We build infrastructure for PHP and Laravel teams. Almost everything here started as something we needed to run our own applications, and stayed open because there was no reason to close it.

Package pages and documentation are at cbox.dk.

Official PHP images give you PHP. These give you a container that knows something about how it is being run.

• php-baseimages: PHP images with a supervised process tree, FPM capacity sized from real memory, and weekly security rebuilds. Four tiers on Debian 12.
• init: PID 1 for containers. Signal forwarding, zombie reaping, dependency ordering, health checks, Prometheus metrics.
• fpm-tune: sizes pm.max_children from the memory workers actually use, instead of the number somebody guessed.
• fpm-exporter: Prometheus exporter for PHP-FPM. Listen queue depth and worker saturation are the signals a scale-out decision needs, and CPU alone will not show you either.
• phpfpm: Go library for talking to PHP-FPM. Pool discovery, config parsing, status scraping, control.
• fcgx: FastCGI client for Go.

• laravel-telemetry: Prometheus metrics, OTLP traces and events without a C extension, protobuf or a sidecar. Built so the counters survive FPM's process model.
• telemetryd: single-binary backend. OTLP in, Loki/Tempo/Prometheus APIs out.
• laravel-telemetry-ui: query Tempo, Loki and Prometheus from inside your own app.
• statamic-telemetry: Stache and static-cache instrumentation, content-aware trace names.
• laravel-health: health checks and Kubernetes probes.
• system-metrics: CPU, memory, disk and cgroup readings in pure PHP. No extension.

• laravel-queue-autoscale: workers sized from queue depth and drain rate against an SLA, not a fixed number in a config file.
• laravel-queue-metrics: throughput, wait time and failure analytics.
• laravel-queue-monitor: per-job tracking with payload storage and replay.

• laravel-id: identity platform for Laravel. AuthN, SSO/SAML, SCIM, OAuth/OIDC provider, RBAC, tamper-evident audit. cbox-id is the deployable app on top of it, with SDKs for JS, Go, Python, React and Vue.
• laravel-billing: gateway-agnostic billing engine. Catalog, subscriptions, usage metering with hard limits, a double-entry ledger, invoicing. cbox-billing is the app.
• laravel-tax: consumption tax. Place-of-supply, reverse charge, inclusive and exclusive rates, with rate data behind a pluggable contract.
• laravel-nexus: US economic nexus. Accumulates sales per state and tells you where a threshold has been crossed.

• laravel-risk: request risk scoring you can explain. IP reputation, geo, disposable email, velocity and bot timing weighted into allow, challenge, step-up or reject.
• laravel-ssrf: blocks outbound requests to private, reserved and cloud-metadata targets. Pins DNS and refuses redirects.
• siem and laravel-siem: a normalized security event and the formatters real SIEMs ingest, plus a durable outbox to deliver them.
• laravel-webhook-signature: signature verification for GitHub, Stripe, Slack, Shopify, Twilio and others. No migrations, no models.
• dns and laravel-dns: queries authoritative nameservers directly over sockets, because a recursive cache is the wrong thing to trust for an ownership check.

• statamic-mcp: MCP server for Statamic v6. Gives an AI assistant structured access to content, blueprints and assets instead of letting it guess at your YAML.
• statamic-filter-builder: collection filters and sort orders built in the control panel.
• statamic-reverse-relationship: see what references an entry without storing anything on it.

Two prefixes carry most of the meaning.

A laravel- repo is a library: UI-free, dependency-light, published on Packagist as cboxdk/<name>. A cbox- repo is the deployable application built on top of one. Applications depend on libraries and never the other way round, which is why the libraries do not pull in our telemetry or autoscaling.

Most of what is here is MIT. The applications differ, so read the LICENSE file in the repo. cbox-id is Elastic License 2.0.