# Regantis SMS — Phase 0 + Phase 1 deployment

Replace every `CPANEL_USER` placeholder with the actual cPanel account user before running commands.

## 1. WHM/cPanel prerequisites

Create the subdomain `sms.regantis.technology` in the existing cPanel account and let AutoSSL issue its certificate.

Confirm Node 22:

```bash
/opt/cpanel/ea-nodejs22/bin/node -v
/opt/cpanel/ea-nodejs22/bin/npm -v
```

If the first path is missing, install `ea-nodejs22` from EasyApache 4.

Confirm required Apache modules:

```bash
httpd -M | egrep 'proxy_module|proxy_http_module|headers_module'
```

Apache 2.4.47+ can proxy WebSocket upgrades through `mod_proxy_http` using `upgrade=websocket`.

## 2. Redis

First check whether Redis already exists:

```bash
redis-server --version
redis-cli ping
```

If not installed, install a server package suitable for CloudLinux 9, then enable it:

```bash
dnf install -y redis
systemctl enable --now redis
redis-cli ping
```

Expected:

```text
PONG
```

Merge the values from `ops/redis.conf.snippet` into the active Redis config. In particular, bind Redis only to loopback and keep protected mode enabled. Set `maxmemory-policy noeviction`;  BullMQ requires this for correct queue behavior. AOF with `appendfsync everysec` is recommended for smoother queue recovery, although MariaDB remains authoritative. Create a dedicated ACL user using the example in `ops/redis-regantis-sms.acl.example`, then reload/restart Redis.

Verify using the new user:

```bash
redis-cli --user regantis_sms --pass 'YOUR_REDIS_PASSWORD' ping
```

## 3. MariaDB database

In cPanel → MySQL Databases create:

```text
Database: CPANEL_USER_regantis_sms
User:     CPANEL_USER_sms
```

Give that user ALL PRIVILEGES on only the SMS database.

Use a long unique password.

## 4. Upload application

Upload this package to the cPanel account and place the server at:

```text
/home/CPANEL_USER/sms_server
```

The public document root is not used for Node source.

As the cPanel user:

```bash
cd /home/CPANEL_USER/sms_server
cp config/local.example.js config/local.js
chmod 600 config/local.js
```

Edit `config/local.js` with the real MariaDB and Redis credentials.

## 5. Install Node dependencies

Run as the cPanel user:

```bash
cd /home/CPANEL_USER/sms_server
/opt/cpanel/ea-nodejs22/bin/npm install --omit=dev
/opt/cpanel/ea-nodejs22/bin/npm run check
# Keep the generated package-lock.json in the project after this first install.
/opt/cpanel/ea-nodejs22/bin/npm test
```

## 6. Apply schema

```bash
cd /home/CPANEL_USER/sms_server
/opt/cpanel/ea-nodejs22/bin/npm run migrate
/opt/cpanel/ea-nodejs22/bin/npm run migration:status
```

Expected final status:

```json
{
  "pending": [],
  "changed": [],
  "ready": true
}
```

Never edit an already-applied migration. Add a new numbered migration instead.

## 7. Create initial administrator

Use a strong password with shell history disabled for this one command, or remove the command from shell history immediately afterward.

```bash
cd /home/CPANEL_USER/sms_server
/opt/cpanel/ea-nodejs22/bin/npm run admin:create -- \
  --email 'YOUR_ADMIN_EMAIL' \
  --name 'Regantis Admin' \
  --password 'YOUR_LONG_RANDOM_PASSWORD'
```

## 8. Create the initial test client and API key

```bash
/opt/cpanel/ea-nodejs22/bin/npm run client:create -- \
  --code regantis-test \
  --name 'Regantis Test'

/opt/cpanel/ea-nodejs22/bin/npm run api-key:create -- \
  --client-code regantis-test \
  --name 'Initial test key'
```

Copy the returned API key immediately. Only its SHA-256 hash is stored.

