This documentation is for a version that has reached its End Of Life. Such versions are no longer supported and don't receive security updates. Consider updating to a newer version.
This installation guide shows in details how to install Ibexa DXP for users who have a subscription agreement with Ibexa.
If you want to install Ibexa OSS, you don't need authentication tokens or an account on updates.ibexa.co, but must adapt the steps shown here to the product edition and the ibexa/oss-skeleton repository.
Install a recent stable version of Composer, the PHP command line dependency manager.
Use the package manager for your Linux distribution.
For example, on Ubuntu:
1
apt-getinstallcomposer
To verify that you have the most recent stable version of Composer, you can run:
Ibexa DXP subscribers have access to commercial packages at updates.ibexa.co.
The site is password-protected.
You must set up authentication tokens to access the site.
Log in to your Service portal on support.ibexa.co, go to your Service Portal, and look for the following on the Maintenance and Support agreement details screen:
Select Create token (this requires the Portal administrator access level).
Fill in a label describing the use of the token.
This allows you to revoke access later.
Save the password, you aren't able to access it again.
Save the authentication token in auth.json to avoid re-typing it
Composer asks whether you want to save the token every time you perform an update.
If you prefer, you can decline and create an auth.json file globally in COMPOSER_HOME directory for machine-wide use:
Different tokens for different projects on a single host
If you configure several projects on one machine, make sure that you set different tokens for each of the projects in their respective auth.json files.
After this, when running Composer to get updates, you're asked for a username and password.
Use:
as username - your Installation key found on the Maintenance and Support agreement details page in the Service portal
as password - the token password you retrieved in step 3 above
Authentication token validation delay
You can encounter some delay between creating the token and being able to use it in Composer.
It might take up to 15 minutes.
Support agreement expiry
If your Support agreement expires, your authentication token(s) will no longer work.
They will become active again if the agreement is renewed, but this process may take up to 24 hours.
(If the agreement is renewed before the expiry date, there will be no disruption of service.)
If Composer asks for your GitHub token, you must log in to your GitHub account and generate a new token (edit your profile and go to Developer settings > Personal access tokens > Generate new token with default settings).
This operation is performed only once, when you install Ibexa DXP for the first time.
If you are using PHP 8.0 (which is not recommended as it has reached End of Life and misses security fixes), use a different set of commands to ignore security advisories about Twig:
1 2 3 4 5 6 7 8 9101112131415161718192021
composercreate-project--no-installibexa/headless-skeleton.
composerconfigaudit.ignore--json'{ "PKSA-5k7f-wvjj-jrgw": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-sjvz-tbbr-vwth": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-h8hf-ytnd-5t9q": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-wwb1-81rc-pd65": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-hgmw-wn4d-hpcy": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-kvv6-36cr-fkzb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n14z-jjjg-g8vd": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-3mcc-k66d-pydb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-gw7n-z4yx-7xjt": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-dpx1-78wg-1kqs": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-21g2-dzjv-sky5": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-yhcn-xrg3-68b1": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2wrf-1xmk-1pky": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-6319-ffpf-gx66": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n7sg-8f52-pqtf": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-8kk8-h2xr-h5nx": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2rbx-bjdx-4d4d": "As this is for code quality tests and not to run a production DXP, this can be ignored."}'
composerupdate
1 2 3 4 5 6 7 8 9101112131415161718192021
composercreate-project--no-installibexa/experience-skeleton.
composerconfigaudit.ignore--json'{ "PKSA-5k7f-wvjj-jrgw": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-sjvz-tbbr-vwth": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-h8hf-ytnd-5t9q": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-wwb1-81rc-pd65": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-hgmw-wn4d-hpcy": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-kvv6-36cr-fkzb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n14z-jjjg-g8vd": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-3mcc-k66d-pydb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-gw7n-z4yx-7xjt": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-dpx1-78wg-1kqs": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-21g2-dzjv-sky5": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-yhcn-xrg3-68b1": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2wrf-1xmk-1pky": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-6319-ffpf-gx66": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n7sg-8f52-pqtf": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-8kk8-h2xr-h5nx": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2rbx-bjdx-4d4d": "As this is for code quality tests and not to run a production DXP, this can be ignored."}'
composerupdate
1 2 3 4 5 6 7 8 9101112131415161718192021
composercreate-project--no-installibexa/commerce-skeleton.
