- How do I install relayercore/laravel-installer in a Laravel application?
- Run composer require relayercore/laravel-installer, then publish the package config and views/assets with the vendor:publish command described in the README. The package registers middleware that redirects traffic to /install until the storage/installed marker exists, so review that middleware before enabling it in an existing app. No manual service provider editing is required beyond what the package auto-discovers.
- Which Laravel and PHP versions does laravel-installer support?
- The README badge and test matrix claim Laravel 10, 11, 12, and 13 support on PHP 8.2 through 8.4, with the caveat that Laravel 12 and 13 require PHP 8.3 or newer. The 1.0.0 changelog mentions only Laravel 10 and 11, so confirm the actual constraint in the package composer.json and CI matrix before committing. PHP 8.2 is not compatible with Laravel 12 or 13.
- How do I stop the installer middleware from blocking API routes, webhooks, or healthchecks?
- The middleware treats every request as uninstalled until storage/installed exists, which means API clients, queue-triggered requests, and healthcheck endpoints can be redirected or return 503. Plan an exemption list for routes that must remain reachable during and after installation. The README does not document a complete exemption mechanism, so verify route exclusions in a spike before deploying.
- How do I add or reorder installer steps?
- Steps are defined in config/installer.php, so you can add, remove, or reorder the Requirements, Permissions, Database, Admin, and Done steps without forking the package. For a custom step, run php artisan make:installer-step to scaffold the Livewire component and register it in the pipeline. The after_install hook is the intended seam for post-install seeding, cache warming, or license activation.
- Does relayercore/laravel-installer work with php artisan config:cache?
- The after_install hook is a closure inside config/installer.php, and closures in config files break php artisan config:cache, which is a standard production deploy step. Verify this in a spike and, if needed, replace the closure with an invokable class or event listener. Without that change you will likely need to fork the config or the package for production deployments.
- Can the installer create admins that work with Fortify, Sanctum, or my roles system?
- The Admin step writes directly to the model configured as admin_model and offers hook-based role assignment. That direct model write can bypass your registration action, password policy, events, verification flow, and audit logging. If you rely on Fortify, Sanctum, or a role package, plan an adapter that reuses your own registration logic.
- Where does the installer store its installed state, and what happens on redeploy or autoscaling?
- Installation state is the storage/installed marker file, which is per-filesystem rather than per-database. On ephemeral containers, scale-out events, or restore-from-backup, that marker can disappear and re-trigger the wizard on a live application with real data. Decide where the marker lives in your target topology before using this in production.
- Does the database step require CREATE DATABASE privileges?
- The Database step tests the connection and can automatically create the database for MySQL, PostgreSQL, SQL Server, and SQLite. Auto-creation needs CREATE DATABASE privileges, which managed services such as RDS or PlanetScale often will not grant. Also check the failure and rollback behavior when the connection test passes but migrations fail.
- Is it safe to ship a generic APP_KEY with the installer and rotate it later?
- The README's boot-key pattern ships a generic APP_KEY and relies on running key:generate as the final installation step. Until installation completes, every distributed copy shares a known cookie and session encryption key, which is a deliberate trade-off rather than a bug. Make sure no path leaves the application reachable but uninstalled.
- Is relayercore/laravel-installer production-ready, and what are the alternatives?
- It is a small, single-organization package with one star, zero dependents, and no documented security disclosure policy, so no third party has validated it in production. If you control deployment through CI/CD and infrastructure as code, the installer solves a problem you may not have, and a custom Artisan install command or seeder is often simpler. The package is most valuable when you ship your Laravel app as an archive to non-technical buyers.