# Deployment Configuration Checklist
**Project:** Zapazime Reception Module
**Purpose:** Ensure production deployment has secure configuration
---
## Pre-Deployment Configuration
### Environment Variables
- [ ] **APP_ENV** set to `production` (NOT `local` or `development`)
- [ ] **APP_DEBUG** set to `false`
- [ ] **APP_DEBUGBAR_ENABLE** set to `false`
- [ ] **APP_URL** set to production URL
- [ ] **APP_KEY** is set and secure (not the default)
- [ ] Database credentials are production-specific
- [ ] Cache driver is set to production cache (e.g., Redis, database)
- [ ] Session driver is set to production session store
- [ ] Queue driver is set to production queue (e.g., Redis, database)
- [ ] Mail settings are production SMTP
### Security Configuration
- [ ] SSL/HTTPS is enabled on production server
- [ ] Session secure cookies are enabled
- [ ] CSRF protection is enabled
- [ ] API rate limiting is configured
- [ ] File permissions are secure (755 for directories, 644 for files)
- [ ] Storage directory is not publicly accessible
- [ ] Debug bar is disabled in production
---
## Deployment Commands
```bash
# 1. Set environment to production
export APP_ENV=production
# 2. Clear configuration cache
php artisan config:clear
# 3. Cache configuration for production
php artisan config:cache
# 4. Clear application cache
php artisan cache:clear
# 5. Clear route cache
php artisan route:clear
# 6. Cache routes for production
php artisan route:cache
# 7. Clear view cache
php artisan view:clear
# 8. Cache views for production
php artisan view:cache
# 9. Clear event cache
php artisan event:clear
# 10. Cache events for production
php artisan event:cache
# 11. Run migrations
php artisan migrate --force
# 12. Optimize composer autoloader
composer install --optimize-autoloader --no-dev
# 13. Clear and cache config again to ensure APP_DEBUG=false
php artisan config:clear
php artisan config:cache
# 14. Verify production configuration
php artisan env
php artisan config:show app.env
php artisan config:show app.debug
```
---
## Post-Deployment Verification
- [ ] Visit production URL and verify no debug information is shown on errors
- [ ] Verify 404 and 500 error pages are generic
- [ ] Verify debug toolbar is not present
- [ ] Check logs are being written to configured log channel
- [ ] Verify database connections are working
- [ ] Verify cache and queue are working
- [ ] Test authentication and authorization
- [ ] Verify HTTPS is working correctly
- [ ] Test critical workflows (booking, check-in, checkout)
---
## Rollback Plan
If issues are detected after deployment:
```bash
# 1. Revert code changes
git revert <commit-hash>
# 2. Clear all caches
php artisan config:clear
php artisan cache:clear
php artisan route:clear
php artisan view:clear
php artisan event:clear
# 3. Re-deploy previous stable version
```
---
## Critical Warning
**NEVER deploy with `APP_DEBUG=true` in production.**
This will expose:
- Stack traces
- Database queries
- Environment variables
- Session data
- Cookie information
- File paths
All of which are security vulnerabilities.
## APP_DEBUG Enforcement (Updated 2026-08-28)
The application now enforces production error handling based on `APP_DEBUG=false` rather than `APP_ENV=production`. This ensures debug information is hidden whenever debug mode is disabled, regardless of the environment name.
**Critical deployment requirement:**
- `APP_DEBUG` must be set to `false` in production
- The exception handler checks `!config('app.debug')` to determine if debug information should be hidden
- This is a deployment-enforced condition, not an assumption based on `APP_ENV`
**Verification:**
```bash
# Verify APP_DEBUG is false after deployment
php artisan config:show app.debug
# Should return: false
```
---
## Monitoring
After deployment, monitor for:
- Error rates in logs
- Response times
- Database performance
- Cache hit rates
- Queue processing times
- Security alerts
---
## Contact
For deployment issues:
- DevOps Team: [contact]
- Security Team: [contact]
- On-call Engineer: [contact]