Read-only servers

Mark a server Read-only when you want to look at it without any risk of changing it: a production server you only debug, or a server someone else owns.

Turning it on

Press e on the server in the home screen and switch on Read-only, or set it in the config:

servers:
  - name: "Production"
    type: ssh
    host: "your-server.com"
    read_only: true

The home screen and the status bar then mark the server READ-ONLY.

What is refused

The check happens in one place, before a screen opens or a command runs. A refused action opens a window that says what was refused and how to turn read-only off. Nothing runs, and nothing goes into the journal.

Refused:

• commands other than known reads (see below), including your own commands and the custom command;
• container actions (start, stop, restart, remove) and Swarm and Compose actions;
• the deploy commands: migrations, optimize, clearing caches, restarting workers, maintenance mode;
• prune and remove in the server cleanup and on images, volumes and networks;
• editing and uploading files, .env included;
• editing table data, and SQL other than a single SELECT;
• Tinker, shells and the raw command prompt;
• deleting Redis keys;
• restoring dumps;
• tunnels, since a desktop client could change the data through them.

What still works

• logs, and the errors summary of a log;
• tables and SELECT queries;
• files and .env, for viewing;
• inspect, stats and events;
• Redis keys and the Redis and MongoDB info commands;
• every download: dumps, files, storage/.

Known reads

Artisan, Composer and npm commands that only read are allowed. A command counts as a read when its subcommand is one of these and the line has no shell syntax (;, |, $, quotes and so on), so about; rm -rf storage does not pass as about.

Tool	Allowed
php artisan	about, list, help, env, inspire, route:list, schedule:list, migrate:status, queue:failed, queue:monitor, event:list, channel:list, model:show, db:show, db:table, config:show, horizon:status, horizon:list, horizon:supervisors, --version
composer	show, info, outdated, licenses, validate, diagnose, depends, why, prohibits, why-not, check-platform-reqs, fund, suggests, search, audit, list, help, --version
npm	ls, list, ll, la, outdated, view, info, show, explain, why, fund, help, audit (not audit fix or audit signatures), --version

What it does not guarantee

Read-only guards laraport’s own actions. It does not change anything on the server, so a user with a shell there can still change what they like. For a guarantee at the database, connect with a read-only database user.