Laravel CRM

A Laravel 13 CRM with a Filament 4 administration panel, role-based access control, workflow-managed tasks, audited soft deletion, encrypted integration credentials, REST APIs, public forms, queued email, reporting, and encrypted CRM backups.

Requirements

• PHP 8.3+
• Composer 2
• Node.js and npm
• MySQL, PostgreSQL, or SQLite

Local setup

rtk composer install
rtk npm install
rtk cp .env.example .env
rtk php artisan key:generate
rtk php artisan migrate
rtk php artisan app:create-admin \
  --email=admin@example.com \
  --first-name=CRM \
  --last-name=Admin
rtk npm run build
rtk php artisan serve

The admin command prompts for a password when --password is omitted. It creates the first verified administrator and synchronizes the super-admin role and all CRM permissions. No default account or password is seeded.

Open /admin to sign in. Run rtk php artisan queue:work in a separate process when QUEUE_CONNECTION is not sync; production should use a durable queue such as database, Redis, or SQS.

Main flows

• Manage companies, contacts, leads, deals, activities, calls, meetings, visits, projects, milestones, tasks, products, campaigns, and contact lists.
• Convert qualified leads atomically into contact, company, and optional deal records.
• Build public forms and collect validated responses at /forms/{form}.
• Compose CRM email and dispatch delivery through the queue.
• Generate sales, financial, contact, and activity reports for a date range.
• Create encrypted, checksum-verified CRM snapshots from the Backups resource. Restore replaces CRM business records and requires confirmation.
• Store external-service credentials encrypted at rest from the Profile page.
• Use granular resource permissions or the unrestricted super-admin role.

API

Sanctum-authenticated CRUD endpoints are available for:

/api/companies
/api/contacts
/api/deals
/api/tasks

API access uses the same granular permissions as Filament, such as view_any_contacts, create_contacts, and update_contacts. Issue tokens only to administrator accounts with the required role permissions.

Security and deployment

• Set APP_ENV=production, APP_DEBUG=false, a unique APP_KEY, and the canonical HTTPS APP_URL.
• Set SESSION_SECURE_COOKIE=true behind HTTPS.
• Set CORS_ALLOWED_ORIGINS to a comma-separated allowlist; wildcard origins are not used.
• Configure SMTP, a durable queue, scheduled backups, log retention, and off-host storage according to your recovery policy.
• Keep composer.lock and package-lock.json committed and run dependency audits in CI.
• Run database migrations before deploying application workers, then restart queue workers.

Quality gates

rtk vendor/bin/pint --test
rtk php artisan test
rtk npm run build
rtk composer validate --strict
rtk composer audit --locked
rtk npm audit

Tests use in-memory SQLite through phpunit.xml and .env.testing. Feature coverage includes authentication, authorization, every resource page, CRUD, public submissions, API access, workflow persistence, encryption, audit logs, soft deletion, backups, reporting, and lead conversion. Unit coverage includes model contracts and application services.