How to Deploy a Laravel App on a DigitalOcean VPS From Scratch

ssh root@<YOUR_SERVER_IP>

# First time: type "yes" to accept the fingerprint
# Then enter your root password

ssh root@<YOUR_SERVER_IP>

sudo systemctl restart ssh

sudo nano /etc/ssh/sshd_config

# Set these values:
PasswordAuthentication yes
PermitRootLogin yes

adduser user <your-username>     # Creates user and sets password

usermod -aG sudo sudo <your-username>     # Grants sudo privileges

su - <your-username>          # Switch to new user
exit                 # Log out from user session
exit                 # Log out from server

ssh <your-username>@<YOUR_SERVER_IP>

sudo nano /etc/ssh/sshd_config

# Update these values:
PermitRootLogin no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no
PermitEmptyPasswords no

sudo systemctl restart ssh

sudo -u <your-username> mkdir -p /home/<your-username>/.ssh
sudo -u <your-username> chmod 700 /home/<your-username>/.ssh
sudo chown -R <your-username>:<your-username> /home/<your-username>/.ssh
sudo -u <your-username> touch /home/<your-username>/.ssh/authorized_keys
sudo -u <your-username> chmod 600 /home/<your-username>/.ssh/authorized_keys
sudo chmod 755 /home/<your-username>
sudo chown <your-username>:<your-username> /home/<your-username>

ssh-keygen -t ed25519 -C "your_email@example.com"

type "%USERPROFILE%\.ssh\id_ed25519.pub" | ssh root@<YOUR_SERVER_IP> "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

chmod 600 ~/.ssh/id_github

Set-Service ssh-agent -StartupType Automatic
Start-Service ssh-agent
ssh-add "$env:USERPROFILE\.ssh\id_ed25519"

ssh -T git@github.com
# Expected: Hi username! You've successfully authenticated...

scp "C:\Users\<YourName>\.ssh\id_github" <your-username>@<YOUR_SERVER_IP>:~/.ssh/
scp "C:\Users\<YourName>\.ssh\id_github.pub" <your-username>@<YOUR_SERVER_IP>:~/.ssh/

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_github

New-Item "$env:USERPROFILE\.ssh\config" -ItemType File
notepad "$env:USERPROFILE\.ssh\config"

Host prod-server
    HostName <YOUR_SERVER_IP>_ADDRESS<YOUR_SERVER_IP>
    User <your-username>
    IdentityFile C:\Users\<YourName>\.ssh\id_github

ssh prod-server     # Instead of: ssh -i "path/to/key" <your-username>@<YOUR_SERVER_IP>

# Move files from custom folder to default .ssh location
Move-Item "C:\Users\<YourName>\.ssh\~ssh\*" "C:\Users\<YourName>\.ssh\"
Remove-Item "C:\Users\<YourName>\.ssh\~ssh"

# Update package list and upgrade all packages
apt update && apt upgrade -y

# Remove unused packages
apt autoremove -y

# Check if reboot is needed (kernel updates)
cat /var/run/reboot-required

# Reboot if file exists
reboot

sudo add-apt-repository ppa:ondrej/php
sudo apt update

sudo apt install -y php8.3-cli php8.3-fpm php8.3-mysql php8.3-sqlite3 \
  php8.3-curl php8.3-mbstring php8.3-xml php8.3-zip php8.3-gd \
  php8.3-intl php8.3-bcmath php8.3-opcache

php -v          # Check PHP version
php -m          # List all loaded extensions

sudo apt install -y unzip

sudo nano /etc/php/8.3/fpm/php.ini

upload_max_filesize = 20M    # Max size of a single uploaded file (default: 2M)
post_max_size = 25M          # Max size of entire POST body — must be > upload_max_filesize
max_execution_time = 60      # Max seconds a script can run (default: 30)
max_input_time = 60          # Max seconds to parse input (default: 60, raise for slow uploads)

sudo systemctl restart php8.3-fpm

curl -sS https://getcomposer.org/installer | php
sudo mv composer.phar /usr/local/bin/composer
composer --version

composer audit           # Check for vulnerabilities
composer update          # Update all packages to fix vulnerabilities

sudo apt install -y mysql-server
sudo mysql_secure_installation   # Run security setup — say Y to all
sudo systemctl status mysql

sudo mysql

CREATE DATABASE <your_database>;
CREATE USER '<your-username>'@'localhost' IDENTIFIED BY 'yourpassword';
GRANT ALL PRIVILEGES ON <your_database>.* TO '<your-username>'@'localhost';
FLUSH PRIVILEGES;
EXIT;

