awaisjameel/laravel-cpanel-hosting

A robust, secure, and production-ready Laravel package that makes deploying Laravel applications on **cPanel / shared hosting** painless and professional.

v1.0.0 2026-02-10 20:24 UTC

Requires

• php: ^8.2
• illuminate/contracts: ^10.0|^11.0|^12.0
• illuminate/support: ^10.0|^11.0|^12.0
• spatie/laravel-package-tools: ^1.16

Requires (Dev)

• larastan/larastan: ^3.0
• laravel/pint: ^1.14
• nunomaduro/collision: ^8.8
• orchestra/testbench: ^8.0||^9.0||^10.0
• pestphp/pest: ^4.0
• pestphp/pest-plugin-arch: ^4.0
• pestphp/pest-plugin-laravel: ^4.0
• phpstan/extension-installer: ^1.4
• phpstan/phpstan-deprecation-rules: ^2.0
• phpstan/phpstan-phpunit: ^2.0

MIT

• awaisjameel

• laravel
• AwaisJameel
• laravel-cpanel-hosting

README

Laravel package for secure shared-hosting deployment endpoints and cPanel-friendly root hosting setup.

Features

• Secure deploy endpoints with token or webhook signature validation
• Configurable deployment pipeline (/deploy)
• .env sync with optional backup and required-key validation
• Storage link fallback (symlink -> recursive copy)
• Installer command for config + root index.php and .htaccess stubs
• Dedicated deploy logging channel
• Optional MySQL legacy index-length compatibility

Installation

composer require awaisjameel/laravel-cpanel-hosting

Run installer:

php artisan cpanel-hosting:install

Configuration

Publish config manually if needed:

php artisan vendor:publish --tag="cpanel-hosting-config"

Key env values:

CPANEL_DEPLOY_ENABLED=false
CPANEL_DEPLOY_TOKEN=
CPANEL_DEPLOY_WEBHOOK_SECRET=
CPANEL_DEPLOY_PREFIX=deploy
CPANEL_DEPLOY_ALLOWED_IPS=
CPANEL_DEPLOY_LOG_CHANNEL=deploy

Endpoints

When enabled, routes are exposed under CPANEL_DEPLOY_PREFIX (default deploy):

• GET /deploy full pipeline
• GET /deploy/sync-env
• GET /deploy/clear
• GET /deploy/migrate
• GET /deploy/migrate-fresh
• GET /deploy/cache
• GET /deploy/queue-restart
• GET /deploy/storage-link
• GET /deploy/maintenance-down
• GET /deploy/maintenance-up
• GET /deploy/optimize
• GET /deploy/health

Authentication:

• X-Deploy-Token: {token} header (preferred)
• ?token={token} query parameter
• X-Hub-Signature-256 / X-Gitlab-Token webhook verification when configured

Security Notes

• Keep CPANEL_DEPLOY_TOKEN secret and rotate on exposure.
• Prefer header token over query token.
• Restrict with CPANEL_DEPLOY_ALLOWED_IPS when possible.
• Do not expose deploy routes with APP_DEBUG=true.
• migrate-fresh is destructive.

Testing

composer test