Deployment

Requirements

• Ubuntu 22.04 / 24.04 (or any Linux), Apache 2.4 with mod_rewrite or nginx
• PHP 8.1 or newer with pdo_mysql, mbstring, gd, curl, openssl, json, fileinfo
• MariaDB 10.6+ / MySQL 8
• HTTPS (Let's Encrypt)

Files and permissions

Upload the contents of public_html/ into the document root of the domain. Then run the included script as root:

sudo bash /var/www/allgameclub.com/public_html/dateirechte.sh

It sets owner planet24, group www-data, 755/644 for code, group-writable storage/ and a read-only config/. Pass OWNER= / GROUP= to override.

Apache

The shipped .htaccess does everything: HTTPS redirect, Authorization header pass-through, routing to index.php, protection of app/, config/, storage/, games/ and friends. Make sure AllowOverride All is set for the document root and mod_rewrite, mod_headers, mod_deflate are enabled.

nginx

server {
    listen 443 ssl http2;
    server_name allgameclub.com;
    root /var/www/allgameclub.com/public_html;
    index index.php;

    location ~ ^/(app|config|database|storage|docs|bin|cron|games)/ { return 404; }
    location ~ /\. { deny all; }
    location ~* \.(md|sql|log|lock|env|ini)$ { deny all; }

    location /public/ { expires 1y; add_header Cache-Control "public, immutable"; try_files $uri =404; }
    location /sdk/    { expires 1h; try_files $uri =404; }

    location / { try_files $uri /index.php?$query_string; }

    location ~ ^/index\.php(/|$) {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
        fastcgi_param HTTP_AUTHORIZATION $http_authorization;
    }
    location ~ \.php$ { return 404; }

    client_max_body_size 8m;
}

Configuration checklist

• app.url set to the public URL (used in emails and API responses)
• app.debug false in production
• app.trust_proxy true only behind a load balancer that sets X-Forwarded-*
• mail.driver mail (sendmail/postfix) or smtp with credentials; test with php bin/console.php mail:test you@example.com
• payments.gateway stripe with secret key, webhook secret and the two Price IDs. Webhook URL: https://allgameclub.com/webhooks/stripe, events: checkout.session.completed, invoice.paid, invoice.payment_failed, customer.subscription.updated, customer.subscription.deleted
• app.company for the imprint, terms and emails

Sign in with Google / Facebook

1. Google: create an OAuth client (type "Web application") in the Google Cloud console, add https://allgameclub.com/auth/google/callback as authorised redirect URI, and put the client id and secret into social_login.google in config/config.php.
2. Facebook: create an app with "Facebook Login", add https://allgameclub.com/auth/facebook/callback as a valid OAuth redirect URI, request the email permission, and put the app id and secret into social_login.facebook.

The buttons appear on the login and registration pages as soon as a provider is configured. Existing members can link providers under Account → Security → Linked accounts. Accounts created via a provider get a verified email and a random unusable password (they can set one through "Forgot password").

Cron

*/15 * * * * php /var/www/allgameclub.com/public_html/bin/console.php cron >> /var/www/allgameclub.com/public_html/storage/logs/cron.log 2>&1

Updating

1. Upload changed files (keep config/config.php and storage/).
2. php bin/console.php migrate applies new files from database/migrations/.
3. php bin/console.php games:sync.

Backups

Back up the database (all tables) and storage/uploads/. Everything else is code.

Logs

• storage/logs/app.log application errors and warnings
• storage/logs/php-error.log PHP errors
• storage/logs/mail.log emails when mail.driver = log
• storage/logs/cron.log if you redirect cron output there

Last updated October 11, 2026.