Production deployment

# 1. Code
git clone <repo> /var/www/html
cd /var/www/html
composer install --no-dev --optimize-autoloader --classmap-authoritative

# 2. Env
cp .env.prod.local.dist .env.prod.local
nano .env.prod.local        # set non-secret values

# 3. Secrets vault
php bin/console secrets:set OPCUA_PASSWORD
php bin/console secrets:set OPCUA_AUTH_TOKEN
php bin/console secrets:set MERCURE_JWT_SECRET

# 4. Cache + warmup
php bin/console cache:clear --env=prod --no-debug
php bin/console cache:warmup --env=prod --no-debug

# 5. Migrations
php bin/console doctrine:migrations:migrate --no-interaction

# 6. OPC UA setup
sudo mkdir -p /var/lib/opcua/trust
sudo chown www-data:www-data /var/lib/opcua/trust
# Use the opcua-cli companion (or your app:trust:add command — see Security · Trust store)
vendor/bin/opcua trust:add opc.tcp://plc.factory.local:4840 \
    --store=/var/lib/opcua/trust

# 7. Services
sudo systemctl daemon-reload
sudo systemctl enable --now opcua-session-manager
sudo systemctl enable --now messenger-opcua-data@{1..4}
sudo systemctl enable --now messenger-opcua-alarms
sudo systemctl enable --now php8.4-fpm
sudo systemctl enable --now nginx

#!/bin/bash
set -e

cd /var/www/html

git fetch origin
git checkout origin/main

composer install --no-dev --optimize-autoloader --no-progress

# Migrations — abort on destructive changes
php bin/console doctrine:migrations:migrate --no-interaction

# Cache
php bin/console cache:clear --env=prod
php bin/console cache:warmup --env=prod

# Restart services
sudo systemctl restart opcua-session-manager
sudo systemctl reload-or-restart 'messenger-opcua-*'
sudo systemctl reload php8.4-fpm

# Verify
sleep 2
curl -fsS http://localhost/health/opcua | grep -q '"status":"up"' || (echo "Daemon not up" && exit 1)

echo "Deploy complete: $(git rev-parse HEAD)"

{
    frankenphp
    order php_server before file_server
}

example.com {
    root * /var/www/html/public
    php_server
}

sudo systemctl reload frankenphp

[Unit]
Description=OPC UA Session Manager (Symfony)
After=network-online.target redis-server.service
Wants=network-online.target

[Service]
Type=simple
User=www-data
Group=www-data
WorkingDirectory=/var/www/html
Environment=APP_ENV=prod APP_DEBUG=0
EnvironmentFile=-/etc/opcua/symfony.env
ExecStartPre=/usr/bin/mkdir -p /var/run/opcua
ExecStartPre=/usr/bin/chown www-data:www-data /var/run/opcua
ExecStart=/usr/bin/php /var/www/html/bin/console opcua:session
ExecStartPost=/usr/bin/php /var/www/html/bin/console app:opcua:resubscribe

Restart=on-failure
RestartSec=5
KillSignal=SIGTERM
TimeoutStopSec=30

ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true
ReadWritePaths=/var/run/opcua /var/log /var/www/html/var /var/lib/opcua

[Install]
WantedBy=multi-user.target

[Unit]
Description=Symfony Messenger Worker (opcua_data, instance %i)
After=opcua-session-manager.service

[Service]
Type=simple
User=www-data
Group=www-data
WorkingDirectory=/var/www/html
Environment=APP_ENV=prod
EnvironmentFile=-/etc/opcua/symfony.env
ExecStart=/usr/bin/php /var/www/html/bin/console messenger:consume opcua_data \
    --time-limit=3600 --memory-limit=512M

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

sudo systemctl enable --now messenger-opcua-data@{1..4}

cd /var/www/html
git checkout <previous-sha>
composer install --no-dev --optimize-autoloader
php bin/console doctrine:migrations:migrate prev --no-interaction  # only if migrated
php bin/console cache:clear --env=prod

sudo systemctl restart opcua-session-manager
sudo systemctl reload-or-restart 'messenger-opcua-*'
sudo systemctl reload php8.4-fpm