Skip to main content

First Start

To do once, after installing a new server.

1. Check the containers​

cd ~/pch-sig
docker compose -f docker-compose.prod.yml ps
docker compose -f docker-compose.prod.yml logs backend | tail -30

The backend log must show the entrypoint steps: JWT keys, database, migrations, permissions, cache.

2. Database​

Migrations run automatically when the backend starts. To check:

docker exec -u www-data pch_backend php bin/console doctrine:migrations:status

To take over an existing database (server migration), restore a dump rather than start from scratch: see Restore.

3. JWT keys​

In pre-production, the entrypoint creates the key pair in backend/config/jwt/ when missing, using JWT_PASSPHRASE. In production this directory is mounted read-only: create the keys on the host before the first start (commands in JWT authentication). These keys belong to the server: do not copy them between servers and do not overwrite them during a deployment.

4. Reference data​

docker exec -u www-data pch_backend php bin/console app:init-geo-data            # regions, sectors, communes, localities
docker exec -u www-data pch_backend php bin/console app:init-categories-reclamation
docker exec -u www-data pch_backend php bin/console app:init-eligibility-templates

Everything else (projects, programmes, PMT methods, grievance workflows, nomenclature) is set up under Settings.

5. First administrator​

docker exec -u www-data pch_backend php bin/console app:create-user <email> '<password>' <LastName> <FirstName> --role=ROLE_ADMIN

Choose the password outside any chat or ticket and store it in the secrets manager. To reset it:

docker exec -u www-data pch_backend php bin/console app:reset-user-password <email> '<new password>'

Then, in the application: attach the administrator to their institution and projects (Settings → Users). An unattached account sees no data. The app:perimetre:initialiser command does this in bulk.

6. Scheduled tasks (host cron)​

# Digest of overdue grievances, 08:00
0 8 * * * docker exec pch_backend php bin/console app:plaintes:send-digest >> /var/log/plainte-digest.log 2>&1
# Bemba assistant document base, 03:15
15 3 * * * docker exec -u www-data pch_backend php bin/console app:assistant:indexer --max-appels=15 >> /home/ubuntu/assistant-indexer.log 2>&1

Other scheduled tasks (grievance escalation, alerts) run in the backend container's scheduler_plaintes worker, which also consumes scheduler_transferts (transfer recurrence, every day at 06:00).

7. Documentation and assistant​

Deploy the documentation build to ~/pch-sig/documentation/build, then index it:

docker exec -u www-data pch_backend php bin/console app:assistant:indexer --etat

8. Final check​

  • https://<domain>/ shows the sign-in screen, https://<domain>/api/health returns 200.
  • Sign in with the administrator account, then sign out.
  • A test e-mail goes out (create a test account: welcome e-mail) and the failed queue stays empty.
cache:clear

Never run cache:clear with docker exec as root: the rebuilt cache belongs to root and php-fpm (www-data) can no longer write, causing 500 errors. Use -u www-data, or recreate the container.