# Ladill Care — deploy runbook

Healthcare management at **care.ladill.com** (patients, appointments, consultations, lab, pharmacy, billing).

## 1. Gitea repo + CI

- Repo: **ladill-care** (`isaacclad/ladill-care`) — canonical source; not nested in the `ladill` monorepo.
- Push to `main` triggers `.gitea/workflows/deploy.yml` (on-host `deploy` runner).
- App root: `/var/www/ladill-care`.

## 2. Server app-slot + database

```bash
sudo install -d -o deploy -g www-data /var/www/ladill-care
sudo install -d -o deploy -g www-data /var/www/ladill-care/{releases,shared}
sudo mysql -e "CREATE DATABASE ladill_care CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
sudo mysql -e "CREATE USER 'ladill_care'@'127.0.0.1' IDENTIFIED BY '<pw>';"
sudo mysql -e "GRANT ALL ON ladill_care.* TO 'ladill_care'@'127.0.0.1'; FLUSH PRIVILEGES;"
```

## 3. Platform wiring (monolith)

On the Ladill platform host:

```bash
cd /var/www/ladill.com/current
php artisan ladill:onboard-app care --run-dns
php artisan passport:client --name="Ladill Care" --redirect_uri=https://care.ladill.com/sso/callback
php artisan ladill:launcher:sync --propagate
```

Apply the generated `IDENTITY_API_KEY_CARE`, `BILLING_API_KEY_CARE`,
`SERVICE_EVENTS_CARE_*`, and `SERVICE_EVENTS_INBOUND_SECRET` values to the monolith `.env`, then:

```bash
php artisan config:cache
```

## 4. Shared `.env` (`/var/www/ladill-care/shared/.env`)

Copy `.env.example`, set production values:

| Variable | Notes |
|----------|-------|
| `APP_KEY` | `php artisan key:generate --show` |
| `APP_URL` | `https://care.ladill.com` |
| `DB_*` | MySQL `ladill_care` credentials |
| `LADILL_SSO_CLIENT_ID` / `LADILL_SSO_CLIENT_SECRET` | Passport client (plain text from `passport:client`) |
| `BILLING_API_KEY_CARE` | Same as monolith consumer key |
| `IDENTITY_API_KEY_CARE` | Same as monolith consumer key |
| `SERVICE_EVENTS_INBOUND_SECRET` | Same as monolith `SERVICE_EVENTS_CARE_SECRET` |

**SSO secret:** use the plain-text value printed once by `passport:client` — never copy
`oauth_clients.secret` from the database (Passport stores a bcrypt hash there).

## 5. nginx + TLS

```bash
sudo bash deployment/setup-service-subdomain-nginx.sh care --app /var/www/ladill-care/current
```

DNS: `care.ladill.com` → app server (via `dns:sync-subdomains` on the monolith).

## 6. First deploy

Push to `main` or run the Gitea deploy workflow manually. Then verify:

```bash
curl -sI https://care.ladill.com | head -1
curl -s -o /dev/null -w '%{http_code}\n' https://care.ladill.com/login
curl -s https://care.ladill.com/api/health
```

### Clinical assessment content packs

After migrate (and on each release that adds packs under `database/data/assessments/`):

```bash
cd /var/www/ladill-care/current
php artisan db:seed --class=Database\\Seeders\\AssessmentTemplateSeeder --force
php artisan db:seed --class=Database\\Seeders\\ClinicalPathwaySeeder --force
# or full: php artisan db:seed --force
```

Packs are platform-global (no per-tenant copy). Enable the engine per organization via
`settings.rollout.assessments_engine = true` (see design doc / `CareFeatures`).
Pathway content lives under `database/data/pathways/`; assessment instruments under
`database/data/assessments/`.

## 7. Optional queue worker

```bash
sudo cp deployment/supervisor/ladill-care-worker.conf /etc/supervisor/conf.d/
sudo supervisorctl reread && sudo supervisorctl update
```