sentix/laravel-remotecommand

A remote command execution system for Laravel (secure API based command runner)

1.0.0 2026-07-08 17:09 UTC

Requires

• php: >=8.0
• illuminate/support: ^10.0|^11.0|^12.0|^13.0|^14.0
• spatie/db-dumper: ^4.1

MIT

• X-DEV

Published on Packagist.org on 2026-07-08 17:12 UTC

README

A small Laravel package that exposes a secure API endpoint to run predefined maintenance commands remotely.

Features

• Run built-in maintenance commands via a POST API
• Commands included: BackupDatabase, DeleteFolder, PingProject, SetAppUrl, ShowTables
• Spatie DbDumper used for reliable MySQL backups with a PHP fallback

Requirements

• PHP >= 8.0
• Laravel 10, 11, 12, 13 or 14

Installation

Install with Composer:

composer require sentix/laravel-remotecommand

The package registers the service provider and facade automatically via Composer's extra.laravel settings.

Usage

Send a POST request to the package route:

POST /remote-command
Content-Type: application/json

{
	"command": "ShowTables",
	"params": {}
}

Example using curl:

curl -X POST http://your-app.test/remote-command \
	-H "Content-Type: application/json" \
	-d '{"command":"ShowTables","params":{}}'

Important: Protect this endpoint with authentication or middleware in your app (for example add auth:sanctum or IP restrictions) — the package does not enable authentication by default.

Available Commands

• BackupDatabase — creates a SQL dump in public/backups/ (uses Spatie DbDumper, falls back to PHP export)
• DeleteFolder — deletes a file or directory inside the project (path must be inside project root)
• PingProject — performs an HTTP GET to the configured app.bgUrl
• SetAppUrl — sets app.bgUrl in the runtime config for the current request
• ShowTables — returns the list of database tables

Refer to the src/Commands folder for implementation details.

Configuration

• app.bgUrl — used by PingProject. You can set this in your config/app.php or via environment-specific config.

Security Notes

This package can execute potent operations (file deletion, DB export). Always:

• Restrict the /remote-command route with authentication and authorization
• Run in trusted environments only
• Log and audit remote calls

Contributing

PRs and issues are welcome. Please follow the repository coding standards and include tests where appropriate.

License

MIT