# Deploying Domain Monitor to cPanel

Plain PHP + MySQL — no build step. The steps are: upload files, import the DB,
fix `config.php`, set the GSC key path, add cron jobs, and switch the Telegram bot
to a webhook.

Assume your dashboard will live at:  `https://yourdomain.com/domain-monitor/`
(Adjust paths to match where you put it.)

---

## 1. Database
1. cPanel → **MySQL Databases** → create a database (e.g. `user_domainmon`) and a
   user, and **add the user to the database with ALL PRIVILEGES**.
2. cPanel → **phpMyAdmin** → select that database → **Import** → upload `backup.sql`
   (the export from your PC). This brings over your domains, settings, and history.
   - `backup.sql` starts with `CREATE DATABASE domain_monitor` — either import into a
     DB named `domain_monitor`, or open the file and change that name to your cPanel
     DB name first. Easiest: create the DB, then import.

## 2. Upload the files
- Zip the `domain-monitor` folder, upload via **File Manager** (or FTP) into
  `public_html/`, and **Extract**. (Or put it in a subdomain's docroot.)
- **Do NOT upload** these PC-only files: `start-bot.bat`, `run-bot-hidden.vbs`,
  `backup.sql` (delete it after import — it contains secrets).

## 3. Edit `config.php`
```php
define('DB_HOST', 'localhost');          // cPanel MySQL is local
define('DB_NAME', 'user_domainmon');     // your cPanel DB name (with prefix)
define('DB_USER', 'user_domainmon');     // your cPanel DB user
define('DB_PASS', 'the-db-password');
define('ADMIN_USER', 'pick-a-name');     // CHANGE from admin/changeme
define('ADMIN_PASS', 'a-strong-password');
date_default_timezone_set('Asia/Kuala_Lumpur');
```

## 4. GSC credentials
- Upload your service-account key (the `onesignal-...json`) somewhere **not public** —
  ideally **above** `public_html` (e.g. `/home/user/credentials.json`).
- In the dashboard → **Settings**, or in phpMyAdmin `settings` table, set
  **`gsc_credentials_path`** to that server path (the old value points to `C:\xampp\...`
  and must be changed).
- The `.htaccess` already blocks `*.json` over the web (Apache/cPanel), so even if the
  key sits in the app folder it returns 403 — but above `public_html` is safest.

## 5. Cron jobs (cPanel → Cron Jobs)
Use the PHP CLI path cPanel shows (often `/usr/local/bin/php`). Replace the path.
```
# Hourly fast report (uptime, SSL, Google rank, your-connection, agents)
0 * * * * /usr/local/bin/php /home/USER/public_html/domain-monitor/cron/run.php deep=0

# Twice-daily full deep check (Globalping + RIPE + MYNIC)
0 7,19 * * * /usr/local/bin/php /home/USER/public_html/domain-monitor/cron/run.php
```
(These replace the Windows Task Scheduler jobs.)

## 6. Telegram bot → webhook (replaces the always-on poller)
Shared cPanel can't run a permanent process, so use a webhook instead.
From the cPanel **Terminal** (or run once via a one-off cron), with HTTPS active:
```
/usr/local/bin/php /home/USER/public_html/domain-monitor/cron/set_webhook.php \
  https://yourdomain.com/domain-monitor/api/bot_webhook.php
```
- This registers the webhook + a secret token (stored in settings). Telegram will now
  POST messages to `api/bot_webhook.php`, which replies instantly. No process to keep up.
- To go back to local polling later: `php cron/set_webhook.php --delete`.
- ⚠️ Only ONE of {webhook, local poller} can be active per bot. On the server use the
  webhook; don't also run `cron/bot.php`.

## 7. First load + verify
1. Open `https://yourdomain.com/domain-monitor/admin/` → log in with your new admin creds.
2. The schema auto-applies on first load; your imported data should show.
3. Confirm secrets are blocked (should be **403**):
   `https://yourdomain.com/domain-monitor/config.php`
   `https://yourdomain.com/domain-monitor/credentials.json` (or wherever the key is)
4. In Telegram, send the bot `/list` — the webhook should reply.
5. Trigger a check: open `cron/run.php?key=<cron_key>&deep=0` (the cron key carried over
   in the DB; find it in Settings or the `settings` table).

## 8. Tidy up
- Delete `backup.sql` from the server after import.
- HTTPS: cPanel AutoSSL gives you TLS — the admin session cookie auto-upgrades to Secure.

---

## After this is live → the visitor beacon
Once the dashboard answers on a public HTTPS URL, the **beacon** can be added: a small
JS snippet on your sites that reports each real visitor's reachability, mapped to their
ISP — lighting up Celcom/Digi (and every ISP) automatically. That's the next step.