# Host the API on StormerHost

StormerHost runs Node.js through **cPanel → Setup Node.js App** (CloudLinux / Passenger). MongoDB is not included — keep using Atlas. The API does not need a local database on the server.

## 1. Atlas (before you upload)

1. Open [MongoDB Atlas](https://cloud.mongodb.com) → Network Access.
2. Allow the StormerHost server IP, or temporarily `0.0.0.0/0` if the shared-host IP changes.
3. Confirm `MONGODB_URI` includes the database name, e.g. `...mongodb.net/pag_pms?retryWrites=true&w=majority`.

## 2. Pack the API (on your Mac)

From `backend/`:

```bash
npm run pack:host
```

That creates `pag-pms-api-stormerhost.zip` without `node_modules` or `.env`. Do not zip secrets.

## 3. Create the Node app in cPanel

1. Log in to cPanel.
2. **Software → Setup Node.js App → Create Application**.
3. Set:
   - **Node.js version:** 20 (or 18+). Do not use 10/12/14.
   - **Application mode:** Production
   - **Application root:** e.g. `pag-api` (a folder in your home directory, not `public_html` unless you intend that)
   - **Application URL:** a subdomain such as `api.yourdomain.com` (create the subdomain first if needed)
   - **Application startup file:** `app.js`
4. Click **Create**.
5. Open **File Manager**, go into that application root, and **delete** the sample `app.js` cPanel created.

## 4. Upload files

1. In File Manager, open the application root.
2. Upload `pag-pms-api-stormerhost.zip` and extract it there (or upload the `backend/` files so `app.js` and `package.json` sit in the root of the app).
3. Create a `.env` file in that same folder (File Manager → + File). Paste production values:

```
NODE_ENV=production
CLIENT_ORIGIN=https://your-frontend-domain.com
MONGODB_URI=mongodb+srv://USER:PASSWORD@cluster.mongodb.net/pag_pms?retryWrites=true&w=majority
JWT_SECRET=long-random-string
JWT_REFRESH_SECRET=another-long-random-string
JWT_EXPIRES_IN=15m
JWT_REFRESH_EXPIRES_IN=7d
COOKIE_SECURE=true
COOKIE_SAMESITE=none
SUPER_ADMIN_EMAIL=admin@pag.gh
SUPER_ADMIN_PASSWORD=your-strong-password
SUPER_ADMIN_NAME=PAG Super Admin
SUPER_ADMIN_PHONE=+233200000000
UPLOAD_DIR=uploads
MAX_UPLOAD_MB=8
FIREBASE_PROJECT_ID=
FIREBASE_CLIENT_EMAIL=
FIREBASE_PRIVATE_KEY=
FIREBASE_STORAGE_BUCKET=
```

Leave `PORT` unset — cPanel injects it.  
`CLIENT_ORIGIN` must be the exact frontend origin (scheme + host, no trailing slash). If you still test from localhost, add both:

`CLIENT_ORIGIN=https://your-frontend-domain.com,http://localhost:5173`

Firebase private key: keep the `\n` sequences in one line inside `.env`. Do not use the cPanel “environment variables” form for the PEM; it often breaks multiline keys.

## 5. Install, start, seed

1. **Setup Node.js App** → find the app → **Run NPM Install**.
2. **Restart** the application.
3. Open a terminal in cPanel (or SSH), enter the Node virtualenv cPanel shows on that page (the `source ~/nodevenv/.../bin/activate && cd ~/pag-api` command), then:

```bash
node scripts/seedAdmin.js
```

Optional: `node scripts/seedRegions.js`

If cPanel shows *“check availability of application has failed”* and a `text/html` vs `application/json` mismatch: that is the panel’s health probe, not a failed install. The probe hits `/` and compared the default HTML sample to the API. The current `app.js` answers `/` as HTML so the check should pass. Confirm `node_modules` exists, **Restart**, then open `/api/health`.

## 6. Check it

Live API: [https://progressiveapi.kasoamarket.org](https://progressiveapi.kasoamarket.org)

- Health: [https://progressiveapi.kasoamarket.org/api/health](https://progressiveapi.kasoamarket.org/api/health)
- Docs: [https://progressiveapi.kasoamarket.org/api/docs](https://progressiveapi.kasoamarket.org/api/docs)

Health should return `{ "success": true, "data": { "status": "ok", ... } }`.

If health fails: **Setup Node.js App → stderr log**. Typical causes: Atlas IP not allowed, missing `.env`, Node version too old, or the startup file is not `app.js` in the app root.

## 7. Point the frontend at it

Frontend `VITE_API_URL` is:

```
VITE_API_URL=https://progressiveapi.kasoamarket.org/api
```

Restart `npm run dev` after changing `.env` (Vite reads it at startup).

On StormerHost, set `CLIENT_ORIGIN` to the Netlify site (and localhost if you still run the UI locally), then **Restart** the Node app:

```
CLIENT_ORIGIN=http://localhost:5173,https://pag-portal.netlify.app
COOKIE_SECURE=true
COOKIE_SAMESITE=none
```

Then **Restart** the Node application. Refresh cookies need `COOKIE_SECURE=true` and `COOKIE_SAMESITE=none` because the web app and API are on different sites.

After every file change on the server, **Restart** the Node application.