# Hosting Installation Guide

The application is designed for a PHP/MySQL shared-hosting account or a VPS. It is not deployed through the sandbox web preview because the target runtime is PHP with MySQL rather than the preview's Node.js service.

| Step | Shared-hosting action | VPS action |
|---|---|---|
| Database | Create a MySQL database/user in the hosting panel. Import `database/schema.sql` through phpMyAdmin. | Create a database/user with `mysql`, then import `schema.sql`. |
| Configuration | Copy `config/config.example.php` to `config/config.php` and enter database credentials. | Same action; protect the file with filesystem permissions. |
| Public root | Point the domain/subdomain to the `public/` directory if the host supports it. Otherwise upload `public/` files to `public_html/` and keep app/config folders outside public HTML. | Configure the Apache or Nginx document root as `/path/to/perangkat-guru/public`. |
| HTTPS | Enable the hosting provider's SSL certificate before creating the first admin user. | Provision a TLS certificate, for example through the server's certificate tooling. |
| Initial account | Open the domain, then submit the first admin form with the private `installer_key`. | Same action. |

The first page shows setup only when the `users` table has no record. After account creation, the application presents the login page. Store the `installer_key` as a secret and replace it immediately if it was exposed.

## Shared-hosting folder layout

The safest layout keeps source and configuration above the browser-accessible directory.

```text
/home/account/perangkat-guru/app
/home/account/perangkat-guru/config
/home/account/perangkat-guru/database
/home/account/perangkat-guru/storage
/home/account/public_html/index.php
/home/account/public_html/.htaccess
/home/account/public_html/assets/
```

When the host requires this layout, set the first line in `public/index.php` to require the real application location, for example `require '/home/account/perangkat-guru/app/bootstrap.php';`. The packaged default expects `public/` to be a direct child of the project folder; it works unchanged when a subdomain document root can be set to that directory.

## Production Checklist

| Control | Expected state |
|---|---|
| PHP version | 8.1 or later, with `pdo_mysql` enabled |
| MySQL connection | Uses a dedicated account and a unique database |
| Charset | Database and connection use `utf8mb4` |
| HTTPS | Enabled before teachers begin using the system |
| File permissions | `config/config.php` is not writable by the web-server user after setup |
| Backups | Database backup is scheduled outside the application |
| Access | The web root exposes only the `public/` folder |