Installing AlumDeck

AlumDeck is installed and tested by Cerevonix on cPanel hosting, so this guide gives cPanel's name for each screen as the example, in brackets. Other control panels offer the same things under their own names and have not been tested by Cerevonix.

You need four things.

Your server also needs to be able to make outbound HTTPS requests to alumdeck.com. AlumDeck checks your licence key with our server during the wizard. If your host blocks outbound connections, installation cannot complete - ask them to allow it.

After installation a running site asks our licence server about twice a day whether the licence is still current. It sends the licence key and your site's address, never anything about your members, and believes only an answer our server signed. It needs an answer now and then: a site that has never had one pauses signing in 21 days after installation, and a site with no answer for 60 days pauses signing in 21 days after that. The admin panel warns you every day before either happens (see the README). Checking for new versions is a separate switch on System > Updates, off until you turn it on.

If Cerevonix ever stops trading, we will publish a final release of AlumDeck that runs without the licence check.

What the server needs

The wizard checks all of this for you on screen and tells you what is missing, so you do not have to audit it in advance. It is listed here so you can send it to your host if something fails.

• PHP 8.3, 8.4 or 8.5 with the ionCube Loader, and pdo, pdo_mysql, mbstring, openssl, tokenizer, xml, dom, ctype, json, fileinfo, filter, hash, session, pcre, intl (the admin panel's bulk actions stop with an error without intl) and sodium (it checks that the licence server's answers are genuine)
• Recommended: gd (photos are resized with it; without it every photo is sent at full size), curl and exif (phone photos the right way up)
• MySQL 8.0+ or MariaDB 10.6+, the versions their makers still fix. The wizard connects before anything is written and warns you about an older server; AlumDeck is built and tested on MariaDB 11.4.
• Disk: the zip is about 26 MB and unpacks to about 80 MB. Add room for your uploads and, if you keep them on the server, the nightly backups.
• Write access to the project folder, storage/ and bootstrap/cache/
• Apache reads the shipped public/.htaccess and needs nothing more. On Nginx or LiteSpeed, add the lines in docs/server/ - see Web servers other than Apache. Those two sample files ship untested: we have not yet run them on a live Nginx or LiteSpeed server.

Create the subdomain in your hosting control panel if you have not already (in cPanel: Domains).

1. Note the document root your host gave the domain. Your hosting control panel shows it beside the domain (in cPanel: Domains); it will look something like /home/youraccount/public_html/alumni.yourschool.edu.

2. Copy the contents of alumdeck/public/ into it - the files inside public, not the public folder itself.

3. Edit index.php in the document root. It has three lines that reach back into the application with __DIR__.'/../'. Each one has to point at the alumdeck folder instead.

Count how deep your document root sits under your home directory, and use that many ../. For /home/youraccount/public_html/alumni.yourschool.edu that is two:

if (file_exists($maintenance = __DIR__.'/../../alumdeck/storage/framework/maintenance.php')) {
    require $maintenance;
}
require __DIR__.'/../../alumdeck/vendor/autoload.php';
$app = require_once __DIR__.'/../../alumdeck/bootstrap/app.php';

The ionCube Loader check in index.php finds the application through the first of these lines, so change only the paths and keep $maintenance as it is.

Get this wrong and you see a 403 or a blank page. It is the one step people get wrong, and it is always the number of ../.

4. Check it. Visit your domain. You should be redirected to /install.

If your host does let you set an arbitrary document root

Some do - a VPS, or a shared hosting account with the restriction lifted. Then you can skip the copying entirely: point the document root straight at /home/youraccount/alumdeck/public and leave index.php alone.

Worth trying first, since it means one less thing to keep in step on every upgrade. If your control panel rewrites the path (cPanel puts it under public_html), use the steps above.

The final screen lists these, and they matter.

1. Confirm the door is shut

Visit yourdomain.com/install. You should get a 404. The wizard disables itself once an administrator exists, so there is no install folder to delete - but check it, because "I assumed it was closed" is not the same as knowing.

Also confirm .env is not reachable: yourdomain.com/.env must not return anything.

2. Set up email

Until you configure mail, AlumDeck writes emails to a log file instead of sending them. Nobody gets a password reset, an event reminder or a welcome message.

In your hosting control panel, create a mailbox (no-reply@yourdomain.com). Then, in the AlumDeck admin, open Settings > Email, choose An SMTP server (or This server (sendmail), which usually works on shared hosting), fill in the mailbox details and press Send a test email. Nothing needs editing on the server; the password is stored encrypted.

Then open Settings > Email design to give every email your look: the logo, the header and accent colours, a signature and the footer text (for example a charity number). The preview shows a sample email before you save, and Send a test to me sends it to your own address.

Two-factor sign-in for staff is switched on by default and starts as soon as email works: the next time you sign in you are asked to set it up (an emailed code or an authenticator app). Until email works it waits, and the dashboard says so.

Sessions are encrypted by default (SESSION_ENCRYPT=true, written by the installer), and the sign-in cookie is sent only over HTTPS when your site address starts with https://. Settings > Security shows all of these at a glance.

3. Add the scheduler

One cron entry, added in your hosting control panel under scheduled tasks (in cPanel: Advanced, then Cron Jobs), set to run every minute. The exact line for your server is shown in the admin under System > Backups > Scheduled tasks; it looks like:

* * * * * cd /home/youraccount/alumdeck && /usr/local/bin/php -d register_argc_argv=1 artisan schedule:run >> /dev/null 2>&1

Both the full path to PHP and -d register_argc_argv=1 matter: cron can run a PHP that otherwise ignores the command name, prints a list and exits as if it had worked (cPanel's cron does). That command-line PHP needs the ionCube Loader too, and some hosts set it up separately from the website's; without it the command stops with a line saying so.

Without it, email campaigns, event reminders, birthday greetings, digests, invitations, automations and the nightly backup never run. The admin dashboard's Needs attention list tells you until it is in place.

4. Follow the getting-started list

The dashboard shows a Getting started list to full administrators: name and logo, email, the scheduler, two-factor sign-in, your members, invitations, the first event and backups. Each item ticks itself when it is really done, and the list disappears when everything is. You can hide it earlier with Hide this list (bring it back under Customise). The guide to every screen explains each step.

Your licence covers one site, and the site is its address. Moving to a new server at the same address needs nothing from us: copy the files, the database and your uploaded media folder, and point the domain at the new server.

Changing the address - a new domain, or going from a test install on your own computer to the real site - needs the key released first:

1. Release the key from the old address on alumdeck.com's release page (alumdeck.com/api/licence/release-site.php). You enter the key and we email a confirmation link, valid for 60 minutes, to the address the licence was bought with. A public address can be moved once every 30 days; a test install on your own computer is released as soon as you confirm.
2. Install AlumDeck at the new address following this guide.
3. Copy your database across, and copy your uploaded media folder.

A copy left running at the old address is told the key is in use elsewhere: its admin panel shows a warning, and signing in there pauses 21 days later. If you cannot release the key yourself, contact us.