## 9. Test Node directly before Apache

```bash
cd /home/CPANEL_USER/sms_server
/opt/cpanel/ea-nodejs22/bin/node app.js
```

In another shell:

```bash
curl -sS http://127.0.0.1:3100/health/live
curl -sS http://127.0.0.1:3100/health/ready
```

Both must succeed; `/health/ready` must show DB, Redis and migrations all `ok: true`.

Stop the manual process after the test.

## 10. Install persistent systemd service

As root:

```bash
cp /home/CPANEL_USER/sms_server/ops/systemd/regantis-sms.service /etc/systemd/system/regantis-sms.service
sed -i 's/CPANEL_USER/ACTUAL_CPANEL_USER/g' /etc/systemd/system/regantis-sms.service
systemctl daemon-reload
systemctl enable --now regantis-sms
systemctl status regantis-sms --no-pager
```

Verify:

```bash
curl -sS http://127.0.0.1:3100/health/ready
journalctl -u regantis-sms -n 100 --no-pager
```

## 11. Add the cPanel Apache vhost include

Do not edit generated `httpd.conf` directly.

As root:

```bash
mkdir -p /etc/apache2/conf.d/userdata/ssl/2_4/CPANEL_USER/sms.regantis.technology
cp /home/CPANEL_USER/sms_server/ops/apache/sms.regantis.technology.conf \
  /etc/apache2/conf.d/userdata/ssl/2_4/CPANEL_USER/sms.regantis.technology/regantis-sms.conf
chmod 600 /etc/apache2/conf.d/userdata/ssl/2_4/CPANEL_USER/sms.regantis.technology/regantis-sms.conf
chown root:root /etc/apache2/conf.d/userdata/ssl/2_4/CPANEL_USER/sms.regantis.technology/regantis-sms.conf

/usr/local/cpanel/scripts/rebuildhttpdconf
apachectl configtest
/usr/local/cpanel/scripts/restartsrv_httpd
```

At this stage only the SSL vhost is proxied. Keep normal cPanel HTTP→HTTPS redirect enabled for the subdomain.

## 12. Public acceptance test

```bash
curl -i https://sms.regantis.technology/health/live
curl -i https://sms.regantis.technology/health/ready
```

Expected:

```text
HTTP/2 200
```

Readiness body must contain:

```json
"database":{"ok":true}
"redis":{"ok":true}
"migrations":{"ok":true}
```

Test API-key authentication:

```bash
curl -sS \
  -H 'Authorization: Bearer sms_live_REPLACE_WITH_KEY' \
  https://sms.regantis.technology/api/v1/auth/check
```

## 13. Admin authentication API smoke test

Login:

```bash
curl -i -c /tmp/regantis-sms-cookie.txt \
  -H 'Content-Type: application/json' \
  -d '{"email":"YOUR_ADMIN_EMAIL","password":"YOUR_PASSWORD"}' \
  https://sms.regantis.technology/admin/api/v1/auth/login
```

Login is throttled to 10 attempts per IP+email in 15 minutes. The response returns a short-lived CSRF token and an HTTP-only secure session cookie. The React admin built in Phase 2 will keep the CSRF token in memory.

## 14. Security checks before continuing

```bash
ss -lntp | egrep ':3100|:6379|:3306'
```

Required topology:

```text
Node  : 127.0.0.1:3100
Redis : 127.0.0.1:6379
MariaDB: local/private only according to existing cPanel configuration
Public: 80/443 only
```

Also verify:

```bash
curl -I http://sms.regantis.technology/health/live
```

It should redirect to HTTPS.

## 15. Phase 0 + 1 exit criteria

Do not start Android yet until all are true:

```text
https://sms.regantis.technology/health/live  -> 200
https://sms.regantis.technology/health/ready -> 200
DB migration status ready=true
Redis authenticated PING works
systemd service survives restart
Apache reverse proxy works
admin login API works
client API key auth works
Node port is not public
Redis port is not public
```

The next implementation is Phase 2: standalone admin frontend and CRUD for one provider/account/SIM/gateway/route.