Operations
Deployment and configuration
Keep PHP code and private data behind a public-only web root.
On this page
Supported starting point
The current distribution is local-first and SQLite-first. A PHP hosting environment with private writable storage and HTTPS is required for the CMS. A static host such as GitHub Pages cannot execute the PHP backend; a separate frontend may be hosted independently. MySQL compatibility must be proven with an application-specific migration and concurrency matrix. Symfony's database support alone does not establish this distribution's compatibility.
Production preparation
Prepare the reviewed, locked release in a separate deployment directory rather than altering your active development dependencies in place.
composer install --no-dev --optimize-autoloader
php bin/console doctrine:migrations:migrate --no-interaction
php bin/console assets:install publicSet the production environment before preparing production cache or serving requests. Back up existing data before migrations. Never copy a demo database over a client installation.
Private configuration
| Variable | Responsibility |
|---|---|
| APP_ENV / APP_DEBUG | prod / 0 on a live deployment |
| APP_SECRET | Unique private secret, at least 32 random bytes |
| DATABASE_URL | Private SQLite location for this tested distribution |
| DEFAULT_URI | The real HTTPS origin |
| MAILER_DSN / LOGIN_MAIL_FROM | Secure verified outbound delivery and sender |
| API_ALLOWED_ORIGIN | Exact optional separate frontend origin |
| BOOKING_TIMEZONE | Appointment display timezone |
| GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET | Optional private OAuth application configuration |
| INTEGRATION_ENCRYPTION_KEY | Optional environment-managed encryption key |
Configure application trusted hosts for your own domains. Do not copy another client's secrets, database, mail sender or hosting path.
Web root and FTP-only hosting
Expose only the application's public/ directory. Keep .env files, vendor/, var/, encryption keys and application source inaccessible from public URLs. Permit PHP to write required private runtime directories without making the whole project publicly writable. If hosting has no Composer/CLI, build a compatible release locally and upload its dependencies as well. Do not upload a locally compiled Symfony cache containing machine-specific paths. Database upgrades and cache rebuilding need a reviewed hosting-specific process; there is no public browser migration runner in the CMS.
Verify before switching traffic
Test HTTPS, the live-host routing, login/email codes, public content, asset loading, private-file denial and a 404. Verify sitemap, canonical URLs and indexing state before changing DNS. Preserve a working rollback release and its compatible database backup.
Something unclear? Contact me about this guide.