Shifting Laminas MVC Document Root to the Public/ Directory

Objective

Ensure that a Laminas MVC application serves only the public/ directory to the web, keeping configuration, vendor code, and local secrets outside the document root.

Context and Uncertainty

The Laminas MVC skeleton assumes the web server’s document root points to public/ and relies on either Apache .htaccess routing or an nginx try_files front‑controller pattern. If the document root is mistakenly set to the project root, files such as config/autoload/*.local.php, composer.json, and the entire vendor/ tree become directly downloadable, potentially exposing credentials. While the framework does not detect or warn about an over‑broad root, teams can harden the web server or add extra deny rules.

• What is the recommended approach to guarantee that only public/ is exposed?
• Should teams rely solely on web‑server configuration, or is it advisable to add framework‑agnostic defense‑in‑depth measures such as explicit deny rules for config/ and vendor/ paths?
• How can a CI/CD pipeline verify that the deployed server’s document root matches public/ before releasing to production?