PHPAML

Documentation · Chapter 06

Prepare the server
before visitors arrive.

Production requires strong secrets, HTTPS, disabled debug, and correct permissions.

No real secret is required: we configure reading-list with safe values.

Configure without copying local .env

phpaml — zsh
aml env:init
aml env:set APP_ENV production
aml env:set APP_DEBUG false
aml env:set APP_URL https://example.com
aml env:set APP_KEY a-random-key-of-at-least-32-characters

On the server, start from .env.example then supply real values through the secret manager or hosting tool.

Let AML inspect

phpaml — zsh
aml install --production
aml doctor --production
aml doctor --production --json
aml build

The check requires APP_DEBUG=false, an HTTPS APP_URL, an APP_KEY of at least 32 characters, and writable runtime/storage/cache. JSON suits CI; normal output suits humans.

Checklist

  • The server exposes public/ only.
  • .env is neither committed nor placed under public/.
  • HTTPS is active and debug is disabled.
  • Logs and backups have a retention policy.
  • aml test and doctor --production pass.
aml serve stays local

In production, use the host's HTTP server with public/ as its root.