# Rockstreet cPanel deployment Target: https://bilweb.rockstreet.co.za/ Access: cPanel File Manager and phpMyAdmin; no SSH assumed. ## Current readiness The local Drupal 11.4.6 site bootstraps and connects to its database. Local Composer validation and platform requirements pass, and the theme builds. The existing contact-page check and standalone recruitment parsing check pass. These checks do not establish compatibility with the Rockstreet server. **Launch blocked:** `composer audit --locked --no-dev` reports 18 security advisories affecting 9 packages, including Drupal core, on 4 November 2026. The audit exits with status 1. Resolve affected dependencies in a separate, tested update before creating a deployable release; no dependency versions were changed during this preparation. The theme is a nested Git repository recorded as a gitlink, with no .gitmodules mapping. Its compiled CSS and JavaScript are tracked in that nested repository. A clone or archive of the parent repository alone will omit the theme contents. Prepare uploads from the complete local filesystem, including that theme, until repository ownership is resolved separately. Do not change repository history as part of deployment. There is no versioned site configuration export. The existing database contains the site configuration and Canvas content: migrate the database and uploaded files together. Do not run a fresh Drupal installation or the page-installation scripts to recreate the site. ## Confirm with Rockstreet before preparing the final upload - PHP 8.4 is preferred to match local development. PHP 8.3 is Drupal's minimum, but the complete locked dependency set must pass platform checks for the selected PHP version. Ensure the domain and scheduled jobs use the same PHP. - Required PHP extensions must satisfy composer.lock; also enable the MySQL PDO driver. Check PHP memory, execution-time, upload and POST limits against the final archive and SQL sizes. Local public uploads are approximately 82 MB. - Database: MariaDB 10.6+ or MySQL 8.0+ according to this installed core. Local development uses MariaDB 11.8; test import compatibility with the actual server before cutover. - cPanel must allow this subdomain's document root to end in `/web`, with the rest of the project outside the public document root. Ask Rockstreet to set this if the control is locked. Do not expose the project root as a workaround. - Apache/LiteSpeed must honor Drupal's generated web/.htaccess, rewriting and access restrictions. An Nginx front end needs equivalent host-managed rules. - Confirm available disk space, phpMyAdmin import limits, AutoSSL, backups, scheduled jobs and outbound HTTPS access to the recruitment feed. - Confirm approved form notification recipients, mail transport, sender domain and retention/access requirements for stored submissions. ## Build the code upload locally Use a separate release staging directory outside the public site. Do not put archives, database dumps or credentials in this repository or a served folder. 1. Copy composer.json, composer.lock and the web directory into staging, including custom modules and the complete bidvest_bil theme. Exclude every .git directory/file, node_modules, local IDE files, logs, caches, database dumps, local settings/services files and web/sites/default/files. Transfer public files separately. Do not include .ddev or local credentials. 2. In staging, install the locked PHP dependencies: ```sh composer install --no-dev --prefer-dist --optimize-autoloader --no-interaction composer validate --no-check-publish composer check-platform-reqs --no-dev composer audit --locked --no-dev ``` Build with a PHP runtime compatible with Rockstreet. Do not use composer update or ignore platform requirements. Review audit results before launch. 3. In the staged web/themes/bidvest_bil directory: ```sh npm ci npm run build ``` Include build/main.min.css and build/motion.js, then omit node_modules from the archive. Node is required on the build machine only. 4. Verify the upload includes vendor/autoload.php, web/index.php, web/autoload.php, web/.htaccess, web/core, contributed modules/themes, custom modules, theme assets and built files. Show hidden files in File Manager. Composer scaffold files are absent from the parent Git index. 