# CyberSpy — Deployment Guide

Deploy target: **https://cyberspy.iteklabs.tech** (FastComet cPanel)

This guide takes you from zero to a live, working CyberSpy install.

---

## 0. What you're deploying

A standalone PHP app. Folder layout:

```
cyberspy.iteklabs.tech/         <- upload everything here (the docroot)
├── .htaccess                   routing + security
├── .gitignore
├── includes/                   config, auth, scanner engine, worker, layout
├── pages/                      home, login, register, dashboard, targets, scan, pricing, ai_pentest, api
├── scripts/                    run_scan_worker.php, create_admin.php
├── db/                         schema.sql
├── deploy.sh                   server-side configurator
└── logs/                       (created on deploy)
```

Do **NOT** upload: `_dev_router.php`, any `_*.php` temp files, or `CyberSpy-Business-Proposal.doc` (keep that off the public server).

---

## 1. Create the subdomain in cPanel

1. Log into FastComet **cPanel**.
2. **Domains → Domains** (or **Subdomains**) → **Create A New Domain**.
3. Domain: `cyberspy.iteklabs.tech`
   - If `iteklabs.tech` isn't on this cPanel account yet, add it first (Domains → Create) or point its DNS/nameservers to FastComet.
4. Note the **Document Root** it creates, e.g. `/home/USER/cyberspy.iteklabs.tech`
   (replace `USER` with your cPanel username everywhere below).

> Make sure DNS for `cyberspy.iteklabs.tech` points to this FastComet server. Then enable **SSL** (cPanel → Security → SSL/TLS Status → Run AutoSSL) so HTTPS works.

---

## 2. Upload the files

**Option A — cPanel File Manager (simplest)**
1. Zip your local `cyberspy.jakasystem.com` folder contents (NOT the folder itself — just what's inside), excluding `_dev_router.php`, `_*.php`, and the `.doc`.
2. cPanel → **File Manager** → open the doc root → **Upload** the zip → **Extract**.

**Option B — FTP / SFTP** (FileZilla)
- Host: your server, user: cPanel user, upload into the doc root.

**Option C — Git** (if available)
- `git clone` into the doc root, or pull.

After upload the doc root should contain `.htaccess`, `includes/`, `pages/`, `scripts/`, `db/`, `deploy.sh`.

---

## 3. Create the database (cPanel → MySQL Databases)

1. **Create New Database** → name it (cPanel prefixes it, e.g. `USER_cyberspy`).
2. **Add New User** → create a DB user + strong password.
3. **Add User To Database** → grant **ALL PRIVILEGES**.
4. Write down: **DB name**, **DB user**, **DB password** (you'll need them in step 5).

FastComet MySQL host is almost always `localhost`.

---

## 4. Import the schema (cPanel → phpMyAdmin)

1. Open **phpMyAdmin**, select your new database on the left.
2. **Import** tab → **Choose File** → select `db/schema.sql` (from the uploaded files, or upload it from your PC).
3. **Go**. You should see 5 tables created: `users`, `scan_targets`, `vuln_scans`, `vuln_findings`, `activity_log`.

---

## 5. Configure the app (SSH — run deploy.sh)

SSH into the server (cPanel → **Terminal**, or an SSH client):

```bash
cd ~/cyberspy.iteklabs.tech
chmod +x deploy.sh
./deploy.sh
```

It will prompt you. Answer:

| Prompt | Value |
|---|---|
| DB_HOST | `localhost` |
| DB_NAME | your DB name from step 3 (e.g. `USER_cyberspy`) |
| DB_USER | your DB user |
| DB_PASS | your DB password |
| APP_URL | `https://cyberspy.iteklabs.tech` |
| JWT_SECRET | press Enter to auto-generate |

The script writes `includes/.env` (chmod 600), sets file permissions, creates `logs/`, and runs a **DB self-test**. You want to see:

```
DB OK, users: 0
>> self-test passed
```

If it fails, fix the DB values in `includes/.env` and re-run `./deploy.sh`.

> No SSH access? See **Appendix A** to configure without SSH.

---

## 6. Create your admin account (SSH)

```bash
php scripts/create_admin.php mis.admin admin@iteklabs.tech 'YourStrongPassword'
```

Output: `Created admin user 'mis.admin'.`

---

## 7. Add the scan-worker cron job (cPanel → Cron Jobs)

Scans run through a background worker. Add a cron that runs **every minute**:

- Common Settings: **Once per minute** (`* * * * *`)
- Command:
```
/usr/local/bin/php /home/USER/cyberspy.iteklabs.tech/scripts/run_scan_worker.php >> /home/USER/cyberspy.iteklabs.tech/logs/scan_worker.log 2>&1
```

(Confirm the PHP path — `deploy.sh` printed the exact `PHP_BIN` it detected. It may be `/usr/local/bin/php` or `/opt/cpanel/ea-php83/root/usr/bin/php`.)

