Production Setup

This guide is for bare metal / a VM after you have completed Installation (app key, .env, migrations, Passport keys, seed, frontend build). Prefer containers? Use compose.prod.yaml — it already runs Horizon, Reverb, and the scheduler for you.

Before you continue

Confirm the install checklist is done:

APP_KEY set
Database migrated
QUEUE_CONNECTION=redis and Redis reachable
Passport keys present (PASSPORT_* env for Docker prod, or php artisan passport:keys on bare metal)
php artisan db:seed + UserSeeder ran
storage:link ran if FILESYSTEM_DISK=public
npm run build completed

Environment (production values)

APP_ENV=production
APP_DEBUG=false
APP_URL=https://your-domain.com

SELF_HOSTED=true

QUEUE_CONNECTION=redis
CACHE_STORE=redis
SESSION_DRIVER=database
BROADCAST_CONNECTION=reverb
FILESYSTEM_DISK=public

REVERB_APP_SECRET=<random>
REVERB_HOST=your-domain.com
REVERB_PORT=443
REVERB_SCHEME=https

VITE_REVERB_* are compiled into the frontend — run npm run build again after changing any REVERB_* value. See Configuration for mail, object storage, and social OAuth.

Optimizations

Run these commands after deployment:

composer install --optimize-autoloader --no-dev

php artisan config:cache
php artisan route:cache
php artisan view:cache
php artisan event:cache

Queue Worker

TryPost uses queues for critical background processing:

Publishing posts to social platforms at scheduled times (one social-<platform> queue per enabled network)
Sending email notifications
Verifying channel connections and refreshing tokens
Collecting analytics for Insights (analytics queue)
Importing posts made outside TryPost and media from Google Drive, Google Photos, Canva or Unsplash (media-imports queue)
Polling RSS feeds (rss-feeds queue); repurpose sources are polled on their network’s social-<platform> queue
Delivering webhooks and their retries (webhooks queue)
Live updates to the browser (broadcasts queue)

Horizon starts a worker pool for each of these queues from config/horizon.php. Without a running queue worker, scheduled posts will not be published. Use Supervisor to keep Horizon running.

Install Supervisor

# Ubuntu/Debian
sudo apt install supervisor

# CentOS/RHEL
sudo yum install supervisor

Configure Supervisor

Create /etc/supervisor/conf.d/trypost-worker.conf:

[program:trypost-horizon]
process_name=%(program_name)s
command=php /var/www/trypost/artisan horizon
autostart=true
autorestart=true
stopasgroup=true
killasgroup=true
user=www-data
redirect_stderr=true
stdout_logfile=/var/www/trypost/storage/logs/horizon.log
stopwaitsecs=3600

Then start it:

sudo supervisorctl reread
sudo supervisorctl update
sudo supervisorctl start trypost-horizon

Nginx Configuration

Example Nginx configuration:

server {
    listen 80;
    listen [::]:80;
    server_name your-domain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name your-domain.com;

    root /var/www/trypost/public;
    index index.php;

    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";

    charset utf-8;
    client_max_body_size 1G;

    # Reverb WebSocket (Pusher protocol) + HTTP API
    location /app/ {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }

    location /apps/ {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    error_page 404 /index.php;

    location ~ \.php$ {
        # Replace with the FPM socket for the PHP version you installed (e.g. php8.4-fpm.sock, php8.5-fpm.sock).
        fastcgi_pass unix:/var/run/php/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}

Both /app/ (browser WebSocket) and /apps/ (Pusher HTTP API) must be proxied to Reverb. Omitting /apps/ causes flaky real-time updates.

SSL Certificate

Use Let’s Encrypt for free SSL:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com

Scheduled Tasks (Cron)

TryPost uses Laravel’s task scheduler for several recurring jobs. The scheduler must run every minute or scheduled posts won’t publish, expiring tokens won’t refresh, and stuck posts won’t recover.

Command	Schedule	Purpose
`posts:process-scheduled`	every minute	Dispatches `PublishPost` jobs for posts that are due
`social:refresh-expiring-tokens`	every 15 minutes	Refreshes OAuth tokens that are about to expire
`social:check-upcoming-connections`	every 15 minutes	Verifies the channels of posts scheduled within the next hour and emails when they need reconnecting
`social:recover-stuck-posts`	every 30 minutes	Detects posts stuck in `publishing` and retries or fails them
`social:reconcile-google-business-posts`	every 5 minutes	Checks Google Business Profile posts that are still in review by Google
`social:resolve-tiktok-video-ids`	every 15 minutes	Asks TikTok for the video id of public posts it has not reported yet, so their link and metrics work
`social:check-connections`	daily	Verifies every connected channel still authenticates
`app:prune-webhook-logs`	daily	Deletes webhook delivery logs older than 7 days
`posts:prune-history`	daily	Deletes published posts older than `POST_HISTORY_RETENTION_DAYS` (default 730) with their media
`media:prune-uploads`	hourly	Deletes uploads never attached to a post after `MEDIA_UPLOAD_RETENTION_HOURS` (default 24)
`repurpose:poll`	every 5 minutes	Queues a check for each repurpose source that is due
`rss-feeds:poll`	every 5 minutes	Queues a check for each RSS feed that is due
`analytics:dispatch-account-daily`	daily, 02:00 UTC	Collects daily follower and account numbers
`analytics:dispatch-publication-discovery`	every 3 hours (X: every 24 hours)	Finds new posts on each channel, including ones made outside TryPost — see `PUBLICATION_DISCOVERY_INTERVAL_HOURS`
`analytics:dispatch-publication-metrics`	daily, 03:00 UTC	Refreshes post metrics

Two jobs also run on the scheduler to close each day’s analytics (23:30 and 00:30 UTC).

posts:prune-history deletes data every night. Published posts older than POST_HISTORY_RETENTION_DAYS are removed together with their media. See Post history retention.

