# Production Todo

Work through Phase 1 first (local fixes and config), then Phase 2 (server deployment and go-live).

---

## Phase 1 — Local fixes before deploy

These are changes made in the local dev environment and committed before anything touches the server.

### 1.1 Fix server-install.sh for Grav 2.0

`server-install.sh` had a gap: it copied the `grav-admin` bundle (which includes `user/plugins/admin2/`) but then immediately did `rm -rf user && git clone ...`, wiping admin2. It never got reinstalled because GPM doesn't carry Admin2.

- [x] Updated `server-install.sh` to stash admin2 before wiping user/, then restore it after
- [x] Removed `admin` from `plugins.txt` — Admin2 replaces it and both conflict on `/admin`

### 1.2 Update config for production

- [x] Cleared `custom_base_url` in `user/config/system.yaml` (was pointing to local dev IP; empty means Grav auto-detects from the request, which works both locally and in production)

### 1.3 Content and metadata

- [ ] Set `date_start` on the Japan & Korea 2026 trip page (`user/pages/01.trips/japan-korea-2026/trip.md`)
- [ ] Add `cover_image` to the trip page (used on the trips listing)
- [ ] Upload actual GPX route file(s) to `/gpx-manager` or drop directly into `user/pages/01.trips/japan-korea-2026/`
- [ ] Run `make content-push` to push all local changes to Gitea

---

## Phase 2 — Server deployment and go-live

### 2.1 Configure .env

- [ ] Set `GRAV_VERSION=2.0.0-rc.9` in `.env`
- [ ] Set `GRAV_CHANNEL_SUFFIX=?testing` (makes the download URL resolve to the RC)
- [ ] Set `REMOTE_HOST`, `REMOTE_USER`, `REMOTE_PORT`, `REMOTE_HOME` for the production server
- [ ] Set `USER_REPO` and `MAIN_REPO` (Gitea URLs)
- [ ] Set `GITEA_HOST`, `GITEA_USER`, `GITEA_TOKEN` for the install-time clone

### 2.2 Run the install

```bash
make remote-env-setup   # writes Gitea token to server temporarily
make remote-install     # downloads Grav, clones repos, installs plugins
make remote-env-remove  # removes token from server
```

After install, the script prints the server's SSH public key. Add it as a deploy key to both Gitea repos so `make remote-fetch` works going forward.

### 2.3 Verify post-install config

These are committed to the `user/` repo and should be present after the clone — just confirm:

- [ ] `user/config/system.yaml` has `accounts.type: flex` and `pages.type: flex`
- [ ] `user/accounts/mischa.yaml` has `api.super: true` and `api.access: true`
- [ ] Old admin plugin is absent from `plugins.txt` (not installed)

### 2.4 Switch to production mode

- [ ] Set `twig.cache: true` in `user/config/system.yaml` on the server (do not commit this to the repo — it would break local dev)
- [ ] If Grav can't auto-detect the base URL (e.g. behind a reverse proxy), set `custom_base_url` in `user/config/system.yaml` on the server

### 2.5 Smoke test

- [ ] Submit one post via `/post`, confirm entry appears in `/trips/japan-korea-2026/dailies` immediately (verifies cache-on-save plugin works with `twig.cache: true`)

### 2.6 Security

- [ ] Change admin password to a strong production password
- [ ] Confirm `/post` requires login — unauthenticated visitors must not be able to post

### 2.7 Map tiles

- [ ] Register at [carto.com](https://carto.com) and review terms for production traffic (CartoDB dark tiles are free but registration is expected for production use)