# Deploying AMW BV to cPanel

The site is a Next.js **static export**. The repository holds the source at the
root and the built site in `out/`. `.cpanel.yml` copies `out/` into
`public_html`, so cPanel never needs to run Node.

## Release workflow

```bash
npm run build     # regenerates out/
git add -A && git commit -m "..." && git push
```

Then in cPanel → Git Version Control → **Manage** → **Update from Remote**,
followed by **Deploy HEAD Commit**.

Editing source alone does not change the live site — `out/` must be rebuilt
and committed.

---

## Connecting cPanel to the private GitHub repository

cPanel validates the clone URL and rejects a password component:

> The clone URL cannot include a password.

So `https://zohaib729:TOKEN@github.com/...` is refused — the problem is the
`:TOKEN` part, not the token itself. Options below, in order of preference.

### Option A1 — token as the username (try this first)

cPanel's check rejects the *password* part of a URL, i.e. everything after the
colon in `user:password@host`. A URL carrying only a username has no password
component, and GitHub accepts a PAT in the username position:

```
https://YOUR_TOKEN@github.com/zohaib729/amwbv-web.git
```

Note there is **no `zohaib729:` prefix and no colon**. This is the only
credential-bearing format with a chance of passing cPanel's validation. If
cPanel still refuses it, it is rejecting any credentials at all — use A2.

### Option A2 — token in `~/.git-credentials` (works regardless)

In cPanel → **Terminal** (or over SSH), run once:

```bash
git config --global credential.helper store
printf 'https://zohaib729:YOUR_NEW_TOKEN@github.com\n' > ~/.git-credentials
chmod 600 ~/.git-credentials
```

Then in cPanel → Git Version Control, use the **plain** URL with no credentials:

```
https://github.com/zohaib729/amwbv-web.git
```

Git reads the token from `~/.git-credentials` and cPanel never sees it.

`~/.netrc` works identically if you prefer it:

```bash
printf 'machine github.com\nlogin zohaib729\npassword YOUR_NEW_TOKEN\n' > ~/.netrc
chmod 600 ~/.netrc
```

No Terminal in your cPanel plan? Create the file in **File Manager** (enable
*Show Hidden Files* in Settings), then set its permissions to **0600**.

**Token requirements** — a fine-grained token must have:
- Repository access → *Only select repositories* → `amwbv-web` ticked
  (or *All repositories*)
- Repository permissions → **Contents: Read-only**

A classic token needs the `repo` scope.

### Option B — SSH deploy key (no token on the server)

This is the method cPanel documents for private repositories.

1. cPanel → **SSH Access** → *Manage SSH Keys* → generate a key, then
   **Authorize** it.
2. Copy the **public** key.
3. GitHub → repo → Settings → **Deploy keys** → *Add deploy key* → paste.
   Leave **Allow write access unchecked** — deployment only needs read.
4. Clone URL in cPanel:

```
git@github.com:zohaib729/amwbv-web.git
```

The key is read-only and works for this repository only, so it cannot reach
anything else in the account.

---

## Notes

- `out/.htaccess` ships with the build and carries the HTTPS redirect, the
  canonical `www` host, the security headers and the 404 page. `.cpanel.yml`
  copies `out/.` rather than `out/*` so that dotfile is included.
- If the token is ever pasted somewhere public, revoke it in GitHub →
  Developer settings and write a fresh one into `~/.git-credentials`.