# Maven Group CMS backend → api.mavengroupglobal.com

This zip is a **complete, ready-to-run Laravel 11 application**. `vendor/` is
included, so you do not need to run Composer on the server.

It also contains `database/maven_cms.sql` — a dump of the working database
with **289 published blog posts (all with full article bodies)**, the 12
service pages, and site/SEO settings. Import that and you're done; there's no
need to re-run the migrations, seeders or the WordPress import.

---

## 1. Upload and extract

Upload the zip to your cPanel account and extract it so the contents land in
the subdomain's folder:

```
~/api.mavengroupglobal.com/
    app/  bootstrap/  config/  database/  public/  routes/  storage/  vendor/
    artisan  composer.json  .env.production.example
```

## 2. Point the document root at `public/`

cPanel → **Domains** → edit `api.mavengroupglobal.com` → Document Root:

```
/home/<cpaneluser>/api.mavengroupglobal.com/public
```

**This is the most important step in the whole file.** If the document root is
the project root instead, then `https://api.mavengroupglobal.com/.env` serves
your database password and application key to anyone who asks for it.

Set PHP to **8.2 or newer** in cPanel → **MultiPHP Manager**.

## 3. Create the database and import the data

cPanel → **MySQL Databases**: create a database and a user, and add the user to
the database with **All Privileges**.

Import via cPanel → **phpMyAdmin** → select the database → **Import** →
`database/maven_cms.sql`. Or over SSH:

```bash
mysql -u cpaneluser_maven -p cpaneluser_maven_cms < database/maven_cms.sql
```

## 4. Configure the environment

```bash
cd ~/api.mavengroupglobal.com
cp .env.production.example .env
php artisan key:generate
```

Then edit `.env` and fill in `DB_DATABASE`, `DB_USERNAME`, `DB_PASSWORD`. The
file explains every other value inline — the CORS and Sanctum notes matter,
don't skip them.

## 5. Finish up

```bash
php artisan storage:link
php artisan config:cache
php artisan route:cache
chmod -R 775 storage bootstrap/cache
```

`storage:link` must be run on the server — the symlink cannot travel in a zip.
Without it every uploaded image 404s.

**Re-run `php artisan config:cache` after any future `.env` edit**, or the
change is silently ignored.

## 6. Verify, in order

1. `https://api.mavengroupglobal.com/` → `{"name":"Maven Group CMS API","status":"ok"}`
2. `https://api.mavengroupglobal.com/api/public/settings/site` → settings JSON
3. `https://api.mavengroupglobal.com/api/public/blog` → your posts
4. `https://api.mavengroupglobal.com/.env` → **must be 403 or 404.**
   If it downloads, go back to step 2 before doing anything else.

## 7. Change the admin password

The dump carries the seeded super-admin:

```
admin@mavengroup.com / ChangeMe!12345
```

Log in at `https://admin.mavengroupglobal.com` and change it immediately.

---

## Starting from scratch instead of the dump

Only if you want an empty CMS rather than the imported content:

```bash
php artisan migrate --seed --force
php artisan content:import-real        # site settings + 12 service pages
php artisan blog:import-wordpress      # 289 posts with full bodies from WordPress
```

`blog:import-wordpress` reads the live WordPress REST API, so it only works
**while WordPress still answers on mavengroupglobal.com**. Once the Next.js
site takes that domain over, the dump in this zip is the only copy of those
article bodies.

## Pulling in new blog posts later

While WordPress is still live, this is the whole job:

```bash
php artisan blog:import-wordpress
```

Safe to re-run — it matches posts on slug, and will not overwrite body text you
have edited in the dashboard unless you pass `--overwrite-content`. Add
`--dry-run` to see what it would do first.

## Notes

- `vendor/` was installed against PHP 8.2. If your server runs PHP 8.1 or
  older, the app will not boot — change the PHP version rather than the code.
  To rebuild dependencies yourself: `composer install` (you may need
  `composer config audit.block-insecure false` first, because Composer 2.9
  blocks Laravel 11 releases that have open security advisories).
- `.env` is deliberately **not** in this zip. Never upload one from a local
  machine — it carries a different `APP_KEY`, and changing `APP_KEY` later
  invalidates every existing login session and password reset token.
- Blog images referenced by post bodies live on the **Next.js** site under
  `public/storage/`, not here. This app's `storage/` holds only what gets
  uploaded through the dashboard's Media Library.