---
sidebar_position: 10
sidebar_label: Deploying
---

# Deploying a Laravel app

On Forge, Vapor, Cloud, or any server that runs Laravel: nothing realtime is kept on your servers, so any of them answers any request.

## Its settings

| | |
|---|---|
| `BROADCAST_CONNECTION` | `wordplus` |
| `WORDPLUS_SITE`, `WORDPLUS_SECRET` | from your app in WordPlus Cloud |
| `WORDPLUS_LOCAL_KEY` | yours: kept as long as the app |
| `WORDPLUS_REALTIME_GENERATIONS` | a cache store every server shares, for moving keys on (`redis`, `database`) |

The package reads them through its config, so `php artisan config:cache` keeps working. The key reaches pages through `@wordplusRealtime`, which is what it is for.

## Its addresses

Add every address your pages are served from to the app in WordPlus Cloud: scheme, host and port exactly (`https://shop.example.com`, `https://www.shop.example.com`). A page anywhere else is refused with `wrong_origin`. Up to 20 addresses an app. If your app hears [webhooks](sending.md#webhooks), set their address there too.

## Its files

`realtime-worker.js`, `realtime-rooms.min.js`, `realtime-rooms-e2ee.worker.js` and `realtime-ui.min.js` are in `public/`, copied by your build (`wordplus-realtime copy public && vite build`), so each release serves the ones its package came with. A browser runs a worker only from the origin of the page itself.

## The queue

Events that implement `ShouldBroadcast` go through your queue: run a worker (`php artisan queue:work`, Horizon), or they wait. `ShouldBroadcastNow` sends during the request, with no worker.

## Behind a proxy

Trust it (`$middleware->trustProxies( at: '*' )` in `bootstrap/app.php`), so sessions and CSRF see HTTPS. The browser routes are on the `web` middleware: serve them from the address of the pages.

## Content Security Policy

If your app sends one, let pages reach the WordPlus Cloud servers (the realtime servers, which may move a connection to another of them, and the media servers for group calls) and run the workers from your own address:

```text
connect-src 'self' https://*.wordplus.cloud wss://*.wordplus.cloud;
worker-src 'self';
```

## Clocks

Your app signs what it sends with the time. Keep the server clock synced (NTP): one more than 5 minutes off has its broadcasts refused with `stale_signature`.