PHP to Proof / OperatorPUBLIC READ-ONLY

Deploy PHP to Proof to your Azure environment

DEPLOY TO YOUR OWN AZURE SUBSCRIPTION / CORE DEV TRAINING LAB

The simplest path is a local Node.js wizard using az login. No custom app registration, client secret, bundled Azure CLI, desktop installer or local web server is required. This website never receives your Azure credentials and never deploys using the hosted demo identity.

Download the deployment wizard ZIP / SHA-256 checksum / Open Azure Cloud Shell / Full GitHub project

1. Install/check the few prerequisites

Cloud Shell is an alternative if local installation is restricted. Open Bash, check the Node version and CLI components there, then run the same extracted wizard. Node24 is still required; Cloud Shell availability does not imply it is already the right version.

2. Download, verify and extract before running

Source package SHA-256:

99c84fb63950d91646076122061af1ca56bfd76e49c6bb7421f38adb67ff16c3

Do not pipe downloaded text into a shell. Review the source and verify the checksum first. The ZIP contains only 36 reviewed core deployment files, launchers and documentation, no credentials, live subscription binding, SDK dependency tree, private captures or container lab.

PowerShell / Windows

Invoke-WebRequest https://php2proof.ninjapaws.org/evidence/deploy/source.zip -OutFile php2proof-deploy.zip
(Get-FileHash .\php2proof-deploy.zip -Algorithm SHA256).Hash.ToLowerInvariant()
# Compare with the exact checksum above, then:
Expand-Archive -LiteralPath .\php2proof-deploy.zip -DestinationPath .\php2proof-deploy
Set-Location .\php2proof-deploy
node .\scripts\wizard.mjs --check
node .\scripts\wizard.mjs

Optional launcher: .\scripts\start.ps1. If enterprise execution policy blocks unsigned PowerShell scripts, use the direct Node command or an approved Cloud Shell/WSL environment; do not bypass your policy. Native Windows invokes the official Azure CLI's bundled Python module directly, never an interpolated cmd.exe command.

Bash / macOS / Linux / Cloud Shell

curl --fail --location --output php2proof-deploy.zip https://php2proof.ninjapaws.org/evidence/deploy/source.zip
shasum -a 256 php2proof-deploy.zip
# Compare with the exact checksum above, then extract to a new directory:
unzip php2proof-deploy.zip -d php2proof-deploy
cd php2proof-deploy
bash scripts/start.sh --check
bash scripts/start.sh

Linux may use sha256sum instead of shasum. The repository version is also available as node scripts/wizard.mjs; no npm installation is needed just to run the core wizard.

3. Answer the essential questions

  1. Use an already signed-in Azure CLI identity or approve browser/WAM/device-code sign-in. Passwords, MFA and tenant consent stay with Microsoft, not this app. Azure CLI authentication uses Microsoft's existing client; RBAC and tenant policy still apply.
  2. Choose an enabled subscription, region, unique suffix, new owned group,1–72-hour metadata lifetime and PHP8.4/8.5 branch.
  3. Explicitly choose paid Defender CSPM/Sentinel/analytics opt-ins, all defaulting off. Existing plans are never disabled. The demo's domain is never adopted.
  4. Save the nonsecret .azure/profiles/<suffix>.json file and select an action.

Normal Azure charges include Front Door Premium/WAF, Linux B1, logs/traffic and any opt-in service. No price or free-tier guarantee is invented. The1-GB/day log ingestion cap is not a budget. Expiry is metadata, not automatic deletion or stopped billing.

4. Install, test, repair and remove safely

The menu offers offline plan, doctor/what-if, new install, validate, five harmless GhostPaw requests, investigate, WAF Prevention, fixture removal, repair and uninstall. No simulation follows install automatically. Every write requires typing the exact group name; install refuses an existing group. What-if runs before deploy/repair/protection and the actual lifecycle rechecks it.

node scripts/wizard.mjs --profile .azure/profiles/<your-suffix>.json

Use that same profile for all later actions. Repair preserves original expiry, fixed state and Prevention; it does not reopen exposure. Uninstall deletes only the exact tagged main group after confirmation, never a subscription/tenant, shared Defender plan, DNS zone or separate advanced environment. Remove this run's CNAME before releasing its hostname.

5. What is and is not deployed

Included: the core public PHP story, guided walkthrough, real Front Door/WAF behavior, synthetic app fixtures, monitoring and explicitly selected optional components. Check actual runtime patch level and findings; a PHP branch or a fixed fixture is not a CVE fix. Historical evidence links go to the clearly labelled central reference recording, not invented logs for your new deployment.

Advanced/separate: the authenticated Node administrator portal, private Key Vault/Storage/networking, raw private evidence collection, tenant-wide XDR onboarding and the private container comparison. These are not silently installed by the simple wizard. Read docs/deployment.md and the full project's operator/README.md before those additional IAM, cost, credential and networking steps.

Reference walkthrough / Official-response mitigation/resolution guide. Download integrity and successful deployment still require your local checks and actual Azure readback.

Reviewed files in this distribution
DISCLAIMER.md
LICENSE
README.md
app/assets/style.css
app/conf.d/dojo.ini
app/health.php
app/index.php
app/lab.php
app/walkthrough.php
bicepconfig.json
config/dev.json
detections/correlation.kql
docs/container-lab.md
docs/deployment.md
infra/main.bicep
infra/modules/defender-cspm.bicep
infra/modules/sentinel.bicep
infra/resources.bicep
operator/README.md
package.json
scripts/dojo.mjs
scripts/lib/azure.mjs
scripts/lib/config.mjs
scripts/lib/safety.mjs
scripts/lib/windows-tools.cjs
scripts/start.ps1
scripts/start.sh
scripts/wizard.mjs
vendor/pawprint/LICENSE
vendor/pawprint/bicepconfig.json
vendor/pawprint/modules/front-door-waf/main.bicep
vendor/pawprint/modules/front-door-waf/profile.bicep
vendor/pawprint/modules/monitoring/main.bicep
vendor/pawprint/modules/php-web-app/main.bicep
vendor/pawprint/modules/types.bicep
vendor/pawprint/scripts/cloudflare-dns.mjs