# Realtime Ai Production Checklist

Use this checklist before putting the platform on a live domain.

## 1. Environment

Copy `server/.env.example` to `server/.env` and set real values. The app also accepts a root `.env`, but `server/.env` is recommended:

```env
NODE_ENV=production
PORT=4000
JWT_SECRET=use_a_long_random_secret_here
APP_URL=https://yourdomain.com
FRONTEND_URL=https://yourdomain.com
CORS_ORIGINS=https://yourdomain.com
SERVE_CLIENT=true
DECART_API_KEY=your_decart_key
DECART_BASE_URL=https://api.decart.ai
DECART_CREDIT_RATE_PER_SECOND=3.3333333333
ENABLE_SELF_HOSTED_AI=false
EXCHANGE_RATE_URL=https://open.er-api.com/v6/latest/USD
USD_NGN_FALLBACK_RATE=1600
NAIRA_PRICE_MARKUP=3000
DB_DRIVER=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_NAME=realtime
DB_USER=root
DB_PASSWORD=
# Use an absolute persistent path if deploys replace the application directory.
AI_TOOL_UPLOAD_DIR=/var/lib/realtime-ai/uploads
```

Do not commit `server/.env`, `server/data.json`, or `server/uploads`. They can contain API keys, SMTP credentials, wallet addresses, users, payments, and generated customer media.

## 2. Build And Start

This is a Node.js app. The production server must support Node.js and NPM. If the server says:

```bash
jailshell: npm: command not found
```

then Node/NPM is not enabled for that hosting account or is not available in your shell PATH. On cPanel hosting, check for **Setup Node.js App**, **Node.js Selector**, or **Application Manager**. If none exists, ask the hosting provider to enable Node.js/NPM or move this app to a Node-capable VPS/shared plan.

Quick checks on the server:

```bash
which node
which npm
node -v
npm -v
```

Do not continue with the commands below until `node -v` and `npm -v` work.

From the cPanel Node.js screen, use the activation command shown at the top before running terminal commands. Example:

```bash
source /home/qmexglob/nodevenv/realtimeai.yourdomain.com/22/bin/activate
cd /home/qmexglob/realtimeai.yourdomain.com
npm -v
npm install
```

Install dependencies:

```powershell
npm install
```

Build the client:

```powershell
npm run build
```

To prepare a clean upload folder without the local GPU engine, run:

```powershell
npm run prepare:production
```

Upload `production-release/` instead of the full project folder. The release contains the compiled frontend and server runtime only. It excludes frontend source, `ai-engine/`, `node_modules/`, `server/.env`, local data, and generated media.

The preparation command also creates `production-release.zip` and
`production-release.sha256`. Verify the uploaded archive before extracting it:

```powershell
(Get-FileHash production-release.zip -Algorithm SHA256).Hash.ToLower()
Get-Content production-release.sha256
```

On Linux, use `sha256sum -c production-release.sha256`.

Start production from the clean `production-release/` folder:

```powershell
npm start
```

### Plesk Node.js

Extract the contents of `production-release.zip` directly into the configured
Application root. Confirm that `app.js`, `package.json`, `server/`, and `client/`
are at that root level. Set the Application startup file to `app.js`, run **NPM
Install**, and restart the application. Do not set a fixed `PORT` in Plesk;
Passenger supplies the listening port to the Node process.

For hosting-panel databases, create the database and database user in the panel
first. The application connects to an existing database without requiring the
global MySQL `CREATE DATABASE` privilege.

If you deploy the full source tree instead of `production-release/`, use `npm run start:prod`.
The Node server serves `client/dist` when `NODE_ENV=production` or `SERVE_CLIENT=true`.

### cPanel Node.js App Setup

If your host has cPanel Node.js support, create the app from cPanel instead of plain SSH:

- Node version: 20.x or 22.x
- Application root: the uploaded project folder, for example `realtimeai.yourdomain.com`
- Application startup file: `app.js`
- Application URL: your domain/subdomain
- Environment variables: copy values from `server/.env.example`

Then use the cPanel UI button for **Run NPM Install** or **NPM Install**. If cPanel gives you a virtualenv/activation command for Node, run that first before using `npm`.

The production release has a simplified root `package.json`, so one root `npm install` is enough. You do not need to run `npm run install-all` on the server.

If the browser shows `503 Service Unavailable`, the Node app is not running or it crashed. Check the cPanel Node.js app error log, confirm NPM install completed, and restart the Node app from cPanel.

