# NTC website: cPanel installation guide

This package is for cPanel accounts that provide **Setup Node.js App** and MySQL/MariaDB. The website, CMS, forms, uploads and database require a continuously running Node.js application. Ordinary file-only hosting is not sufficient.

## 1. Create the database

1. Open **cPanel → MySQL Databases**.
2. Create a database named `ntc` and a user named `ntc`.
3. Create a strong database password and save it privately.
4. Add the user to the database and select **ALL PRIVILEGES**.
5. Note the full names shown by cPanel. They normally look like `account_ntc`.

The application creates its two tables automatically. If your host blocks automatic table creation, open **phpMyAdmin**, select the database, choose **Import**, and upload `database/schema.sql`.

## 2. Upload the website

1. In **File Manager**, create a private application directory such as `/home/ACCOUNT/ntc-app`. Do not put the whole application inside `public_html`.
2. Upload the ZIP file and extract it into that directory.
3. Confirm that `server.mjs`, `package.json`, `public`, `site` and `database` are directly inside `ntc-app`—not inside a second nested folder.
4. The downloadable ZIP deliberately excludes `.env`, `node_modules`, local caches, source-control files and development builds.

## 3. Configure the application

Copy `.env.example` to a new file named `.env`. Edit it and replace every `CHANGE_ME` value. Example:

```ini
NODE_ENV=production
PORT=3000
HOST=0.0.0.0
SITE_URL=https://www.ntc.ug
DB_HOST=localhost
DB_PORT=3306
DB_NAME=account_ntc
DB_USER=account_ntc
DB_PASSWORD=PASTE_THE_DATABASE_PASSWORD
ADMIN_USERNAME=ntc-admin
ADMIN_PASSWORD=PASTE_A_NEW_PASSWORD_WITH_12_OR_MORE_CHARACTERS
SESSION_SECRET=PASTE_A_RANDOM_STRING_LONGER_THAN_32_CHARACTERS
RECOVERY_CODE=PASTE_A_LONG_PRIVATE_RECOVERY_CODE
UPLOAD_DIR=./public/uploads
```

Never share `.env`. The initial administrator password is converted to a salted scrypt hash the first time the application starts. Changing `ADMIN_PASSWORD` later does not overwrite the saved password; use **CMS → Change password**. The recovery code in `.env` enables the no-email **Forgot password** screen.

## 4. Create the Node.js application

1. Open **cPanel → Setup Node.js App**.
2. Choose Node.js **20.17 or newer**.
3. Set **Application mode** to `Production`.
4. Set **Application root** to `ntc-app`.
5. Choose the domain or subdomain that will host the website.
6. Set **Application startup file** to `server.mjs`.
7. Choose **Create**.
8. In the application screen, choose **Run NPM Install**. If your cPanel shows a command instead, copy it into **Terminal**, change into the application directory, and run:

```bash
npm install --omit=dev
npm run check
```

9. Return to **Setup Node.js App** and choose **Restart**.

The first successful request creates the tables, securely creates the initial administrator, and loads labelled placeholder content automatically. No separate seed command is required.

## 5. Open the website and CMS

```text
Website: https://www.ntc.ug/
CMS:     https://www.ntc.ug/admin
```

Sign in with the `ADMIN_USERNAME` and original `ADMIN_PASSWORD` from `.env`, then immediately use **Change password**. Store the recovery code offline in a secure organisational password manager.

## 6. Enable HTTPS

1. Point the domain's DNS records to the cPanel server as instructed by the host.
2. Open **cPanel → SSL/TLS Status**.
3. Select the domain and choose **Run AutoSSL**.
4. Confirm that `SITE_URL` starts with `https://`, restart the Node.js application, and visit the site using HTTPS.

## 7. Backups and updates

- Include the MySQL database and `public/uploads` in every backup.
- Never delete `public/uploads` during an update.
- Before replacing application files, download a database backup from phpMyAdmin and a copy of the uploads directory.
- Routine content, staff profiles, programmes, images, colours, enquiries and newsletter records are managed through `/admin` and do not require another upload.

## Before launch

All photographs, statistics, people, contact details, partner information, programme copy and legal text supplied in this package are clearly labelled placeholders. Replace and verify them through the CMS before public launch.