hammer doctor

hammer doctor

Checks that a host has what Slim Killer needs, and says exactly what to fix.

php hammer doctor                                         # command line and server
php hammer doctor --url=https://example.com \
                  --webroot=~/domains/example.com/public_html   # ...and the website

The command ends with 0 when nothing failed, 1 when something must be fixed, and 2 when it was called wrongly, so scripts can rely on it.

Reading the report

Each line has one of four labels:

Label	Meaning
PASS	Exactly what Slim Killer needs.
WARN	Works, with a limitation or an accepted alternative. Read the hint.
FAIL	Slim Killer cannot work like this. The grey line under it says how to fix it.
INFO	Useful to know; neither good nor bad.

The report has three sections.

Command line checks the PHP that ran hammer: version, extensions, disabled functions, limits and image support.

Server checks things that are not about one PHP:

• PHP for cron and hammer: the binary to use, and every PHP version installed.
• Storage folder: can Slim Killer write its files?
• GitHub: can this server reach api.github.com and codeload.github.com?
• Cron: has hammer cron:heartbeat run in the last three minutes, and with which PHP? Before the first run it prints the exact line to add.

Website runs the same PHP checks against your website's PHP, then tests the web server: do .htaccess rewrites work, and are folder listings blocked? Without --url and --webroot this section only reminds you to run it.

How the website check works

The doctor creates a folder with a random name in the web root, for example _slimkiller-probe-3f9c2a…, containing:

• probe.php, which reports the website's PHP facts as JSON, but only to a request carrying a second random key;
• an .htaccess file with one rewrite rule and Options -Indexes;
• an empty listing folder.

It requests those over HTTPS, then deletes the folder, whether the checks passed or not. The probe is written in old PHP syntax on purpose, so it can report a website that runs an old PHP.

The setup page

Every run of the doctor saves its report and ends with a private link:

Setup page (private, works for one hour):
  https://example.com/cp/setup?token=68f6c7df…

The page shows the website's own PHP, checked live each time you open it, followed by the doctor's saved report for everything only the server can check (cron, the PHP for cron, outgoing connections), with how long ago the doctor ran.

• The link works for one hour, and each run of the doctor replaces the last link.
• Only someone who can run hammer on the server can get one; only a hash of it is stored.
• Without a valid link, /cp/setup shows only "This setup link has expired".
• The address is never sent on to other sites: the control panel sends no referrer.

Without --url, the link uses APP_URL from .env, or prints just the path to add to your website's address.

Adding your own checks

Checks are small classes. A PhpCheck runs against the command line's PHP and again against the website's; a HostCheck runs once. Register one in your site's config/site.php:

return [
    'doctor.host_checks' => DI\add([DI\get(App\Doctor\MyCheck::class)]),
];