# Deployment guide

## 1. Get the code onto the server

```bash
sudo mkdir -p /opt/brand-manual-server
sudo chown $USER /opt/brand-manual-server
cd /opt/brand-manual-server
# copy/unzip the brand-manual-server bundle here
```

## 2. Python environment

```bash
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
playwright install --with-deps chromium
```

## 3. Test it runs

```bash
uvicorn app:app --host 127.0.0.1 --port 8000
# in another shell:
curl -s localhost:8000/ -o /dev/null -w "%{http_code}\n"   # expect 200
```

Ctrl+C once confirmed -- systemd takes over from here.

## 4. Persistent service (systemd)

```bash
sudo cp deploy/brand-manual.service /etc/systemd/system/
sudo useradd --system --no-create-home www-data 2>/dev/null || true  # usually already exists
sudo chown -R www-data:www-data /opt/brand-manual-server
sudo systemctl daemon-reload
sudo systemctl enable --now brand-manual
sudo systemctl status brand-manual   # should show "active (running)"
```

Note the service binds to `127.0.0.1:8000` only -- it's not reachable from
outside the box directly. That's intentional; the reverse proxy is the
only public entry point.

## 5. Reverse proxy + TLS

Pick one:

**Caddy (simplest — automatic HTTPS, no certbot):**
```bash
# install caddy: https://caddyserver.com/docs/install
sudo cp deploy/Caddyfile /etc/caddy/Caddyfile
# edit the domain inside it first
sudo systemctl restart caddy
```

**nginx (if you already run it elsewhere on this box):**
```bash
sudo cp deploy/nginx-brand-manual.conf /etc/nginx/sites-available/brand-manual.conf
# edit the domain inside it first
sudo ln -s /etc/nginx/sites-available/brand-manual.conf /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d brands.yourdomain.com   # adds TLS
```

Either way: point your domain's A record at the server's IP *before*
running certbot/Caddy, or certificate issuance will fail.

## 6. Verify end to end

```bash
curl -s https://brands.yourdomain.com/ -o /dev/null -w "%{http_code}\n"   # expect 200

curl -s -o test.pdf \
  -F "client_name=Test Co" \
  -F "logo=@/path/to/a/logo.png;type=image/png" \
  https://brands.yourdomain.com/generate
file test.pdf   # should say "PDF document"
```

## Redeploying after changes

```bash
cd /opt/brand-manual-server
git pull   # or re-copy updated files
sudo systemctl restart brand-manual
```

## Notes carried over from app.py

- Single worker, synchronous generation -- fine for low-traffic testing,
  each PDF render spins up headless Chromium which is memory-hungry, so
  don't raise `--workers` without also sizing the server's RAM for it
- `jobs/` is never cleaned up automatically -- add a cron job once this
  runs unattended for any length of time:
  `0 3 * * * find /opt/brand-manual-server/jobs -mtime +1 -exec rm -rf {} +`
- No auth, no rate limiting -- fine for a private test deployment behind
  a domain only you know about, not fine once this is publicly linked