What folders should I use for Laravel 5.*?

@stobbsc

There’s really not a defined directory structure per se. As a general recommendation, the project will normally define the structure. Since you already have an existing project directory structure in place, you’re free to use the location of your choice – just make sure that the directory you select as “home” is configured to be used by your web server (which, from the tags, would be Apache).

If you’re simply looking for recommedations, I generally start with a command such as:

mkdir -p /home/username/htdocs/{public,private,logs/{access,error}}

This creates the following using a one-line command, which is the base structure. I’ll often store data below public and in private to simplify and organize.

/home/username
/home/username/htdocs
/home/username/htdocs/logs
/home/username/htdocs/logs/access
/home/username/htdocs/logs/error
/home/username/htdocs/private
/home/username/htdocs/public

Followed by the useradd command to set username to a home directory and remove the ability to login via SSH (using SSH’s internal SFTP allows SFTP to still be used and doesn’t require another FTP software to be installed). No password is set, thus even if the shell wasn’t modified, access would not be granted but I air on the side of assurance versus potential.

useradd -d /home/username -s /sbin/nologin username

Then

chown root:root /home/username
chown -R username:username /home/username/htdocs

This ensures reading & writing starting from ./htdocs down to ./htdocs/{public,private,logs}, and no further (i.e. nothing is happening in /home/username).

Beyond the above, ensuring that directories have a maximum chmod of 0755 and files have a maximum of 0644, that’s the basics.

Sidenote: Despite what some may say, a chmod of 0777 (i.e. World Readable, World Writable and World Executable) is not required on a properly configured server, nor should it be an option. When using such permissive levels, you open yourself up to a growing list of potentials.

Anything outside of the above is done to simply tighten up security, such as using ACL’s to further restrict access and the ability to read, write and execute.