# Admin deployment

1. Point the DNS record for `backoffice.ghabilee.ir` to the production VPS.
2. Create `/opt/ghabilee-admin/.env` from `.env.example` and set production values.
3. Issue TLS: `certbot certonly --webroot -w /var/www/html -d backoffice.ghabilee.ir` (after ACME path is reachable on port 80).
4. Deploy installs `deploy/nginx/backoffice.conf` when the cert exists (otherwise HTTP bootstrap); app listens on `127.0.0.1:3009`.
5. Push to `main` (or run the deploy workflow manually) after the environment is ready.

Deploy Telegram alerts use admin-specific copy in `scripts/notify-deploy.sh`
(success → backoffice URL; distinct from the consumer frontend message).

## GitHub secrets checkpoint

Deployment requires `VPS_HOST`, `VPS_USER`, and `VPS_SSH_KEY`. The repository owner will add these GitHub Actions secrets later, before the first deployment.