Requirements

PostgreSQL 14+ is the recommended production database. MySQL 8 works. SQLite is used for tests and is fine for a single-user evaluation, but not for anything with concurrent writes.

Cache, queue, and sessions all default to database-backed drivers, so a working deployment needs no Redis. Redis is worth adding once queue throughput matters, but it is not a prerequisite.

Three, and two of them are silent when they stop.

A real transport is required in production. The default log driver writes mail to a file and sends nothing, which means no email verification, no password reset, and no platform-admin invitation - and since admin access requires a verified address, nobody can become an administrator either.

Resend is what the application is configured for; any Laravel-supported transport works. Before sending, verify the domain and publish SPF, DKIM, and DMARC records. An unauthenticated domain gets security notices filed as spam, which is the one place they are useless.

Several templates invite a reply, and individual messages override the sender per category - security@, support@, privacy@, sales@. Those addresses need to accept mail.

• A TLS certificate for the application hostname. The API refuses plaintext.

• A second hostname for the documentation, if you want it served separately - see Configuration reference.

• Outbound access to your mail provider, and to your billing provider if you use one.

• Outbound access to wherever you host CLI artifacts, if you distribute your own build.

The workload is small. Requests are short, payloads are tiny, and the expensive operation - unwrapping two keys and decrypting a value - is measured in microseconds.

Plan storage growth around audit entries rather than secrets. Secrets are small and bounded by how many resources you register; audit entries accumulate for as long as people work.