# Deployment & operations runbook — NYES 2026

## 1. Environment variables

Copy `.env.example` and set at minimum:

| Key | Notes |
|-----|--------|
| `APP_URL` | Public HTTPS URL |
| `APP_KEY` | `php artisan key:generate` |
| `DB_*` | MySQL 8 credentials |
| `MAIL_*` | Production mailer |
| `QUEUE_CONNECTION` | `database` or `redis` |
| `EVENT_*` | Confirmed event meta |
| `SMS_DRIVER` | `log` (dev) or your gateway driver |
| `OTP_DEBUG` | `false` in production |
| `EVENT_QUEUE_MAIL` | `true` in production |

## 2. Document root

Configure Nginx/Apache so the document root is `public/`.

Example Nginx snippet:

```nginx
root /var/www/nyes2026/public;
location / {
    try_files $uri $uri/ /index.php?$query_string;
}
```

## 3. Deploy commands

```bash
git pull
composer install --no-dev --optimize-autoloader
npm ci && npm run build
php artisan migrate --force
php artisan config:cache
php artisan route:cache
php artisan view:cache
php artisan storage:link
php artisan queue:restart
```

## 4. Background processes

- Queue worker: `php artisan queue:work --sleep=3 --tries=3 --max-time=3600`
- Scheduler: cron `* * * * * cd /var/www/nyes2026 && php artisan schedule:run`
- Keep HTTPS certificates renewed

## 5. Backups

- Nightly encrypted MySQL dump + `storage/app/private`
- Test restore monthly
- Restrict backup access to super admins only

## 6. Event-day readiness

- Freeze non-essential deploys 24h before doors
- Train check-in officers on `/admin/checkin`
- Keep a printed fallback list of approved names + references
- Monitor `notification_logs` for failed SMS/email
- Super admin on call for badge revoke / reissue

## 7. Security reminders

- Least-privilege staff roles
- Rate limits on registration, OTP, verify, check-in
- QR tokens never contain PII
- Identity documents restricted to registration officers / managers / auditors
- Rotate compromised badges via admin UI