# Core License System Deployment

## Recommended Split Install

Extract the split ZIP from the cPanel account home folder, not inside `public_html`.

Expected IPOS layout:

```text
/home4/iposcomp/core_license_app/
    app/
    storage/
    config.php
    database/
    client_sdks/

/home4/iposcomp/public_html/core/
    index.php
    assets/
    .htaccess
```

Only `/home4/iposcomp/public_html/core` should be browser-accessible.

Create the private signing key folder before opening Server Control:

```text
/home4/iposcomp/core_license_private/storage/keys
```

Make sure PHP can write to that folder.

## Database

For IPOS, import:

```text
database/core_license_iposcomp_core_AUTHORITY_HARDENED_20260709-014500.sql
```

For Parallax, import:

```text
database/parallax_core_AUTHORITY_HARDENED_20260709-014500.sql
```

These include `CoreTokenRevocations`, `CoreLoginAttempts`, `CoreIpAllowlist`, and `CoreKeyRotationHistory`.

## Email

Open Settings -> SMTP Email Setup.

- Enable Email
- Fill SMTP host, port, encryption, username, password, from email
- Click Send Test Email
- Use the Digest Cron URL in Windows Task Scheduler or hosting cron every 5 hours

## Security Checklist

- Use a strong owner admin password.
- Enable Two-Factor Authentication.
- Keep private signing keys outside public web access. Production configs should set `security.signing_key_path` to a folder like `/home/parallax/core_license_private/storage/keys` or `/home4/iposcomp/core_license_private/storage/keys`.
- If you cannot split the deployment, the root `.htaccess` blocks browser access to `app/`, `storage/`, `database/`, `client_sdks/`, `docs/`, and `config.php`.
- Do not deploy local `config.php`, session files, or generated private keys from another machine.
- Delete or block `/public/install` after production setup if your environment allows it.