Deployment

On your own machine Symfony runs in development mode: with the debug toolbar and detailed errors. A server needs production mode — fast and without extra information for visitors. Deployment is a few commands run in the same order every time.

Production mode

The mode is set by environment variables on the server — in the .env.local file or in the hosting settings:

APP_ENV=prod
APP_SECRET=a-long-random-string
DATABASE_URL="mysql://blog:password@127.0.0.1:3306/blog?serverVersion=8.0.32&charset=utf8mb4"

In prod mode the debug toolbar is off, and instead of error details a visitor sees a plain page.

Deployment steps

git pull
composer install --no-dev --optimize-autoloader
php bin/console doctrine:migrations:migrate --no-interaction
php bin/console cache:clear

Styles and scripts

If the project uses AssetMapper, the files are prepared with:

php bin/console asset-map:compile

It copies styles and scripts into public/assets with a hash in the name.

Fast environment variables

Symfony reads the .env files on every request. A command gathers them into one PHP file that loads faster:

composer dump-env prod

The web server

The site's root folder must be public. Every request that has no matching file is sent to index.php. An example for Nginx:

server {
    server_name example.com;
    root /var/www/blog/public;
 
    location / {
        try_files $uri /index.php$is_args$args;
    }
 
    location ~ ^/index\.php(/|$) {
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        internal;
    }
}

Folder permissions

The web server needs write access to the var folder: the cache and the log live there. It only needs to read the rest of the project.

Checking after deployment

php bin/console about
tail -n 50 var/log/prod.log

The first command shows the mode and versions, the second the last lines of the error log.

Common mistake

dev mode on a production server is a serious vulnerability: the profiler shows any visitor the settings, database queries and environment variables with passwords. Make sure the server has APP_ENV=prod and that packages were installed with the --no-dev flag.