# SoftSuite CMS Production Checklist

## Required before go-live
1. Use PHP 8.3+ and MySQL 8+; install Composer dependencies and build Vite assets.
2. Configure APP_ENV=production, APP_DEBUG=false, HTTPS, secure cookies, real MAIL_*, QUEUE_CONNECTION=database or redis.
3. Run `php artisan migrate --force`, `php artisan db:seed --force`, then change/remove all demo credentials.
4. Configure only the real office public IP/CIDR values. Never whitelist broad internet ranges.
5. Configure trusted proxies carefully so `Request::ip()` reflects the real client only through your known reverse proxy/load balancer.
6. Enable MFA for Founder, HR and Finance users.
7. Run `php artisan test`, `php artisan route:list`, `php artisan config:cache`, `php artisan route:cache`, `php artisan view:cache`.
8. Install Supervisor config for queue workers and cron entry for scheduler.
9. Verify SMTP delivery, password reset, MFA messages, document privacy, backup creation/restoration.
10. Run browser tests from the actual office network and a non-office network; confirm the second cannot create attendance.
11. Verify HTTPS/HSTS, CSP, file upload limits, DB least-privilege account, firewall, backups, monitoring and log rotation.

## Deployment-only acceptance tests
Production proxy/client-IP behavior, DNS/TLS, SMTP, filesystem permissions, queue daemon uptime, cron execution, restore drills and real office-network attendance cannot be truthfully certified inside a source-code build environment. They must be executed on the target server.