# AIA Production Setup (RHEL/Rocky/AlmaLinux 9)

Production deployment on your VPS with AlmaLinux 9, php-fpm, MariaDB, Redis, firewalld, SELinux enforcing.

## Prerequisites

```bash
sudo dnf install -y epel-release
sudo dnf install -y \
  php-fpm php-mysqlnd php-mbstring php-xml php-bcmath \
  php-intl php-zip php-redis php-opcache php-json \
  mariadb-server mariadb \
  redis \
  nginx certbot python3-certbot-nginx \
  git unzip
```

Install Composer:
```bash
curl -sS https://getcomposer.org/installer | php
sudo mv composer.phar /usr/local/bin/composer
```

## Deploy AIA

```bash
sudo mkdir -p /var/www/aia
sudo chown $USER:$USER /var/www/aia
cd /var/www/aia
git clone <your-repo> .
composer install --no-dev --optimize-autoloader
cp .env.example .env
php artisan key:generate

# Edit .env for production
nano .env
# Set at minimum:
#   APP_ENV=production
#   APP_DEBUG=false
#   APP_URL=https://aia.yourdomain.tld
#   DB_PASSWORD=<real password>
#   CACHE_STORE=redis
#   SESSION_DRIVER=redis
#   QUEUE_CONNECTION=redis
#   AIA_ADMIN_* (for first-run bootstrap)
```

## Database

```bash
sudo systemctl enable --now mariadb
sudo mysql_secure_installation

sudo mysql -uroot -p <<SQL
CREATE DATABASE aia CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'aia'@'localhost' IDENTIFIED BY 'strong-password-here';
GRANT ALL PRIVILEGES ON aia.* TO 'aia'@'localhost';
FLUSH PRIVILEGES;
SQL

cd /var/www/aia
php artisan migrate --force --seed
```

## Permissions + SELinux

```bash
sudo chown -R nginx:nginx /var/www/aia
sudo find /var/www/aia -type f -exec chmod 644 {} \;
sudo find /var/www/aia -type d -exec chmod 755 {} \;
sudo chmod -R ug+rwx /var/www/aia/storage /var/www/aia/bootstrap/cache

# SELinux contexts
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/aia/storage(/.*)?"
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/aia/bootstrap/cache(/.*)?"
sudo restorecon -Rv /var/www/aia
sudo setsebool -P httpd_can_network_connect 1
```

## nginx

Create `/etc/nginx/conf.d/aia.conf`:

```nginx
server {
    listen 80;
    server_name aia.yourdomain.tld;
    root /var/www/aia/public;
    index index.php;

    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options SAMEORIGIN;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php-fpm/www.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\. { deny all; }
}
```

Then:
```bash
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d aia.yourdomain.tld
```

## Queue worker (systemd)

Create `/etc/systemd/system/aia-worker.service`:

```ini
[Unit]
Description=AIA Queue Worker
After=redis.service

[Service]
User=nginx
Group=nginx
Restart=always
ExecStart=/usr/bin/php /var/www/aia/artisan queue:work --sleep=3 --tries=3 --max-time=3600

[Install]
WantedBy=multi-user.target
```

```bash
sudo systemctl enable --now aia-worker
```

## Firewall

```bash
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
```

## Post-deploy checklist

- [ ] `curl https://aia.yourdomain.tld/health` returns `{"status":"ok"}`
- [ ] Log in with the bootstrap admin via `/api/auth/login`
- [ ] Remove `AIA_ADMIN_*` from `.env` after first successful login
- [ ] Set up daily backups of MariaDB
- [ ] Set up log rotation for `/var/www/aia/storage/logs/`
- [ ] Add monitoring (e.g. UptimeRobot pinging `/health`)