composerconfigaudit.ignore--json'{ "PKSA-5k7f-wvjj-jrgw": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-sjvz-tbbr-vwth": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-h8hf-ytnd-5t9q": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-wwb1-81rc-pd65": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-hgmw-wn4d-hpcy": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-kvv6-36cr-fkzb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n14z-jjjg-g8vd": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-3mcc-k66d-pydb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-gw7n-z4yx-7xjt": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-dpx1-78wg-1kqs": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-21g2-dzjv-sky5": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-yhcn-xrg3-68b1": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2wrf-1xmk-1pky": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-6319-ffpf-gx66": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n7sg-8f52-pqtf": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-8kk8-h2xr-h5nx": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2rbx-bjdx-4d4d": "As this is for code quality tests and not to run a production DXP, this can be ignored."}'
composerupdate
Using PHP 7.4
If you are using PHP 7.4 (which is not recommended as it has reached End of Life and misses security fixes), use a different set of commands to ignore security advisories about Twig and GraphQL:
1 2 3 4 5 6 7 8 9101112131415161718192021222324
composercreate-project--no-installibexa/headless-skeleton.
composerconfigaudit.ignore--json'{ "GHSA-68jq-c3rv-pcrr": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "GHSA-fc86-6rv6-2jpm": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "GHSA-r7cg-qjjm-xhqq": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-5k7f-wvjj-jrgw": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-sjvz-tbbr-vwth": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-h8hf-ytnd-5t9q": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-wwb1-81rc-pd65": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-hgmw-wn4d-hpcy": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-kvv6-36cr-fkzb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n14z-jjjg-g8vd": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-3mcc-k66d-pydb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-gw7n-z4yx-7xjt": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-dpx1-78wg-1kqs": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-21g2-dzjv-sky5": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-yhcn-xrg3-68b1": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2wrf-1xmk-1pky": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-6319-ffpf-gx66": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n7sg-8f52-pqtf": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-8kk8-h2xr-h5nx": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2rbx-bjdx-4d4d": "As this is for code quality tests and not to run a production DXP, this can be ignored."}'
composerupdate
1 2 3 4 5 6 7 8 9101112131415161718192021222324
composercreate-project--no-installibexa/experience-skeleton.
composerconfigaudit.ignore--json'{ "GHSA-68jq-c3rv-pcrr": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "GHSA-fc86-6rv6-2jpm": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "GHSA-r7cg-qjjm-xhqq": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-5k7f-wvjj-jrgw": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-sjvz-tbbr-vwth": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-h8hf-ytnd-5t9q": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-wwb1-81rc-pd65": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-hgmw-wn4d-hpcy": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-kvv6-36cr-fkzb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n14z-jjjg-g8vd": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-3mcc-k66d-pydb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-gw7n-z4yx-7xjt": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-dpx1-78wg-1kqs": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-21g2-dzjv-sky5": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-yhcn-xrg3-68b1": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2wrf-1xmk-1pky": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-6319-ffpf-gx66": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n7sg-8f52-pqtf": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-8kk8-h2xr-h5nx": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2rbx-bjdx-4d4d": "As this is for code quality tests and not to run a production DXP, this can be ignored."}'
composerupdate
1 2 3 4 5 6 7 8 9101112131415161718192021222324
composercreate-project--no-installibexa/commerce-skeleton.
