# Launch fortedge.io

This release is a customer portal for protecting existing domains. Customers keep their hosting and registrar. FortEdge is the only authoritative DNS option in the portal. The existing Telegram bot does not need an update for this release.

## 1. Upgrade the FortEdge controller and traffic nodes

On the Ubuntu **controller**, take a current backup using your usual procedure, upload the supplied `ironside-edge.run` to `/root`, and run:

```sh
sudo bash /root/ironside-edge.run --verify &&
sudo bash /root/ironside-edge.run --upgrade
```

**This portal release targets a standalone controller (remote traffic workers are supported). Do not use this upgrade or the portal-token tool on an active HA controller pair.** In **Traffic nodes**, update every installed worker, including standbys, and wait for them to return healthy. Use the management hostname with a public trusted TLS certificate. Generate the portal’s dedicated bridge credential on the controller:

```sh
sudo python3 /opt/ironside-edge/ops/portal-token.py
```

The command prints the management URL and writes the credential to a root-only file. Put it in the private cPanel configuration; do not use the administrator API token. Make sure the controller has the FortEdge nameservers you operate and that the glue and public authoritative DNS work. Allow outbound DNS over TCP port 53 from the controller so it can verify the parent delegation. **Client websites** in the controller is separate from your existing domains.

## 2. Install the portal on cPanel

Start with [the cPanel guide](docs/CPANEL.md). Extract the ZIP into your account home, outside the web root; the archive creates a `fortedge/` folder. Only the files under `public/` belong on the public internet. Use the primary-domain instructions if cPanel fixes the document root to `public_html`. The project needs PHP 8.2+ with SQLite, cURL, and working local mail; it needs no Node, Composer, or frontend build. The installer and portal are different artifacts for different servers.

Run `php bin/console.php setup` from the extracted directory as the cPanel user with the matching PHP CLI. Fill in `private/config.php`: canonical URL, working outgoing mailbox, customer support contact, controller URL and dedicated token, Stripe and NOWPayments credentials. Run `php bin/console.php doctor`; schedule `php bin/console.php cron` every minute. Signup and recovery emails are queued for that cron, so set it up before testing signup. Payment integration, exact provider webhook events and renewal/reversal rules are in [the billing guide](docs/BILLING.md).

## 3. Run a staging acceptance test before taking payments

- Create and verify a customer account. A new trial grants one domain for 30 days, once. No card. The Pro and Business terms are prepaid, with no automatic renewal.
- Start with a test domain you own. Prove ownership via TXT. Import or recreate existing mail and service records, and handle existing DNSSEC before changing delegation. At its registrar, replace all authoritative nameservers with the ones shown for the zone. Wait for DNS and a trusted HTTPS certificate; use an origin that already serves the hostname on public HTTPS:443. If the origin stays publicly accessible outside FortEdge, clients can bypass edge protection by going directly to it. Restrict origin web access to your actual traffic-node addresses once migration is working, preserving ACME and administrative access.
- Visit the protected domain while its **Live traffic** panel is open. Check individual decisions and recent visitors. Toggle one policy and check its effect from another browser. Confirm the zone is visible in the controller’s **Client websites** section.
- Complete a Stripe test card checkout and a NOWPayments sandbox checkout; replay their signed callbacks and verify that a purchase grants only one term. Test email delivery, password reset, expiry and renewal. Trial or paid expiry pauses protected web traffic while authoritative DNS and mail records remain. Move DNS to another provider before cancelling/removing an in-use zone if you want uninterrupted service.
- Review the public service/privacy copy for your business, configure support and provider accounts, point fortedge.io to this cPanel vhost, and enable the live credentials and webhooks when ready. Keep protected backups of the application database, config and the controller. Monitor email, cron, webhook delivery, available storage, nameserver reachability and traffic-node health.

**Product limits:** HTTP request limits help protect against application-layer floods; upstream network capacity still matters. The optional exploit guard blocks selected URL probes (including traversal, sensitive config/source files and common exposed endpoints); it does not inspect every request body or replace a managed WAF. CDN caching is on the roadmap. Individual traffic samples are bounded and transient, on the currently serving node; paths, request bodies and cookies are not included.

For controller-side integration details, see `docs/CLIENT_WEBSITE.md` in the controller installer.