Common 503 causes:

- `server/.env` was not created.
- `JWT_SECRET` is missing or still using the placeholder value.
- NPM install did not finish, so server dependencies are missing.
- `node_modules/dotenv` is missing because NPM install was not run in the cPanel Node environment.
- The cPanel startup file is not set to `app.js`.
- MySQL credentials in `server/.env` are wrong.
- `CORS_ORIGINS`, `FRONTEND_URL`, and `APP_URL` are missing or do not use HTTPS.
- `JWT_SECRET` is shorter than 32 characters.

At minimum, production needs a real `server/.env` like:

```env
NODE_ENV=production
SERVE_CLIENT=true
JWT_SECRET=replace_this_with_a_long_random_secret_at_least_64_characters
APP_URL=https://realtimeai.yourdomain.com
FRONTEND_URL=https://realtimeai.yourdomain.com
CORS_ORIGINS=https://realtimeai.yourdomain.com
ENABLE_SELF_HOSTED_AI=false
DB_DRIVER=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_NAME=your_cpanel_database_name
DB_USER=your_cpanel_database_user
DB_PASSWORD=your_cpanel_database_password
DECART_API_KEY=your_decart_key
DECART_BASE_URL=https://api.decart.ai
DECART_CREDIT_RATE_PER_SECOND=3.3333333333
EXCHANGE_RATE_URL=https://open.er-api.com/v6/latest/USD
USD_NGN_FALLBACK_RATE=1600
NAIRA_PRICE_MARKUP=3000
```

After restarting, if it still shows 503, check these files in the app folder:

```text
startup-error.log
server/startup-error.log
```

They contain the exact startup error written by the app.

## Self-Hosted AI Engine

The self-hosted Python/CUDA engine is local-only and is not required for the current Decart production setup.

Do not upload:

```text
ai-engine/
```

Keep this production variable disabled:

```env
ENABLE_SELF_HOSTED_AI=false
```

Only set it to `true` later if you deploy a separate GPU server and want the admin panel to show the self-host provider again.

## 3. Paystack

In Admin Settings, set Paystack to `Live Mode` and paste live keys.

Set these URLs in Paystack:

```text
Callback URL: https://yourdomain.com/paystack-payment/callback
Webhook URL:  https://yourdomain.com/webhook/paystack
```

Paystack payments are automatic and add credits after successful verification.
BTC/USDT wallet methods are disabled by default. Keep them disabled unless you intentionally want manual crypto payment review.

## 4. Domain And HTTPS

Put the Node server behind a production web server such as Nginx, Apache, IIS, or a hosting reverse proxy.

Required:

- HTTPS enabled
- WebSocket support enabled
- Large request body allowed if users upload proof images
- Proxy requests to `http://127.0.0.1:4000`

## 5. Data And Backups

The app can use MySQL when `DB_DRIVER=mysql` is set. For your XAMPP setup, the configured database is:

```env
DB_DRIVER=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_NAME=realtime
DB_USER=root
DB_PASSWORD=
DB_STATE_TABLE=app_state
```

Run the migration command once after MySQL is running:

```powershell
npm run migrate:mysql
```

The first migration imports the current `server/data.json` into the MySQL `app_state` table. After that, MySQL becomes the active database while `DB_DRIVER=mysql` stays enabled.

Blank MySQL passwords are acceptable for local XAMPP development only. Use a real database user and password in production.

Generated media is stored under `server/uploads/ai-tools` by default. Set `AI_TOOL_UPLOAD_DIR` to an absolute persistent path when using containers, release directories, or hosts that replace the application folder during deployment. Back up this directory together with MySQL.

## 6. Production Smoke Test

Run these checks after deployment:

```powershell
npm run check
```

Then test in the browser:

- Register user
- Verify email
- Pay with Paystack test or live card
- Confirm credits are added automatically
- Confirm the pricing page shows Naira amounts only
- Start studio session
- Open payment history, session history, and receipt
- Check admin transactions, sessions, users, pricing, and settings pages

## 7. Security Notes

- Use a strong unique `JWT_SECRET`.
- Set `ADMIN_EMAIL` and an `ADMIN_PASSWORD` of at least 12 characters before running `node server/seed_admin.js`. The seed command has no default credentials.
- Keep Paystack secret keys server-side only.
- The generation provider master key stays server-side. Live Studio receives short-lived, model- and origin-restricted client tokens.
- Keep SMTP certificate verification enabled with `SMTP_TLS_REJECT_UNAUTHORIZED=true`.
- Use abuse rules and terms before enabling face/identity transformation publicly.
- Keep `server/data.json`, `server/uploads`, `.env`, and AI model files out of git.