# cPanel configuration

Use an isolated test subdomain first. PHP 8.1+ (prefer a currently supported newer version), MySQL 8.0.16+, and pdo_mysql, curl, sodium and fileinfo extensions are required. This project has not yet passed PHP/MySQL integration or payment testing.

## Directory layout

Preferred: keep the complete project under `/home/CPANELUSER/referral-platform/` and set the test subdomain's document root to `/home/CPANELUSER/referral-platform/public` if your host allows it.

For a domain whose document root is fixed at `/home/CPANELUSER/public_html`, copy only the CONTENTS of `public/` into public_html. Keep app/, database/, storage/ and docs outside public_html. The existing entrypoints require app/ as a sibling of the web directory, so with this layout place app/ at `/home/CPANELUSER/app/`. The storage default becomes `/home/CPANELUSER/storage/course-pdfs/`. Do not mix this with an existing unrelated app/ folder. Never upload the entire project into public_html. If the host restricts all files to public_html, ask the host to configure a safe document root/private storage layout before proceeding.

## Database and configuration

Create a MySQL database and a separate user through Database Wizard, assign that user privileges on that database only, and import database/full-database.sql into the NEW EMPTY database. Do not also import the three component SQL files.

Copy app/config.example.php to app/config.local.php. Replace the DB_DSN database name, DB_USER and DB_PASSWORD with the exact cPanel-prefixed values. Set APP_URL to the HTTPS domain origin (no subfolder/path or trailing slash). Values are PHP single-quoted strings: escape an apostrophe as \' and a backslash as \\ when entering passwords. Do not share the file, passwords, or encryption key.

Use the cPanel Terminal to generate a master key: `php -r "echo base64_encode(random_bytes(32)), PHP_EOL;"`. Put the resulting value into GATEWAY_MASTER_KEY. Keep it stable and backed up privately. If Terminal is unavailable, ask hosting support to generate the key securely; do not create a public key-generator PHP page. Use permissions 0600 on config.local.php where supported and 0700 on private course storage, owned by the PHP account. Verify your host's PHP execution user before changing permissions.

Enable SSL and force HTTPS. Adjust upload_max_filesize to 20M and post_max_size to 24M or larger, plus the web-server request limit. Register your own account, then promote only its verified row in phpMyAdmin by changing role from user to admin. Never use a shared/default admin password.

Sign in again, then Admin → Payment gateway. Enter the base URL https://newlink.click/api/v1, gateway username and API key. Keep payments disabled until staging checks pass. Configure course plan prices, commissions and PDFs. Select/publish plans only when ready. Existing orders retain original gateway configuration; changing a URL to another host requires updating the server host allowlists too.

## Required before public launch

Verify schema import, sign-in/sign-out, admin isolation, successful/pending/failed payments, duplicate callbacks, exact amounts/order IDs, PDF view/download authorization and multi-level entries on the staging host. Implement and verify pending commission release, wallet/withdrawals, refund reversal, reconciliation, admin MFA and backups before a full earning-system launch. Automatic activation currently needs a return/status visit; unattended settlement requires reconciliation/webhook support. Consult GATEWAY-SETUP.md for payment limitations.