# Deploying Rankora to cPanel

The app is a Next.js 16 server app (SQLite + server actions). It must run as a
**Node.js application** on cPanel — not as static files. cPanel provides this
via **Setup Node.js App** (Phusion Passenger).

## What changed in this release (must be applied on deploy)

1. **Sub-path hosting fix** — the app is served under `/rankora`. It now honors
   a `basePath`, driven by an env var. You MUST set it in production:
   ```
   NEXT_PUBLIC_BASE_PATH=/rankora
   ```
   Without it, internal links resolve to the domain root and 404 (the bug you saw
   when clicking "Search Console").

2. **Google OAuth redirect URI** — because links are now prefixed, update the
   authorized redirect URI in Google Cloud Console to include `/rankora`:
   ```
   https://clawstechnologies.com/rankora/api/integrations/gsc/callback
   ```
   (and the Gmail one if used: `.../rankora/api/integrations/gmail/callback`)

3. **Reverse proxy must pass `/rankora` through** (not strip it). With Passenger
   this is automatic when the app's "Application URL" is set to `rankora`.

## Option A — cPanel Git Version Control (recommended)

1. cPanel → **Git Version Control** → point it at this repo (or push the repo up).
2. cPanel → **Setup Node.js App**:
   - Application root: the repo folder
   - Application URL: `clawstechnologies.com/rankora`
   - Application startup file: `node_modules/.bin/next` won't work under Passenger
     directly — use the standalone server (see Option C) OR a small `server.js`.
   - Node version: 20+.
3. Add environment variables (see list below) in the Node.js App UI.
4. Run, in the app's virtualenv terminal:
   ```
   npm install
   NEXT_PUBLIC_BASE_PATH=/rankora npm run build
   ```
5. Restart the app.

## Option B — SSH (fastest if you have shell access)

```bash
cd ~/rankora                       # the app folder on the server
git pull                           # or upload the changed files
npm install
NEXT_PUBLIC_BASE_PATH=/rankora npm run build
# restart via cPanel "Setup Node.js App" → Restart, or:
touch tmp/restart.txt              # Passenger restart trigger
```

## Option C — Standalone server (cleanest for Passenger)

Passenger wants a startup file. Next's standalone output gives you one:

1. Add to `next.config.ts`: `output: "standalone"` (ask me to add it).
2. Build: `NEXT_PUBLIC_BASE_PATH=/rankora npm run build`
3. Deploy `.next/standalone/` + `.next/static/` (into `.next/standalone/.next/static/`)
   + `public/` + your `sqlite.db`.
4. Passenger startup file: `.next/standalone/server.js`
5. Set env vars, restart.

## Required environment variables (production)

```
NEXT_PUBLIC_BASE_PATH=/rankora
AUTH_SECRET=...            # keep the existing value so sessions survive
ENCRYPTION_KEY=...         # keep existing — decrypts stored GSC/WP credentials
GOOGLE_CLIENT_ID=...
GOOGLE_CLIENT_SECRET=...
GROQ_API_KEY=...           # ROTATE this — it was exposed in chat
GROQ_MODEL=llama-3.1-8b-instant
PAGESPEED_API_KEY=...
# DB: point at the persistent SQLite file (see src/db). Do NOT overwrite the
# production DB — it holds real users, sites, and encrypted credentials.
```

## Do NOT

- Overwrite the production `sqlite.db` — it contains live accounts + encrypted
  GSC/WordPress credentials.
- Rotate `AUTH_SECRET`/`ENCRYPTION_KEY` — doing so logs everyone out and makes
  stored integration credentials undecryptable.