ShipAnvil

ShipAnvil is a production-grade SaaS starter kit for Symfony, written by a developer with fifteen years of Symfony behind him and used to build his own products. It covers everything between composer install and your first paying customer, so you start at the interesting part: your own product.

What is inside:

• Auth you can ship as-is: email and password with mandatory verification, magic-link sign-in, TOTP 2FA with backup codes, password reset, login throttling and 30-day remember-me. • Billing on two rails: Stripe and Lemon Squeezy behind one PaymentProvider interface, with hosted checkout, customer portal, plan upgrades, dunning emails, and an offline sandbox so you can build before creating any account. • Webhooks that survive reality: signed, replay-protected, stored in an idempotent inbox and processed asynchronously through Messenger with retries. Out-of-order and duplicate deliveries are test cases, not incidents. • Teams and multi-tenancy: organizations with owner, admin and member roles, email invitations and an organization switcher. A Doctrine filter scopes every query to the current organization, with tests proving tenant isolation. • Admin with real metrics: a hand-rolled back office on the kit's own stack, with estimated MRR, churn and signups, read-only billing mirrors, and secure user impersonation with an audit log. • Claude AI, wired in: streaming chat over SSE and structured extraction via tool use, metered per organization with per-plan token quotas. An offline fake provider keeps development and CI key-free. • Factur-X ready: a framework-free EN 16931 engine with Factur-X (CII) and PDF/A-3 embedding, PEPPOL BIS (UBL) and business-rule validators, checked in CI by the official KoSIT and OpenPEPPOL validators. EU e-invoicing mandates, handled. • Transactional emails: six branded templates with inlined CSS, a one-file theme, asynchronous sending, a preview catalog and an SPF/DKIM/DMARC deliverability guide. • Security by default: nonce-based CSP and security headers, CSRF on every state change, per-IP rate limits on email-sending endpoints, hardened sessions and a documented threat model. • Deploy two ways: a multi-stage FrankenPHP Docker image or a step-by-step VPS recipe, plus an optional GitHub Actions deploy workflow. • Marketing site included: landing page, markdown blog, SEO and OpenGraph meta, sitemap and legal page skeletons. The official site itself runs on the kit.

Stack: Symfony 7.4 LTS, PHP 8.4 and 8.5, PostgreSQL, AssetMapper, Stimulus, Turbo and Tailwind CSS v4. No Node.js and no build step to babysit.

Quality: 392 tests and 1,735 assertions, including full billing lifecycles replayed from signed webhook fixtures, PHPStan at level max with zero errors, and a ready-made CI pipeline.