Production Deployment

Point the domain to Laravel's public directory and use .env.production.example as the secure starting point.

Before opening traffic

1. Set APP_ENV=production, APP_DEBUG=false, an HTTPS APP_URL, and a generated APP_KEY.
2. Keep SESSION_ENCRYPT=true, SESSION_SECURE_COOKIE=true, and use database/Redis sessions, cache, and a non-sync queue.
3. Keep PUBLIC_BOOKING_MANUAL_PAYMENT_ENABLED=false. Configure signed live Stripe/PayPal webhooks before enabling those providers.
4. Run php artisan migrate --force, php artisan storage:link, and cache configuration, routes, and views.
5. Confirm storage/app/installed exists and set INSTALLER_ENABLED=false.
6. Start scheduler and queue supervision, configure real SMTP, and complete a backup/restore drill.

Release gates

composer validate --strict
composer audit
npm audit --omit=dev
npm run build
php artisan access:audit --fail-on-drift
php artisan schedule:list
php artisan test --stop-on-failure

If any production safety requirement is unsafe, the application deliberately responds with HTTP 503 and logs the violations instead of continuing insecurely.