Skip to main content
Markdown

Deploying a Laravel app

On Forge, Vapor, Cloud, or any server that runs Laravel: nothing realtime is kept on your servers, so any of them answers any request.

Its settings​

BROADCAST_CONNECTIONwordplus
WORDPLUS_SITE, WORDPLUS_SECRETfrom your app in WordPlus Cloud
WORDPLUS_LOCAL_KEYyours: kept as long as the app
WORDPLUS_REALTIME_GENERATIONSa cache store every server shares, for moving keys on (redis, database)

The package reads them through its config, so php artisan config:cache keeps working. The key reaches pages through @wordplusRealtime, which is what it is for.

Its addresses​

Add every address your pages are served from to the app in WordPlus Cloud: scheme, host and port exactly (https://shop.example.com, https://www.shop.example.com). A page anywhere else is refused with wrong_origin. Up to 20 addresses an app. If your app hears webhooks, set their address there too.

Its files​

realtime-worker.js, realtime-rooms.min.js, realtime-rooms-e2ee.worker.js and realtime-ui.min.js are in public/, copied by your build (wordplus-realtime copy public && vite build), so each release serves the ones its package came with. A browser runs a worker only from the origin of the page itself.

The queue​

Events that implement ShouldBroadcast go through your queue: run a worker (php artisan queue:work, Horizon), or they wait. ShouldBroadcastNow sends during the request, with no worker.

Behind a proxy​

Trust it ($middleware->trustProxies( at: '*' ) in bootstrap/app.php), so sessions and CSRF see HTTPS. The browser routes are on the web middleware: serve them from the address of the pages.

Content Security Policy​

If your app sends one, let pages reach the WordPlus Cloud servers (the realtime servers, which may move a connection to another of them, and the media servers for group calls) and run the workers from your own address:

connect-src 'self' https://*.wordplus.cloud wss://*.wordplus.cloud;
worker-src 'self';

Clocks​

Your app signs what it sends with the time. Keep the server clock synced (NTP): one more than 5 minutes off has its broadcasts refused with stale_signature.