composerconfigaudit.ignore--json'{ "GHSA-68jq-c3rv-pcrr": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "GHSA-fc86-6rv6-2jpm": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "GHSA-r7cg-qjjm-xhqq": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-5k7f-wvjj-jrgw": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-sjvz-tbbr-vwth": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-h8hf-ytnd-5t9q": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-wwb1-81rc-pd65": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-hgmw-wn4d-hpcy": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-kvv6-36cr-fkzb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n14z-jjjg-g8vd": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-3mcc-k66d-pydb": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-gw7n-z4yx-7xjt": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-dpx1-78wg-1kqs": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-21g2-dzjv-sky5": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-yhcn-xrg3-68b1": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2wrf-1xmk-1pky": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-6319-ffpf-gx66": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-n7sg-8f52-pqtf": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-8kk8-h2xr-h5nx": "As this is for code quality tests and not to run a production DXP, this can be ignored.", "PKSA-2rbx-bjdx-4d4d": "As this is for code quality tests and not to run a production DXP, this can be ignored."}'
composerupdate
Authentication token
If you added credentials to the COMPOSER_AUTH variable, at this point add this variable to auth.json (for example, by running echo $COMPOSER_AUTH > auth.json).
Tip
You can set different version constraints, for example, specific tag (4.6.30), version range (~4.6.10), or stability (^4.6@rc):
Choose a secret and provide it in the APP_SECRET parameter in .env.
It should be a random string, made up of at least 32 characters, numbers, and symbols.
It's used by Symfony when generating CSRF tokens, encrypting cookies, and for creating signed URIs when using ESI (Edge Side Includes).
Caution
The app secret is crucial to the security of your installation.
Be careful about how you generate it, and how you store it.
Here's one way to generate a 64 characters long, secure random string as your secret, from command line:
1
php-r"print bin2hex(random_bytes(32));"
Don't commit the secret to version control systems, or share it with anyone who doesn't strictly need it.
If you have any suspicion that the secret may have been exposed, replace it with a new one.
The same goes for other secrets, like database password, Varnish invalidate token, JWT passphrase, and more.
After changing the app secret, make sure that you clear the application cache and log out all the users.
Consider adding the Symfony DebugBundle which fixes memory outage when dumping objects with circular references.
The DebugBundle contains the VarDumper and its Twig integration.
1
composerrequire--devsymfony/debug-bundle
For detailed information about request treatment, you can also install Symfony Profiler:
Directories var and public/var must be writable by CLI and the web server user.
Future files and directories created by these two users need to inherit those permissions.
Caution
For security reasons, in production, the web server cannot have write access to other directories than var.
Skip the step above and follow the link below for production needs instead.
You must also make sure that the web server cannot interpret the files in the var directory through PHP.
To do so, follow the instructions on setting up a virtual host below.
To set up permissions for production, it's recommended to use an ACL (Access Control List).
See Setting up or Fixing File Permissions in Symfony documentation for information on how to do it on different systems.
You can copy the example vhost file
to /etc/apache2/sites-available as a .conf file and modify it to fit your project.
Specify /<your installation directory>/public as the DocumentRoot and Directory, or ensure BASEDIR is set in the environment.
Uncomment the line that starts with #if [APP_ENV] and set the value to prod or dev, depending on the environment that you're configuring, or ensure APP_ENV is set in the environment.
1
SetEnvIf Request_URI ".*" APP_ENV=prod
When the virtual host file is ready, enable the virtual host and disable the default:
12
a2ensiteibexa
a2dissite000-default.conf
Finally, restart the Apache server.
The command may vary depending on your Linux distribution.
For example, on Ubuntu use:
1
serviceapache2restart
You can use this example vhost file and modify it to fit your project. You also need the ibexa_params.d files that should reside in a subdirectory below where the main file is, as is shown here.
Specify /<your installation directory>/public as the root, or ensure BASEDIR is set in the environment.
Ensure APP_ENV is set to prod or dev in the environment, depending on the environment that you're configuring, and uncomment the line that starts with #if[APP_ENV.
When the virtual host file is ready, enable the virtual host and disable the default.
Finally, restart the nginx server.
The command may vary depending on your Linux distribution.
Open your project in the browser by visiting the domain address, for example http://localhost:8080.
You should see the welcome page.
To enable delayed publishing of Content using the Date-based Publisher, you must set up cron to run the bin/console ibexa:scheduled:run command periodically.
For example, to check for publishing every minute, add the following script: