README

Read-only Porro connector for Laravel 11–13. It sends one signed report about your site to Porro on the scheduler. It never changes the site and never accepts commands: Porro never connects in.

Install

composer require porro/laravel-connector
php artisan porro:connect <site key>

Copy the site key from the site's page in Porro. porro:connect writes PORRO_KEY to .env and sends the first report.

Reports then go every 15 minutes on Laravel's scheduler, which needs one cron line. If the scheduler isn't already running, porro:connect offers to add it to the server's crontab for you, with the right PHP binary and project folder. If it can't, it prints the line to paste into Forge, Ploi or crontab -e. Use --cron to add it without asking (handy in provisioning scripts) or --no-cron to leave the crontab alone. Skipped it, or connected from another machine? Run php artisan porro:cron on the server; it needs no key.

On Laravel Cloud and Vapor the platform runs the scheduler for you, so there's no cron line: turn the scheduler on (Cloud) or leave it on (Vapor), and set PORRO_KEY as an environment variable.

Add php artisan porro:report to your deploy script so Porro hears about deploys straight away.

Using Filament or Statamic? Install porro/filament-connector or porro/statamic-connector instead. They include this package.

Site health, with or without Porro

Porro\Laravel\SiteHealth checks the site from the inside, without a Porro account: PHP and Laravel versions past or close to the end of security support (endoflife.date, with a bundled copy for when it can't be reached), known security advisories in composer.lock (Packagist's advisories API, the one composer audit uses; only package names are sent), newer Laravel releases, whether the scheduler runs, debug mode in production, pending migrations, failed jobs, backups and spatie/laravel-health checks. Once the site is connected, it adds the site's open findings in Porro (uptime, SSL, the domain, the server's OS and packages) with links into Porro.

The Statamic and Filament connectors show this as a panel in the control panel. Results are cached for five minutes; the public data behind them for between six hours and a day.

When the site isn't connected, the scheduler still writes a heartbeat every PORRO_INTERVAL minutes so the panel can tell whether cron runs.

What leaves a site

• Laravel, PHP and package versions (names and versions from composer.lock; the list is only sent when the lock file changes)
• The environment name, and whether debug mode is on (true or false, never the value of any setting)
• Scheduler heartbeat, failed jobs in the last 24 hours, pending migrations
• Newest backup date from spatie/laravel-backup and check results from spatie/laravel-health, if installed

Reading the site's findings back from Porro is a GET signed with the same key; it never sends anything about the site.

What never does

Content, customer or user data, environment values or secrets. Run php artisan porro:status --json to see the exact report your site would send.

Commands

Config

Developing

composer install
composer test

Security

Please email security@porro.dev rather than opening an issue. We reply within one working day.

License

MIT