Frequently asked questions

What is darvis/lemmings?

A small Laravel package that adds a hidden easter egg page on /lemmings: a Lemmings picture in which the umbrella links to the site of the developer, as a quiet proof of who built the application. It also adds /clearDgP, a page that clears the caches on hosting without shell access and only works with a secret token.

How do I add a hidden developer easter egg to a Laravel site?

Run composer require darvis/lemmings. The service provider is discovered automatically and registers a page on /lemmings with a Lemmings picture. The umbrella in the picture links to the address in LEMMINGS_URL, so set that to your own site.

How do I change the URL of the darvis/lemmings page?

Set LEMMINGS_ROUTE in .env, for example LEMMINGS_ROUTE=/built-by. The default is /lemmings. The path is read when the application boots, so run php artisan route:cache again when you cache your routes. The route name stays lemmings.

What does the /lemmings page show about my application, and do search engines index it?

Nothing about the application. It is a static page with one embedded picture, the title Oh no more Lemmings.... and a link to the address in LEMMINGS_URL. It shows no Laravel or PHP version, no environment, no debug state and no paths, and nothing from the request ends up on it. A robots meta tag with noindex, nofollow asks search engines to leave it out.

Which routes does darvis/lemmings add to my application?

Two GET routes. lemmings on the path from LEMMINGS_ROUTE, public and without middleware, and lemmings.clear on the fixed path /clearDgP, which clears the caches and recreates the storage link. The second one answers 404 unless the request carries the secret from LEMMINGS_CLEAR_TOKEN, and after five wrong tokens in a minute an IP address gets that 404 for every request until the minute is over.

How do I clear the cache of a Laravel site without SSH?

With darvis/lemmings installed, set LEMMINGS_CLEAR_TOKEN in .env to a long random value, for example the output of php -r "echo bin2hex(random_bytes(24));", and request /clearDgP with that value in the X-Lemmings-Token header. The route runs cache:clear, route:clear, config:clear, view:clear, storage:link, event:clear and optimize:clear. ?token= works in a browser too, but then the token ends up in the access log.

Is the /clearDgP route of darvis/lemmings safe?

It is closed by default: without LEMMINGS_CLEAR_TOKEN it answers 404 for everybody. A wrong token gets the same 404 as a path that does not exist, and after five wrong tokens in a minute an IP address is refused until the minute is over. In 1.5.0 to 1.6.0 it was open to every visitor, and 1.7.0 showed rate limit headers on a refusal, so use the latest version. Whoever has the token can empty the cache and remove the cached routes and config, nothing more; replace the token when it may have leaked.

How do I switch the darvis/lemmings routes off?

The maintenance route is off until you set LEMMINGS_CLEAR_TOKEN. There is no config switch for the easter egg page. Define a route on the same path in your own routes/web.php, which replaces the package route, or add darvis/lemmings to extra.laravel.dont-discover in your composer.json so the provider is never loaded.

Can I change the picture or the text of the easter egg page?

Yes. Copy vendor/darvis/lemmings/src/Laravel/resources/views/lemmings.blade.php to resources/views/vendor/darvis-lemmings/lemmings.blade.php and edit the copy. Laravel uses your file instead of the one in the package. There is no publish tag for the view.

Which Laravel and PHP versions does darvis/lemmings support?

PHP 8.2 and higher with Laravel 11, 12 or 13. The test suite runs on every combination, on the lowest and the latest dependencies.