# Step-by-step: upload NCSBFC to Epic hosting and turn on SSL

You will upload **one folder**: `ncsbfc-families`.  
Everyone lands on the homepage. Quote forms email **info@ncsbfc.com** when mail is configured.

---

## Before you start

Have these ready:

1. Your Epic/cPanel login  
2. Your domain name (example: `ncsbfc.com`)  
3. SSL already on that domain (you said Epic has SSL)  
4. An email mailbox for **info@ncsbfc.com** (create it in cPanel → Email Accounts if it does not exist)  
5. The mailbox password for info@ncsbfc.com  

On your Mac, the site folder is:

`/Users/toddsiebels/ncsbfc-families`

---

## Step 1 — Make a secret key

On your Mac, Terminal:

```bash
python3 -c "import secrets; print(secrets.token_urlsafe(48))"
```

Copy the long string. That is your `SECRET_KEY`. Do not reuse the default in the code.

---

## Step 2 — Zip the site

1. In Finder, go to `/Users/toddsiebels/ncsbfc-families`  
2. Zip **the contents of that folder**, or zip the folder itself  
3. Keep these files inside: `app.py`, `passenger_wsgi.py`, `requirements.txt`, `config.py`, `leads.py`, `accounts.py`, `templates`, `static`, `data`

Do **not** upload `ncsbfc-guides`.

---

## Step 3 — Upload in cPanel

1. Log in to Epic/cPanel  
2. Open **File Manager**  
3. Create a folder in your home directory, for example `ncsbfc` (not inside a random old `public_html` HTML site if Python App will own the domain)  
4. Upload the zip  
5. Extract it so `app.py` is visible in that folder  

If Epic uses **Setup Python App**, the application root should be this `ncsbfc` folder.

---

## Step 4 — Create the Python app

1. In cPanel, open **Setup Python App** (sometimes under Software)  
2. Click **Create Application**  
3. Fill in:

   - **Python version:** 3.10 or newer  
   - **Application root:** `ncsbfc` (the folder with `app.py`)  
   - **Application URL / domain:** your domain, path `/`  
   - **Application startup file:** `passenger_wsgi.py`  
   - **Application entry point:** `application`  

4. Create the app  

---

## Step 5 — Install Python packages

In Setup Python App, open the terminal/command it shows for that app (it usually starts with `source /home/.../bin/activate`). Then:

```bash
pip install -r requirements.txt
```

Click **Restart** on the Python app.

---

## Step 6 — Point the domain at the app

- Application URL should be the domain you want, path `/`  
- If an old `index.html` in `public_html` still shows instead of Flask, remove or rename that `index.html` so the Python app can serve `/`  
- Confirm the domain uses **HTTPS** in cPanel SSL/TLS (certificate installed and assigned to this domain)

---

## Step 7 — Secure the app (required)

In Setup Python App → **Environment variables**, add:

| Name | Value |
| --- | --- |
| `NCSBFC_ENV` | `production` |
| `SECRET_KEY` | the long string from Step 1 |
| `SITE_URL` | `https://YOUR-DOMAIN.com` (no trailing slash) |
| `LEAD_NOTIFY_EMAIL` | `info@ncsbfc.com` |
| `SMTP_HOST` | usually `mail.YOUR-DOMAIN.com` or `localhost` (Epic support can confirm) |
| `SMTP_PORT` | `587` |
| `SMTP_USER` | `info@ncsbfc.com` |
| `SMTP_PASSWORD` | the mailbox password |
| `SMTP_FROM` | `info@ncsbfc.com` |
| `SMTP_USE_TLS` | `true` |

Restart the Python app after saving.

`NCSBFC_ENV=production` turns on:

- HTTPS redirect  
- Secure cookies  
- HSTS header  

---

## Step 8 — Make the data folder writable

Quote submissions are saved in `data/leads.json`. Agent accounts are saved in `data/agent_accounts.json`.

In File Manager, the `data` folder must be writable by the app (permissions `755` on the folder is usually enough on cPanel).

---

## Step 9 — Test quote forms

1. Open `https://YOUR-DOMAIN.com`  
2. Confirm the padlock (SSL)  
3. Submit a test quote with **your** email and phone  
4. You should land on the thank-you page  
5. Check **info@ncsbfc.com** for the lead email  
6. Reply-To on that email is the visitor’s address so you can reply directly  

If the thank-you page works but no email arrives:

- Confirm the mailbox exists  
- Confirm `SMTP_HOST` / password  
- Ask Epic: “What SMTP host and port should a Python app use to send from info@ncsbfc.com?”  
- Leads are still saved in `data/leads.json` even if email fails  

---

## Step 10 — Test agent accounts

1. `https://YOUR-DOMAIN.com/agents/register`  
2. Create a test account (password at least 10 characters)  
3. Sign in at `/agents/login`  
4. Sign out  

---

## What “protected” means here

| Protection | Status |
| --- | --- |
| SSL/HTTPS | Epic certificate + app redirect in production |
| Form data in transit | Encrypted over HTTPS |
| Agent passwords | Hashed, not stored as plain text |
| Secret key | You set a unique `SECRET_KEY` |
| Clickjacking / sniffing headers | Turned on |
| Quote delivery | Email to info@ncsbfc.com once SMTP is set |

SSL does not stop someone from filling a fake quote. It stops others from reading the form in transit.

---

## After it is live

Tell me the live URL. We can then:

- Confirm HTTPS  
- Send a test quote  
- Add Meta/Google ads tags if you have the IDs