Packing and deploying Symfony web site

Well, I will take a shot.

what to include/exclude (obviously I don't want to pack dev dependencies, and deploying composer files also doesn't seems to make any sense)

I notice you don't have a .gitignore. If you are not using GIT (you should) take a look at the default gitignore, it will tell you which folders you don't need.

You are right, vendors are not necessary. Composer's lock file contains the exact versions you are using. Just do composer install once you copied the files to the server. The simplest way of "deployment" is to use git(hub), and set up an ssh key on your server, and grant it read access to your git repo. (Deploy key)

what to change (there's .env file - containing APP_ENV and APP_SECRET - where do I use those values?)

The .env file only works in dev mode by default. (notice the require-dev part in your composer.json).

Symfony recommend using "real" environmental variables in production, but you could use the .env file. To do this you will have to move "symfony/dotenv" from require-dev to require in composer.json. (Do an update after)

You will also want to set APP_ENV to prod on your server, configure db acccess and mailer too.

my hosting uses folder www for public presentation, do I have to change/configure something before renaming public directory just to www?

I won't answer this fully, that would take too long. Configure apache to point to your public dir using a VirtualHost. More here: https://symfony.com/doc/current/setup/web_server_configuration.html

do I have to configure .htaccess to not route images/css/js trough PHP?

If you have installed the apache pack, you will get a .htaccess file, and that ignores files.

# If the requested filename exists, simply serve it.# We only want to let Apache serve files and not directories.RewriteCond %{REQUEST_FILENAME} -fRewriteRule ^ - [L]

This way requested files won't hit your PHP code.If however a file does not exist, Symfony will process the request.I recommend ignoring common file extensions eg:

# Do not allow image requests to hit symfonyRewriteCond %{REQUEST_URI} \.(gif|jpg|jpeg|png|ico|map)$ [NC]RewriteRule .* - [L]

TL;DR

Since PHP is not a compiled language, a "building" process in terms of compiling code into an executable is not pertinent here.

Building a Stateless Container

However, if you are developing a web application and you want to deploy it, your best way to go (meaning, industry standard) is to "build" a stateless container out of it. In that container, you will tipically have Apache + PHP, or Ngnix + PHP-FPM (or even just PHP with PHP-PM). That will be your application process, exposed by port 80: a beautiful, stateless and scalable docker container.

In the process of building the container, the idea is that you install the PHP version of your choice (with pertinent extensions) and the web server or process that will run through the HTTP port. Then, you pull your code in the container using git and set your environment variables, and do a composer install. The result will be a docker image with a version of your application in it, reachable by port 80.

More on that here.

Mmmm, nah, I don't do containers

Of course, this may not be the way to go for you, depending on how much your application follows the principles of a twelve factor app and where you are going to host it.

If you want to deploy to a shared hosting, you will need to change the public folder for the document root of your hosting provider. Since you don't have access to the PHP runtime in a shared hosting, you will need to copy your .env file and send it to the web hosting (which is a horribly insecure practice).

To setup the automatic deployment, you should prefer ssh. If you don't have console access to your web hosting, then git-ftp is probably your best friend here. By using webhooks (on Github for example), on a post-receive event, you will deploy your code running a script that will have, among other things, a composer install (with locked dependencies), and a chown of everything to the www-data user (or the web server user, for that matter).

Now, to proper answers

Having said that, I'll try to answer somo of your questions:

1. You are correct. vendor/ should stay out. Not the composer.lock however. Basically, you have to deploy all the code living in your repository.

2. In your deploy script (yes, you will have one), you should create a new .env file to be added. Yes, you need all the parameters in there, but obviously with the values for the production environment.

3. Yes, you should rename symfony's public folder to www. As far as I'm concerned, you shouldn't run into problems. That is, unless you are using symfony server for development. But a simple php -S localhost:8000 -t www in your project will suffice for development purposes. I use it all the time.

   4. If you are using apache, yes, you should include in your deployment a .htaccess.

Your Update

So I see that your hosting has git deployment capabilities. That's good. In that case, there must be a way to configure a post-receive hook in the repo located there. That post-receive can execute any bash command, like a composer install. However, that will the composer executable, but I don't thing that that will be included. What you can do is to upload a composer.phar in your hosting root. It's composer, in a single executable.

Then, in your post-receive hook (aka your deploy script) you will run a composer install, and the mentioned chown.

Non Requested Advice

I understand that your requirements are to deploy to a web hosting. However, you are seeking the benefits of CI/CD in a way that is not the current industry standard. Web hostings are not naturally designed for deployment pipelines. The way you are doing it now could cause you some pain in the future, especially when adding some other backing services, or scaling, etc...

Now, if your application is small and simple, you can probably ignore my words.