How do I install npm & composer on cPanel?
Having trouble finding a clear tutorial on how to do this, and whether this should be installed globally as the root or per cPanel user. Running Linux and I have access to the Yum package manager, so should I just install per-user using yum?
29 Replies
For context too, I'm doing this so that we don't have to include
vendor/ or node_modules/ in our git repos
Okay apparently this is a bad idea anyway to run npm install and composer install in Prod...
Now I have to figure out how to do an automatic build step or just include node_modules and vendor in git...
I'm just going to include it in git for nowyou don't
please
if you want to have security holes, please just give me the password
it's faster
I'm completely new to any devops stuff and just have no idea how I'm supposed to go about this. We have our vendor directories inside git and I'd ideally like to not include them in git as to clean up the repo / best practice... is the only recommended way to setup a build step that
npm i / composer install and then have that step automatically upload the files to the prod directory in the server?
Why's this a security issue?it literally can install and execute any code any possible attacker could want
But wouldn't they need access to the server first to actually do that?
if, somewhere, you have a vulnerability that lets run a single command, having composer can let attackers install malicious libraries and backdoors
and you make it super easy
or, better yet, if you leave the composer.php, it's easier to do that
So is the only recommended way to setup an automatic build step like I described above?
to use a build docker image
one for composer, one for node
We're using ddev which is a way to builder docker images for php environments, previously we included that in the git repo too but I removed it, should I just include that again?
I really would rather not include these generated files if I don't have to - it adds onto the repo when we don't need to
that's up to you
but you don't need to, if it just saves into the server
Okay, so I guess in plain english what should my steps look like? What do I actually need to do? I'm so new to docker / anything like this I really just have no clue what I'm doing
do you use githug or gitlab?
We use github
use pre-existing github actions
Got it, I figured that might be the case. What would our github actions actually look like then? Just something like
1. npm i, composer install
2. upload files to prod environment
3. done ???
basically, yes
I know it's more in-depth than that, just high level overview
Okay damn. Thanks epic. Really was hoping there was an easier way. The github actions is just a lot of setup that I don't have time for right now so this will be a 3 months into the future type thing
you can build locally and shove it all into the server after
I actually tried getting this automatic build step setup in the beginning of the year but I never have time for it 😅
Yea that's what we're doing we just upload it to github and then pull down in the server
but you need to be careful with composer, as composer may be running in a different php version than the one you have in the server
That's so funny
🤣
told you
Thankfully I've been through this issue a couple times so I can fix it
you can say which php version you have, and composer will do everything for that version
That took me wayyyy too long to finally get this staging site up. Go figure, I try to make the process better and end up making a whole mess for myself, only to arrive at the point I started at
Epic, do you recommend keeping the staging site as
staging.domain.com? Or should it be something separate like staging.random-domain.com? We have some staging domains inside our company domain rather than on the client's domain, and I feel like that's kind of silly - but I can see from a 'obfuscation' perspective why it was probably done
I'd rather just keep it on the client's domain. We don't have basic http auth setup so if you just type it in you'll see the staging but I don't think that'll be that big of a deal?i recommend it to not be accessible outside your company
whatever domain name you pick, doesn't matter
ty!!
you're welcome
it's extremely important that it isn't accessible outside the company
not only because you have an unfinished version, but because that unfinished version can be vulnerable to bugs and that just cracks open everything to the attacker