5. Archive the staged project and record its checksum and source revisions. Review the archive listing for local configuration and secrets before upload. ## Export content and files Freeze editorial changes for the final migration. Export the existing database locally with DDEV's export-db command to a protected directory outside webroot. Treat the dump as sensitive: it includes accounts and may include form data. Transfer it securely and import only into a new, empty destination database. Do not overwrite any existing Rockstreet database without a verified backup. Copy web/sites/default/files, including its protection files. Locate and migrate any configured private files separately, outside webroot. Database and file snapshots must correspond. Keep backup copies outside public access and remove temporary upload archives/dumps after verifying the migration. ## cPanel installation 1. Back up any existing domain files and database and record DNS settings. 2. Create a dedicated database and database user in cPanel, granting access only to this database. Record credentials in the approved password manager. 3. Extract the code archive into its final project directory. Set the subdomain document root to that directory's web folder. Import SQL using phpMyAdmin; ask Rockstreet to import it if the dump exceeds panel limits. 4. Create web/sites/default/settings.php on the server from the matching core's default.settings.php. Do not upload the local settings.php or DDEV settings. Enter the destination database details privately and generate a unique hash salt. Set trusted_host_patterns to `^bilweb\.rockstreet\.co\.za$` (one backslash before each dot). Do not use a wildcard. Keep settings read-only after editing. 5. Configure private files and temporary storage outside webroot, with only necessary write access. Make public uploaded files writable by the PHP user; keep application code read-only where hosting permits. Never use mode 777. 6. Disable development services, Twig debugging and verbose public error output. Enable CSS/JS aggregation and appropriate production caching. Inspect the imported settings for local URLs, mail destinations and external integrations. Do not change serialized database values with a text search-and-replace. 7. Issue and verify the TLS certificate, then enable the host's HTTPS redirect. Configure reverse-proxy trust only if Rockstreet supplies the actual topology and trusted proxy addresses. 8. Use /update.php as an authorized administrator if pending database updates exist; back up first. Keep update_free_access disabled. Clear caches at /admin/config/development/performance. Do not add public maintenance scripts. If login/cache state prevents this, ask Rockstreet to run Drush privately. 9. Review /admin/reports/status for runtime, database and filesystem issues. Configure cPanel Cron Jobs using the host-confirmed PHP binary and full Drush path, or use Drupal's cron URL privately. Never publish the cron key. 10. Configure and test mail delivery. The custom form installer creates storage Webforms without email handlers; inspect the migrated handlers before assuming notifications exist. Arrange recipients and sender authentication with the domain/mail owner. ## Acceptance before public launch - Verify HTTPS, canonical redirects, certificate and trusted-host enforcement. - Test anonymous desktop and mobile navigation, images, fonts, downloads, contact, careers, news, legal pages and all key service/industry pages. - Submit contact, quick-estimate and supplier forms with synthetic data. Verify validation, stored submissions, recipient delivery and anonymous access restrictions on submissions/admin routes. Remove test submissions afterward. - Verify recruitment-feed success and its unavailable-service fallback. - Confirm administrator login, Canvas editing, save/publish and cache refresh. - Verify uploaded PHP execution is blocked and private files are inaccessible. Verify /.git/HEAD, /composer.json, /vendor/autoload.php and sensitive settings cannot be downloaded. A successful page render alone is insufficient. - Confirm cron runs, logs are accessible to operators, backups are scheduled and a restore has been tested. Review dependency security audit results. - Remove upload archives, SQL dumps and temporary test files from the server. If this URL is a preview rather than the final public domain, apply host-level password protection and prevent indexing until public launch is authorized. ## Rollback Keep the previous code release, matching database/files snapshot and DNS values. If acceptance fails, keep traffic on the previous site. After cutover, pause writes before rollback and preserve new submissions/content for reconciliation; restoring an old database would otherwise lose them. Restore matching code, database and files, then clear caches and repeat critical checks. DNS rollback can take time due to caching. ## Outstanding launch gates Server access/capabilities, PHP/database versions, document-root control, TLS, final release archive, database/files export and import, live settings, mail, cron, security audit and destination smoke tests remain to be completed. No Rockstreet changes or public deployment have been performed by this prep.