> Even without cron, scans still run: the app kicks off an inline run when you click "Start scan". Cron just makes queued scans reliable.

---

## 8. Go live & smoke-test

Open **https://cyberspy.iteklabs.tech** and check:

1. **Landing page** loads (hero, animations).
2. **/pricing.php** and **/ai_pentest.php** load.
3. **Log in** with your admin account → dashboard.
4. **Targets** → add `iteklabs.tech` (or any domain you own) → it shows a verification token.
5. Verify ownership (file method is easiest on your own hosting — see below) → **Verify**.
6. **Scan** → run a quick scan on the verified target → findings appear.

### Verifying a domain you host on FastComet (fastest = file method)
When adding the target, choose **File upload**. CyberSpy shows a token. Create this file on that domain's docroot:
```
/home/USER/<that-domain>/.well-known/cyberspy-verify.txt
```
containing exactly the line CyberSpy shows (e.g. `cyberspy-site-verification=cs_xxxxx`). Then click **Verify**.

---

## 9. Post-launch checklist

- [ ] AutoSSL issued (padlock shows on https://cyberspy.iteklabs.tech)
- [ ] `includes/.env` is chmod 600 and NOT web-accessible (try visiting `/includes/.env` → should be 403)
- [ ] `/db/schema.sql` returns 403 (blocked by .htaccess)
- [ ] Admin login works; a test scan completes
- [ ] Cron worker logging to `logs/scan_worker.log`
- [ ] Rotate/secure the `JWT_SECRET` and DB password (never commit `.env`)

---

## Appendix A — No SSH? Configure without deploy.sh

If you can't use SSH, create `includes/.env` manually via cPanel File Manager
(File Manager → open `includes/` → **+ File** → name it `.env` → Edit):

```
CYBERSPY_ENV=production
APP_BASE_PATH=/home/USER/cyberspy.iteklabs.tech
APP_URL=https://cyberspy.iteklabs.tech
DB_HOST=localhost
DB_NAME=USER_cyberspy
DB_USER=USER_cyberspyuser
DB_PASS=your-db-password
JWT_SECRET=paste-a-long-random-string-here
```

Then create the admin user via phpMyAdmin instead of the CLI:
1. Generate a bcrypt hash of your password (any bcrypt generator, or run locally:
   `php -r "echo password_hash('YourPassword', PASSWORD_DEFAULT);"`).
2. phpMyAdmin → `users` table → **Insert**:
   - `username` = mis.admin
   - `email` = admin@iteklabs.tech
   - `password_hash` = (the bcrypt hash)
   - `role` = admin
   - `is_verified` = 1
   - `plan` = pro
   - `scan_quota` = 9999

---

## Appendix B — Troubleshooting

| Symptom | Fix |
|---|---|
| Blank page / 500 | Check `logs/` and cPanel error log. Usually a DB credential mistake in `includes/.env`. |
| Pages 404 (e.g. /pricing.php) | mod_rewrite/AllowOverride — ensure `.htaccess` is present in the docroot; FastComet (LiteSpeed) supports it by default. |
| "Not verified" on a domain you own | The TXT/file/meta token isn't published yet or has a typo. Use the **file** method on FastComet-hosted domains for instant results. |
| Scan stuck on "queued" | Add the cron (step 7), or it will still run inline on "Start scan". |
| `/includes/.env` downloads in browser | Your `.htaccess` isn't being read — confirm AllowOverride/LiteSpeed rewrite is on. |
| DB self-test fails | DB user not granted to DB, wrong host (use `localhost`), or wrong password. |

---

## Appendix C — Updating the app later

1. Upload changed files (overwrite).
2. `includes/.env` is preserved (never overwrite it).
3. If the DB schema changed, apply the new SQL via phpMyAdmin.
4. Hard-refresh the browser (Ctrl+F5) to clear cached CSS/JS.

---

_CyberSpy scans only domains whose ownership is verified. Keep `.env`, `db/`, `logs/`, and the business proposal off the public web (the bundled `.htaccess` already denies `includes/`, `scripts/`, and `db/`)._