# Read-only servers

Source: https://laraport.app/docs/read-only/

> Mark a production server read-only and laraport refuses everything that would change it: what is refused, what still works, what is not guaranteed.

Mark a server **Read-only** when you want to look at it without any risk of changing it: a production server you only debug, or a server someone else owns.

## Turning it on

Press `e` on the server in the home screen and switch on **Read-only**, or set it in the config:

```yaml
servers:
  - name: "Production"
    type: ssh
    host: "your-server.com"
    read_only: true
```

The home screen and the status bar then mark the server `READ-ONLY`.

## What is refused

The check happens in one place, before a screen opens or a command runs. A refused action opens a window that says what was refused and how to turn read-only off. Nothing runs, and nothing goes into the [journal](https://laraport.app/docs/journal/).

Refused:

- commands other than known reads (see below), including your own commands and the custom command;
- container actions (start, stop, restart, remove) and Swarm and Compose actions;
- the deploy commands: migrations, optimize, clearing caches, restarting workers, maintenance mode;
- prune and remove in the server cleanup and on images, volumes and networks;
- editing and uploading files, `.env` included;
- editing table data, and SQL other than a single `SELECT`;
- Tinker, shells and the raw command prompt;
- deleting Redis keys;
- restoring dumps;
- tunnels, since a desktop client could change the data through them.

## What still works

- logs, and the errors summary of a log;
- tables and `SELECT` queries;
- files and `.env`, for viewing;
- inspect, stats and events;
- Redis keys and the Redis and MongoDB info commands;
- every download: dumps, files, `storage/`.

## Known reads

Artisan, Composer and npm commands that only read are allowed. A command counts as a read when its subcommand is one of these and the line has no shell syntax (`;`, `|`, `$`, quotes and so on), so `about; rm -rf storage` does not pass as `about`.

| Tool | Allowed |
|---|---|
| `php artisan` | `about`, `list`, `help`, `env`, `inspire`, `route:list`, `schedule:list`, `migrate:status`, `queue:failed`, `queue:monitor`, `event:list`, `channel:list`, `model:show`, `db:show`, `db:table`, `config:show`, `horizon:status`, `horizon:list`, `horizon:supervisors`, `--version` |
| `composer` | `show`, `info`, `outdated`, `licenses`, `validate`, `diagnose`, `depends`, `why`, `prohibits`, `why-not`, `check-platform-reqs`, `fund`, `suggests`, `search`, `audit`, `list`, `help`, `--version` |
| `npm` | `ls`, `list`, `ll`, `la`, `outdated`, `view`, `info`, `show`, `explain`, `why`, `fund`, `help`, `audit` (not `audit fix` or `audit signatures`), `--version` |

## What it does not guarantee

Read-only guards laraport's own actions. It does not change anything on the server, so a user with a shell there can still change what they like. For a guarantee at the database, connect with a read-only database user.