Self-hosting

Server requirements

The backend requires PHP 8.5, PostgreSQL, Redis, and the extensions required by backend/composer.lock, including pdo_pgsql. Set the web root to backend/public. Use HTTPS for the API and administration panels. See realtime for the bundled Soketi runtime's deployment restrictions.

Keep .env, private uploads, backups, and writable storage outside disposable release directories. Configure Redis's actual hostname, authentication and TLS settings; separate hosting containers do not necessarily share localhost.

Backend installation

1. Build a local release with bin/deploy-backend --package.
2. Install the package on the host and configure the environment using backend/.env.production.example as a reference.
3. Set a unique APP_KEY, the public APP_URL, database/Redis connections, SMTP settings, frontend URL and allowed frontend origins.
4. Back up the database, then run php artisan migrate --force from the backend.
5. Run php artisan config:cache and check /up.
6. Provision the first platform administrator explicitly:

php artisan firehall:admin [email protected] --name="Administrator name"

Sign in at /admin/login using the emailed code or link. Department chiefs apply at /manage/register; platform administrators approve their applications. The local test administrator is not seeded outside APP_ENV=local.

Web and docs hosting

Build the clients and inspect their Workers deployment packages:

bin/build web
bin/build docs
bin/deploy-web --dry-run
bin/deploy-docs --dry-run

The web Worker uses the SESSIONS Durable Object binding for persistent browser sessions. Set FIREHALL_BROKER_ORIGINS to the permitted backend origins and FIREHALL_WEB_ORIGIN to the web application's public origin. Configure the backend's FIREHALL_CORS_ALLOWED_ORIGINS to include that browser origin.

The default server shown by the web app comes from public-config.json. Update that file through the build configuration when hosting your own default instance. Users can still select other servers permitted by the browser broker.

Background work

Run a Redis worker to deliver queued email and process application jobs:

php artisan queue:work redis --queue=firehall --timeout=60

On hosts that only provide cron, run bin/queue-cron once per minute. It uses flock to prevent overlapping workers and processes jobs for a bounded period. Run Laravel's scheduler every minute with php artisan schedule:run; the firehall:prune task removes expired authentication state and abandoned uploads.

Updates and rollback

Back up the database and preserve storage before applying an update. Firehall is live: existing migrations are immutable. Add schema changes in new, additive forward migrations; never run migrate:fresh on a deployed database. Switch to a new release directory when the host supports it, or use a maintenance window for an in-place update. Rollback restores the previous code/configuration while retaining persistent data.

For symlink-based releases, PHP must re-resolve the active release path. A realpath_cache_ttl of 0 means entries never expire, not that caching is disabled. Use a short positive TTL with OPcache path/timestamp revalidation, and verify that the rendered homepage references the new release's CSS and that the asset returns 200.