# BCOS First-Launch Installation and Hosting Guide

## What you need
You do not need to buy `portal.baffoes.com` separately. It is a subdomain of `baffoes.com`. Your hosting plan must permit a subdomain, PHP 8.2+, MySQL/MariaDB, cron jobs, HTTPS and sufficient private storage. Create the subdomain in cPanel or point it through Cloudflare to the hosting account.

## Mac preparation
1. In Finder create `Documents/BCOS/01-Archives`, `02-Release`, `03-Backups`, and `04-Deployment`.
2. Keep every sprint ZIP in `01-Archives`. Do not merge them manually. Sprint 25 is cumulative.
3. Put only the Sprint 25 ZIP and checksum in `02-Release`.
4. In Terminal verify: `shasum -a 256 BCOS_FIRST_LAUNCH_1.0.0-RC1.zip`.
5. Unzip with Finder or `unzip BCOS_FIRST_LAUNCH_1.0.0-RC1.zip -d BCOS-FIRST-LAUNCH`.

## Hosting preparation
1. Back up the WordPress website and its database.
2. In cPanel create subdomain `portal.baffoes.com` with a document root separate from WordPress, for example `/home/ACCOUNT/bcos/public`.
3. Create a MySQL database and a database user with privileges only on that database.
4. Enable AutoSSL. Confirm `https://portal.baffoes.com` loads before application upload.
5. Upload the release outside `public_html` where possible. Point the subdomain document root to the package `public` folder.
6. Never place `.env`, `storage/private`, backups or database dumps in the public document root.

## Installation
1. Copy `.env.production.example` to `.env` and enter production values.
2. Generate APP_KEY on Mac: `openssl rand -base64 48`.
3. Run `php tools/release_preflight.php`.
4. Run `php tools/install_database.php` once. It records checksums and refuses changed applied SQL.
5. Run `php tools/create_first_admin.php "Benjamin Baffoe" your-email@example.com`.
6. Configure MFA at first login.
7. Configure SMTP and test from staging.
8. Configure ClamAV. Keep uploads quarantined until scanning returns CLEAN.
9. Configure cron for email, scheduler, health and backup tools.

## Cloudflare
1. Add an `A` or `CNAME` record for `portal` to the hosting origin.
2. Start with proxy disabled until origin HTTPS works, then enable the orange-cloud proxy.
3. Set SSL/TLS to Full (strict), never Flexible.
4. Enable Always Use HTTPS, Brotli and appropriate WAF rules.
5. Do not cache `/api/*`, login, authenticated pages or file downloads.
6. Test real visitor IP handling through Cloudflare.

## Staging before production
Use a staging database and URL first. Complete every UAT, security, authorization, backup/restore and mobile checklist. Production launch requires explicit owner approval.

## Launch
1. Create a verified database and file backup.
2. Enable maintenance mode.
3. Upload the approved release and production `.env`.
4. Run migration installer.
5. Run readiness check and browser smoke tests.
6. Disable maintenance only after sign-off.
7. Monitor logs, email queue, storage, security events and backups for 72 hours.