# Deploy HMS on cPanel with MySQL/MariaDB

The HMS Laravel application already supports MySQL. SQLite files cannot be imported directly into phpMyAdmin as MySQL tables.

1. In cPanel **MySQL Databases**, create a database and database user. Grant the user all privileges on that database.
2. In cPanel File Manager, enable **Show Hidden Files**, edit the application's private `.env` file (alongside `artisan`):

```dotenv
APP_ENV=production
APP_DEBUG=false
DB_CONNECTION=mysql
DB_HOST=localhost
DB_PORT=3306
DB_DATABASE=CPANELUSER_hms
DB_USERNAME=CPANELUSER_hmsuser
DB_PASSWORD=YOUR_DATABASE_PASSWORD
SESSION_DRIVER=database
```

Keep the existing `APP_KEY` when moving an existing installation. Set the correct `APP_URL` and SMTP settings.

3. Ensure PHP has `pdo_mysql` enabled. Keep the Laravel project outside `public_html`; point the site's document root to the application's `public` directory.
4. If cPanel Terminal is unavailable, use **Cron Jobs** temporarily to execute Laravel commands. For example, create a cron job with the command below (adjust both paths), allow it to run **once**, and delete the job immediately:

```sh
cd /home/CPANELUSER/hms && /usr/local/bin/php artisan optimize:clear && /usr/local/bin/php artisan migrate --force
```

Verify the PHP CLI path with your hosting provider; some cPanel hosts use `/opt/cpanel/ea-php82/root/usr/bin/php` or another path. Configure the job to send output to a private log file if needed. **Do not schedule migrations repeatedly.**

5. Create the **first** platform admin with a separate, one-time Cron Job (use your real email address):

```sh
cd /home/CPANELUSER/hms && /usr/local/bin/php artisan hms:bootstrap-admin --name="Platform Administrator" --email="admin@example.com"
```

The command refuses to create a second platform admin, generates an unusable random initial password, and emails a password setup/reset link to the administrator. Configure SMTP before running it. **Delete the cron job after it runs.** No default password is committed to GitHub.

6. If the password email fails, the admin account is still created. Resolve SMTP delivery and use the application's password reset mechanism or ask an authorized server administrator to issue a reset link.

7. Do not upload your SQLite file expecting MySQL to read it. To preserve existing SQLite records, migrate data separately with a tested conversion script and a verified backup. Running migrations on empty MySQL creates a new empty HMS database.

**Security:** Never expose `.env`, SQL backups, logs, or PHP setup scripts under the public web root. This prototype is not approved for real patient data without a security and compliance review.