Documentation
Install it, set it up, keep it running.
The reference for whoever looks after the site. Where AlumDeck needs something from you, or does less than you might assume, it says so here rather than in a support reply.
Requirements
What the server needs, and why.
Send this table to your host if you are not sure. The installer checks all of it on screen anyway.
| Requirement | What AlumDeck needs | Notes |
|---|---|---|
| PHP | 8.3 or newer | The installer refuses anything older before it writes a thing. |
| Database | MySQL 8, or MariaDB 10.6 or newer | One empty database and a user with all privileges on it. There is no PostgreSQL option. |
| PHP extensions, required | 14: pdo, pdo_mysql, mbstring, openssl, tokenizer, xml, dom, ctype, json, fileinfo, filter, hash, session, pcre | All standard. The server check names any that are missing. |
| PHP functions, required | mb_split, mb_str_split, random_bytes, openssl_encrypt | Checked by name, because mbstring can be built without its regular-expression half and still say it is there. |
| PHP extensions, recommended | gd or imagick, curl, zip, exif, intl | Shown amber, not red. The install carries on without them. |
| Writable folders | The application folder (for .env), storage/ and everything in it, bootstrap/cache/ | Usually 755 in File Manager; some hosts want 775. Never 777. |
| Outbound HTTPS | Required at install | Screen one checks your key with alumdeck.com. After that a status check runs about twice a day, and it fails open. |
| Cron | One line, every minute | It runs 11 scheduled jobs, backups included. |
PHP exec() | Needed for backups | Backups call mysqldump and tar. Where a host disables exec(), use the host's own backups instead. |
| Web server | Apache or LiteSpeed | The usual cPanel servers. An .htaccess with security headers ships in the zip. |
| Shell access | Not needed to install | An update that changes the database needs one terminal command, or a question to us first. |
Installing
Six screens, in a browser.
| Screen | Asks for | What it does |
|---|---|---|
| 1. Licence | Your licence key | Checks it with alumdeck.com, sending the key, the product name and your hostname |
| 2. Server | Nothing | Checks every requirement live; red must be fixed before you can go on |
| 3. Database | Host, port, name, user and password | Opens a real connection, then creates and drops a probe table to prove it can create tables |
| 4. Site | Site name, address, timezone and the first admin | Keeps it in your session; nothing is written yet. The admin password needs 12 characters or more |
| 5. Review | Whether to add sample content (ticked by default) | Writes .env, creates the tables and your account, adds leaving years and legal page templates, makes the uploads folder |
| 6. Done | Nothing | Shows a summary. From now on /install returns a plain 404 |
There is no command-line install, and nothing needs Composer or a build step: the zip ships with its libraries and compiled assets. The one thing most cPanel accounts need is a three-line edit to index.php, because cPanel keeps document roots under public_html. The install guide walks through it.
After the installer
First steps, before you invite anyone.
Add the cron line
One entry in cPanel, Cron Jobs, running every minute; the line is below these steps. Eleven jobs depend on it, backups included.
Set up mail
Settings, Mail: choose SMTP or sendmail, fill in the sender and server, and press Send a test email. The SMTP password is stored encrypted.
Check the door is shut
/installshould return 404 and/.envshould return nothing.Name the association, and the year it was founded
Settings, General. With the founding year blank, the built-in homepage prints this year as "Founded" and "0 years of history", so fill it in or build your own homepage blocks.
Brand it
Settings, Branding and Theme: a wide logo, a square badge, a favicon and four colours. Leave the colours blank and you get the packaged palette.
Decide which modules to run
Settings, Modules. Then, if you switched anything off, build a custom menu at Settings, Menus, because the built-in navigation still links to every module.
Share the work out
Add committee members as staff with only the areas they need, and turn on two-factor sign-in for every full administrator.
Replace the legal templates
The installer adds privacy and terms pages that open with a notice saying they are not legal advice. Rewrite them for your association before you invite anyone.
The cron line
Change the PHP path and the account name to match your hosting.
