If you've ever shipped a Laravel app to a VPS, you know the drill: install PHP and the right extensions, configure Nginx, tune PHP-FPM, set up MariaDB, wire up Supervisor for queues, get SSL working, lock down the firewall, and finally figure out a deploy strategy that doesn't take the site down on every push. It's hours of work, and one wrong config line away from a 502.

Cipi removes that entire layer. It's an open-source, Laravel-first deployment CLI (MIT licensed, free forever) that turns a bare Ubuntu VPS into a production-ready, multi-app hosting platform with a single command. No web panel, no bloat — just SSH and the cipi command.

Installation

Spin up an Ubuntu 24.04 or 26.04 LTS VPS with root access and ports 22, 80, and 443 open. Any provider works — DigitalOcean, Hetzner, Vultr, Linode, AWS EC2, Scaleway, and so on. Then run:

wget -O - https://cipi.sh/setup.sh | bash

That's it. This single command installs and configures a complete LEMP stack: Nginx as a reverse proxy, multiple PHP versions (7.4 through 8.5) with Composer 2, MariaDB auto-tuned to your server's available RAM, Valkey, Supervisor, cron, Fail2ban, and UFW.

Creating an App

Once the stack is up, creating an isolated application is another single command. Each app you create gets its own:

  • Linux user with an isolated filesystem
  • Dedicated PHP-FPM pool with a selectable PHP version
  • Dedicated MariaDB database with its own user
  • Queue workers managed by Supervisor
  • SSH/deploy key
  • SSL certificate via Let's Encrypt

This per-app isolation is the heart of Cipi's design: one compromised or misbehaving app cannot touch the others. You can run dozens of projects on a single server, each fully sandboxed.

Zero-Downtime Deploys

Cipi's Deployer handles releases atomically. On each deploy it clones your repository, runs composer install, links the storage directory, runs migrations, and then swaps a symlink to point at the new release — so the cutover is instant and the site never goes dark. It keeps the last five releases, which means rolling back to a previous version is immediate if something goes wrong.

You can trigger deploys manually, or hook them up to GitHub or GitLab. Cipi configures deploy keys and webhooks automatically (with HMAC signature verification), so a git push deploys your app. Custom Git providers are supported too.

Security Out of the Box

Security isn't an afterthought you bolt on later — it ships configured:

  • Fail2ban with progressive brute-force banning and a recidive jail
  • UFW firewall allowing only SSH, HTTP, and HTTPS
  • Privilege escalation prevention between apps
  • Vault — app configs encrypted at rest with AES-256
  • Encrypted sync archives by default
  • GDPR-compliant log rotation

Backups and Portability

Cipi can run automated daily backups of your databases and the shared/ storage directory to Amazon S3 or any S3-compatible provider via cron — schedule it once and forget it. You also get email alerts on backup or deploy failure.

For migration, failover, or disaster recovery, the Sync feature transfers entire stacks or single apps between Cipi servers, with credentials protected by encrypted archives in transit.

AI Agent Ready

This is where Cipi gets interesting if you live in an AI-assisted workflow. Cipi ships with a built-in MCP server. Install the cipi-agent package:

composer require cipi-sh/cipi-agent

It exposes six typed tools — health, app_info, deploy, logs, db_query, and artisan — over HTTPS with Bearer token auth, no SSH keys required. Point Claude, Cursor, VS Code, or any MCP-compatible client at the endpoint, and you can deploy, roll back, read production logs, run migrations, and debug issues through natural language.

Optional API, CLI Client, and WHMCS

Cipi stays CLI-first by default, but it scales up when you need it:

  • REST API — enable it with a single command to manage apps, aliases, SSL, and deploys programmatically. Bearer tokens with granular permissions, plus an OpenAPI/Swagger spec.
  • CLI Client (cipi-cli) — a standalone cross-platform Go binary for Linux and macOS that manages your server from your local terminal over the REST API. JSON output pipes cleanly into jq for CI/CD.
  • WHMCS module — automate hosting provisioning from a billing panel. A customer order triggers app creation; suspend, unsuspend, and terminate all flow from WHMCS to the server without a single SSH session.

Who It's For

Cipi fits a range of needs. Solo developers get a production stack without the DevOps overhead. Agencies run many isolated client projects on one VPS and onboard new clients in minutes. Startups and SaaS teams get atomic deploys, instant rollbacks, and S3 backups, then grow from a cheap single VPS to a multi-server setup without changing their workflow. Infrastructure teams wire the plain shell commands into Ansible playbooks or provisioning scripts to manage hundreds of apps programmatically.

The Bottom Line

The value of Cipi comes down to a few things: it collapses hours of manual server setup into one command, it isolates every app so problems stay contained, it makes deploys boring and reversible, and it's genuinely free and open source with no paid tier or hidden costs. If you write Laravel and don't want to spend your evenings reading Nginx documentation, it's worth an afternoon to try.

Get started at cipi.sh/docs, or grab the source on GitHub.