DEPLOY LARAVEL ON
ORACLE CLOUD
FREE TIER — FULL GUIDE

# Set key permissions (required on Linux/Mac)
chmod 400 ~/Downloads/your-key.key

# SSH into instance (ubuntu is default user for Ubuntu images)
ssh -i ~/Downloads/your-key.key ubuntu@YOUR_PUBLIC_IP

# First — update everything
sudo apt update && sudo apt upgrade -y

# Add Ondrej PHP PPA (most up-to-date PHP packages)
sudo add-apt-repository ppa:ondrej/php -y
sudo apt update

# Install PHP 8.3 + all Laravel required extensions
sudo apt install -y \
  php8.3 \
  php8.3-fpm \
  php8.3-cli \
  php8.3-mbstring \
  php8.3-xml \
  php8.3-curl \
  php8.3-mysql \
  php8.3-zip \
  php8.3-bcmath \
  php8.3-tokenizer \
  php8.3-gd \
  php8.3-redis \
  unzip git

# Verify
php -v
# PHP 8.3.x (cli) ...

# Install Composer globally
curl -sS https://getcomposer.org/installer | php
sudo mv composer.phar /usr/local/bin/composer
composer --version

sudo apt install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx

server {
    listen 80;
    listen [::]:80;
    server_name yourdomain.com www.yourdomain.com;

    root /var/www/laravel/public;
    index index.php index.html;

    # Laravel SPA / API — all requests to index.php
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass   unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include        fastcgi_params;
    }

    # Block access to .env and hidden files
    location ~ /\.(?!well-known).* {
        deny all;
    }

    # Static asset caching
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2)$ {
        expires    30d;
        add_header Cache-Control "public, no-transform";
    }

    client_max_body_size 50M;
    error_log  /var/log/nginx/laravel-error.log;
    access_log /var/log/nginx/laravel-access.log;
}

# Enable site
# sudo ln -s /etc/nginx/sites-available/laravel /etc/nginx/sites-enabled/
# sudo nginx -t && sudo systemctl reload nginx

# Enable site, remove default, reload
sudo ln -s /etc/nginx/sites-available/laravel /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t            # must show: syntax is ok
sudo systemctl reload nginx

sudo apt install mysql-server -y
sudo systemctl enable mysql

# Run security wizard — set root password, remove test DB
sudo mysql_secure_installation

# Create Laravel database and user
sudo mysql -u root -p

-- Inside MySQL shell:
CREATE DATABASE laravel_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'laravel_user'@'localhost' IDENTIFIED BY 'StrongPassword123!';
GRANT ALL PRIVILEGES ON laravel_db.* TO 'laravel_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

# Create web directory and clone your project
sudo mkdir -p /var/www/laravel
sudo chown ubuntu:ubuntu /var/www/laravel
cd /var/www/laravel

git clone https://github.com/youruser/your-laravel-app.git .

# Install dependencies (no dev packages on production)
composer install --optimize-autoloader --no-dev

# Copy and configure environment
cp .env.example .env
nano .env

# ── Inside .env, set these: ─────────────────
APP_ENV=production
APP_DEBUG=false
APP_URL=https://yourdomain.com
DB_DATABASE=laravel_db
DB_USERNAME=laravel_user
DB_PASSWORD=StrongPassword123!
# ────────────────────────────────────────────

# Generate app key, run migrations, cache config
php artisan key:generate
php artisan migrate --force
php artisan config:cache
php artisan route:cache
php artisan view:cache

# Set correct permissions
sudo chown -R www-data:www-data /var/www/laravel
sudo chmod -R 755 /var/www/laravel
sudo chmod -R 775 /var/www/laravel/storage
sudo chmod -R 775 /var/www/laravel/bootstrap/cache

# Install Certbot + Nginx plugin
sudo apt install certbot python3-certbot-nginx -y

# Request certificate (auto-configures Nginx for HTTPS)
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

# Certbot will ask for email, agree to TOS
# It auto-modifies your Nginx config to add:
#   listen 443 ssl;
#   ssl_certificate / ssl_certificate_key paths
#   HTTPS redirect from port 80

# Test auto-renewal
sudo certbot renew --dry-run

# Auto-renew cron (already added by Certbot, verify):
sudo systemctl status certbot.timer

# Configure UFW — whitelist only what's needed
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp       # SSH
sudo ufw allow 80/tcp       # HTTP
sudo ufw allow 443/tcp      # HTTPS

# Enable — type 'y' when prompted
sudo ufw enable
sudo ufw status verbose

# Create deploy script
nano /var/www/laravel/deploy.sh

#!/bin/bash
set -e

APP_DIR="/var/www/laravel"
echo "🚀 Starting deployment..."

cd $APP_DIR

# Pull latest code
git pull origin main

# Install/update dependencies
composer install --optimize-autoloader --no-dev --quiet

# Run migrations (safe with --force in CI)
php artisan migrate --force

# Clear & rebuild all caches
php artisan optimize:clear
php artisan config:cache
php artisan route:cache
php artisan view:cache

# Reset permissions
sudo chown -R www-data:www-data $APP_DIR/storage
sudo chown -R www-data:www-data $APP_DIR/bootstrap/cache

# Restart PHP-FPM gracefully
sudo systemctl reload php8.3-fpm

echo "✅ Deployment complete!"

chmod +x /var/www/laravel/deploy.sh

# Test deploy manually first
bash /var/www/laravel/deploy.sh

# Add sudo rule so deploy.sh can reload php-fpm without password
echo "ubuntu ALL=(ALL) NOPASSWD: /usr/bin/systemctl reload php8.3-fpm" | sudo tee /etc/sudoers.d/laravel-deploy