Weave Code
Remote Laravel Package
laravelcollective/remote
LaravelCollective Remote brings SSH and SFTP to Laravel. Connect to remote servers, run commands, upload and download files, and manage multiple named connections through a clean, familiar Laravel-style API, ideal for deployments, server maintenance, and remote automation.
Remote SSH Access for the Laravel Framework
Frequently asked questions about Remote
- Does laravelcollective/remote support Laravel 9, 10 or 11, and is it still maintained?
- No. The last release, v6.2.0 from September 2020, is a compatibility-only bump declaring Laravel 8 support, so its supported ceiling is Laravel 8, which reached end of life in January 2023. The Composer constraint will block an upgrade to Laravel 9, 10 or 11, effectively pinning your application to an unsupported framework branch. Widening the constraint means forking the package and taking on maintenance yourself. If your application is on Laravel 10 or 11, there is no supported path and you should pick an alternative.
- How do I install and configure laravelcollective/remote in a Laravel app?
- Run composer require laravelcollective/remote, and on Laravel with package auto-discovery the service provider and Remote facade are registered for you. Publish the config file with php artisan vendor:publish, then define your named remotes with host, username, key or password, and any required SSH options. Keep credentials in .env-backed config values rather than committing them, and resolve the connection from the container or facade in your code. There are no migrations or front-end assets to worry about.
- How do I run a remote SSH command and read the exit code, stdout and stderr?
- Call run() on a configured connection through the Remote facade and you get back a result object exposing the exit code, standard output and standard error. The critical detail is that nonzero exit codes are returned, not thrown as exceptions, so a script that ignores the exit code will fail silently. Always check the exit code and log stderr before treating a command as successful. Wrap the call so unexpected results surface as errors in your own code.
- How do I upload and download files over SFTP with this package?
- The package exposes SFTP put and get methods plus directory listing on the same fluent connection object you use for commands. Point the source and destination paths at local and remote locations, and use the listing helper to check for existing files before overwriting. Failures are reported through the return value rather than exceptions, so verify results explicitly. For large or many files, consider whether a dedicated sync tool or CI job is a better fit than doing this inside a request.
- Can I define multiple named remote server connections?
- Yes. Connections are declared as named entries in the package config file, and you select one by name when resolving the connection, so a single application can target several servers. This is useful for staging versus production hosts or for a small fleet of known machines. Keep each entry's credentials env-backed and avoid duplicating the same host under different names, which makes rotation harder. There is no pooling, so each call opens its own synchronous connection.
- How does host key verification work, and how do I avoid a MITM attack?
- Host key verification must be configured explicitly, and accepting an unknown host key by default is a man-in-the-middle exposure on any path that crosses an untrusted network. Pin the expected host key or fingerprint in your config so a changed key causes a hard failure rather than a silent connect. Prefer key-based authentication over passwords and store private keys with restrictive permissions on the app server. Where keys live and how they rotate should be a documented operational decision, not a default.
- How do I prevent shell injection when building remote commands?
- Command strings assembled by interpolating user input are a shell injection vector, because the remote command is executed by a shell on the target host. Keep commands as fixed strings plus escaped arguments, or validate input against a strict allowlist before it reaches the command. Never pass request data, filenames from untrusted sources or environment values straight into a command line without escaping. Wrapping execution behind your own narrow executor interface also gives you one place to enforce this.
- Is laravelcollective/remote safe to use for deployments, backups and production automation?
- It is a synchronous, blocking SSH client, so running deploys or destructive remote mutations inside a web request is a design problem the package cannot solve for you. It works best for application code that already owns credentials for a handful of known servers and needs scripted, read-mostly tasks such as shipping backups or pushing config. Consider the blast radius of a wrong command: if a silent failure would corrupt production, put the work in CI, a scheduler or an orchestration tool instead. Credentials live in config and key files with no secret-manager integration, so plan storage, logging redaction and rotation yourself.
- How do I test code that uses the Remote facade?
- The facade can be mocked, so you can assert that a connection was resolved and that run or put was called with the expected arguments without touching a real server. That said, mocking the facade couples your tests to the package API, which is painful if you later swap it out. A better pattern is to define your own small command executor and file transfer interfaces, bind the package behind them in a service provider, and fake those ports in tests. That keeps your test suite stable while the underlying SSH implementation changes.
- What are the best alternatives to laravelcollective/remote?
- spatie/ssh offers a modern, maintained SSH wrapper with a similar feel, and using phpseclib 3 directly removes the Laravel version pin entirely at the cost of more boilerplate. If the work is really deployment or configuration management, Laravel Envoy, Ansible or a CI runner such as GitHub Actions is usually the right home rather than application code. All of these avoid the Laravel 8 ceiling. Choose based on whether you need a library inside the app or a proper orchestration tool outside it.
Weaver
How can I help you explore Laravel packages today?