* * * * * /usr/local/bin/php /home/youraccount/alumdeck/artisan schedule:run >/dev/null 2>&1Settings
The twelve settings screens in one table.
| Screen | What it controls |
|---|---|
| General | Site and association names, tagline, founding year, address and contact details, social links, the member number prefix, the leaving-level label, timezone, five date layouts, a 12 or 24-hour clock, and the admin area address |
| Branding | Wide logo and its height, square badge, favicon, header subtitle, homepage photo, and whether the site can be installed on a phone home screen |
| Theme | Four colours: primary (a full range of shades is made from it), accent, dark and surface |
| Admin appearance | The default of three admin layouts. Each admin can pick their own; every layout has the same features |
| Homepage | Seven block types in any order: hero banner, stats band, latest news, upcoming events, rich text, call to action and custom HTML |
| Footer | Widget columns, a copyright line with {year} and {site} tokens, and a bottom note |
| Log, sendmail or SMTP, the sender, the server details, and a test button | |
| SEO | Site-wide defaults, titles and descriptions for 14 fixed pages, analytics and verification IDs, and three snippet fields. Every snippet change is written to the audit log |
| Giving | Currency code and symbol, receipt number prefix, receipt footer (a charity number, say) and the giving page's own content |
| Privacy and cookies | The cookie banner: on or off, its message and your policy address. What members see about each other is set by each member, not here |
| Modules | The 13 feature switches, below |
| Maintenance | A holding page with your own message; signed-in admins pass through |
All twelve, plus Backups, the member import and Menus, are for full administrators only. Press Ctrl+K (Cmd+K on a Mac) anywhere in the admin to search every screen and individual setting by name, including everyday words: smtp finds Mail, gdpr finds the cookie banner, donate finds Giving. It searches screens and settings, not members or posts.
Moving the admin address
Settings, General can change /admin to another path. The old address stops working the moment you save, so bookmark the new one. It makes the panel harder to find, not harder to break into, and the shipped robots.txt still names only /admin.
Modules
Thirteen switches, and which ones are only half wired.
Settings, Modules. Know which switches do less than the screen suggests before you rely on one.
| Module | Ships | When you switch it off |
|---|---|---|
| News | On | Its admin screens leave the menu and its public pages return 404 |
| Events | On | The same |
| Galleries | On | The same |
| Heritage | On | The same, and the editor for free-form pages goes too, though those pages keep serving |
| Giving | On | The same |
| Members | On | The same |
| Search | On | Site search returns 404; while on, it skips any module that is off |
| Surveys | Off | The member link and dashboard tile disappear; the survey address still answers |
| Mentoring | Off | No visible change in the member area |
| Tickets | Off | The ticket panel leaves the event page; a Yes on a ticketed event still issues a ticket |
| Community | On | Nothing on the public side: batch rooms and contact requests stay reachable |
| Association | On | Nothing on the public side: the documents area stays reachable to members |
| Volunteers | Off | Nothing changes |
| Job board | Always on | There is no switch |
People
Members and staff and who can see what.
How members arrive
Through the public join form, which asks for the leaving year, a roll number if you use them, and a memory that proves they were there, and records four separate consents. The applicant confirms their email address. Existing members can vouch for applicants within three years of their own, and if you have imported an old register, the review screen suggests matching records. Nobody gets in until a person with the registrations area approves them; approval creates the account, allocates a member number such as ALUM-2026-0001 and emails a set-your-password invitation.
Bringing in an existing list
Full administrators can import a CSV: upload it, map the columns (common headings are matched for you), run a dry run that lists every problem, then commit. The email address is the match key, so a second import updates rather than duplicates. Files up to 8 MB.
Imported members are not emailed. There is no bulk invitation yet, so they get in with forgotten password on the sign-in page, once you tell them the site exists. Bulk invitations and reminders are planned for release 1.1.
Staff and permissions
A user is either a full administrator or staff holding any of 13 areas: registrations, members, news, galleries, events, community, association, contact, heritage, giving, surveys, communications and users. There is no limit on how many. Staff cannot make themselves full administrators, and nobody can delete their own account.
