Deployment

Deployment

1. Point the document root at public/. Use deploy/nginx.conf (upstream pool, limit_req / limit_conn, Brotli/gzip, immutable asset caching) or Apache with public/.htaccess.
2. Copy deploy/.env.production.example to .env: APP_ENV=production, APP_DEBUG=false, HTTPS, Redis for cache, sessions and queue.
3. Build and migrate:

   composer install --no-dev -o
   npm ci && npm run build:ssr
   php artisan migrate --force
   php artisan optimize

4. Run deploy/supervisor.conf for queue workers, the scheduler and the SSR server.
5. Run ClamAV's clamd and point CLAMAV_SOCKET at it. Set the Stripe keys and add the webhook endpoint (see Payments).
6. Behind a load balancer, set the trusted proxy range so rate limits and bans see real client IPs, and keep CACHE_LIMITER_STORE / BAN_CACHE_STORE on Redis.

Go-live checklist

• Seeded staff passwords changed or accounts revoked (php artisan user:admin admin@zovita.com --revoke)
• ZOVITA_SITE_URL set to your domain (sitemap, canonicals, llms files)
• MAIL_FROM_ADDRESS on a domain verified in Resend
• reCAPTCHA keys allow your domain
• PAYMENTS_DRIVER=stripe (the sandbox is refused in production)
• Scheduler running (prescription auto-accept, payment expiry, refill reminders)
• Demo catalogue replaced with your own licensed catalogue