Vortos
A modern PHP framework built for CQRS, event-driven architecture, and high-throughput applications.
Vortos
Vortos is a PHP framework built around CQRS, domain-driven design, and event-driven architecture. It ships as a set of independent packages — use only what you need.
Get Started
Modules
Foundation
Runner, Container auto-discovery, PackageInterface, and container caching.
HTTP
Attribute-based routing, controllers, event subscribers, and error handling.
Domain
Aggregates, identities, domain events, value objects, and collections.
CQRS
Command and query buses with compile-time discovery and idempotency.
Persistence
DBAL write repositories, MongoDB read repositories, and optimistic locking.
Messaging
Kafka-backed event bus, outbox pattern, retry, and dead letter queues.
Cache
PSR-16 cache with tag-based invalidation — Redis, InMemory, ArrayAdapter.
Auth
JWT authentication, route protection, rate limiting, 2FA, and quotas.
Authorization
Policy-based authorization, role hierarchy, scoped and temporal permissions.
Logger
Monolog PSR-3 logger — LineFormatter in dev, JSON to stderr in production.
Tracing
OpenTelemetry-compatible distributed tracing with sampling and per-module disable.
Docker
Publish production-ready Docker files for FrankenPHP or PHP-FPM.
Deployment & Operations
Ops Kit
The swappable-driver pattern every operations package below is built from — ports, drivers, capabilities, registries.
Deploy
Fail-closed deploy engine — content-hashed plans, blue-green/canary strategies, phase-gated migrations, zero-standing-secrets credentials.
Secrets
Redact-by-construction secret values, envelope encryption, off-host key custody, two-phase rotation.
Release
Immutable build manifests, schema fingerprinting, the rollback invariant, and coordinated semver tagging.
Pipeline
Generate CI/CD workflows from a provider-agnostic model — pinned actions, native ARM64, OIDC.
Backup
Streaming encrypted backups, GFS retention with hard safety floors, restore drills, and DR runbooks.
Alerts
Dedupe, flap damping, escalation with quiet hours and on-call rotation, SSRF-hardened webhooks.
Analytics
Privacy-by-default product analytics — consent-gated, allowlisted, PII-redacted independently.
Infrastructure as Code
Export real infrastructure to deterministic Terraform JSON, governed by a policy-gated, audited lifecycle.