Production deployment

# 1. Code
git clone <repo> /var/www/html
cd /var/www/html
composer install --no-dev --optimize-autoloader

# 2. Env
cp .env.production .env
php artisan key:generate

# 3. Migrations
php artisan migrate --force

# 4. Cache
php artisan config:cache
php artisan route:cache
php artisan view:cache
php artisan event:cache

# 5. Storage
mkdir -p storage/framework/{sessions,views,cache,opcua}
chown -R www-data:www-data storage

# 6. OPC UA setup
sudo mkdir -p /var/lib/opcua/trust
sudo chown www-data:www-data /var/lib/opcua/trust

OPCUA_TRUST_STORE_PATH=/var/lib/opcua/trust \
  vendor/bin/opcua-cli trust:add opc.tcp://plc.factory.local:4840

# 7. Services
sudo systemctl daemon-reload
sudo systemctl enable --now opcua-session-manager
sudo systemctl enable --now horizon
sudo systemctl enable --now reverb         # if using

#!/bin/bash
set -e

cd /var/www/html

git fetch origin
git checkout origin/main

composer install --no-dev --optimize-autoloader --no-progress

# Migrations — abort if a destructive change is queued
php artisan migrate --force

# Caches
php artisan config:cache
php artisan route:cache
php artisan view:cache
php artisan event:cache

# Restart services that don't auto-reload PHP
sudo systemctl restart opcua-session-manager
sudo systemctl reload php8.4-fpm

php artisan horizon:terminate   # Horizon gracefully restarts itself
php artisan octane:reload       # if using Octane

# Post-deploy verification — use a small custom command (or curl
# your /health/opcua endpoint). The laravel-opcua package does not
# ship opcua:ping; see docs/observability/debugging.md for a
# minimal probe pattern.
sleep 2
curl -fsS http://127.0.0.1/health/opcua \
    || (echo "Daemon not up after deploy!" && exit 1)

echo "Deploy complete: $(git rev-parse HEAD)"

php artisan octane:reload

[Unit]
Description=OPC UA Session Manager
After=network-online.target redis.service
Wants=network-online.target

[Service]
Type=simple
User=www-data
Group=www-data
WorkingDirectory=/var/www/html
EnvironmentFile=/etc/opcua/laravel.env
ExecStartPre=/usr/bin/mkdir -p /var/run/opcua
ExecStartPre=/usr/bin/chown www-data:www-data /var/run/opcua
ExecStart=/usr/bin/php /var/www/html/artisan opcua:session \
    --socket-mode=0660 \
    --log-channel=opcua \
    --cache-store=redis
# socket_path, auth_token, allowed_cert_dirs and auto_publish come
# from config/opcua.php (sourced from /etc/opcua/laravel.env via
# OPCUA_SOCKET_PATH, OPCUA_AUTH_TOKEN, OPCUA_AUTO_PUBLISH, and the
# `allowed_cert_dirs` key in the config file). There are no CLI
# flags for those settings on opcua:session.

ExecStartPost=/bin/sleep 2
ExecStartPost=/usr/bin/php /var/www/html/artisan opcua:resubscribe

Restart=on-failure
RestartSec=5
KillSignal=SIGTERM
TimeoutStopSec=30

ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true
ReadWritePaths=/var/run/opcua /var/log /var/www/html/storage /var/lib/opcua

[Install]
WantedBy=multi-user.target

cd /var/www/html
git checkout <previous-sha>
composer install --no-dev --optimize-autoloader
php artisan migrate:rollback --step=1     # only if you migrated
php artisan config:cache
sudo systemctl restart opcua-session-manager
php artisan horizon:terminate
php artisan octane:reload