Open Source·shipped
PHP Ghost Wall
Composer package for Laravel that hash-checks a monitored file on every boot, POSTs a tamper alert if it changed, and phones home with server metadata — built for shared hosting without CI file watchers.
Date2024-08
Reading TimeN/A
Statusshipped
StackPHP, Laravel, Packagist
What it does
On every Laravel boot, PhpGhostWallServiceProvider (via booted):
- Integrity check — SHA-256 of a configured path vs an expected hash in
.env - Tamper alert — webhook POST when the hash mismatches
- Phone-home — on a clean check, send domain, IP, PHP/Laravel versions, and
git rev-parse HEAD
Built for environments where you cannot install a file-integrity daemon or rely on CI watching the server — the same constraint that showed up shipping the school CMS on shared hosting.
Install
composer require vishalxtyagi/php-ghost-wall
php artisan vendor:publish --provider="Vishalxtyagi\PhpGhostWall\PhpGhostWallServiceProvider"Configure paths and endpoints in .env (INTEGRITY_MONITOR_*).
Design notes
- Singleton via the service container;
booted()runs after other providers so HTTP facades are available. - Monitored path is configurable (originally
AppServiceProvider.phpas a common injection target). - Skipping TLS verification on the alert POST was a pragmatic shared-hosting choice — treat that as a known tradeoff, not a general security recommendation.
What it demonstrates
- Shipping a Packagist package for a real ops constraint
- Boot-time integrity as a substitute when you lack host-level watchers
- Keeping the surface small: one provider, env config, webhook side effects