- How do I install jmrashed/laravel-installer in a Laravel application?
- Run composer require jmrashed/laravel-installer, publish the package config with vendor:publish, optionally publish its assets, then open /install in the browser to start the wizard. Beyond provider registration there is no host-app code to modify, which is the package's main selling point. You need PHP 8.1 or newer and Laravel 9 or newer, and the app must be able to write to .env and storage directories.
- Does jmrashed/laravel-installer support Laravel 12?
- Yes, but only from v2.0.9 onward. That release exists specifically because the package previously failed to resolve into a new Laravel 12 application. The package requires PHP 8.1 or higher and Laravel 9 or higher, so pin to v2.0.9 or later if you are on Laravel 12.
- Is it safe to leave the /install route publicly accessible in production?
- Treat it as high risk. The wizard is an unauthenticated HTTP surface that needs write access to .env, a live database connection with DDL rights, and filesystem permissions it validates itself, so anyone reaching /install can potentially rewrite your environment. Restrict it by IP allowlist or middleware, or remove the route entirely once setup is complete. Also review what changes on upgrade, because v2.0.9 activates security, performance, progress, and dependency middleware that earlier 2.0.x releases shipped but never wired up.
- What are the server requirements for this Laravel installer package?
- The package requires PHP 8.1 or newer and Laravel 9 or newer. The wizard itself checks your PHP version and required extensions in its server requirements step, validates directory permissions in the next step, and then validates Composer dependencies. You also need a reachable database user with permission to run migrations.
- How does the wizard handle .env and database configuration?
- Step 5 writes your environment settings directly into the .env file, and step 6 configures and tests the database connection. Because the package rewrites .env rather than reading environment variables from your platform, back up any existing .env before running it and diff the result afterward. On containerized or platform-managed deployments these values usually belong to the pipeline, so the wizard duplicates that logic.
- Does the installer back up the database before running migrations?
- Yes, step 7 takes a pre-migration backup and then runs your migrations automatically. There is a restoreBackup method exposed for recovery, but the documentation provides no tested evidence that a restore actually works end to end. Verify the backup and a full restore in staging before relying on it in a customer-facing install.
- Why am I hitting 429 rate limit errors during installation?
- In v2.0.9 the rate limiting middleware is actually registered and active, and its limit of roughly 20 requests per 5 minutes can be tripped by a legitimate multi-step flow on a slow connection or behind a shared NAT. Older 2.0.x versions implemented this middleware but never wired it in, which is why the behavior appears only after upgrading. Publish and adjust the package config, or temporarily relax the limiter for the installer routes during setup.
- How do I disable or lock the installer after setup is complete?
- The README does not document a reliable self-lock after a successful install, so assume you have to enforce it yourself. Remove or comment out the service provider registration, delete the published routes, or wrap the installer routes in middleware that returns 404 once an environment flag is set. Decide the deprecation trigger before you ship, and test that forcing the lock actually blocks /install and the /install/api endpoints.
- What are better alternatives to a web installer for deploying Laravel apps?
- If you ship Docker images, Terraform, Helm charts, CI/CD pipelines, or a managed platform, the installer competes with logic you already own and should not be adopted. In those cases use environment variables injected at deploy time, artisan migrate in the pipeline, and platform tooling such as Laravel Forge, Envoyer, or Vapor. A browser wizard only makes sense when the artifact you hand a customer is a source tree they will open in a browser.
- Is jmrashed/laravel-installer actively maintained and trustworthy for production?
- Be cautious. The repository has only a handful of GitHub stars, zero dependents, and a single maintainer, while its release history includes a command-injection fix in the dependency installer and a permanent license-validation bypass fix, both in the code path that runs before authentication exists. Any version before 2.0.9 should be considered unsuitable. Pin an exact version, read the source of the installer path, and avoid putting it on a critical path without a spike and a maintainer-of-record decision.