# Ladill Frontdesk — deploy runbook

Visitor management at **frontdesk.ladill.com** (check-in, badges, kiosk, reports).

## 1. Gitea repo + CI

- Repo: **ladill-frontdesk** (`isaacclad/ladill-frontdesk`).
- Push to `main` triggers `.gitea/workflows/deploy.yml` (on-host `deploy` runner).
- App root: `/var/www/ladill-frontdesk`.

## 2. Server app-slot + database

```bash
sudo install -d -o deploy -g www-data /var/www/ladill-frontdesk
sudo install -d -o deploy -g www-data /var/www/ladill-frontdesk/{releases,shared}
sudo mysql -e "CREATE DATABASE ladill_frontdesk CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
sudo mysql -e "CREATE USER 'ladill_frontdesk'@'127.0.0.1' IDENTIFIED BY '<pw>';"
sudo mysql -e "GRANT ALL ON ladill_frontdesk.* TO 'ladill_frontdesk'@'127.0.0.1'; FLUSH PRIVILEGES;"
```

## 3. Platform wiring (monolith)

On the Ladill platform host:

```bash
cd /var/www/ladill.com/current
php artisan ladill:onboard-app frontdesk --run-dns
php artisan passport:client --name="Ladill Frontdesk" --redirect_uri=https://frontdesk.ladill.com/sso/callback
```

Apply the generated `IDENTITY_API_KEY_FRONTDESK`, `BILLING_API_KEY_FRONTDESK`, and
`SERVICE_EVENTS_FRONTDESK_*` values to the monolith `.env`, then:

```bash
php artisan config:cache
```

## 4. Shared `.env` (`/var/www/ladill-frontdesk/shared/.env`)

Copy `.env.example`, set `APP_KEY` (`php artisan key:generate --show`), DB creds, SSO
client id/secret, billing + identity keys, and `SERVICE_EVENTS_INBOUND_SECRET`.

**SSO secret:** use the plain-text value printed once by `passport:client` — never copy
`oauth_clients.secret` from the database (Passport stores a bcrypt hash there).

## 5. nginx + TLS

```bash
sudo bash deployment/setup-service-subdomain-nginx.sh frontdesk --app /var/www/ladill-frontdesk/current
```

DNS: `frontdesk.ladill.com` → app server (via `dns:sync-subdomains` on the monolith).

## 6. First deploy

Push to `main` or run the Gitea deploy workflow manually. Then verify:

```bash
curl -sI https://frontdesk.ladill.com | head -1
curl -s -o /dev/null -w '%{http_code}\n' https://frontdesk.ladill.com/login
```

## 7. Optional queue worker

```bash
sudo cp deployment/supervisor/ladill-frontdesk-worker.conf /etc/supervisor/conf.d/
sudo supervisorctl reread && sudo supervisorctl update
```