# SiloMart production environment checklist

Never paste secret values into tickets/logs. Report only **PRESENT / MISSING / INVALID FORMAT**.

## REQUIRED

| Variable | Notes |
|----------|--------|
| `NODE_ENV` | Must be `production` |
| `AUTH_SECRET` | Long random string (≥16 chars). **Required** — no hardcoded fallback in production |
| `NEXT_PUBLIC_SITE_URL` | `https://your-domain.com` (no trailing slash required) |
| Database | Either `DATABASE_URL` **or** `DB_USER` + `DB_NAME` (+ `DB_HOST`/`DB_PORT`/`DB_PASSWORD`) |

### Database (cPanel MySQL)

| Variable | Notes |
|----------|--------|
| `DB_HOST` | Usually `localhost` on cPanel |
| `DB_PORT` | Usually `3306` |
| `DB_USER` | cPanel MySQL user |
| `DB_PASSWORD` | cPanel MySQL password |
| `DB_NAME` | Database name |
| `DATABASE_URL` | Optional full URL; overrides composition when set |
| `DB_CONNECTION_LIMIT` | Optional, default `5` |
| `DB_POOL_TIMEOUT` | Optional, default `10` |

## REQUIRED for live Stripe checkout

| Variable | Notes |
|----------|--------|
| `STRIPE_SECRET_KEY` | Server only — never `NEXT_PUBLIC_` |
| `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY` | Browser publishable key |
| `STRIPE_WEBHOOK_SECRET` | **Required in production** for `/api/webhooks/stripe` |

## OPTIONAL

| Variable | Notes |
|----------|--------|
| `HOSTNAME` | Bind host for `server.js` (default `0.0.0.0`) |
| `PORT` | Set automatically by cPanel Node.js App |
| `ENABLE_STATUS_ENDPOINT` | Set `true` only while debugging `/__status`; keep off in stable prod |
| `CPANEL_FIX_NEXT_PATHS` | Set `1` once if Windows paths remain and you cannot run fix-paths script |
| `ALLOW_NPM_INSTALL` | For `cpanel-deps.js` only |
| `CLEAN_NEXT` | For `cpanel-clean.js` only |
| SMTP fields | Prefer Admin → Settings → Email (stored in DB) |

## DEVELOPMENT ONLY

| Variable | Notes |
|----------|--------|
| `ALLOW_DEMO_CHECKOUT` | `true` allows unpaid demo checkout — **blocked in production by default** |

## Not used by this project

- `NEXTAUTH_SECRET` / `NEXTAUTH_URL` (custom JWT auth via `AUTH_SECRET`)

## After setting vars

1. Run JS Script: `scripts/cpanel-doctor.js`
2. STOP → START the Node app
3. Open `/api/health`
4. Change seed admin password immediately if `admin@silomart.com` exists