# TANRAIL ONE — Deployment & Infrastructure

## 1. Current State
- The target infrastructure has not been formally provisioned yet.
- **TBD — Infrastructure Decision Required:** A decision is needed regarding cloud hosting (AWS/DigitalOcean/Azure) vs. on-premise hosting. Given the multi-branch nature of the businesses, a cloud-hosted solution is strongly recommended to ensure accessibility from all locations.

## 2. Target Production Architecture (Proposed)

### 2.1 Server Stack
- **Load Balancer:** For SSL termination and traffic routing.
- **Application Servers:** At least two distinct nodes running Nginx and PHP-FPM (Laravel) for high availability.
- **Database:** Managed PostgreSQL or MySQL cluster with daily automated backups and Point-In-Time-Recovery (PITR) enabled.
- **Cache & Queues:** Managed Redis instance (essential for session sharing across app nodes and processing background jobs).

### 2.2 Asset Storage
- **Public Assets:** CSS, JS, and UI images served via CDN.
- **Private Files:** Uploaded documents (Invoices, Receipts, Contracts) must be stored in private object storage (e.g., AWS S3) and accessed via signed URLs to enforce authorization.

## 3. Deployment Process
- Implement Zero-Downtime Deployments (e.g., using Laravel Envoyer or a GitHub Actions pipeline).
- **Migration Strategy:** Database migrations must be non-destructive where possible.

## 4. Monitoring & Logging
- **Application Errors:** Sentry or Flare/Bugsnag integration to catch PHP and JavaScript exceptions.
- **Server Health:** New Relic or Datadog for CPU/Memory/DB Query performance monitoring.
- **Audit Logs:** Application-level audit logs (Doc 10) are stored in the database, but critical security events should also be streamed to external logs (e.g., CloudWatch).