# Production deployment notes

This package is production-oriented infrastructure, but destination-host adapters must be implemented and validated against the destination hosts' current official/authorized APIs before enabling them.

Before production:
- Use HTTPS.
- Put public/ behind the web server document root.
- Keep app/, worker/, cron/, and database/ outside public web root.
- Set restrictive filesystem permissions.
- Use a dedicated MariaDB user with only the required database privileges.
- Use environment/secret management for API credentials rather than committing secrets.
- Configure systemd/Supervisor for the worker.
- Configure weekly cleanup cron.
- Back up MariaDB.
- Test failure/retry/cleanup behavior on a staging VPS.
- Do not use the service to bypass host restrictions, access controls, rate limits, DRM, or copyright enforcement.

Branding:
Admin -> Branding allows site name, logo URL, mobile logo URL, and favicon URL.

## Production V2 host features

Admin -> Hosts now supports:
- Internal adapter name
- Editable display name
- Host icon/logo URL
- Host website URL
- API endpoint/token fields
- Official API vs custom adapter
- Enabled/disabled
- Display position
- Concurrent upload limit
- Retry attempts
- Timeout

Successful mirror links open in a new tab with:
target="_blank" rel="nofollow noopener noreferrer"

Run database/migrate-v2.sql on an existing V1 database before using the new host fields.
Only configure integrations that use the destination host's documented/authorized upload interface.