Deploying Laravel

ssh root@your_server_ip
apt update && apt upgrade -y

# Create a new user
adduser deployer

# Add user to sudo group
usermod -aG sudo deployer

# Switch to the new user
su - deployer

# On your local machine, generate an SSH key (if you don't have one)
ssh-keygen -t ed25519 -C "your_email@example.com"

# Copy your public key to the server
ssh-copy-id deployer@your_server_ip

# Enable UFW
sudo ufw enable

# Allow SSH
sudo ufw allow OpenSSH

# Allow HTTP and HTTPS
sudo ufw allow 'Nginx Full'

# Check firewall status
sudo ufw status

sudo apt install nginx -y

# Start and enable Nginx
sudo systemctl start nginx
sudo systemctl enable nginx

# Verify Nginx is running
sudo systemctl status nginx

# Add PHP repository
sudo add-apt-repository ppa:ondrej/php -y
sudo apt update

# Install PHP 8.3 and required extensions
sudo apt install -y php8.3-fpm php8.3-cli php8.3-common \
  php8.3-mysql php8.3-pgsql php8.3-sqlite3 php8.3-redis \
  php8.3-mbstring php8.3-xml php8.3-curl php8.3-zip \
  php8.3-bcmath php8.3-intl php8.3-gd php8.3-imagick \
  php8.3-opcache php8.3-readline

# Verify PHP installation
php -v

# Download and install Composer
curl -sS https://getcomposer.org/installer | php

# Move to global location
sudo mv composer.phar /usr/local/bin/composer

# Verify installation
composer --version

# Install Node.js 20 LTS
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install nodejs -y

# Verify installation
node -v
npm -v

# Install Redis
sudo apt install redis-server -y

# Configure Redis to run as a service
sudo sed -i 's/supervised no/supervised systemd/' /etc/redis/redis.conf

# Restart Redis
sudo systemctl restart redis
sudo systemctl enable redis

# Test Redis
redis-cli ping

# Install MySQL
sudo apt install mysql-server -y

# Start and enable MySQL
sudo systemctl start mysql
sudo systemctl enable mysql

# Run security script
sudo mysql_secure_installation

# Log into MySQL
sudo mysql

# Create database
CREATE DATABASE laravel_app CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

# Create user with strong password
CREATE USER 'laravel_user'@'localhost' IDENTIFIED BY 'your_secure_password';

# Grant privileges
GRANT ALL PRIVILEGES ON laravel_app.* TO 'laravel_user'@'localhost';
FLUSH PRIVILEGES;

# Exit MySQL
EXIT;

# Create web directory
sudo mkdir -p /var/www/laravel-app

# Set ownership to deployer user
sudo chown -R deployer:deployer /var/www/laravel-app

# Navigate to directory
cd /var/www/laravel-app

# Clone the repository
git clone https://github.com/your-username/your-laravel-app.git .

# Or for private repos, set up SSH key first
git clone git@github.com:your-username/your-laravel-app.git .

# Install PHP dependencies (production mode)
composer install --optimize-autoloader --no-dev

# Install npm dependencies and build assets (if applicable)
npm ci
npm run build

# Copy example environment file
cp .env.example .env

# Generate application key
php artisan key:generate

# Edit environment file
nano .env

APP_NAME="Your App Name"
APP_ENV=production
APP_DEBUG=false
APP_URL=https://yourdomain.com

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=laravel_app
DB_USERNAME=laravel_user
DB_PASSWORD=your_secure_password

CACHE_DRIVER=redis
SESSION_DRIVER=redis
QUEUE_CONNECTION=redis

REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

# Run migrations
php artisan migrate --force

# Optionally seed the database
php artisan db:seed --force

# Set storage and cache permissions
sudo chown -R deployer:www-data /var/www/laravel-app
sudo chmod -R 775 /var/www/laravel-app/storage
sudo chmod -R 775 /var/www/laravel-app/bootstrap/cache

# Cache configuration
php artisan config:cache

# Cache routes
php artisan route:cache

# Cache views
php artisan view:cache

# Cache events (Laravel 11+)
php artisan event:cache

sudo nano /etc/nginx/sites-available/laravel-app

server {
    listen 80;
    listen [::]:80;
    server_name yourdomain.com www.yourdomain.com;
    root /var/www/laravel-app/public;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";
    add_header X-XSS-Protection "1; mode=block";

    index index.php;

    charset utf-8;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_hide_header X-Powered-By;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied expired no-cache no-store private auth;
    gzip_types text/plain text/css text/xml text/javascript
               application/x-javascript application/xml
               application/javascript application/json;
}

