Deployment

Deployment is moving a project from the developer's computer to a server where visitors can see it. Besides copying files you need to configure the web server, turn off debug mode and run a few commands.

Document root

The web server must point not at the project root but at the webroot folder: then configuration files and source code are not reachable by the site address. All requests that have no file are sent to webroot/index.php. For Nginx:

server {
    server_name example.com;
    root /var/www/blog/webroot;
    index index.php;
 
    location / {
        try_files $uri $uri/ /index.php?$args;
    }
 
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
}

For Apache it is enough to enable the mod_rewrite module: the webroot/.htaccess file with the required rules is already in the project.

Project files

cd /var/www
git clone https://example.com/blog.git blog
cd blog
composer install --no-dev --optimize-autoloader

The --no-dev option skips development packages: DebugKit, bake, PHPUnit.

Server settings

The config/app_local.php file is not in the repository, so it is created on the server by hand:

// config/app_local.php
return [
    'debug' => false,
 
    'Security' => [
        'salt' => 'your-own-long-random-string',
    ],
 
    'Datasources' => [
        'default' => [
            'host' => 'localhost',
            'username' => 'blog',
            'password' => 'secret',
            'database' => 'blog',
        ],
    ],
];

With debug set to false a visitor does not see error details. The Security.salt value on the server must be its own, different from the developer's.

Folder permissions

The application writes the cache and the log to the tmp and logs folders, so they must be writable by the web server user:

chown -R www-data:www-data tmp logs

Database and cache

bin/cake migrations migrate
bin/cake cache clear_all
bin/cake schema_cache build

Open the site address and the home page should appear.

Updating

Every next release repeats the same sequence:

git pull
composer install --no-dev --optimize-autoloader
bin/cake migrations migrate
bin/cake cache clear_all

It is convenient to put it into a script file and run it with one command.

Checklist

Common mistake

Debug mode on a production server shows any visitor the error text with SQL queries and file paths. Make sure that debug is false and that packages are installed with the --no-dev option.