# VPS/cloud deployment (target checklist; not executed)

Use Ubuntu/Debian or supported host OS with PHP 8.2+, Composer, Nginx/Apache TLS, MySQL/MariaDB, private durable file storage, firewall, DNS, and monitoring. Deploy a non-root app user. Keep secrets in a protected environment file or secret manager. Point web server only to Laravel `public/`; deny source, dotfiles, and private storage. Use least-privilege DB credentials, TLS for DB/network where applicable, secure cookies and production debug-off.

Build release in CI/staging, run composer install, tests, migrations, and dependency/security scans, deploy immutable release, switch symlink, run `php artisan migrate --force`, `php artisan config:cache`, route/view cache if compatible, and restart workers. Run scheduler with system cron or a managed scheduler; run queue workers under systemd/Supervisor with bounded restarts, `--tries`/timeout policy, graceful deployment restart, alerts, and queue monitoring. Store user media outside web root with private access and malware scan. Encrypt backups and test restoration. Configure provider webhooks with TLS, signature validation, replay protection and observability before enabling external delivery. Rollback and schema compatibility plan required for every release.