What the base application includes
innoboxrr/laravel-setup turns a fresh Laravel 13 application into the ecosystem's base application, with the interface in Vue or React. It is a development package: you install it with --dev, it writes the files, and from then on everything left in the application is yours.
bash
composer require --dev innoboxrr/laravel-setup
php artisan app:setup # Vue
php artisan app:setup --react # React
php artisan app:installEvery step is explained in Install.
What you see in the browser
| Part | Routes | What it does |
|---|---|---|
| Public site | /, /privacy, /terms, /contact, /join | Five pages rendered from the theme option of laravel-options, with 13 sections and a complete example site. Edited from the admin panel. |
| Authentication | /auth/login, /auth/register, /auth/forgot-password, /auth/reset-password/:token/:email | Log in, register, password reset, an email verification notice and returning from impersonation, with laravel-auth. |
| Admin panel | /admin, /admin/profile, /admin/site and the module routes | A menu built from the LaraPack modules, home cards, a notifications bell, dark mode, a profile with photo and password, the site editor, and links to the logs and to the .env editor. |
| Users | Generated module, admins only | The User model is generated by LaraPack from laraimport.json, with its API, policies, tests and screens, like any other model. |
Each part has its own page: The site and its editor, Authentication and users, The admin panel.
What ends up in the backend
app:setup copies these files into the application (from the package's stubs/app/common):
| File | What it is for |
|---|---|
bootstrap/app.php | statefulApi() so the SPA uses the Sanctum session; redirectGuestsTo('/auth/login'), because Laravel's login route does not exist; the admin alias for EnsureUserIsAdmin; JSON errors for api/* and for requests that expect JSON. |
bootstrap/providers.php | AppServiceProvider, EventServiceProvider and RouteServiceProvider. LaraPack generates the last two: without the route provider routes/api/models/*.php is not loaded, and without the event provider an export sends no notification. |
routes/web.php | / serves the app view and a fallback serves the SPA on every other route. A missing api/* or JSON request gets a 404. |
app/Providers/AppServiceProvider.php | JsonResource::withoutWrapping(), because tables read data, meta and links at the root; and the viewLogViewer gate, admins only. |
app/Http/Middleware/EnsureUserIsAdmin.php | The admin middleware: 403 unless the user returns true from isAdmin(). |
config/env-editor.php | The .env editor enabled (ENV_EDITOR_ENABLED, default true) behind web, auth and admin. |
database/migrations/0001_01_01_000010_add_payload_and_soft_deletes_to_users_table.php | Adds payload and deleted_at to users. LaraPack does not alter that table because Laravel wrote its migration. |
database/seeders/SiteOptionsSeeder.php | The example site: site_name, site_description and theme. |
laraimport.json | The user declaration. Whatever you add later goes here. |
It also writes config/routes-to-json.php, adds admins to config/auth.php, generates the user with LaraPack and copies a UserPolicy that lets each person view and edit their own account.
The packages it installs
app:setup writes them into composer.json and app:install installs them. The right-hand column says what actually uses them:
| Package | Version | Used by |
|---|---|---|
innoboxrr/laravel-auth | ^6.1.0 | Authentication, session, verification and impersonation. 6.1 is the minimum because returning from impersonation is a POST. |
innoboxrr/laravel-options | ^2.1 | The site and its editor. |
innoboxrr/laravel-notifications | ^2.1 | The admin notifications bell. |
innoboxrr/laravel-uploads | ^2.1 | The profile photo. |
innoboxrr/laravel-env-editor | ^2.1 | The "Environment" admin link. |
opcodesio/log-viewer | ^3.24 | The "Logs" admin link. |
innoboxrr/routes-to-json | ^2.1 | php artisan route:json, which writes the interface's routes.json. |
innoboxrr/search-surge, innoboxrr/support, innoboxrr/traits | ^3.0, ^2.1, ^2.1 | The code LaraPack generates: filtering and pagination, metas and payload. |
maatwebsite/excel | ^4.0 | The exports LaraPack generates. |
laravel/sanctum | ^4.3 | The SPA session against the API. |
innoboxrr/locale-generator | ^2.1 | The locale:generate and locale:translate commands. |
league/flysystem-aws-s3-v3 | ^3.0 | Flysystem's S3 driver, for anyone using an S3 disk. |
staudenmeir/belongs-to-through, staudenmeir/eloquent-has-many-deep | ^2.18, ^1.22 | Not used directly by the base application. |
innoboxrr/laravel-audit | ^2.1 | Installed with no UI. Its API exists; no screen uses it. |
innoboxrr/aws-file-manager | ^2.0 | Installed with no UI. Its API exists and answers 503 until S3 is configured; no screen uses it. |
algolia/scout-extended | ^5.0 | Installed, not configured or used. |
google/recaptcha | ^1.3 | Installed, not used. No form has reCAPTCHA. |
innoboxrr/larapack-generator (dev) | ^7.10.2 | Generating models. |
It also removes lab404/laravel-impersonate: laravel-auth handles impersonation.
What is not wired
- Social login.
app:setupwritesVITE_GOOGLE_LOGIN,VITE_FACEBOOK_LOGINandVITE_MICROSOFT_LOGIN, but neither interface reads anyVITE_*variable. laravel-auth has the Socialite routes; the screens have no buttons. - Starting an impersonation. The interfaces only include "Back to my account". There is no button to log in as another user; see Authentication and users.
- Auditing, the S3 file manager, Scout and reCAPTCHA. Installed, with no screens or configuration.
- Interface tests in your application. The Vue and React tests live in the package and are not copied.
Vue or React
Both interfaces are the same application: same routes, same screens, same site JSON and same backend calls. The interface contract pins that down. What changes is the stack and where some things are configured:
| Vue | React | |
|---|---|---|
| Entry | resources/vue/app/main.js | resources/react/app/main.jsx |
| Router | vue-router 4, guards in beforeEach | React Router 7 (data router), a guard in each route's loader |
| State | Pinia 3 | Zustand 5 |
| Components | innoboxrr-form-elements | innoboxrr-react-form-elements |
| Tables | innoboxrr-vue-datatable | innoboxrr-react-datatable |
| Settings | config.js only exports adminOnly; the rest is written in its own file | config.js exports adminOnly, adminBase, userUpdateRoute, adminTools, notificationsInterval and sitePages |
Each one has its page: With Vue and With React. The behavioral differences are listed in Customize and extend.
Who owns each file
| Where | What | Owner |
|---|---|---|
resources/<ui>/app/ | Site, authentication, admin panel, state and routes | Yours once installed: laravel-setup never touches it again. |
resources/<ui>/index.js, resources/<ui>/src/ | The generated modules (users and whatever you generate) | LaraPack's: they are regenerated. The base application imports them and never edits them. |
laraimport.json | The user declaration and your models | Yours |
database/seeders/SiteOptionsSeeder.php | The example site | Yours |
app/Http/Middleware/EnsureUserIsAdmin.php | The admin middleware | Yours |
config/auth.php → admins | Who administers (ADMIN_EMAILS) | Yours |
<ui> is vue or react.
Next step
Install the base application, or follow the complete guide in A new application.