Laravel Laravel Package

Product Decisions This Supports

• Build vs. buy for queue observability. This package is the integration layer that lets a Rocketeers-hosted Laravel app surface Horizon metrics (status, throughput, failed jobs, wait times) inside the Rocketeers dashboard instead of requiring an in-house ops dashboard, a self-hosted Grafana/Prometheus stack, or per-team Horizon logins.
• Consolidating multi-instance monitoring. The endpoint returns aggregate counts across Horizon instances, which supports the product decision to give operators a single fleet-level table rather than instance-by-instance dashboards. Useful when scoping "one pane of glass" roadmap work.
• Security posture and credential model. The shift from a broad bearer token (2.9.0) to a narrow, short-lived, server-signed URL (2.10.0) is a deliberate least-privilege decision. This supports choosing signed-URL delegation over distributing shared secrets to browsers, and it sets a precedent for how other dashboard integrations should be authorized.
• Deployment/onboarding friction. Configuration is a single env var (ROCKETEERS_HORIZON_SECRET) written automatically at environment provisioning, with optional origin and TTL overrides. This supports the decision to keep onboarding self-serve rather than requiring a support ticket or manual secret exchange.
• Defensive defaults as a product requirement. The endpoint returns 404 when Horizon is absent and stays closed when the secret is empty. This supports the decision that the package can be installed broadly across a portfolio of apps without gating on Horizon adoption.
• Framework currency. Laravel 13 support (via orchestra/testbench 11.x) affects the roadmap decision of when to schedule framework upgrades — the package no longer blocks a Laravel 13 migration for the test suite.

When to Consider This Package

Adopt when:

• You host or deploy on Rocketeers and want Horizon data visible in its dashboard without building custom tooling.
• You run Horizon and need read-only aggregate visibility (throughput, failed counts, queue wait) across one or more environments.
• You want browser-side dashboards to never hold a long-lived credential — the signed-URL model is the reason to prefer this over hand-rolled token endpoints.
• You need the package installed across many apps where Horizon may or may not be present; the 404-when-absent behavior makes it safe to ship everywhere.
• You are planning or already executing a Laravel 13 upgrade and need dependencies that don't pin you to Laravel 12.

Look elsewhere when:

• You are not on Rocketeers — the endpoint exists to feed one specific dashboard and offers little standalone value.
• You need job payloads, retries, deletes, or other Horizon action endpoints. This integration is deliberately narrower than that; you need Horizon's own UI or the bearer-token path from 2.9.0.
• You need push-based metrics, historical retention, alerting, or SLO reporting. This returns point-in-time aggregate counts only; a metrics pipeline (Prometheus, OpenTelemetry, etc.) is the correct tool.
• Your monitoring must be vendor-neutral or portable across hosts — this couples observability to a specific platform.
• You require an inbound-auth scheme that fits existing SSO/OAuth infrastructure; HMAC-signed query strings are a distinct pattern to operate and audit.

How to Pitch It (Stakeholders)

For executives: This release gives operators visibility into queue health — throughput, failures, and wait times — directly in the Rocketeers dashboard, with no new infrastructure and no additional vendor spend. It is a low-risk, incremental improvement to an existing integration. The security model is the headline: the browser only ever receives a short-lived, server-generated signature scoped to read-only aggregate counts, never a credential that could reach job data or Horizon's destructive actions. It also unblocks Laravel 13 upgrades.

For engineering: The endpoint (GET /rocketeers/horizon/stats) is a signed, read-only surface: HMAC over an expiry timestamp, default 300s TTL, 403 on invalid or expired signatures, and a closed endpoint if ROCKETEERS_HORIZON_SECRET is unset. It is registered outside the web middleware group, so no session, cookie, or CSRF token is involved, and it uses no custom request headers — keeping it a CORS simple request that never preflights. It returns aggregate counts only; job payloads and Horizon's action endpoints are unreachable through it, and it coexists independently with the broader bearer-token access added in 2.9.0. It returns 404 when Horizon isn't installed, so it is safe to leave enabled fleet-wide. Operationally, the only required config is ROCKETEERS_HORIZON_SECRET, provisioned automatically for new environments and available via Insert › Horizon monitoring in the env editor for existing ones; ROCKETEERS_HORIZON_ORIGIN and ROCKETEERS_HORIZON_TTL are optional. Separately, orchestra/testbench was widened to ^11.0, which lets the suite actually boot Laravel 13.29 — the previous ^10.0 cap meant Laravel 13 support was declared but never exercised in CI. No breaking changes are indicated in this release.