# Holistica V23 — cPanel / Passenger deployment

## Before starting
- Confirm **Setup Python App** or **Application Manager** is enabled by the host, Python **3.12+** is available, and Passenger supports the domain root.
- Confirm MySQL database support, SSH/Terminal access, SSL certificates, and email SMTP.
- Django Channels/WebSockets are **not** served by Passenger WSGI. Do not advertise live chat/video as tested until separately deployed and verified. In-memory channels cannot share messages between processes.
- Make a full backup of the database, uploads, and private configuration. Do not overwrite a live database.

## Setup
1. Point the domain DNS A record to your hosting server's IP and issue SSL for telehealthscare.com and www.telehealthscare.com.
2. cPanel → **Setup Python App** → Create application. Use a Python 3.12+ version compatible with installed dependencies, root `holistica_app`, URL `telehealthscare.com/`, startup file `passenger_wsgi.py`, entry point `application`. If unavailable, ask host to enable Passenger / Python Selector.
3. Extract the contents of `HOLISTICA_V14` into `/home/YOUR_CPANEL_USERNAME/holistica_app/` (not `public_html`). `manage.py` and `passenger_wsgi.py` must be at the root.
4. Copy `.env.production.example` to `.env` in the application root. Replace placeholders. Keep `.env` private (chmod 600 when supported). Do not upload the example as an active `.env`.
5. Create a MySQL database/user using cPanel and grant privileges. Set DB_NAME, DB_USER, DB_PASSWORD. Existing SQLite data does NOT migrate to MySQL automatically; plan an explicit data migration if preserving local records.
6. Activate the virtualenv using the exact command shown in cPanel's Python App panel, then run:

```bash
cd ~/holistica_app
python -m pip install -r requirements-cpanel.txt
python manage.py check --deploy
python manage.py migrate --noinput
python manage.py collectstatic --noinput
```

7. Configure static URL `/static/` to serve `~/holistica_app/staticfiles` (WhiteNoise serves static assets through WSGI when configured correctly). Uploaded media `/media/` requires a **separate protected serving strategy**. Never expose clinical EMR documents or patient uploads as public files. Test all images and CSS.
8. Restart in cPanel Setup Python App or run `mkdir -p tmp && touch tmp/restart.txt` from the application root.
9. Verify public pages, staff login, owner/staff permissions, forms, slot creation, booking, payments, email, media authorization, and audit logs. Test HTTP→HTTPS after enabling SSL redirect.
10. Once HTTPS is confirmed and reverse-proxy headers are correct, set `DJANGO_SECURE_SSL_REDIRECT=1`, and cautiously enable HSTS (`DJANGO_SECURE_HSTS_SECONDS=300` to start). Avoid redirect loops; use `DJANGO_TRUST_PROXY_HTTPS=1` only if the host confirms the forwarded-proto header is trusted.

## Production limitations / release blockers
- `DEBUG=False` and a unique `DJANGO_SECRET_KEY` are mandatory.
- `requirements.txt` includes Daphne/Channels/Redis; these do not make WebSockets work through WSGI Passenger. An ASGI host is required for WebSocket-dependent features.
- Healthcare patient records, uploads, permissions, backups, privacy notices, payment callbacks, and appointment race conditions require real end-to-end security testing before patient use.
- MySQL driver installation may fail on some shared hosts; ask the host for compatible Python/MySQL client libraries.
- Do not copy `db.sqlite3` into public_html or treat SQLite as a safe shared-hosting production default.
- Don't run `runserver` in production.