Rocketeers Laravel Laravel Package

Product Decisions This Supports

• Observability consolidation (build vs. buy): Rather than building an internal cross-environment queue dashboard, teams can adopt Rocketeers and let this signed endpoint feed a single Horizon table across every instance. The PM decision is "integrate, don't build" — the aggregation, signing, and transport concerns are already handled.
• Security posture as a product requirement: The endpoint returns aggregate counts only (status, processes, jobsPerMinute, failedJobs, recentJobs, wait) and cannot reach job payloads or Horizon's action endpoints. This is the argument that lets a security-conscious org approve external queue visibility without handing over a bearer token.
• Roadmap / platform currency: Testbench 11.x unblocks laravel/framework 13.x in CI. This is a forward-compatibility signal for teams planning a Laravel 13 upgrade — the package is being tested against it, not merely declaring support.
• Feature scoping decisions: The 2.9.0 bearer-token path and the 2.10.0 signed path are explicitly independent and coexisting. That's a deliberate product choice — narrow, short-lived read access for browser dashboards, broader token access for server-to-server — and it sets the precedent for how future integrations should be scoped.
• Failure-mode design worth copying: 404 when Horizon is absent, endpoint closed when the secret is empty, 403 on invalid or expired signatures. Safe-by-default, so enabling the package does not silently widen your attack surface.
• Use cases unlocked: fleet-wide queue health at a glance, catching a backed-up or failing worker in one environment while comparing against the others, and giving non-engineers a read-only status view without Horizon UI credentials.

When to Consider This Package

Adopt when:

• You run Laravel Horizon in production, especially across more than one environment or instance, and want a single aggregated view instead of tab-hopping.
• You want that visibility without distributing Horizon bearer tokens or exposing Horizon's UI and its action endpoints to a browser or third party.
• You are on, or planning, Laravel 12/13 and want a vendor that tests against the version you're targeting.
• You already use (or are evaluating) Rocketeers for provisioning — the secret is written automatically on environment creation, and Insert › Horizon monitoring handles existing environments, so setup cost is near zero.

Look elsewhere or defer when:

• Horizon is not installed. The endpoint 404s by design, so the feature is inert for you — though harmless.
• You need job-level introspection: payloads, retries, deletes, or Horizon's action endpoints. This endpoint is deliberately aggregate-only; it is not a Horizon API replacement, and the 2.9.0 bearer path exists for anything deeper.
• You already have first-party observability (Pulse, Telescope, an APM, Prometheus/Grafana) covering queue depth and failure rates. This adds a second pane of glass, not a replacement.
• You cannot set ROCKETEERS_HORIZON_SECRET in your environment, or your org prohibits an inbound endpoint outside the web middleware group on principle, regardless of its signature model.
• You need push-based alerting. This is pull-only and refreshed by the dashboard; it won't page anyone.

How to Pitch It (Stakeholders)

For executives: This release gives you one table showing the health of every Horizon queue in every environment, refreshed live in the Rocketeers dashboard — no new infrastructure, no new vendor, no engineering sprint. The access model is a short-lived signed URL, so the credential never reaches the browser, and the endpoint can only read summary counts: it cannot see job contents and cannot trigger retries or deletes. It also confirms the package is being tested against Laravel 13, which de-risks our eventual framework upgrade. Cost is one environment variable and a checkbox.

For engineering: v2.10.0 is additive and non-breaking. GET /rocketeers/horizon/stats is registered outside the web group — no session, cookie, or CSRF involvement — and sends no custom headers, so it stays a CORS simple request and never preflights. Authorization is an HMAC signature with a configurable TTL (ROCKETEERS_HORIZON_TTL, default 300s); invalid or expired signatures get 403, an empty secret keeps the endpoint closed, and it 404s when Horizon isn't installed. Signing happens server-side, so only the signature reaches the client. It coexists with, and is narrower than, the 2.9.0 bearer-token access. Separately, orchestra/testbench is now allowed at ^11.0, which actually boots Laravel 13.29 in the suite instead of silently testing only 12 — worth noting if you're tracking upgrade readiness.

Ask: set ROCKETEERS_HORIZON_SECRET for environments where queue visibility is wanted (auto-populated on new provisions; use Insert › Horizon monitoring for existing ones) and confirm with security that a signed, aggregate-only, session-less read endpoint is acceptable.