# Check privileges
SHOW GRANTS FOR '<your-username>'@'localhost';

# Revoke privileges
REVOKE ALL PRIVILEGES ON <your_database>.* FROM '<your-username>'@'localhost';
FLUSH PRIVILEGES;

# Reset user password
ALTER USER '<your-username>'@'localhost' IDENTIFIED BY 'newpassword';
FLUSH PRIVILEGES;

# Drop and recreate user
DROP USER '<your-username>'@'localhost';
CREATE USER '<your-username>'@'localhost' IDENTIFIED BY 'newpassword';
GRANT ALL PRIVILEGES ON <your_database>.* TO '<your-username>'@'localhost';
FLUSH PRIVILEGES;

mysql -u <your-username> -p -h 127.0.0.1 <your_database>

# Edit MySQL config
sudo nano /etc/mysql/mysql.conf.d/mysqld.cnf
# Change: bind-address = 0.0.0.0

# Create remote user
sudo mysql
CREATE USER '<your-username>'@'%' IDENTIFIED BY 'yourpassword';
GRANT ALL PRIVILEGES ON <your_database>.* TO '<your-username>'@'%';
FLUSH PRIVILEGES;

sudo systemctl restart mysql

sudo apt install -y nginx
sudo systemctl status nginx

sudo nginx -t                    # Test config for errors
sudo systemctl restart nginx    # Restart Nginx
sudo systemctl reload nginx     # Reload without downtime
sudo systemctl status nginx     # Check status

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt install -y nodejs

node -v    # Verify Node version
npm -v     # Verify NPM version

# Create and own the target directory
sudo mkdir -p /var/www/<your-app>
sudo chown <your-username>:<your-username> /var/www/<your-app>

# Clone directly into folder (note the dot at the end)
cd /var/www/<your-app>
git clone git@github.com:your/repo.git .

mv /var/www/<your-app>/<your-app>/* /var/www/<your-app>/
mv /var/www/<your-app>/<your-app>/.* /var/www/<your-app>/ 2>/dev/null
rmdir /var/www/<your-app>/<your-app>

cd /var/www/<your-app>
composer install

# If .env.example exists:
cp .env.example .env

# If not (manually create):
nano .env

APP_NAME=<YourAppName>
APP_ENV=production
APP_KEY=
APP_DEBUG=false
APP_URL=https://<yourdomain.com>

LOG_CHANNEL=stack

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=<your_database>
DB_USERNAME=<your-username>
DB_PASSWORD="<your_db_password>"

CACHE_STORE=file
SESSION_DRIVER=file
QUEUE_DRIVER=sync

MAIL_MAILER=resend
MAIL_FROM_ADDRESS="no-reply@mail.<yourdomain.com>"
MAIL_FROM_NAME="${APP_NAME}"
RESEND_API_KEY=<your_resend_api_key>

php artisan key:generate
php artisan migrate

# Clear everything at once
php artisan optimize:clear

# Or individually:
php artisan config:clear
php artisan cache:clear
php artisan view:clear
php artisan route:clear

# Remove cached config file manually
rm /var/www/<your-app>/bootstrap/cache/config.php

php artisan tinker

# Create user
App\Models\User::create([
    'name' => '<Your Name>',
    'email' => 'you@email.com',
    'password' => bcrypt('<your_password>')
]);

# Update user role
App\Models\User::where('email', 'you@email.com')
    ->update(['role' => 'admin', 'is_admin' => 1]);

exit

sudo nano /etc/nginx/sites-available/<your-app>.conf

server {
    listen 80;
    server_name <your-app>.<yourdomain.com> www.<your-app>.<yourdomain.com>;
    root /var/www/<your-app>/public;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";

    index index.php;
    charset utf-8;

    client_max_body_size 20M;    # Allow uploads up to 20 MB (default is 1 MB — causes 413 errors)

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}

sudo ln -s /etc/nginx/sites-available/<your-app>.conf /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx

sudo rm /etc/nginx/sites-available/default
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl restart nginx

sudo apt install -y certbot python3-certbot-nginx

sudo certbot --nginx -d <your-app>.<yourdomain.com> -d www.<your-app>.<yourdomain.com>

sudo certbot renew --dry-run

server {
    if ($host = <your-app>.<yourdomain.com>) {
        return 301 https://$host$request_uri;
    }
    if ($host = www.<your-app>.<yourdomain.com>) {
        return 301 https://$host$request_uri;
    }
    listen 80;
    server_name <your-app>.<yourdomain.com> www.<your-app>.<yourdomain.com>;
    return 404;
}

ns1.digitalocean.com
ns2.digitalocean.com
ns3.digitalocean.com

composer require resend/resend-laravel

MAIL_MAILER=resend
MAIL_FROM_ADDRESS="no-reply@mail.<yourdomain.com>"
MAIL_FROM_NAME="${APP_NAME}"
RESEND_API_KEY=re_xxxxxxxxxxxxxxxxxxxx    # Note: RESEND_API_KEY not RESEND_KEY

php artisan config:clear
php artisan tinker

Mail::raw('Test email', function($m) {
    $m->to('you@gmail.com')->subject('Test');
});

