# Ladill Transfer — deploy & cutover runbook

Standalone app for **secure file sharing** at `transfer.ladill.com` — upload files,
get a QR code + share link, control retention, track downloads. Storage bills at
**GHS 0.30/GB/month** from the platform UserWallet.

Public scans stay at `ladill.com/q/<code>`. The platform forwards transfer codes
to this app (`TransferQrForwarder` on the monolith).

---

## 0. Prerequisites

| Secret | Where |
|---|---|
| `LADILL_SSO_CLIENT_ID` / `LADILL_SSO_CLIENT_SECRET` | `passport:client` on platform |
| `BILLING_API_KEY_TRANSFER` | platform `.env` + this app |
| `IDENTITY_API_KEY_TRANSFER` | platform `.env` + this app |

## 1. Gitea repo + CI

1. Repo: **ladill-transfer** on Gitea (`isaacclad/ladill-transfer`)
2. Push to `main` triggers `.gitea/workflows/deploy.yml`.
3. App root: `/var/www/ladill-transfer`

## 2. Server app-slot + database

```bash
sudo install -d -o deploy -g www-data /var/www/ladill-transfer/{releases,shared}
sudo mysql -e "CREATE DATABASE ladill_transfer CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
sudo mysql -e "CREATE USER 'ladill_transfer'@'127.0.0.1' IDENTIFIED BY '<pw>';"
sudo mysql -e "GRANT ALL ON ladill_transfer.* TO 'ladill_transfer'@'127.0.0.1';"
sudo mysql -e "GRANT SELECT ON ladilldb.platform_settings TO 'ladill_transfer'@'127.0.0.1';"
sudo mysql -e "GRANT SELECT ON ladill_transfer.qr_codes TO 'ladilldb'@'127.0.0.1'; FLUSH PRIVILEGES;"
```

Copy `deploy/shared.env.example` → `/var/www/ladill-transfer/shared/.env`, set
`APP_KEY` (`php artisan key:generate --show`), DB creds, and SSO secrets.

## 3. Register OIDC client (platform)

```bash
cd /var/www/ladill.com/current
php artisan passport:client \
  --name="Ladill Transfer" \
  --redirect_uri="https://transfer.ladill.com/sso/callback"
```

Generate billing/identity API keys (same random string in both platform `.env`
and transfer `shared/.env`):

```bash
php -r 'echo bin2hex(random_bytes(32)), PHP_EOL;'
```

Platform `.env`:

```env
BILLING_API_KEY_TRANSFER=<key>
IDENTITY_API_KEY_TRANSFER=<key>
TRANSFER_DB_DATABASE=ladill_transfer
TRANSFER_DB_USERNAME=ladill_transfer
TRANSFER_DB_PASSWORD=<pw>
RP_TRANSFER_FRONTCHANNEL_LOGOUT=https://transfer.ladill.com/sso/logout-frontchannel
```

## 4. nginx + TLS

Handled automatically by the deploy workflow. Manual:

```bash
sudo deployment/setup-service-subdomain-nginx.sh transfer --app /var/www/ladill-transfer/current
```

## 5. First deploy

Push to `main` on Gitea — the `deploy` runner builds assets, runs migrations,
and switches `current`. Or manually:

```bash
cd /var/www/ladill-transfer/current
php artisan migrate --force
php artisan config:cache route:cache view:cache
```

## 6. Verify

- Sign in at `https://transfer.ladill.com`
- Create a transfer (multi-file upload) → share link + QR
- Open `ladill.com/q/<code>` → forwards to transfer landing
- Home hub lists Transfer (no longer “Soon”)