# Create symbolic link
sudo ln -s /etc/nginx/sites-available/laravel-app /etc/nginx/sites-enabled/

# Remove default site (optional)
sudo rm /etc/nginx/sites-enabled/default

# Test Nginx configuration
sudo nginx -t

# Reload Nginx
sudo systemctl reload nginx

sudo apt install certbot python3-certbot-nginx -y

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

# Test renewal process
sudo certbot renew --dry-run

# Check the timer status
sudo systemctl status certbot.timer

sudo nano /etc/php/8.3/fpm/pool.d/www.conf

pm = dynamic
pm.max_children = 50
pm.start_servers = 10
pm.min_spare_servers = 5
pm.max_spare_servers = 20
pm.max_requests = 500

; Process idle timeout
pm.process_idle_timeout = 10s

sudo nano /etc/php/8.3/fpm/php.ini

upload_max_filesize = 64M
post_max_size = 64M
memory_limit = 256M
max_execution_time = 60
max_input_time = 60
opcache.enable=1
opcache.memory_consumption=256
opcache.interned_strings_buffer=16
opcache.max_accelerated_files=10000
opcache.validate_timestamps=0
opcache.save_comments=1

sudo systemctl restart php8.3-fpm

sudo apt install supervisor -y

sudo nano /etc/supervisor/conf.d/laravel-worker.conf

[program:laravel-worker]
process_name=%(program_name)s_%(process_num)02d
command=php /var/www/laravel-app/artisan queue:work redis --sleep=3 --tries=3 --max-time=3600
autostart=true
autorestart=true
stopasgroup=true
killasgroup=true
user=deployer
numprocs=2
redirect_stderr=true
stdout_logfile=/var/www/laravel-app/storage/logs/worker.log
stopwaitsecs=3600

sudo supervisorctl reread
sudo supervisorctl update
sudo supervisorctl start laravel-worker:*

# Edit crontab for deployer user
crontab -e

# Add this line
* * * * * cd /var/www/laravel-app && php artisan schedule:run >> /dev/null 2>&1

#!/bin/bash
set -e

echo "Starting deployment..."

# Navigate to application directory
cd /var/www/laravel-app

# Enable maintenance mode
php artisan down --retry=60

# Pull latest changes
git pull origin main

# Install PHP dependencies
composer install --optimize-autoloader --no-dev

# Install and build frontend assets
npm ci
npm run build

# Run database migrations
php artisan migrate --force

# Clear and rebuild caches
php artisan config:cache
php artisan route:cache
php artisan view:cache
php artisan event:cache

# Restart queue workers
sudo supervisorctl restart laravel-worker:*

# Disable maintenance mode
php artisan up

echo "Deployment completed successfully!"

chmod +x deploy.sh

# Set ownership
sudo chown -R deployer:www-data /var/www/laravel-app

# Set directory permissions
find /var/www/laravel-app -type d -exec chmod 755 {} \;

# Set file permissions
find /var/www/laravel-app -type f -exec chmod 644 {} \;

# Writable directories
chmod -R 775 /var/www/laravel-app/storage
chmod -R 775 /var/www/laravel-app/bootstrap/cache

# Secure environment file
chmod 600 /var/www/laravel-app/.env

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self';" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

sudo nano /etc/logrotate.d/laravel

/var/www/laravel-app/storage/logs/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 deployer www-data
    sharedscripts
}

#!/bin/bash
# /home/deployer/backup-db.sh

BACKUP_DIR="/home/deployer/backups"
DATE=$(date +%Y%m%d_%H%M%S)
DB_NAME="laravel_app"
DB_USER="laravel_user"
DB_PASS="your_secure_password"

mkdir -p $BACKUP_DIR

mysqldump -u$DB_USER -p$DB_PASS $DB_NAME | gzip > $BACKUP_DIR/db_$DATE.sql.gz

# Keep only last 7 days of backups
find $BACKUP_DIR -name "db_*.sql.gz" -mtime +7 -delete

# Add to crontab
0 2 * * * /home/deployer/backup-db.sh