Reverb publishing is pinned to the INTERNAL reverb service (both dev * and prod compose name it `reverb`), so realtime keeps working right after a * domain change and never depends on the new public cert. The browser endpoint is * injected by the layout from DeploymentService::reverbClient(). * - app.url -> https:// so absolute URL generation matches how the panel is * served. With no domain (bare IP / dev) the env-derived app.url is left as is. */ public function boot(DeploymentService $deployment): void { // Re-apply the onboarding gate to EVERY Livewire component update, not just the // initial page GET. Livewire only re-runs route middleware that is registered as // persistent; without this, a component mounted while onboarded could keep running // destructive actions (hardening, SSH-key provisioning, credential changes) over // /livewire/update after the account is reverted to must_change_password mid-session. Livewire::addPersistentMiddleware([ EnsureSecurityOnboarded::class, ]); config([ 'broadcasting.connections.reverb.options.host' => 'reverb', 'broadcasting.connections.reverb.options.port' => 8080, 'broadcasting.connections.reverb.options.scheme' => 'http', 'broadcasting.connections.reverb.options.useTLS' => false, ]); $domain = $deployment->domain(); if ($domain !== null) { config(['app.url' => 'https://'.$domain]); } } }