Deploying to a server

An app that works on your computer has to be moved to a server for visitors to see it. The steps are the same for almost any hosting with SSH access.

What the server needs

PHP of the same version as in development, with the mbstring, pdo, openssl and fileinfo extensions;
Composer;
a database — MySQL or PostgreSQL;
the Nginx or Apache web server.

The site root is the public folder

The web server must point at the public folder, not at the project root. Otherwise a visitor could open the .env file with the passwords. For Nginx it looks like this:

server {
    server_name example.com;
    root /var/www/blog/public;
    index index.php;
 
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
 
    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

Code and dependencies

git clone https://github.com/you/blog.git /var/www/blog
cd /var/www/blog
composer install --no-dev --optimize-autoloader

The --no-dev flag skips development packages, --optimize-autoloader speeds up class loading.

The .env file

The server gets its own .env — it is not in the repository:

APP_ENV=production
APP_DEBUG=false
APP_URL=https://example.com
 
DB_CONNECTION=mysql
DB_DATABASE=blog
DB_USERNAME=blog
DB_PASSWORD=secret

The application key is created with php artisan key:generate. It encrypts sessions and cookies — do not lose or change it.

Preparing

php artisan migrate --force
php artisan storage:link
php artisan config:cache
php artisan route:cache
php artisan view:cache

The --force flag is needed because in production Laravel asks to confirm migrations. The cache commands compile the settings, routes and templates into ready files — the site responds faster.

The storage and bootstrap/cache folders must be writable by the web server.

Updating

Every update repeats the same sequence:

git pull
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache
php artisan route:cache
php artisan view:cache

These commands go into a script so that no step is skipped.

Common mistake

APP_DEBUG=true on a production server shows any visitor an error page with code fragments, queries and setting values. Check this line first. And remember: after changing .env you have to run php artisan config:cache again, otherwise the app keeps working with the old settings.

Thanks for reading!