PHPackages                             thelia/web-scheduler-module - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [CLI & Console](/categories/cli)
4. /
5. thelia/web-scheduler-module

ActiveThelia-module[CLI & Console](/categories/cli)

thelia/web-scheduler-module
===========================

Expose Symfony Console commands as HMAC-signed HTTP triggers, adaptive to the hosting capabilities (CLI fork, FastCGI finish, synchronous).

v1.1.4(1mo ago)023LGPL-3.0-or-laterPHPPHP ^8.3CI passing

Since Apr 20Pushed 2w agoCompare

[ Source](https://github.com/thelia-modules/WebScheduler)[ Packagist](https://packagist.org/packages/thelia/web-scheduler-module)[ RSS](/packages/thelia-web-scheduler-module/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (2)Dependencies (3)Versions (7)Used By (0)

WebScheduler — Thelia module
============================

[](#webscheduler--thelia-module)

Trigger Symfony Console commands from signed HTTP URLs, with an execution strategy that adapts to the hosting's capabilities.

Designed for shared hostings (Infomaniak, OVH mutualisé, …) that only offer web-based scheduled tasks and no real cron.

How it works
------------

[](#how-it-works)

The hosting's scheduler hits a signed URL on your Thelia site. The module authenticates the request (HMAC-SHA256 signature with a short time window), picks the best available execution strategy and runs the configured command.

Three strategies are available. The `auto` strategy (default) picks the best one supported by the hosting — detected and cached at runtime.

StrategyRequiresBehaviour`cli_fork``proc_open` + a PHP CLI binarySpawns `nohup php Thelia  &` detached from the HTTP worker. HTTP responds in milliseconds. Best choice for long-running syncs.`fastcgi_finish``fastcgi_finish_request`Responds to the client, flushes the PHP-FPM buffer, then runs the command in-process (via an external process if `proc_open` is allowed, in-process Thelia Application otherwise).`sync`noneRuns the command in the HTTP request and returns the output. Limited by PHP's `max_execution_time`. Last-resort fallback.Features
--------

[](#features)

- Static HMAC-signed trigger URLs — paste once in your hosting's cron panel, never rotate it
- Per-task opaque slug and secret (secret revealed once at creation); rotating the secret invalidates the URL
- Per-task IP allowlist (CIDR), minimum interval rate limit, maximum runtime
- Concurrency lock (`symfony/lock`, file-based) — overlapping calls are skipped
- Execution history with status, exit code, strategy used and command output
- Back-office diagnostic panel — shows which capabilities the hosting provides and which strategies are supported
- Back-office CRUD for tasks, manual "trigger now" button, secret regeneration
- Any Symfony Console command registered in Thelia is schedulable (no need to write module-side glue)

Install
-------

[](#install)

```
composer require thelia/web-scheduler-module
```

Activate the module in the back-office → Modules.

Quick start
-----------

[](#quick-start)

1. Back-office → Tools → **Web Scheduler**
2. **Create a task** — pick a command (auto-completed from your registered Symfony commands), set optional arguments, choose `auto` strategy.
3. On save, the secret is revealed **once** — store it if you ever need to sign URLs outside the module.
4. Copy the **Trigger URL** from the task list (or from the task edit page).
5. Paste that URL into your hosting's scheduled-tasks panel.

### Infomaniak example

[](#infomaniak-example)

On Infomaniak's "Planifier une tâche" panel:

- URL: paste the full trigger URL (including `?ts=...&sig=...`)
- Password: leave unchecked — the HMAC signature replaces URL basic-auth

Paste the URL once and let Infomaniak call it on its schedule. The URL is stable — there is no timestamp or expiry. If the URL ever leaks and you want to invalidate it, hit **Regenerate secret** in the task form: the slug stays the same, the signature changes, every previously-copied URL stops working.

Security model
--------------

[](#security-model)

- Each task has a unique 32-hex opaque slug embedded in the URL path.
- The URL is signed: `sig = HMAC-SHA256(slug, secret)`. The signature is static (no timestamp), so the URL is stable for web-cron usage.
- Signature comparison is timing-safe (`hash_equals`).
- Command arguments are **frozen** per task — nothing from the query string influences the executed command. No RCE surface.
- Optional per-task IP allowlist (CIDR, one entry per line) — the strongest defence-in-depth layer if the URL leaks.
- Optional per-task rate limit (`min_interval_seconds`).
- Rejected requests always respond `202 Accepted` with a neutral body, to avoid leaking task existence.
- To invalidate a leaked URL: **Regenerate secret** in the task form.

Dev notes
---------

[](#dev-notes)

- Namespace: `WebScheduler\*` (PSR-4)
- Requires PHP 8.3+, Thelia 2.6+, Symfony 6.4 or 7.x
- Strategies are services tagged `webscheduler.execution_strategy`, loaded into `StrategyResolver` via `#[AutowireIterator]`
- Lock store: `FlockStore` rooted at `THELIA_CACHE_DIR/webscheduler_locks`
- Command capture: output is truncated to 64 KiB per execution

License
-------

[](#license)

LGPL-3.0-or-later

###  Health Score

43

—

FairBetter than 89% of packages

Maintenance94

Actively maintained with recent releases

Popularity8

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity53

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

6

Last Release

50d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/2196919?v=4)[thelia](/maintainers/thelia)[@thelia](https://github.com/thelia)

---

Top Contributors

[![anoziere](https://avatars.githubusercontent.com/u/118798868?v=4)](https://github.com/anoziere "anoziere (7 commits)")

---

Tags

schedulerTheliacronThelia-moduleinfomaniakshared hostingweb-cron

### Embed Badge

![Health badge](/badges/thelia-web-scheduler-module/health.svg)

```
[![Health](https://phpackages.com/badges/thelia-web-scheduler-module/health.svg)](https://phpackages.com/packages/thelia-web-scheduler-module)
```

###  Alternatives

[crunzphp/crunz

Schedule your tasks right from the code.

2312.3M7](/packages/crunzphp-crunz)[jmose/command-scheduler-bundle

This Symfony bundle will allow you to schedule all your commands just like UNIX crontab

3301.4M1](/packages/jmose-command-scheduler-bundle)[shopware/core

Shopware platform is the core for all Shopware ecommerce products.

585.4M506](/packages/shopware-core)[guikingone/scheduler-bundle

A Symfony bundle that allows to schedule and create repetitive tasks

115220.2k](/packages/guikingone-scheduler-bundle)[dukecity/command-scheduler-bundle

This Symfony bundle will allow you to schedule all your commands just like UNIX crontab

26367.7k6](/packages/dukecity-command-scheduler-bundle)[open-dxp/opendxp

Content & Product Management Framework (CMS/PIM)

9017.2k55](/packages/open-dxp-opendxp)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)