# Production Todo

Fresh server — no Grav installed yet. Work through these sections in order.

---

## 1. Pre-install: fix server-install.sh for Grav 2.0

`server-install.sh` has a gap: it copies the `grav-admin` bundle (which includes `user/plugins/admin2/`) but then immediately does `rm -rf user && git clone ...`, which wipes admin2. It never gets reinstalled because GPM doesn't carry Admin2.

- [ ] Update `server-install.sh` to stash admin2 before wiping user/, then restore it after:

```bash
# After "cp -rf grav-admin/. ." and before "rm -rf user":
cp -rf grav-admin/user/plugins/admin2 /tmp/admin2-plugin

# After "git clone $USER_REPO user" and "mkdir -p user/plugins ...":
cp -rf /tmp/admin2-plugin user/plugins/admin2
rm -rf /tmp/admin2-plugin
```

- [ ] Remove `admin` from `plugins.txt` if it's there — Admin2 replaces it and both conflict on `/admin`

## 2. Pre-install: configure .env

- [ ] Set `GRAV_VERSION=2.0.0-rc.9` in `.env`
- [ ] Set `GRAV_CHANNEL_SUFFIX=?testing` in `.env` (makes the download URL resolve to the RC)
- [ ] Set `REMOTE_HOST`, `REMOTE_USER`, `REMOTE_PORT`, `REMOTE_HOME` for the production server
- [ ] Set `USER_REPO` and `MAIN_REPO` (Gitea URLs)
- [ ] Set `GITEA_HOST`, `GITEA_USER`, `GITEA_TOKEN` for the install-time clone

## 3. Run the install

```bash
make remote-env-setup   # writes Gitea token to server temporarily
make remote-install     # downloads Grav, clones repos, installs plugins
make remote-env-remove  # removes token from server
```

After install, the script prints the server's SSH public key. Add it as a deploy key to both Gitea repos so `make remote-fetch` works going forward.

## 4. Post-install: config

These are already committed to the `user/` repo so they'll be present after the clone — just verify:

- [ ] `user/config/system.yaml` has `accounts.type: flex` and `pages.type: flex`
- [ ] `user/config/system.yaml` `custom_base_url` is set to the production domain (currently set to the local dev IP — update before deploy)
- [ ] `user/accounts/mischa.yaml` has `api.super: true` and `api.access: true`
- [ ] Disable old admin plugin: set `enabled: false` in `user/plugins/admin/admin.yaml` on production (or ensure it's not in `plugins.txt`)

## 5. Post-install: switch to production mode

- [ ] Set `twig.cache: true` in `user/config/system.yaml`
- [ ] Smoke test: submit one post via `/post`, confirm entry appears in `/trips/japan-korea-2026/dailies` immediately (verifies cache-on-save plugin works with Twig cache on)

## 6. Security

- [ ] Change admin password to a strong production password
- [ ] Confirm `/post` requires login — unauthenticated visitors must not be able to post

## 7. Map tiles

- [ ] Register at [carto.com](https://carto.com) and review terms for production traffic (CartoDB dark tiles are free but registration is expected for production use)

## 8. Content

- [ ] Set `date_start` on the Japan & Korea 2026 trip page (`user/pages/01.trips/japan-korea-2026/trip.md`)
- [ ] Upload actual GPX route file(s) to the trip page media — currently no GPX files, so the map shows no route
- [ ] Add `cover_image` to the trip page (used on the trips listing)
- [ ] Run `make content-push` to push any local content changes to Gitea before going live