Master Laravel Reverb: Real-Time WebSocket Server for Production

BROADCAST_DRIVER=reverb
REVERB_APP_ID=my-app-id
REVERB_APP_KEY=my-app-key
REVERB_APP_SECRET=my-app-secret
REVERB_HOST=0.0.0.0
REVERB_PORT=8080
REVERB_SCHEME=http
REVERB_REDIS_HOST=127.0.0.1
REVERB_REDIS_PASSWORD=null
REVERB_REDIS_PORT=6379

Generate the app credentials using the Artisan command:

php artisan reverb:generate

This updates your .env with the keys. Now, start the Reverb server:

php artisan reverb:start

For production, you should run this as a daemon using Supervisor.

<?php

return [
    'apps' => [
        [
            'app_id' => env('REVERB_APP_ID'),
            'key' => env('REVERB_APP_KEY'),
            'secret' => env('REVERB_APP_SECRET'),
            'capacity' => null,
            'enable_client_messages' => false,
            'enable_statistics' => true,
        ],
    ],
    'scaling' => [
        'enabled' => true,
        'channel' => 'reverb',
        'server' => [
            'url' => env('REVERB_REDIS_HOST'),
            'host' => env('REVERB_REDIS_HOST', '127.0.0.1'),
            'port' => env('REVERB_REDIS_PORT', 6379),
            'password' => env('REVERB_REDIS_PASSWORD'),
            'database' => '0',
        ],
    ],
    'host' => env('REVERB_HOST', '0.0.0.0'),
    'port' => env('REVERB_PORT', 8080),
    'scheme' => env('REVERB_SCHEME', 'http'),
    'max_request_size' => 10000,
    'ping_interval' => 30,
    'close_on_disconnect' => false,
];

Broadcasting Events with Reverb

Reverb works with Laravel's Broadcasting system. First, define an event that implements ShouldBroadcast:

```php

namespace App\Events;

use Illuminate\Broadcasting\Channel; use Illuminate\Broadcasting\InteractsWithSockets; use Illuminate\Contracts\Broadcasting\ShouldBroadcast; use Illuminate\Foundation\Events\Dispatchable; use Illuminate\Queue\SerializesModels;

class MessageSent implements ShouldBroadcast { use Dispatchable, InteractsWithSockets, SerializesModels;

public $message;

public function __construct($message) { $this->message = $message; }

public function broadcastOn() { return new Channel('chat'); } } ```

To broadcast, dispatch the event:

```php use App\Events\MessageSent;

$message = 'Hello, world!'; event(new MessageSent($message)); ```

On the client side, use Laravel Echo with the Reverb connector. Install Echo and the Reverb connector:

``bash npm install --save-dev laravel-echo pusher-js ``

Note: Reverb uses the Pusher protocol, so we use pusher-js.

Configure Echo in your JavaScript:

```javascript import Echo from 'laravel-echo'; import Pusher from 'pusher-js';

window.Pusher = Pusher;

window.Echo = new Echo({ broadcaster: 'reverb', key: import.meta.env.VITE_REVERB_APP_KEY, wsHost: import.meta.env.VITE_REVERB_HOST, wsPort: import.meta.env.VITE_REVERB_PORT ?? 80, wssPort: import.meta.env.VITE_REVERB_PORT ?? 443, forceTLS: (import.meta.env.VITE_REVERB_SCHEME ?? 'https') === 'https', enabledTransports: ['ws', 'wss'], }); ```

Listen for events:

``javascript Echo.channel('chat') .listen('MessageSent', (e) => { console.log(e.message); }); ``

Make sure to define the environment variables in your .env and prefix with VITE_ for Vite.

<?php

namespace App\Events;

use Illuminate\Broadcasting\Channel;
use Illuminate\Broadcasting\InteractsWithSockets;
use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
use Illuminate\Foundation\Events\Dispatchable;
use Illuminate\Queue\SerializesModels;

class MessageSent implements ShouldBroadcast
{
    use Dispatchable, InteractsWithSockets, SerializesModels;

    public $message;

    public function __construct($message)
    {
        $this->message = $message;
    }

    public function broadcastOn()
    {
        return new Channel('chat');
    }
}

Private and Presence Channels

For authenticated channels, use Private and Presence channels. Define authorization logic in routes/channels.php:

