# Production Deployment Guide for AlmaLinux 9
## Narada • Bulk Business Messaging & WhatsApp Marketing Platform
### Official Meta Cloud API v21.0 & Laravel 13 on AlmaLinux 9 (RHEL 9 Binary Compatible)

This step-by-step guide is customized specifically for **AlmaLinux 9** servers utilizing **DNF**, **Remi's PHP 8.3**, **Nginx**, **MariaDB/MySQL**, **Firewalld**, and **SELinux**.

---

### Step 1: Update AlmaLinux 9 & Install EPEL / Remi Repositories

Log in to your AlmaLinux 9 server via SSH as `root`:
```bash
ssh root@YOUR_SERVER_IP
```

Update system packages:
```bash
dnf update -y
dnf install -y epel-release curl wget git unzip zip tar policycoreutils-python-utils
```

Install Remi's RPM repository for Enterprise Linux 9:
```bash
dnf install -y https://rpms.remirepo.net/enterprise/remi-release-9.rpm
```

Reset the default PHP module and enable Remi's **PHP 8.3** stream:
```bash
dnf module reset php -y
dnf module enable php:remi-8.3 -y
```

---

### Step 2: Install PHP 8.3, Extensions & Composer

Install PHP 8.3 and all required extensions for Laravel 13 and Meta Cloud API:
```bash
dnf install -y php-fpm php-cli php-mysqlnd php-curl php-mbstring \
php-xml php-zip php-bcmath php-intl php-gd php-opcache php-json
```

Install Composer globally:
```bash
curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
composer --version
```

Configure PHP-FPM for Nginx:
Open `/etc/php-fpm.d/www.conf`:
```bash
nano /etc/php-fpm.d/www.conf
```
Ensure the user and group match `nginx`:
```ini
user = nginx
group = nginx
listen = /run/php-fpm/www.sock
listen.owner = nginx
listen.group = nginx
listen.mode = 0660
```

Start and enable PHP-FPM:
```bash
systemctl enable --now php-fpm
systemctl status php-fpm
```

---

### Step 3: Install & Secure MariaDB / MySQL Database

Install MariaDB Server:
```bash
dnf install -y mariadb-server
systemctl enable --now mariadb
```

Secure the database and create the Narada database:
```bash
mariadb -u root
```
Run the following SQL commands:
```sql
CREATE DATABASE narada_marketing CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'narada_user'@'localhost' IDENTIFIED BY 'StrongPassword2026!#';
GRANT ALL PRIVILEGES ON narada_marketing.* TO 'narada_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;
```

---

### Step 4: Extract the Zip File & Set AlmaLinux / SELinux Permissions

Upload `narada-backend-laravel.zip` to your server (e.g. into `/tmp` or `/var/www`):
```bash
mkdir -p /var/www/narada
cd /var/www/narada
unzip /tmp/narada-backend-laravel.zip -d /var/www/narada
```

Install production dependencies:
```bash
composer install --no-dev --optimize-autoloader
```

Set file ownership to `nginx`:
```bash
chown -R nginx:nginx /var/www/narada
find /var/www/narada -type f -exec chmod 644 {} \;
find /var/www/narada -type d -exec chmod 755 {} \;
chmod -R 775 /var/www/narada/storage /var/www/narada/bootstrap/cache
```

#### SELinux Configuration (MANDATORY on AlmaLinux 9)
AlmaLinux enforces SELinux in `Enforcing` mode by default. Run these commands so Nginx and PHP-FPM can write to storage and connect to the Meta Cloud API:
```bash
# Allow Nginx/PHP to read/write storage and cache directories
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/narada/storage(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/narada/bootstrap/cache(/.*)?"
restorecon -Rv /var/www/narada/storage /var/www/narada/bootstrap/cache

# Allow PHP-FPM / Nginx to make outbound network calls to Meta Graph API (graph.facebook.com)
setsebool -P httpd_can_network_connect 1

# Allow web server to connect to MySQL/MariaDB
setsebool -P httpd_can_network_connect_db 1
```

