# HalaVoice AI for Salla — Production Deployment Checklist

## Pre-Deployment

### Environment Configuration
- [ ] `APP_KEY` generated (`php artisan key:generate`)
- [ ] `APP_ENV=production`
- [ ] `APP_DEBUG=false`
- [ ] `APP_URL` set to production URL
- [ ] `DB_*` configured (production database)
- [ ] `QUEUE_CONNECTION=database` or `redis`
  - [ ] Redis: `REDIS_HOST`, `REDIS_PASSWORD`, `REDIS_PORT`
  - [ ] Database: `jobs` table migrated
- [ ] `CACHE_DRIVER=redis` or `memcached`
- [ ] `SESSION_DRIVER=redis` or `database`
- [ ] `SANCTUM_STATEFUL_DOMAINS` includes Salla iframe domain

### Salla Configuration
- [ ] Salla Partner account created
- [ ] App registered in Salla Partner Dashboard
- [ ] `SALLA_CLIENT_ID` set
- [ ] `SALLA_CLIENT_SECRET` set
- [ ] `SALLA_REDIRECT_URI` configured (matches Salla Partner Dashboard)
- [ ] `SALLA_WEBHOOK_SECRET` generated and set
- [ ] Required scopes configured (see REQUIRED-SCOPES.md)

### HalaVoice Configuration
- [ ] `HALAVOICE_API_URL` set to production HalaVoice instance
- [ ] `HALAVOICE_API_KEY` generated
- [ ] `HALAVOICE_API_URL=http://localhost:5003/api` (points to HalaVoice REST API Plugin)
- [ ] Test connection with `php artisan tinker`: `app(HalaVoiceClient::class)->healthCheck()`
- [ ] Phone numbers provisioned (Twilio/Plivo)
- [ ] WhatsApp Business API configured
- [ ] WhatsApp message templates approved by Meta

### Database
- [ ] Run migrations: `php artisan migrate --force`
- [ ] Verify indexes created
- [ ] Set up daily backup (preferably pg_dump/automated)
- [ ] Database user has minimum required permissions

### Queue Workers
- [ ] Supervisor configuration for queue workers:
  ```
  [program:halavoice-worker]
  process_name=%(program_name)s_%(process_num)02d
  command=php /path/to/app/artisan queue:work --sleep=3 --tries=3 --backoff=10
  autostart=true
  autorestart=true
  numprocs=4
  user=www-data
  ```
- [ ] Restart supervisor after config: `supervisorctl reread && supervisorctl update`

### Web Server (Nginx)
```nginx
server {
    listen 443 ssl http2;
    server_name your-app-domain.com;

    root /path/to/app/public;
    index index.php;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Webhook endpoint (no auth)
    location /webhook {
        try_files $uri $uri/ /index.php?$query_string;
    }
}
```

### SSL/TLS
- [ ] SSL certificate installed
- [ ] HTTPS enforced (redirect HTTP → HTTPS)
- [ ] HSTS headers configured

## Deployment Steps

1. **Code Deployment**
   ```bash
   git pull origin main
   composer install --no-dev --optimize-autoloader
   php artisan migrate --force
   php artisan config:cache
   php artisan route:cache
   php artisan view:cache
   php artisan queue:restart
   ```

2. **Verify Deployment**
   ```bash
   php artisan about
   curl -I https://your-app-domain.com
   php artisan tinker
   ```

3. **Webhook Configuration**
   - Register webhook URL in Salla Partner Dashboard
   - Subscribe to required events (see REQUIRED-SCOPES.md)
   - Test webhook delivery with Salla webhook tester

4. **Salla App Store Submission**
   - Submit app for review in Salla Partner Dashboard
   - Provide app store listing (Arabic + English)
   - Ensure test store credentials for Salla review team
   - Respond to review feedback

## Monitoring & Alerts

### Health Checks
- [ ] Endpoint: `GET /health` (returns 200 + DB connection status)
- [ ] Queue health: jobs processed per minute
- [ ] Failed jobs alert: `php artisan queue:failed` count > threshold

### Alerts (Configure in monitoring tool)
- [ ] Webhook failure rate > 5%
- [ ] Queue backlog > 1000 jobs
- [ ] HalaVoice API latency > 5 seconds
- [ ] Salla API token refresh failures
- [ ] Database connection errors
- [ ] Disk space < 20% (logs, transcripts)

### Logging
- [ ] Laravel logs rotated daily (logrotate config)
- [ ] Webhook events stored in database (30+ day retention)
- [ ] Failed jobs logged with payload
- [ ] Salla API errors logged with full context

### Backup Strategy
- [ ] Database: daily automated backup (pg_dump → S3/storage)
- [ ] Media files: if any, backed up separately
- [ ] Backup retention: 30 days minimum
- [ ] Test restore procedure documented

## Launch Checklist

### Final Validation
- [ ] All TESTING-CHECKLIST.md items passed
- [ ] Load test: 50 concurrent webhooks handled
- [ ] Security audit: no secrets in code/logs
- [ ] CORS configured for Salla domain
- [ ] Rate limiting verified
- [ ] SSL/TLS check passed (Qualys A+)
- [ ] Email delivery working (SMTP configured)
- [ ] Queue workers running and processing jobs
- [ ] Salla App Store listing submitted

### Post-Launch Monitoring (First 48 Hours)
- [ ] Monitor webhook delivery rates
- [ ] Watch for failed jobs
- [ ] Check HalaVoice API call volumes
- [ ] Validate dashboard loads correctly in Salla iframe
- [ ] Test uninstall → reinstall flow
- [ ] Verify billing/subscription webhooks fire correctly

### Rollback Plan
1. Disable webhook endpoint: return 503 at `/webhook`
2. Revert code: `git revert`
3. Re-run migrations (if rollback needed): `php artisan migrate:rollback`
4. Update Salla Partner Dashboard with old webhook URL
5. Notify affected merchants via email