```php use Illuminate\Support\Facades\Broadcast;

Broadcast::channel('chat.{roomId}', function ($user, $roomId) { return $user->canJoinRoom($roomId); // Custom logic }); ```

Then, create an event that broadcasts on a private channel:

``php public function broadcastOn() { return new PrivateChannel('chat.' . $this->roomId); } ``

On the client, subscribe to the private channel:

``javascript Echo.private('chat.' + roomId) .listen('MessageSent', (e) => { console.log(e.message); }); ``

Presence channels add user information. Define:

``php Broadcast::channel('presence-room.{roomId}', function ($user, $roomId) { return $user->canJoinRoom($roomId) ? ['id' => $user->id, 'name' => $user->name] : false; }); ``

Client subscription:

``javascript Echo.join('presence-room.' + roomId) .here((users) => { console.log('Users in room:', users); }) .joining((user) => { console.log(user.name + ' joined'); }) .leaving((user) => { console.log(user.name + ' left'); }) .listen('MessageSent', (e) => { console.log(e.message); }); ``

Ensure the broadcasting auth endpoint is enabled. By default, Laravel provides /broadcasting/auth. Make sure your routes include it:

``php // In routes/api.php or routes/web.php Broadcast::routes(); ``

<?php

use Illuminate\Support\Facades\Broadcast;

Broadcast::channel('chat.{roomId}', function ($user, $roomId) {
    return $user->canJoinRoom($roomId);
});

Broadcast::channel('presence-room.{roomId}', function ($user, $roomId) {
    return $user->canJoinRoom($roomId) ? ['id' => $user->id, 'name' => $user->name] : false;
});

Scaling Reverb with Redis

Reverb supports horizontal scaling using Redis as a pub/sub backend. When scaling, multiple Reverb server instances communicate via Redis to broadcast events across all connections.

Enable scaling in config/reverb.php:

``php 'scaling' => [ 'enabled' => true, 'channel' => 'reverb', 'server' => [ 'url' => env('REVERB_REDIS_HOST'), 'host' => env('REVERB_REDIS_HOST', '127.0.0.1'), 'port' => env('REVERB_REDIS_PORT', 6379), 'password' => env('REVERB_REDIS_PASSWORD'), 'database' => '0', ], ], ``

Ensure Redis is installed and running. Then, start multiple Reverb instances on different ports or servers. For example, using Supervisor:

``ini [program:reverb-1] command=php /path/to/artisan reverb:start --port=8080 process_name=%(program_name)s_%(process_num)02d numprocs=2 autostart=true autorestart=true user=forge ``

Each instance will share the same app credentials and use Redis to synchronize. Clients can connect to any instance; the pub/sub ensures all instances receive broadcasts.

To load balance, use a reverse proxy like Nginx with sticky sessions (optional but recommended for performance):

```nginx upstream reverb { least_conn; server 127.0.0.1:8080; server 127.0.0.1:8081; }

server { listen 443 ssl; server_name reverb.example.com;

location / { proxy_pass http://reverb; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } } ```

[program:reverb]
command=php /home/forge/example.com/artisan reverb:start --port=8080
process_name=%(program_name)s_%(process_num)02d
numprocs=2
autostart=true
autorestart=true
user=forge
redirect_stderr=true
stdout_logfile=/home/forge/example.com/storage/logs/reverb.log

Security Best Practices

Securing your WebSocket server is critical. Here are key practices:

1. Use HTTPS/WSS: Always serve WebSocket over TLS. Configure your reverse proxy to handle SSL and set REVERB_SCHEME=https.
2. Authenticate Private Channels: Never expose private data without authorization. Use Laravel's built-in channel authorization.
3. Rate Limiting: Reverb doesn't have built-in rate limiting. Implement it at the application level or use a reverse proxy like Nginx:

```nginx limit_req_zone $binary_remote_addr zone=reverb:10m rate=10r/s;

server { location /app/ { limit_req zone=reverb burst=20 nodelay; proxy_pass http://reverb; } } ```

