Demo mode examples
A public demo of Exponential publishes its administrator sign-in and runs with the environment variable
EXP_DEMO_MODE=1: administrator passwords cannot be changed or reset, the installers accept the published demo
password (publish or publishing), and the administration shows a Demo mode banner. The variable must reach
every PHP process of the demo, and no process of any other site. The files here show how, one per place PHP runs.
What demo mode does, and its risks: Demo mode.
Warning
.htaccess slows down every request. When .htaccess files are enabled (AllowOverride anything but None), let alone
used, Apache looks for them and reads and evaluates them on every request, in every directory of the path, and
page loading times go up drastically (measured). The only real fix is to switch the feature off for
the virtual host: AllowOverride None in the HTTPS virtual host, and the rules in the virtual host's own
configuration as mod_rewrite rules. That is far faster in production speed tests and well worth the time it takes
to optimize a production configuration. Switch over right away: copy the rules of the
example HTTPS virtual host into your virtual host (with the static cache, also
staticcache_offload.conf), set AllowOverride None, run apachectl configtest, reload Apache and
test the site. The same rules for other servers: nginx, LiteSpeed,
Caddy, IIS, Velocity (built in); where virtual host rules go in a control
panel: Plesk, cPanel, DirectAdmin, ISPConfig.
On LiteSpeed or OpenLiteSpeed, the server's own page cache can also answer anonymous visitors and crawlers without PHP: Page caching with LiteSpeed and OpenLiteSpeed.
Warning
Copy these files only into the configuration of a demo whose content, users and settings are all throwaway. Never into a shared pool, a server-wide configuration, a base image or a template other sites are built from.
Contents
The files
| File | Where it goes |
|---|---|
htaccess-setenv.conf | appended to the demo's .htaccess: Apache (mod_php, or PHP-FPM through mod_proxy_fcgi) and LiteSpeed with lsphp |
apache-vhost-demo.conf | SetEnv in the demo's Apache virtual host (also a Plesk "Additional Apache directives" box) |
php-fpm-pool-demo.conf | env[EXP_DEMO_MODE] = 1 in the demo's own PHP-FPM pool |
nginx-fastcgi-demo.conf | fastcgi_param EXP_DEMO_MODE 1 where nginx passes requests to PHP-FPM |
/etc/vc/sites-available/<site>.envvars (no file here: one line) | recommended for Exponential Velocity: export EXP_DEMO_MODE=1 in the demo's own site envvars; exp:velocity start reads it for this installation's server only, so restarts and deploys from any shell keep it. Never the shared /etc/vc/envvars: every installation's server reads that, and a worker refuses demo mode from it (demo mode) |
velocity-demo-mode.conf | a systemd drop-in with Environment=EXP_DEMO_MODE=1 for the unit that starts the demo's own Exponential Velocity |
crontab-demo | the demo user's crontab: EXP_DEMO_MODE=1 for the cronjobs and the scheduled rebuild |
docker-demo.env | an environment file for the demo container only (--env-file, env_file:) |
install-demo-sqlite.sh | the generic shape of a rebuild script: clone, composer install, exp:install on SQLite in demo mode, check that the published password went in as given, SetEnv in .htaccess, swap, warm |
install-demo-sqlite-demo-exponential-earth.sh | the real script of https://demo.exponential.earth/ (daily from cron at 04:20, sign-in admin / publish at edit.demo.exponential.earth): the generic shape plus siteaccess matching written after the install (MatchOrder=host_uri;host;uri: HostUriMatchMapItems[] for each siteaccess the installer made under the demo's host, HostMatchMapItems[] for the admin on its own host and for the site, so /admin on the site's host is a 404), a check that the settings name only the demo's hosts, and .htaccess rules that redirect the vhost's old names to the new ones |
Which one you need
- Web requests: one of
.htaccess, the virtual host, the PHP-FPM pool, nginx or (for Velocity) the site envvars/etc/vc/sites-available/<site>.envvarsor the systemd drop-in, depending on what serves PHP. PHP reads the variable withgetenv()first, then$_SERVER; both the FastCGI parameters of PHP-FPM and Apache'sSetEnvarrive that way. - Cron and the console: the crontab line, and
export EXP_DEMO_MODE=1in the shell of anyone who runs commands on the demo. A process without the variable runs with demo mode off. - The installation:
EXP_DEMO_MODE=1in the environment ofexp:install, the kickstarter or the setup wizard's PHP. Without it a well-known or short password is replaced by a generated one, which the rebuild script treats as a failed build. - Containers: the environment file, for the demo service only.
- Two-step sign-in: a new installation requires it of Administrator users and Editors
(
settings/override/sevenxauthentication2fa.ini.append.php,Enforce2FA=enabled). The visitors of a public demo share one administrator account, so the first one to set up an authenticator would lock out every other one. Both rebuild scripts here switch it off after the installation (Enforce2FA=disabled);DEMO_ENFORCE_2FA=1keeps the default, for a demo that shows the second step and is not shared. - Queue and imports:
crontab-demoruns the cron partsexpqueueandsqliimportevery minute with the admin siteaccess (-s admin), where sqliimport is switched on.
Checking it
- The administration shows the Demo mode banner on every page; the forgot-password page tells every visitor that administrator passwords cannot be reset.
grep 'demo/mode' var/log/security.loglists one line per process that started with demo mode, with its SAPI (fpm-fcgi,litespeed,cliand so on). Setup > Log files groups them asdemo/mode.- The audit has a
system.demo.modeevent per process. - When something does not work: Demo mode problems.
Related pages
- Demo mode: the upgrade note
- Run a public demo on LiteSpeed and Plesk
- Demo mode for hosts, Demo mode FAQ
- Environment variables
- Web server examples
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.