PHP Ledger hosting requirements

Confirm the complete stack before renting a server or uploading the package.

Which requirements are hard gates?

Verify the database, PHP runtime and private web-root controls before attempting installation.

Package requirements and preferred operating choices
Component	Required baseline	Recommended check
PHP	8.2 or newer with required extensions	Use a patched 8.3 runtime for CLI and web
Database	MySQL 8.4 with InnoDB	Verify the server, not only the client program
Encoding	utf8mb4 and supplied schema collation	Run the package migration chain unchanged
Web server	HTTPS and front-controller routing	Test sign-in and direct route navigation
Operator	Terminal access for CLI commands	A named person able to recover a failed upgrade
Files	Private application/configuration and writable sessions	Expose only www/phpledger/public
Recovery	Matched application, configuration and database backup	Restore into an isolated database and check views/triggers

The table does not certify a hosting vendor. MariaDB and earlier MySQL versions are not validated for this package. A database described simply as “MySQL compatible” is not enough evidence. Ask the provider for the actual server version and database privileges. If those answers are unavailable, stop before uploading business data. A panel’s PHP selector cannot compensate for a database version that the installer does not support.

How do you check PHP without exposing configuration?

Inspect CLI PHP privately, then run the package’s preflight using the same configured runtime.

php -v
php -m
php www/phpledger/install/preflight.php

The first command identifies the binary executing in the terminal. The second lists its loaded extensions. Neither proves that the web server uses the same binary or configuration. Ask the host to confirm the domain’s handler and version, and verify the web journey after installation. Do not leave a public diagnostic page displaying the full environment. Such output can reveal paths, settings and operational details that strangers do not need.

BCMath preserves decimal calculations without passing money through binary floats. PDO and PDO MySQL provide the database connection, mbstring handles text, and the package also requires curl, OpenSSL and fileinfo. PHP sessions need a writable private location. A missing extension is an installation issue to resolve with the host; disabling checks or editing the dependency platform guard does not add the missing capability.

What database privileges are required?

Migrations create tables, indexes, triggers and views; normal runtime access must be verified separately.

Use a dedicated account scoped to the application database. Do not configure the running application with MySQL root. Installation needs sufficient rights to apply the supplied statements and record their checksums. After installation, a host may separate migration privileges from normal runtime privileges, but it must test the real application flows under that restricted account. This guide does not claim one minimal grant list has been proven for every host.

The 0.3.0 effective-source views use a stable database definer: the account that creates them. Keep that account valid with access to the underlying tables, and verify that the runtime account can select the views. Restoration into a different database needs the same review. A view that exists but cannot execute is not a completed restore. The restore guide explains how source rows and their dependencies fit this check.

Which files may the web server serve?

Only the application’s public directory belongs under the web document root.

phpledger-0.4.0-preview/
  vendor/
  resources/
  tools/
  www/phpledger/includes/
  www/phpledger/install/
  www/phpledger/templates/
  www/phpledger/public/

The directories above public contain dependencies, internal PHP functions and operator tools. They remain outside public routing. Preserve their relative layout because bootstrap and resources depend on it. A host that forces the entire archive into a publicly downloadable folder needs a corrected document-root arrangement before use. Disabling directory listing alone is insufficient: a person who knows a private filename may still request it directly.

Protect database configuration and any OAuth keys using the host’s ownership and file-permission model. Application code can remain read-only to the web process. The preview does not require making the whole tree writable. Test denied private paths and working public assets after routing changes; a rule that blocks everything is not a successful security configuration.

How much memory and disk are enough?

No measured universal minimum is published; capacity must be checked against the intended workload.

PHP and MySQL share resources with the operating system, control panel, backups and other applications. A small VPS may be a useful evaluation environment, but its advertised memory is not a guarantee for a busy accountancy practice. Test realistic company and history sizes in staging, then observe response times, process memory and available disk. Include month-end reports and backup extraction, which can behave differently from opening a dashboard.

Keep enough free space for two release directories and a private backup during an upgrade. Decide where backup copies leave the server and how their integrity is checked. A provider snapshot can be helpful, but you still need to know what it contains and how to recover a compatible application/database pair. Read the VPS procedure for the installation order and the shared-hosting guide for provider questions.

What counts as a completed preflight?

A successful preflight confirms prerequisites and recognized schema state; it does not certify accounting use.

Record the selected package and PHP/MySQL versions.
Resolve every missing prerequisite before running migrations.
After migration, rerun preflight and retain a current-schema result.
Sign in, post synthetic entries and reconcile their reports.
Check recovery with the matching release and private configuration.

The /health endpoint checks database connectivity only. It does not prove account creation, authorization, views, balanced postings or recovery. Treat health as one signal in a larger acceptance record. If the package detects unknown or interrupted migrations, investigate rather than deleting receipts.

When should you reject a hosting plan?

Reject a plan that cannot meet a hard requirement or provide a workable recovery route.

What should you do next?

No terminal access, an unsupported database, an unchangeable public root or blocked trigger/view creation each prevents this installation path. A provider can sometimes supply an operator-assisted solution; get that arrangement in writing before a pilot. If the application’s missing invoicing or tax workflows are the obstacle, changing hosts will not solve it. Choose another currently suitable accounting product or wait for the relevant feature’s acceptance.

Questions before you continue

Check these boundaries before applying the procedure to a business installation.

Will any PHP hosting plan work?

No. Check database version, terminal access, extensions, document-root control and migration privileges separately.

Do I need Composer on the customer server?

The release ZIP includes production dependencies. Composer is needed for development or rebuilding dependencies, not the documented package install.

Sources and next steps

Technical references and project behavior were checked on 16 September 2026; hosting access remains plan-specific.

The linked project files describe the current preview. Follow the instructions inside your exact downloaded package if a later release changes a command. Technical testing does not establish statutory compliance or independent accounting acceptance. See the project and preview limits.