Add the Laravel scheduler to the cron of the user that runs PHP (usually www-data), so the files it creates stay writable by php-fpm and Horizon:

sudo crontab -u www-data -e

Add this line:

* * * * * cd /var/www/trypost && php artisan schedule:run >> /dev/null 2>&1

This is required. Without the cron job, scheduled posts will not be published automatically and social tokens will expire silently.

WebSocket Server (Reverb)

TryPost uses Laravel Reverb for real-time updates in the app (posts created, deleted or changing status, post notes, Telegram connections and webhook delivery logs). Add a Supervisor config to keep it running: Create /etc/supervisor/conf.d/trypost-reverb.conf:

[program:trypost-reverb]
process_name=%(program_name)s
command=php /var/www/trypost/artisan reverb:start --host=127.0.0.1 --port=8080
autostart=true
autorestart=true
stopasgroup=true
killasgroup=true
user=www-data
redirect_stderr=true
stdout_logfile=/var/www/trypost/storage/logs/reverb.log

Then reload Supervisor:

sudo supervisorctl reread
sudo supervisorctl update
sudo supervisorctl start trypost-reverb

Proxy /app/ and /apps/ through Nginx as shown above.

File Permissions

Set correct permissions:

sudo chown -R www-data:www-data /var/www/trypost
sudo chmod -R 755 /var/www/trypost
sudo chmod -R 775 /var/www/trypost/storage
sudo chmod -R 775 /var/www/trypost/bootstrap/cache

Keep storage/oauth-private.key readable only by the app user (typically mode 600).

Checklist

Make sure all of these are in place in production:

Item	How	Purpose
App key	`php artisan key:generate`	Encrypts sessions / cookies
Passport keys	`PASSPORT_PRIVATE_KEY` / `PASSPORT_PUBLIC_KEY` (or `php artisan passport:keys` once on bare metal)	Sign/verify API & MCP tokens
Passport client	`php artisan db:seed` (once; Docker prod also runs `PassportSeeder` on boot)	Issue personal access tokens
Admin user	`php artisan db:seed --class=UserSeeder` (once)	First login
Storage link	`php artisan storage:link` (once, if `FILESYSTEM_DISK=public`)	Local media URLs — skip for S3 / R2 / Spaces
Redis	`QUEUE_CONNECTION=redis` + Redis up	Queues, cache, schedule locks
Mail	SMTP or SendKit	Invites, password reset, alerts
Horizon	`php artisan horizon` (Supervisor)	Publishes posts, sends email and webhooks, collects analytics
Reverb	`php artisan reverb:start` (Supervisor)	Real-time WebSocket updates
Scheduler	cron → `schedule:run` every minute	Due posts, token refresh, stuck-post recovery

If Horizon, Reverb, or the scheduler are not running, TryPost will not function correctly. Scheduled posts won’t publish, notifications won’t send, and the dashboard won’t update in real time.

Monitoring

Consider setting up monitoring for:

Server health (CPU, memory, disk)
Application errors (Laravel logs in storage/logs/)
Queue status (Horizon dashboard at /horizon)
WebSocket connections (Reverb logs in storage/logs/reverb.log)

Backups

Regularly backup:

Database
.env file
Passport keys (storage/oauth-*.key or PASSPORT_* env) — losing them invalidates API keys and MCP OAuth grants
Uploaded media (if using local storage)

Upgrading asks for a database dump before every migrate --force. The commands below read the database credentials from environment variables. On bare metal, load them from .env first, from the app directory: set -a; . ./.env; set +a. Inside the bundled Compose stack the app container already has them. PostgreSQL

PGPASSWORD="$DB_PASSWORD" pg_dump -h "$DB_HOST" -U "$DB_USERNAME" -d "$DB_DATABASE" \
  -Fc -f "trypost-$(date +%F).dump"

# restore
PGPASSWORD="$DB_PASSWORD" pg_restore -h "$DB_HOST" -U "$DB_USERNAME" -d "$DB_DATABASE" \
  --clean "trypost-2026-01-01.dump"

MySQL

mysqldump -h "$DB_HOST" -u "$DB_USERNAME" -p"$DB_PASSWORD" \
  --single-transaction "$DB_DATABASE" > "trypost-$(date +%F).sql"

# restore
mysql -h "$DB_HOST" -u "$DB_USERNAME" -p"$DB_PASSWORD" "$DB_DATABASE" < "trypost-2026-01-01.sql"

On the bundled Compose stack the app container carries both clients and already has those variables, so docker compose -f compose.prod.yaml exec app runs either one as written — as does php artisan db for an interactive session.

The image carries mysql-client alongside pdo_mysql, so the MySQL commands run inside the container.