# Production Deployment Checklist

## Your Info
- **Domain**: sales.globalerc.pt
- **Public IP**: 78.137.202.90
- **Local IP**: 192.168.10.67
- **Flask Port**: 5000

---

## Pre-Deployment

- [ ] Read DEPLOYMENT_README.md
- [ ] Backed up current app.py
- [ ] Tested Flask locally on port 5000
- [ ] Have access to domain registrar account
- [ ] Have access to router admin panel

---

## Phase 1: DNS Configuration ⚙️

- [ ] Logged into domain registrar
- [ ] Located DNS Management section
- [ ] Found existing A record for "sales"
- [ ] Updated A record:
  - [ ] Type: A
  - [ ] Value: 78.137.202.90
  - [ ] TTL: 300
- [ ] Removed old A record (if pointing elsewhere)
- [ ] Saved DNS changes
- [ ] Waited 5-15 minutes for propagation
- [ ] Tested DNS: `nslookup sales.globalerc.pt` → returns 78.137.202.90

---

## Phase 2: Router Configuration 🔌

- [ ] Accessed router admin panel
- [ ] Located Port Forwarding settings
- [ ] Created Port 80 forwarding rule:
  - [ ] External: 80 (TCP)
  - [ ] Internal: 192.168.10.67:80
- [ ] Created Port 443 forwarding rule:
  - [ ] External: 443 (TCP)
  - [ ] Internal: 192.168.10.67:443
- [ ] Saved/Applied settings
- [ ] Router restarted (if required)

---

## Phase 3: Nginx Installation 📦

- [ ] Installed Chocolatey (if not already done)
- [ ] Installed Nginx: `choco install nginx`
- [ ] Verified Nginx: `nginx -v` shows version
- [ ] Located Nginx folder: C:\nginx

---

## Phase 4: Nginx Configuration ⚙️

- [ ] Copied nginx.conf to C:\nginx\conf\nginx.conf
- [ ] Tested config: `cd C:\nginx; .\nginx.exe -t`
- [ ] Config test passed (no errors)
- [ ] Updated SSL certificate paths in nginx.conf (once certs obtained)

---

## Phase 5: SSL Certificate 🔐

Choose ONE method:

### Option A: ZeroSSL (Easiest)
- [ ] Created ZeroSSL account
- [ ] Added certificate for sales.globalerc.pt
- [ ] Completed domain verification
- [ ] Downloaded certificate files
- [ ] Created folder: C:\certbot\live\sales.globalerc.pt\
- [ ] Placed fullchain.pem in folder
- [ ] Placed privkey.pem in folder
- [ ] Updated paths in nginx.conf

### Option B: Certbot (WSL2)
- [ ] Installed WSL2 with Ubuntu
- [ ] Installed certbot: `sudo apt install certbot`
- [ ] Generated certificate: `sudo certbot certonly --standalone -d sales.globalerc.pt`
- [ ] Created C:\certbot\live\sales.globalerc.pt\ folder
- [ ] Copied certificate files
- [ ] Updated paths in nginx.conf

### Option C: Let's Encrypt (Windows)
- [ ] Downloaded Certbot for Windows
- [ ] Generated certificate
- [ ] Placed in C:\certbot\live\sales.globalerc.pt\
- [ ] Updated nginx.conf paths

Status: **Method _____ completed**

---

## Phase 6: Service Startup 🚀

Nginx:
- [ ] Opened PowerShell as Administrator
- [ ] Changed to C:\nginx
- [ ] Ran `.\nginx.exe`
- [ ] Verified Nginx running: `Get-Process nginx`
- [ ] Verified port 443 listening: `netstat -an | findstr :443`

Flask:
- [ ] Opened separate PowerShell window
- [ ] Ran `.\run_prod.ps1`
- [ ] Verified Flask running: `Get-Process python`
- [ ] Verified port 5000 listening: `netstat -an | findstr :5000`

---

## Phase 7: Google OAuth Update 🔐

- [ ] Logged into Google Cloud Console
- [ ] Selected correct project
- [ ] Went to APIs & Services → Credentials
- [ ] Opened OAuth 2.0 Client
- [ ] Added authorized redirect URIs:
  - [ ] `https://sales.globalerc.pt/oauth2callback`
  - [ ] `http://localhost:5000/oauth2callback` (dev)
- [ ] Saved changes
- [ ] Waited a few minutes for changes to apply

---

## Phase 8: Testing 🧪

DNS:
- [ ] `nslookup sales.globalerc.pt` → 78.137.202.90 ✓
- [ ] `nslookup sales.globalerc.pt 8.8.8.8` → 78.137.202.90 ✓

Port Status:
- [ ] Port 80 listening
- [ ] Port 443 listening
- [ ] Port 5000 listening locally

HTTP to HTTPS:
- [ ] `curl -iL http://sales.globalerc.pt` → redirects to HTTPS
- [ ] HTTP headers show 301 redirect

HTTPS:
- [ ] `curl -v https://sales.globalerc.pt` → returns 200 OK
- [ ] SSL certificate valid (no warnings)
- [ ] HTTPS works in browser: https://sales.globalerc.pt

Application:
- [ ] Dashboard loads: `https://sales.globalerc.pt/dashboard`
- [ ] CSS/images load correctly
- [ ] Not getting "mixed content" warnings
- [ ] Login redirect works

OAuth:
- [ ] Click Google/Microsoft login button
- [ ] Redirected to OAuth provider
- [ ] Successfully authenticated
- [ ] Redirected back to dashboard

---

## Phase 9: Monitoring 📊

- [ ] Services stay running after restart
- [ ] Check Nginx logs: C:\nginx\logs\
- [ ] Check Flask logs (check terminal)
- [ ] Test again after 1 hour (DNS propagation complete)
- [ ] Set up monitoring script (optional)

---

## Phase 10: Backup & Documentation 📋

- [ ] Backed up nginx.conf
- [ ] Documented final configuration
- [ ] Created maintenance notes
- [ ] Set calendar reminder for SSL renewal (3 months before expiry)

---

## Common Issues & Solutions

If DNS not resolving:
- [ ] Confirm registrar changes saved
- [ ] Wait 15+ minutes
- [ ] Try `ipconfig /flushdns`
- [ ] Try different DNS: `nslookup sales.globalerc.pt 8.8.8.8`

If Nginx won't start:
- [ ] Check config with `.\nginx.exe -t`
- [ ] Check log files in C:\nginx\logs\
- [ ] Verify port 443 not already in use
- [ ] Check firewall allows port 443

If SSL certificate errors:
- [ ] Verify file paths in nginx.conf match actual files
- [ ] Check certificate validity
- [ ] Ensure fullchain.pem (not just cert.pem)

If login doesn't work:
- [ ] Verify Google OAuth redirect URIs updated
- [ ] Check browser console for error messages
- [ ] Verify HTTPS is working

---

## Completion

- [ ] All phases completed
- [ ] All tests passed
- [ ] Production dashboard accessible at https://sales.globalerc.pt
- [ ] Team notified of new URL
- [ ] Old URL still redirects (if applicable)

**Date Completed**: ________________

**Deployed By**: ________________

**Notes**: 
________________________________________________________________
________________________________________________________________
________________________________________________________________

---

📍 You're live! Enjoy your production deployment! 🎉