1. Disable Client Messages: Unless needed, set enable_client_messages to false in config to prevent clients from sending arbitrary events.
2. Validate Input: When broadcasting events, sanitize data. For example, strip HTML tags from chat messages.
3. Use Separate App Credentials: For different environments (staging, production), use different app IDs and keys.
4. Monitor Connections: Log connection/disconnection events to detect anomalies. Use Laravel's event listeners:

``php Event::listen(\Laravel\Reverb\Events\ConnectionEstablished::class, function ($event) { Log::info('WebSocket connected', ['connection_id' => $event->connection->id]); }); ``

<?php

namespace App\Providers;

use Illuminate\Foundation\Support\Providers\EventServiceProvider as ServiceProvider;
use Illuminate\Support\Facades\Event;
use Laravel\Reverb\Events\ConnectionEstablished;
use Laravel\Reverb\Events\ConnectionClosed;

class EventServiceProvider extends ServiceProvider
{
    public function boot()
    {
        parent::boot();

        Event::listen(ConnectionEstablished::class, function ($event) {
            \Log::info('WebSocket connected', ['connection_id' => $event->connection->id]);
        });

        Event::listen(ConnectionClosed::class, function ($event) {
            \Log::info('WebSocket disconnected', ['connection_id' => $event->connection->id]);
        });
    }
}

Monitoring and Debugging

Production monitoring is essential. Reverb provides statistics via the reverb:stats command:

``bash php artisan reverb:stats ``

This shows connected clients, channels, and memory usage. For real-time monitoring, enable statistics in config and use a dashboard.

You can also integrate with Laravel Horizon to monitor queue jobs. Since broadcasts are queued, Horizon shows failed jobs and throughput.

For debugging, enable logging in Reverb:

``php // config/reverb.php 'logging' => [ 'enabled' => env('REVERB_LOGGING_ENABLED', false), 'channel' => env('REVERB_LOGGING_CHANNEL', 'stack'), ], ``

Set REVERB_LOGGING_ENABLED=true in .env to see detailed logs.

If events aren't received, check the queue worker logs. Also, ensure the event is broadcasted on the correct channel and the client is subscribed.

'logging' => [
    'enabled' => env('REVERB_LOGGING_ENABLED', false),
    'channel' => env('REVERB_LOGGING_CHANNEL', 'stack'),
],

Deployment with Supervisor

For production, run Reverb as a daemon using Supervisor. Create a configuration file:

``ini [program:reverb] command=php /path/to/artisan reverb:start --port=8080 process_name=%(program_name)s_%(process_num)02d numprocs=2 autostart=true autorestart=true user=forge redirect_stderr=true stdout_logfile=/path/to/storage/logs/reverb.log ``

Then, update Supervisor:

``bash sudo supervisorctl reread sudo supervisorctl update sudo supervisorctl start reverb:* ``

Ensure the queue worker is also supervised:

``ini [program:reverb-worker] command=php /path/to/artisan queue:work --queue=reverb --sleep=3 --tries=3 process_name=%(program_name)s_%(process_num)02d numprocs=2 autostart=true autorestart=true user=forge ``

For zero-downtime deployments, use a load balancer and gracefully stop old instances. You can send SIGTERM to Reverb processes; they will finish ongoing broadcasts before exiting.

Also, consider using a process manager like Laravel Forge or Envoyer for automated deployments.

[program:reverb]
command=php /home/forge/example.com/artisan reverb:start --port=8080
process_name=%(program_name)s_%(process_num)02d
numprocs=2
autostart=true
autorestart=true
user=forge
redirect_stderr=true
stdout_logfile=/home/forge/example.com/storage/logs/reverb.log

[program:reverb-worker]
command=php /home/forge/example.com/artisan queue:work --queue=reverb --sleep=3 --tries=3
process_name=%(program_name)s_%(process_num)02d
numprocs=2
autostart=true
autorestart=true
user=forge
redirect_stderr=true
stdout_logfile=/home/forge/example.com/storage/logs/reverb-worker.log