Darwvin Encoder setup guide

What you need

Source

PHP 8.0 or newer

Target servers

Linux with the Darwvin loader extension installed for the running PHP version

Hosting

Servers where a PHP extension can be installed — most shared hosting plans do not allow this

Keys

A per-customer key pair; the private key is installed on the customer's server, the public key stays with the encoder

Online checks

Optional. When enabled the target server needs outbound HTTPS to your license server

Installation

1. 1. Install the loader on the target server

   Copy the loader for the customer's PHP version into the extension directory, point it at the customer's private key and restart PHP-FPM. Protected files then run like ordinary PHP — your application code does not change.

   extension = darwvin.so
   darwvin.customer_privkey = /etc/darwvin/customer_priv.pem

2. 2. Generate a key pair per customer

   Each customer gets their own key pair, so a build made for one customer cannot be unlocked with another customer's key. The signing key that proves a build came from you stays private to your team.

3. 3. Collect the server fingerprint (optional)

   If you want a build to run on one specific machine, the customer runs a one-line script that prints a server fingerprint, and you pass it when encoding.

4. 4. Encode the project with the locks you need

   Encoding walks the source tree and writes protected files that keep your folder structure. Locks are embedded in each build: allowed domains, allowed IPs or CIDR ranges, a machine fingerprint, an install path prefix, an activation date, an expiry date, and optionally an online license check with an offline grace period.

   --domains          example.com,*.example.com
   --ips              203.0.113.5,10.0.0.0/8
   --machine-id       <server fingerprint>
   --allowed-paths    /var/www/myapp
   --not-before       2026-06-01
   --expire           2027-12-31
   --license-url      https://licenses.example.com/v1/check
   --offline-grace-sec 604800

5. 5. Deliver and verify

   Ship the protected directory to the customer along with their private key. A quick check on their server confirms the loader is active before anything goes live.

   php -m | grep darwvin

Security notes

• Payloads are encrypted with AES-256-GCM and the session key is wrapped per customer with RSA-4096.
• Each build carries an Ed25519-signed manifest, so tampered packages are rejected.
• The loader performs anti-debug and anti-hook checks and refuses to run when another encoder or debugger extension hooks compilation.
• No protection is absolute: this raises the cost of copying far above obfuscation, it does not make code mathematically unrecoverable.

If something does not work

"customer_privkey is not set"

The php.ini entry pointing at the customer's private key is missing on that server.

"Cannot decrypt — wrong private key"

The installed private key does not match the public key the build was encoded with. Re-check which customer the build was made for.

"Machine ID mismatch" or "Domain not allowed"

The server or domain changed. Re-encode with the new fingerprint or domain, or issue the build without that lock.

"License has expired"

The expiry date embedded in the build has passed. Issue a new build with a later date — a useful lever when an invoice is outstanding.

We agree the delivery model with each customer: encoding as a managed service, or a self-hosted setup when source must never leave your infrastructure. Loader builds are provided for the PHP versions your customers run.