Two-factor sign-in and sessions
Each admin can turn on two-factor sign-in from My profile, with an authenticator app or an emailed code; eight wrong codes lock it for 15 minutes. It is opt-in, because a new install has no mail to send codes with. To require it for every admin, set REQUIRE_ADMIN_2FA=true in .env. Admin sessions end after 60 idle minutes and after 12 hours in any case, and every sign-in and change to 17 kinds of record goes into an audit log, kept for 365 days by default.
On an HTTPS site, also set SESSION_SECURE_COOKIE=true in .env so the session cookie is only ever sent over HTTPS.
Email sends nothing until you set it up.
Until Settings, Mail is set up, every email is written to a log file instead: password resets, welcome invitations, event reminders, birthday greetings, gift receipts and campaigns. A committee that skips this step decides registration is broken.
What goes out on its own
New posts, events and association documents are emailed to members who opted in, within a minute of publishing. Members with a Yes RSVP get a reminder two days before an event, at 09:00. Birthday greetings go at 08:00, a welcome-new-alumni digest on the 1st of each month, and staff get a Monday digest of what is waiting for them. Members choose three categories of email in their profile; account and security mail ignores those choices.
Email campaigns
Written in Markdown, sent to an audience you build from leaving years, cities, engagement bands, mentors or volunteers. Count the audience, send yourself a test, then queue it. Campaigns go out 60 messages a minute, and consent is checked again for each person at the moment of sending. You see how many were sent and opened.
Three limits to plan around. There is no scheduling: queueing means starting now. There is no click tracking, only first opens. And there is no unsubscribe link in the message; members opt out in their own profile. A one-click unsubscribe is planned for release 1.1. If you send to a large list before then, take advice, or export the consenting members to a mail service.
WhatsApp and newsletter services
The WhatsApp page builds a list of members to message, with an Open chat link for each that opens WhatsApp on your own phone with the text filled in, plus a CSV of numbers. It sends nothing itself. Set the phone country code and local number length in Settings, General first, or most numbers are skipped. For a newsletter service, export the members who opted in to updates as a CSV.
Backups
Nightly backups, tested every Sunday.
What is written, and where
At 02:30 every night AlumDeck writes a timestamped folder with four files: database.sql.gz (your database), media.tar.gz (uploaded photos), documents.tar.gz (private documents, contact attachments, import files) and manifest.json, which records a SHA-256 checksum for each file. It keeps the last seven.
The folder is BACKUP_PATH if you set it, otherwise alumdeck-backups beside the application. AlumDeck refuses any location a browser could reach, creates the folder readable by your account only, and passes the database password through a private file rather than the command line, where other accounts on a shared server could read it.
Every Sunday, a restore test
At 04:00 on Sundays it imports the newest dump into a scratch database, compares every table's row count with the live one, and then drops the scratch copy. A backup nobody has restored is a rumour; this is what makes it a fact. The Backups page shows the last run, its sizes and checksums, and warns when a backup goes stale.
Restoring
- Fetch the timestamped folder off the server by SFTP or File Manager.
- Check each file against its checksum in
manifest.json. - Turn on maintenance mode at Settings, Maintenance, and stay signed in while it is on.
- Import the database. With a terminal:
gunzip -c database.sql.gz | mysql -u DBUSER -p DBNAME- Without one, unzip the file on your computer and import the .sql in phpMyAdmin.
- Unpack
media.tar.gzover your uploads folder anddocuments.tar.gzoverstorage/app/private. - Turn maintenance mode off and check a public page, an uploaded photo and a test email.
The licence check
What the licence does, day to day.
Screen one of the installer checks your key once. After that, a running site asks alumdeck.com whether the licence is current about every 12 hours, sending only the key and its hostname, and only when somebody opens a page behind a sign-in. A site with visitors but nobody signing in never asks at all. The answer is kept in storage/app/licence-state.json.
