ladill-transfer/DEPLOY.md

Ladill Transfer — deploy & cutover runbook

Standalone app for secure file sharing at transfer.ladill.com — upload files, get a QR code + share link, control retention, track downloads. Storage bills at GHS 0.15/GB/month from the platform UserWallet.

Public scans stay at ladill.com/q/<code>. The platform forwards transfer codes to this app (TransferQrForwarder on the monolith).

---

0. Prerequisites

Secret	Where
LADILL_SSO_CLIENT_ID / LADILL_SSO_CLIENT_SECRET	passport:client on platform
BILLING_API_KEY_TRANSFER	platform .env + this app
IDENTITY_API_KEY_TRANSFER	platform .env + this app

1. Gitea repo + CI

1. Repo: ladill-transfer on Gitea (isaacclad/ladill-transfer)
2. Push to main triggers .gitea/workflows/deploy.yml.
3. App root: /var/www/ladill-transfer

2. Server app-slot + database

sudo install -d -o deploy -g www-data /var/www/ladill-transfer/{releases,shared}
sudo mysql -e "CREATE DATABASE ladill_transfer CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
sudo mysql -e "CREATE USER 'ladill_transfer'@'127.0.0.1' IDENTIFIED BY '<pw>';"
sudo mysql -e "GRANT ALL ON ladill_transfer.* TO 'ladill_transfer'@'127.0.0.1';"
sudo mysql -e "GRANT SELECT ON ladilldb.platform_settings TO 'ladill_transfer'@'127.0.0.1';"
sudo mysql -e "GRANT SELECT ON ladill_transfer.qr_codes TO 'ladilldb'@'127.0.0.1'; FLUSH PRIVILEGES;"

Copy deploy/shared.env.example → /var/www/ladill-transfer/shared/.env, set APP_KEY (php artisan key:generate --show), DB creds, and SSO secrets.

3. Register OIDC client (platform)

cd /var/www/ladill.com/current
php artisan passport:client \
  --name="Ladill Transfer" \
  --redirect_uri="https://transfer.ladill.com/sso/callback"

Generate billing/identity API keys (same random string in both platform .env and transfer shared/.env):

php -r 'echo bin2hex(random_bytes(32)), PHP_EOL;'

Platform .env:

BILLING_API_KEY_TRANSFER=<key>
IDENTITY_API_KEY_TRANSFER=<key>
TRANSFER_DB_DATABASE=ladill_transfer
TRANSFER_DB_USERNAME=ladill_transfer
TRANSFER_DB_PASSWORD=<pw>
RP_TRANSFER_FRONTCHANNEL_LOGOUT=https://transfer.ladill.com/sso/logout-frontchannel

4. nginx + TLS

Handled automatically by the deploy workflow. Manual:

sudo deployment/setup-service-subdomain-nginx.sh transfer --app /var/www/ladill-transfer/current

5. First deploy

Push to main on Gitea — the deploy runner builds assets, runs migrations, and switches current. Or manually:

cd /var/www/ladill-transfer/current
php artisan migrate --force
php artisan config:cache route:cache view:cache

6. Verify

• Sign in at https://transfer.ladill.com
• Create a transfer (multi-file upload) → share link + QR
• Open ladill.com/q/<code> → forwards to transfer landing
• Home hub lists Transfer (no longer “Soon”)