Skip to content

Installation

CPalius can be installed in two ways: upload the release package and run the browser wizard (for everyone, including shared hosting), or install from the command line (for development environments).

Requirements

Requirement Detail
PHP 8.4 or later
PHP extensions ctype, iconv, fileinfo, pdo, pdo_mysql, mbstring, xml, dom, tokenizer, json, intl, openssl
Memory memory_limit of at least 128 MB (a warning is shown below 256 MB)
Database MySQL 8+ or MariaDB 10.6+ (an empty database)
Web server Apache or Nginx with public/ as the document root
Write permission Project root (for .env), cp-core/var, public/uploads
Node.js Not required
PostgreSQL and SQLite

Not supported at the moment. The migration files produce MySQL-specific DDL.

The wizard checks all of these requirements in the first step and does not write .env until every mandatory item passes. The reason: a missing extension causes errors in a half-installed setup, and someone without SSH access to the server cannot repair that.

Way 1: Browser wizard

  1. Upload the release zip to the server and extract it. The package contains the cp-includes/vendor folder; you do not need to run Composer.
  2. Make public/ the document root. If your hosting panel does not allow this, the .htaccess in the project root serves the public/ directory and closes off the rest of the tree.
  3. Open the site in the browser. If it is not installed, the wizard appears.

The wizard steps:

  1. Requirements: PHP version, extensions, memory, writable folders.
  2. Database: host, port, database name, user, password. The connection is tested.
  3. Site: site name, address, default language (tr or en), time zone and the first administrator (email, username, display name, password). A password that does not meet the password policy is rejected.
  4. Done: .env is written, migrations run, the first administrator is created, sample content is added and the wizard deletes itself.

When the wizard finishes, an installation lock is written; the wizard directory is only deleted if the lock exists. This way, even if cleanup gets stuck somewhere, the information that the site is installed is not lost. If the installation is interrupted, the installing.lock file prevents a half-written .env from being treated as an "installed site", and you can return to the wizard.

A new installation starts with these modules: Media, Menu, Pages, Blog, Forum, Seo. Other modules (Portal, Docs, Widget, Showcase…) stay on disk and are enabled from the admin panel or the store.

As sample content, a blog category and post, a forum section, a board and a message are added; all of them can be deleted.

Way 2: Command line

composer install
cp .env.example .env     # set DATABASE_URL, APP_SECRET and the tokens
php cp-core/bin/console doctrine:migrations:migrate
php cp-core/bin/console cp:user:create-admin
First thing: commit protection

If you cloned the repository, run git config core.hooksPath .githooks right away. It blocks commits that empty a source file, shrink it by more than 80 percent or contain secrets.

.env variables

Variable Meaning
APP_ENV, APP_DEBUG prod and 0 in production. Do not leave dev in production.
APP_SECRET A random string of at least 32 characters. To generate one: php -r "echo bin2hex(random_bytes(32));"
DATABASE_URL Connection string
CP_APP_DEBUG_LEVEL safe (quietly quarantine a faulty module; for production) or verbose (show error details; development only)
DEFAULT_URI Default address for URL generation on the command line
CPALIUS_LOCALES, CPALIUS_DEFAULT_LOCALE Fallback language list. Normally languages are read from the database; these only apply when the database cannot be reached or the language table is empty
Recovery token If empty, the recovery console is disabled
Cron token If empty, the HTTP cron endpoint is disabled
serverVersion

The serverVersion in DATABASE_URL must state the real version of the server. DBAL picks the platform from this string alone. If you write 8.0.32 for MariaDB, the MySQL platform is selected and the schema difference never closes (the "The metadata storage is not up to date" error appears on every request). Write it in the form serverVersion=8.0.32 for MySQL and serverVersion=mariadb-11.4.12 for MariaDB, according to the output of SELECT VERSION().

After installation

  1. Sign in as the administrator at /aacp.

  2. Under AACP → System → Updates, see the version and any pending update.

  3. Set up cron on the server for scheduled tasks:

    * * * * * php /path/cp-core/bin/console cp:cron:run

    If the server has no cron, you can call the token-protected HTTP cron endpoint from an external scheduler.

  4. Run a health check with cp:doctor (below).

Health check: cp:doctor

php cp-core/bin/console cp:doctor

Doctor runs these checks:

  • Environment: PHP version and extensions.
  • Pending migrations and pending updates.
  • Quarantined modules.
  • Module SQL consistency: do the tables and columns an applied migration claims to have created really exist.
  • Entity mapping coverage.
  • Capability integrity in roles: does a role contain a capability that is not defined.
  • Translation parity: are the TR and EN keys the same.
  • Security posture.

The output lists findings by severity.

Server notes

  • Apache: public/.htaccess is ready; mod_rewrite must be enabled.
  • Nginx: route all requests to public/index.php; disable PHP execution inside public/uploads.
  • Cache in production: Symfony does not rebuild the container by itself in production. If you updated files by hand, empty cp-core/var/cache/prod/; for releases that change entities or the schema, also clear the Redis cache.
  • Session: No session is started for anonymous visitors; this is a precondition for the Nginx FastCGI cache or Varnish to work efficiently.
Last updated: 13.10.2026