It fails open
If our server cannot be reached, answers with an error, or says something unexpected, nothing changes. After a licence lapses there are 21 days of grace, with a banner on every admin page, before anything pauses. Once a warning is showing, the check runs hourly, so a renewal takes effect within the hour, and the pause screen has a check again now button.
| Pauses after a lapse | Never pauses |
|---|---|
| The admin panel | Every public page: news, events, history, galleries, archive, giving |
| The member area, including its sign-in form | The members-area front page at /connect |
| The two-factor screens | The sitemap and the news feed |
| New releases and support, from the renewal date | Signing out, which always works |
Updating
Applying a new version, by hand, on purpose.
- Check that last night's backup exists on the Backups page, and export the database from phpMyAdmin too.
- Turn on maintenance mode, and stay signed in.
- Extract the new zip into your home directory as
alumdeck-new, beside the live folder, never over it. - Copy
.envfromalumdecktoalumdeck-new, then copy across any key the new.env.examplehas that yours lacks. MissAPP_INSTALLED=trueand the installer reappears. - Rename
alumdecktoalumdeck-old, andalumdeck-newtoalumdeck. - If you copied
public/into your document root at install, copy the new one over it, delete files inbuild/that are not in the new release, and make your three-lineindex.phpedit again, because the new file points back at../. - If the release changes the database, run
php artisan migrate --forcein a terminal. No terminal? Ask us before you swap, and we will tell you whether it does. - Turn maintenance mode off. Check that
/installis a 404, that your logo and a photo load, that robots.txt shows your rules, and that a test email sends. - Keep
alumdeck-oldfor a week. If anything is wrong, swap the folders back and restore the database export.
| Yours: never replaced | Ours: replaced by every update |
|---|---|
.env, your configuration | app/, config/, resources/, routes/ |
| The database: members, content, gifts | vendor/, bootstrap/, artisan |
| Uploaded media, in your uploads folder | public/build/ and public/images/ |
Troubleshooting
When something is wrong after the install.
Problems during the install itself, from blank pages to refused databases, are in the install guide.
Nothing scheduled ever happens
No reminders, digests, campaigns or backups. This is almost always the missing cron line. Add it, wait a minute, and check the Backups page. The Backups page also prints a separate cron line for each command, for hosts where the scheduler will not run; those lines include -d register_argc_argv=1, without which artisan prints its command list, exits happily and runs nothing.
No email arrives
The shipped transport is log. Open Settings, Mail, set up SMTP and press Send a test email. It reports your mail server's own error rather than a vague failure.
Backups never appear on the Backups page
Either PHP's exec() is disabled on your host, or the backup folder was refused for sitting somewhere a browser could reach. The Backups page says which, in words. Set BACKUP_PATH in .env to a folder outside the web root to fix the second.
Photos upload but do not display
Open one uploaded image's address directly. A 404 means PUBLIC_DISK_ROOT is not a folder inside your document root. A 403, or your host's own page, means the address is blocked: set PUBLIC_DISK_URL to an address that is not /storage.
The admin looks broken, or analytics and video albums do not load
Both are Content Security Policy. If the admin has invisible buttons or no menu, an .htaccess in a folder above AlumDeck is sending a policy written for a plain HTML site; the panel needs 'unsafe-eval' and 'unsafe-inline' for scripts and inline styles. If Google Analytics or YouTube albums do not load, the policy in the shipped public/.htaccess blocks them: widen it for the services you use. Press F12 and read the console; a blocked policy names the directive. Allowing your own analytics tags by default is planned for release 1.1.
A menu link returns 404
A module is switched off and the built-in navigation does not know. Build a custom menu at Settings, Menus; it replaces the built-in list entirely.
An admin is locked out of two-factor sign-in
From a terminal on the server, run php artisan alumdeck:disable-2fa followed by that admin's email address. They can sign in with their password and set two-factor up again.
You need to see the real error
Set APP_DEBUG=true in .env, reload the failing page, read the error, then set it back to false at once: with it on, an error page shows file paths and configuration to anyone. The log is storage/logs/laravel.log; the last entry is usually the one you want.
Stuck on something this page does not cover?
Email support from the people who build AlumDeck, within one working day, while your licence is current.
Sign-in details on the demo pageResets every night