Skip to content
Anvil

Deployment

Running an Anvil application in production. This chapter assumes an application set up as in Installation (or the AppStarter) and describes what changes between a development machine and a server.

Pages of this chapter

Section titled “Pages of this chapter”
Page Content
Server PHP and MySQL versions, extensions, directory layout, web server and PHP configuration
Environment production settings in .env
Keys and secrets encryption.key, audit key, single sign-on secrets, key rotation
Releases the first installation, every further release, zero downtime
Scheduled commands and queue anvil:tick, anvil:prune, cron, queue worker
HTTPS and headers HSTS, security headers, CSP, CSRF, reverse proxies
Sessions, files and several servers session and cache handlers, shared files, database rights
Monitoring and backups logs, alerts, what to back up
Checklist everything to check before going live

Production in one page

Section titled “Production in one page”
Terminal window
# Once, on the server
composer install --no-dev --optimize-autoloader --no-interaction
cp env .env                                   # then set the values below
php spark migrate --all
php spark anvil:install --tenant="Muster AG" --email=admin@example.com


# Cron (user PHP runs as)
* * * * *   cd /var/www/app && flock -n /tmp/anvil-tick.lock php spark anvil:tick > /dev/null
15 3 * * *  cd /var/www/app && php spark anvil:prune > /dev/null
45 3 * * *  cd /var/www/app && php spark anvil:audit:verify > /dev/null
.env
CI_ENVIRONMENT = production
app.baseURL = 'https://admin.example.com/'
app.forceGlobalSecureRequests = true
app.CSPEnabled = true
cookie.secure = true
logger.threshold = 5


encryption.key = hex2bin:…        # php spark key:generate --show
anvil.auditKey = base64:…         # php spark anvil:audit:generate-key
database.default.password = …

Plus: document root public/, HTTPS with HSTS at the web server, a queue worker for large exports, backups of the database, the uploads and the keys. The pages above explain each step; the checklist collects them.

Security in production

Section titled “Security in production”

Anvil is built for operation under ISO 27001 and similar frameworks. The deployment decides a large part of it:

  • secrets only in .env or the environment, never in the repository,
  • HTTPS everywhere, strict CSP, no debug output,
  • tamper-evident audit log with a key of its own, verified daily,
  • security events forwarded to log management,
  • tested restore of database, files and keys.

See also Security and Configuration → Environments.