---

### Step 5: Configure Environment (`.env`) & Run Seeders

Configure `.env`:
```bash
cp .env.example .env
nano .env
```
Ensure your database credentials and Meta credentials match:
```dotenv
APP_NAME="Narada WhatsApp Marketing"
APP_ENV=production
APP_KEY=
APP_DEBUG=false
APP_URL=https://your-domain.com

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=narada_marketing
DB_USERNAME=narada_user
DB_PASSWORD=StrongPassword2026!#

# Official Meta WhatsApp Business Cloud API v21.0
META_API_VERSION=v21.0
META_PHONE_NUMBER_ID=913349665192073
META_WABA_ID=1378746380406848
META_ACCESS_TOKEN=EAAl6rWdth7YBSvrGsUqF53H26vetTv1BmfGssD9wZAFW9XkTcJIawKkKEdJDD6GSgqKhGlfOceMiZCR4ilLtszYanJhMRZBdrj9fyXcZAzvMHupNGD5VEyzAgwSs649OBBtYSLp5HVFU4no0ZBEfnm5c9cLepoZCZByZAS6yVpl9CUXJlzdU8kdxVlg4VgAK4C745C7Q5nQKn7zLF65h8O7jVZCIuu2yM2IGTIMJhn40gZC6mzfRGfmnOjNr3IJ3JeuzgroDsZD
META_WEBHOOK_VERIFY_TOKEN=narada_wa_verify_secret_2026

# Business Profile (DEWA Gram Udhyog Pvt Ltd)
BUSINESS_NAME="DEWA Gram Udhyog Pvt Ltd"
BUSINESS_GSTIN="06AAJCD0975H1ZK"
BUSINESS_EMAIL="contact@sdadigital.in"
BUSINESS_MOBILE="+919461321162"
BUSINESS_ADDRESS="Gali No 4, Uttam Nagar Loharu Road, Bhiwani 127021 HR"
```

Initialize Laravel key and run seeders:
```bash
php artisan key:generate
php artisan migrate:fresh --seed --force
php artisan optimize
```

---

### Step 6: Install & Configure Nginx on AlmaLinux 9

Install Nginx:
```bash
dnf install -y nginx
```

Create server block `/etc/nginx/conf.d/narada.conf`:
```bash
nano /etc/nginx/conf.d/narada.conf
```
Paste configuration:
```nginx
server {
    listen 80;
    server_name your-domain.com;
    root /var/www/narada/public;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";

    index index.php index.html;
    charset utf-8;
    client_max_body_size 64M;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php-fpm/www.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_hide_header X-Powered-By;
        fastcgi_read_timeout 300;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}
```

Test and enable Nginx:
```bash
nginx -t
systemctl enable --now nginx
```

---

### Step 7: Open Firewall Ports with `firewalld`

AlmaLinux 9 uses Firewalld. Allow HTTP and HTTPS:
```bash
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload
firewall-cmd --list-all
```

---

### Step 8: Install Free SSL Certificate (Certbot)

Meta WhatsApp Cloud API **strictly requires valid SSL/HTTPS**:
```bash
dnf install -y certbot python3-certbot-nginx
certbot --nginx -d your-domain.com --non-interactive --agree-tos --email contact@sdadigital.in
```

---

### Step 9: Configure Systemd Queue Worker Service

On AlmaLinux, Systemd natively manages background queue workers for broadcast dispatches:
Create `/etc/systemd/system/narada-worker.service`:
```bash
nano /etc/systemd/system/narada-worker.service
```
Paste:
```ini
[Unit]
Description=Narada WhatsApp Queue Worker
After=network.target

[Service]
User=nginx
Group=nginx
Restart=always
ExecStart=/usr/bin/php /var/www/narada/artisan queue:work database --sleep=3 --tries=3 --max-time=3600
RestartSec=5s

[Install]
WantedBy=multi-user.target
```

Enable and start the worker:
```bash
systemctl daemon-reload
systemctl enable --now narada-worker
systemctl status narada-worker
```

---

### Step 10: Configure Webhook in Meta Developer Portal

1. In [Meta for Developers](https://developers.facebook.com/):
   - **Callback URL**: `https://your-domain.com/webhooks/meta`
   - **Verify Token**: `narada_wa_verify_secret_2026`
2. Subscribe to `messages` and `message_template_status_update`.

---

### Step 11: Access Dedicated Consumer and Admin Portals

The application implements strict directory separation for all login portals and workspaces:

| Portal | Dedicated Directory | Controller Namespace | URL Route | Target Audience |
| :--- | :--- | :--- | :--- | :--- |
| **Portal Selector** | `resources/views/` | `routes/web.php` | `https://your-domain.com/` | Public Landing & Role Chooser |
| **Consumer Workspace** | `resources/views/consumer/auth/` | `App\Http\Controllers\Consumer\Auth\` | `https://your-domain.com/consumer/login` | DEWA Gram Udhyog Pvt Ltd & Business Marketers |
| **Admin Operations** | `resources/views/admin/auth/` | `App\Http\Controllers\Admin\Auth\` | `https://your-domain.com/admin/login` | Compliance Staff, Contact Queue Auditors |
| **Super Admin Console**| `resources/views/superadmin/auth/` | `App\Http\Controllers\SuperAdmin\Auth\`| `https://your-domain.com/superadmin/login` | Platform Owner, Meta WABA Governance |

Each portal features:
- Dedicated **WhatsApp OTP delivery** via Meta Cloud API v21.0
- Isolated middleware enforcement (`EnsureConsumer`, `EnsureAdmin`, `EnsureSuperAdmin`)
- 1-tap instant test bypass authentication with pre-seeded test accounts
- Direct logout and session invalidation returning to their dedicated login directory