Go to file
Claude bc8bbc56a5
tests / pest (push) Successful in 7m4s Details
tests / assets (push) Successful in 19s Details
tests / release (push) Successful in 4s Details
Make the console's access list reach the proxy, price in euros, and answer errors
The console was unreachable, and not for the reason it looked like. Two causes,
both mine.

A failed `artisan optimize` — the one that hit duplicate route names — left a
broken route cache behind, so every request to the console host answered 500.
Rebuilt.

Underneath that: the reverse proxy has its own console allowlist, hard-coded,
and it runs BEFORE the application. Everything added on the console's own
access page was therefore ineffective, and when the owner's address changed
they were turned away by the proxy before reaching the page that would have
fixed it. The proxy now imports a fragment generated from the same list the
console manages, regenerated by the host agent and reloaded when it changes.

Getting that safe took most of the review. It refuses to rewrite an ambiguous
Caddyfile rather than replacing some other site's matcher; it never falls back
to a loopback-only list when the application cannot be reached, because that
list validates cleanly and locks out every remote operator; it retries a reload
that failed instead of assuming it worked; and an installation that upgrades
without rerunning the installer is told, because otherwise the whole mechanism
is invisibly absent.

Prices are entered in euros. The form asked for cents, so €799 was typed as
79900 and one slipped digit was a factor of ten on an invoice. Conversion
happens in one place, on the string rather than through a float — (float)
'79.90' × 100 is 7989.999… and casting truncates to 7989, one cent short on
exactly the prices people charge — and it refuses an amount the column cannot
hold instead of failing at the database.

Every error code has a page now, in the site's own language and typeface,
self-contained so it still renders when the asset manifest is the thing that
broke. There was only a bare white 404.

The VPN list stops being a seven-column table nobody could fit: names broke
across two lines and so did the headings. These are attributes of one access,
not quantities compared down a column, so each access is a row — identity on
one line, measurements in mono on the next.

The status page says what it measures rather than what it promises. "New orders
are delivered without failures" read as a marketing claim on a page whose only
job is to be believed, and said nothing about the last 24 hours.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-27 06:51:05 +02:00
.gitea/workflows feat(deploy): releases you can pin to, and a version that tells the truth 2026-07-26 15:21:38 +02:00
.npm chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack) 2026-07-25 00:21:30 +02:00
app Make the console's access list reach the proxy, price in euros, and answer errors 2026-07-27 06:51:05 +02:00
bin chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack) 2026-07-25 00:21:30 +02:00
bootstrap feat(security): the console decides who may reach it, and the owner keeps the list 2026-07-26 20:27:26 +02:00
config Move the console off /admin, give the status page its own address, and measure monitoring 2026-07-27 06:05:40 +02:00
database Move the console off /admin, give the status page its own address, and measure monitoring 2026-07-27 06:05:40 +02:00
deploy Make the console's access list reach the proxy, price in euros, and answer errors 2026-07-27 06:51:05 +02:00
docker fix(nginx): the live hostnames were missing from the admin denylist 2026-07-26 18:43:44 +02:00
docs feat(deploy): releases you can pin to, and a version that tells the truth 2026-07-26 15:21:38 +02:00
lang Make the console's access list reach the proxy, price in euros, and answer errors 2026-07-27 06:51:05 +02:00
public Rebuild the public site as a document, and read prices from the catalogue 2026-07-27 03:52:25 +02:00
resources Make the console's access list reach the proxy, price in euros, and answer errors 2026-07-27 06:51:05 +02:00
routes Let the console keep its recovery hostnames without breaking route caching 2026-07-27 06:20:44 +02:00
storage chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack) 2026-07-25 00:21:30 +02:00
tests Make the console's access list reach the proxy, price in euros, and answer errors 2026-07-27 06:51:05 +02:00
.dockerignore chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack) 2026-07-25 00:21:30 +02:00
.editorconfig chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack) 2026-07-25 00:21:30 +02:00
.env.example feat(billing): one plan change at a time, and every price says what it is 2026-07-26 09:23:49 +02:00
.gitattributes chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack) 2026-07-25 00:21:30 +02:00
.gitignore feat(deploy): unattended install from a single answers file 2026-07-26 00:40:33 +02:00
.npmrc chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack) 2026-07-25 00:21:30 +02:00
README.md chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack) 2026-07-25 00:21:30 +02:00
VERSION feat(deploy): releases you can pin to, and a version that tells the truth 2026-07-26 15:21:38 +02:00
artisan chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack) 2026-07-25 00:21:30 +02:00
composer.json feat(vpn): ownership, a Developer role, and password-gated config retrieval 2026-07-25 22:31:54 +02:00
composer.lock feat(vpn): ownership, a Developer role, and password-gated config retrieval 2026-07-25 22:31:54 +02:00
docker-compose.yml fix(ci): keep the workflow and runner compatible with Gitea 1.20 2026-07-26 01:15:45 +02:00
package-lock.json Rebuild the public site as a document, and read prices from the catalogue 2026-07-27 03:52:25 +02:00
package.json Rebuild the public site as a document, and read prices from the catalogue 2026-07-27 03:52:25 +02:00
phpunit.xml fix(billing): a paid order opens a contract, and provisioning obeys it 2026-07-26 11:10:00 +02:00
postcss.config.js feat(portal): design foundation — Tailwind v3, tokens, self-hosted fonts 2026-07-25 00:43:01 +02:00
tailwind.config.js Rebuild the public site as a document, and read prices from the catalogue 2026-07-27 03:52:25 +02:00
vite.config.js feat(ops): update page, automatic 419 recovery, CI workflow 2026-07-26 00:58:27 +02:00

README.md

Laravel Logo

Build Status Total Downloads Latest Stable Version License

About Laravel

Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable and creative experience to be truly fulfilling. Laravel takes the pain out of development by easing common tasks used in many web projects, such as:

Laravel is accessible, powerful, and provides tools required for large, robust applications.

Learning Laravel

Laravel has the most extensive and thorough documentation and video tutorial library of all modern web application frameworks, making it a breeze to get started with the framework.

In addition, Laracasts contains thousands of video tutorials on a range of topics including Laravel, modern PHP, unit testing, and JavaScript. Boost your skills by digging into our comprehensive video library.

You can also watch bite-sized lessons with real-world projects on Laravel Learn, where you will be guided through building a Laravel application from scratch while learning PHP fundamentals.

Agentic Development

Laravel's predictable structure and conventions make it ideal for AI coding agents like Claude Code, Cursor, and GitHub Copilot. Install Laravel Boost to supercharge your AI workflow:

composer require laravel/boost --dev

php artisan boost:install

Boost provides your agent 15+ tools and skills that help agents build Laravel applications while following best practices.

Contributing

Thank you for considering contributing to the Laravel framework! The contribution guide can be found in the Laravel documentation.

Code of Conduct

In order to ensure that the Laravel community is welcoming to all, please review and abide by the Code of Conduct.

Security Vulnerabilities

If you discover a security vulnerability within Laravel, please send an e-mail to Taylor Otwell via taylor@laravel.com. All security vulnerabilities will be promptly addressed.

License

The Laravel framework is open-sourced software licensed under the MIT license.