaults and click Go.

## 2. Upload the files

1. In **File Manager**, create a folder outside `public_html` (for example `/home/cpuser/mis-coding`).
2. Upload `MIS-CODING-platform.zip` into it and **Extract** it there.
3. You should now see `app.js`, `package.json`, `api/`, `web/`, `data/`, and `database/`.

## 3. Create the Node.js app

Go to cPanel > **Setup Node.js App** > **Create Application** and enter:

| Field | Value |
|---|---|
| Node.js version | 20.x or 22.x (minimum 18.18) |
| Application mode | Production |
| Application root | `mis-coding` (the folder from step 2) |
| Application URL | your domain or subdomain |
| Application startup file | `app.js` |

Under **Environment variables**, add every key from `.env.example` with real values. Alternatively, copy `.env.example` to `.env` in the app folder and fill it in. The keys you must fill in:

- `EPICOR_USER`, `EPICOR_PASSWORD`, `EPICOR_API_KEY`. Keep `EPICOR_BASE_URL` on the PILOT URL until go-live.
- `DB_HOST` (usually `localhost`), `DB_USER`, `DB_PASSWORD`, and `DB_NAME`. Use the prefixed names from step 1.
- `JWT_SECRET`: a long random string of 64 or more characters.
- `NEXTAUTH_URL`: the site URL, for example `https://shopfloor.example.com`.
- `NEXTAUTH_SECRET`: any long random string.
- `COOKIE_SECURE`: `true` on HTTPS. On plain `http://` the browser drops secure cookies and sign-in will loop, so set it to `false` there.

Click **Create**.

## 4. Install the dependencies and start

1. On the app page, click **Run NPM Install**. Alternatively, copy the "Enter to the virtual environment" command into cPanel **Terminal** and run `npm install --omit=dev`.
2. Click **Restart**.
3. Open the site. The sign-in page should load, and `https://your-domain/sfapi/health` should return `{"ok":true,"pilot":true}`.

## 5. First sign-in

- The database comes with the users and roles from the local system. The built-in administrator is **admin / Admin@123** unless you changed it locally. **Change this password immediately** under Admin > Users.
- If you ever change `JWT_SECRET`, every user is signed out. That is expected.

## Notes

- Uploaded avatars and audit logs are stored in `data/`. Include this folder in your backups along with the database.
- After changing an environment variable or replacing files, click **Restart** in Setup Node.js App.
- Errors are written to the app's `stderr.log` (in the app root) or shown on the Setup Node.js App page.
- The website itself does not need `public_html`. Passenger serves the app at the Application URL.