Sessions, files and several servers

Sessions and cache

Topic	Production
Session lifetime	Config\Session::$expiration (7200 s by default) to match your policy; component tokens live Config\Anvil::$componentTokenTtl (7200 s)
Session handler	file handler for one server; DatabaseHandler or RedisHandler with several
Cache	a real handler, not dummy: rate limits, the throttle of security events, single sign-on state and API replay protection use it; a shared one (e.g. redis) with several servers
Clocks	NTP on all servers: TOTP, signed API requests and token expiry depend on it

Files and uploads

Uploads are stored under WRITEPATH/anvil/files (Config\Anvil::$filePath) with random keys, exports under WRITEPATH/anvil/exports. With several servers, the directory must be shared (or use another Anvil\Files\Storage). Scan uploads for viruses with clamd:

app/Config/Anvil.php

public ?string $fileScanner = \Anvil\Files\ClamAvScanner::class;
public string $clamAvSocket = 'unix:///var/run/clamav/clamd.ctl';

If clamd cannot be reached, uploads are rejected (fail closed), so monitor it. See Files.

Database

• MySQL 8.0 or newer with utf8mb4; the application time zone is UTC (Config\App::$appTimezone), audit timestamps are UTC.
• The application user needs no DDL rights if migrations run with a separate database group: php spark migrate --all -g <group>.
• Restrict the audit tables for the application user: only INSERT and SELECT on anvil_audit_log, SELECT and UPDATE on anvil_audit_chain, see Limits.