Sharing a project I've been building: AZERIOID Stack Manager — a self-hosted server control panel, entirely Laravel 12 + Livewire 3 under the hood.
The part that might interest this sub architecturally: the web-facing Laravel app runs completely unprivileged. All privileged host operations (installing packages, writing web-server configs, managing databases) go through a separate "broker" process invoked via a tightly-scoped sudoers rule — the Laravel app itself never touches the filesystem outside its own directory or runs shell commands directly. Every privileged action is registry-gated (a JSON schema defines exactly what's installable, no arbitrary package names ever reach the shell) and audited.
A few Laravel-specific bits:
- Livewire powers the whole dashboard — vhost management, a live web terminal (via a broker-spawned ttyd process, reverse-proxied through the panel's own authenticated session), a code-editor-based file manager, database management.
- Laravel's queue system runs background jobs for anything long-running (component installs, panel self-update) with live progress polling from the UI.
- A custom Artisan-based CLI (`azerioid`) is a thin wrapper over the exact same broker actions the UI calls — full parity, so nothing is UI-only or CLI-only by accident.
- Panel self-update is git-tag-based (semver), running as a background job with an automatic rollback-on-failure path if a migration fails mid-update.
MIT licensed, tested end-to-end on Ubuntu/Debian/EL9: https://github.com/azerioid/azerioid-stack-manager
Would love feedback from other Laravel devs, especially on the broker/privilege-separation pattern if anyone's done something similar.
[link] [留言]
