# Deploying the Inquiry API to cPanel (Phusion Passenger)

This app is designed for cPanel's **Setup Node.js App** feature. The startup
file is `app.js` at the project root.

## 1. Get the code onto the server

Upload the project folder (everything except `node_modules`, `.env`, and
`data/*.jsonl` — those are created on the server) to a directory **outside**
your public_html web root, e.g.:

```
/home/<cpaneluser>/apps/fintech-builder-api
```

You can use Git (clone your repo) or the cPanel File Manager / FTP.

## 2. Create the Node.js app

cPanel → **Setup Node.js App** → **Create Application**:

| Field                      | Value                                           |
| -------------------------- | ----------------------------------------------- |
| Node.js version            | 18+ (20 or 22 recommended)                      |
| Application mode           | Production                                      |
| Application root           | `apps/fintech-builder-api`                      |
| Application URL            | e.g. `api.thefintechbuilder.com` (a subdomain)  |
| Application startup file   | `app.js`                                         |

Click **Create**. cPanel writes the Passenger directives into the Application
URL's document-root `.htaccess` automatically — you don't manage those.

## 2b. Create the MySQL database

cPanel → **MySQL Databases**:

1. Create a database, e.g. `tfb_admin`. cPanel prefixes it with your account
   name, so the real name becomes something like `cpaneluser_tfb_admin`.
2. Create a database user with a strong password.
3. **Add the user to the database** with *All Privileges*.

Use those exact prefixed names in `DB_NAME` / `DB_USER` below. There are no
migrations to run — with `DB_SYNC=true` the tables (`inquiries`, `comments`,
`reports`) are created automatically on first boot. Once the schema is settled
you can set `DB_SYNC=false`.

## 3. Environment variables

In the same screen, add the environment variables from `.env.example`. At
minimum:

- `NODE_ENV=production`
- `DB_HOST=127.0.0.1`, `DB_NAME`, `DB_USER`, `DB_PASSWORD` (the prefixed names
  from step 2b)
- `DB_SYNC=true` for the first boot
- `BREVO_API_KEY=…`
- `BREVO_SENDER_NAME`, `BREVO_SENDER_EMAIL` (a **verified** Brevo sender)
- `SALES_NOTIFY_EMAIL=islam.baraka.90@gmail.com`
- `CORS_ALLOWED_ORIGINS=https://thefintechbuilder.com,https://www.thefintechbuilder.com`
- `APP_URL=https://api.thefintechbuilder.com`

cPanel env vars override any committed `.env`.

## 4. Install dependencies

In the Node.js App panel, click **Run NPM Install** (or open the app's virtualenv
in Terminal and run `npm ci`/`npm install`).

## 5. Start / restart

Click **Restart**. Verify:

```
curl https://api.thefintechbuilder.com/api/health
```

You should get `{"ok":true,"data":{"status":"up","database":"up","emailConfigured":true,…}}`.
If `database` says `down`, check the DB credentials in step 3.

To restart after a code change, either click **Restart** in cPanel or run
`npm run cpanel:restart` (touches `tmp/restart.txt`, which Passenger watches).

## 6. Brevo sender + Authorised IPs

- The `BREVO_SENDER_EMAIL` must be a **verified sender / domain** in Brevo, or
  sends are rejected.
- If your Brevo account has **Security → Authorised IPs** enabled, add the
  cPanel server's outbound IP to the allowlist, otherwise sends fail with
  `401 unauthorized`. (Inquiries are still saved to `data/inquiries.jsonl` and
  the website falls back to `mailto:` in that case.)

## 7. Point the website at it

In the **website** project, set:

```
NEXT_PUBLIC_INQUIRY_API=https://api.thefintechbuilder.com/api/inquiries
```

then rebuild and redeploy the static export (`npm run deploy`). Submit the
consultation form once to confirm the owner notification and acknowledgement
emails arrive.

## Troubleshooting

- **502 / app won't boot:** check the app log in the Node.js App panel. Most
  often a missing env var or a failed `npm install`.
- **CORS error in the browser:** the site origin isn't in
  `CORS_ALLOWED_ORIGINS`. Add it exactly (scheme + host, no trailing slash).
- **`emailConfigured:false` in `/api/health`:** `BREVO_API_KEY` isn't set in the
  cPanel environment.
- **Leads not emailed but present in `data/inquiries.jsonl`:** Brevo rejected the
  send — check sender verification and Authorised IPs.