# Install htpasswd tool
sudo apt install -y apache2-utils

# Create password file (first time)
sudo htpasswd -c /etc/nginx/.htpasswd  <your-username>

# Add/update user without overwriting file
sudo htpasswd /etc/nginx/.htpasswd <your-username>

server {
    # ... other config ...
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

# Remove these two lines from <your-app>.conf:
# auth_basic "Restricted Access";
# auth_basic_user_file /etc/nginx/.htpasswd;

sudo nginx -t
sudo systemctl restart nginx

sudo chown -R $USER:www-data .
sudo find . -type f -exec chmod 664 {} \;
sudo find . -type d -exec chmod 775 {} \;
sudo chgrp -R www-data storage bootstrap/cache
sudo chmod -R ug+rwx storage bootstrap/cache

sudo chmod -R 775 /var/www/<your-app>/storage
sudo chown -R <your-username>:www-data /var/www/<your-app>/storage

# Load SSH key first
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_github

# Pull from branch
cd /var/www/<your-app>
git pull origin production

# 1. Enable maintenance mode — shows friendly "down for maintenance" page to visitors
php artisan down

# 2. Run any new migrations (--force skips the production confirmation prompt)
php artisan migrate --force

# 3. Clear all caches so new code takes effect
php artisan optimize:clear

# 4. Re-cache config, routes and views for production performance
php artisan optimize

# 5. Bring the site back up
php artisan up

cat /var/www/<your-app>/resources/views/web-lab/index.blade.php

cd ~/.ssh
sudo nano config

Host github.com
    User git
    Hostname github.com
    IdentityFile ~/.ssh/id_github
    TCPKeepAlive yes
    IdentitiesOnly yes
    ServerAliveInterval 60

sudo chown <your-username> config     # Change owner from root to <your-username>
ll                           # Verify ownership

ssh -T git@github.com                   # Test connection
cd /var/www/<your-app>
git pull origin production              # Should work without ssh-add

npm install          # Install dependencies
npm run build        # Build assets for production

sudo chmod +x ./node_modules/.bin/tsc
npm run build        # Try again

sudo systemctl restart php8.3-fpm
sudo systemctl status php8.3-fpm

# Check installed modules
php8.3 -m

# Install php-fpm if missing
sudo apt install -y php8.3-fpm

# Restart fpm
sudo systemctl restart php8.3-fpm

# Refresh browser

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_github
git pull origin production

# 1. Wrap password in quotes in .env
DB_PASSWORD="your@password"

# 2. Create user for both localhost and 127.0.0.1
sudo mysql
CREATE USER '<your-username>'@'127.0.0.1' IDENTIFIED BY 'yourpassword';
GRANT ALL PRIVILEGES ON <your_database>.* TO '<your-username>'@'127.0.0.1';
FLUSH PRIVILEGES;

# 3. Clear Laravel config cache
php artisan config:clear

sudo rm /etc/nginx/sites-available/default
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl restart nginx

composer audit      # Check vulnerabilities
composer update     # Fix them
composer audit      # Verify fixed

# ── Setup ────────────────────────────────────────────────────
php artisan key:generate       # Generate APP_KEY (run once after clone)
php artisan storage:link       # Create public/storage symlink (run once on fresh deploy)

# ── Database ─────────────────────────────────────────────────
php artisan migrate            # Run pending migrations
php artisan migrate --force    # Run in production without confirmation prompt
php artisan migrate:rollback   # Undo the last batch of migrations
php artisan migrate:status     # Show which migrations have / haven't run
php artisan db:seed            # Run database seeders

# ── Cache — clear ────────────────────────────────────────────
php artisan optimize:clear     # Clear all caches at once (config + route + view + app)
php artisan config:clear       # Clear config cache only
php artisan cache:clear        # Clear application cache only
php artisan view:clear         # Clear compiled Blade views only
php artisan route:clear        # Clear route cache only

# ── Cache — build (production performance) ───────────────────
php artisan optimize           # Cache config + routes + views in one command
php artisan config:cache       # Cache config only
php artisan route:cache        # Cache routes only (faster routing)
php artisan view:cache         # Pre-compile all Blade views

# ── Maintenance mode ─────────────────────────────────────────
php artisan down               # Put site in maintenance mode (shows 503 page)
php artisan up                 # Bring site back online

# ── Debugging ────────────────────────────────────────────────
php artisan route:list         # List all registered routes
php artisan tinker             # Interactive PHP/Laravel shell
tail -f storage/logs/laravel.log  # Stream live error log

sudo systemctl status nginx
sudo systemctl restart nginx
sudo systemctl status mysql
sudo systemctl restart mysql
sudo systemctl status ssh
sudo systemctl restart ssh

https://dnschecker.org

telnet smtp.gmail.com 587    # Test if port is open