Home  ›  Open source  ›  OmnioPHP
Open source · PHP framework

The framework our client work runs on.

OmnioPHP is a lightweight, batteries included PHP 8.1+ framework. Twenty three components in one package, so there is no stitching a dozen libraries together before you can ship. It is the foundation under the apps we build, and it is yours to use too.

View on GitHub What's inside GPL-3.0 · PHP 8.1+
0
Components, from routing to queues to a full CLI.
0
Packages to assemble before you can ship.
L0
PHPStan static analysis level, enforced on every push.
8.1 to 8.3
PHP versions tested against a real MySQL 8 in CI.
What's inside

A whole stack, already assembled.

Most projects start by gluing a router to an ORM to a template engine to a queue, each from a different vendor. OmnioPHP ships twenty three components as one coherent package that already knows how to work together.

Routing and HTTP

4 components

A request finds its handler through a dynamic router and a clear middleware pipeline, with a client and rate limiting for talking outward.

Dynamic routerParameters, route groups, named routes, RESTful resource() giving 7 CRUD routes, plus route caching.
8 step middleware pipelineBuilt in aliases for auth, guest, csrf, cors, throttle, admin, json and log, with prebuilt web, api and admin groups.
HTTP clientMake outbound requests with a small, consistent interface.
Rate limitingThrottle by route or client to keep endpoints healthy under load.

Database and ORM

5 components

Talk to the database however the task wants, from a fluent builder up to full Active Record models.

PDO query builderFluent and always parameterized.
Active Record models$fillable, auto table names, CRUD, hasMany, belongsTo, belongsToMany, eager loading and soft deletes.
MigrationsVersion your schema and roll it forward.
Transactions and shardingWrap work safely and spread it across databases.

Container and runtime

4 components

The wiring that holds an application together, from dependency injection to background work.

PSR-11 DI containerAutowiring and service providers.
Event systemListeners, subscribers and wildcards.
Queue and jobsRetries and delayed execution on a database driver.
CacheRedis, Memcached, File and APCu drivers with a remember() pattern.

Views and content

4 components

Turn data into pages and payloads, in the languages your audience reads.

Blade like templatesLayout inheritance, compiled caching, escaped and raw output, custom directives.
Collections25+ chainable methods over arrays.
PaginationWith clean JSON output.
LocalizationShipped in en, es, fr and de.

Tooling and ops

3 components

The day to day workflow, from scaffolding code to reading what went wrong.

Console CLIGenerators and migrations: make:controller, make:model, migrate, queue:work, serve.
LoggingMulti level with rotation.
Error handling and validationCentralized handling with 120+ predefined error codes, and validation with 17+ rules.

Comms and security

3 components

Sign people in, reach them, and store their files, with the safe defaults switched on from the first request.

Auth and sessionsLogin, registration, remember me, and secure HTTPOnly SameSite cookies, with CSRF protection built in.
MailOver SMTP with templates and queue integration.
File storageA single abstraction over Local, S3 and FTP, with streaming.
Familiar on day one

Patterns you already know.

Active Record models, route groups with middleware, a fluent query builder, chainable collections and Blade style templates. If you have worked with a modern PHP framework, you will feel at home in minutes, not weeks.

How it works

One clear path for every request.

A request follows the same, readable route every time. Nothing hidden, nothing magic, so the next engineer can always trace exactly what happened.

01

index.php

Every request enters through one front controller.

02

Request

The HTTP request is wrapped in a Request object, with a Response ready to fill.

03

Router match

Matched to a route, with parameters resolved.

04

Middleware pipeline

Auth, CSRF, rate limits and more, in an 8 step pipeline.

05

Controller

Your code runs, with the container wiring dependencies.

06

Response

HTML or JSON goes back, cleanly and consistently.

Built to a standard

The boring parts, done properly.

A framework is only as good as the discipline behind it. These are not extras bolted on later, they are enforced on every commit.

Tested three ways

PHPUnit unit, feature and integration suites, run on every push so behaviour stays behaviour.

Statically analysed

PHPStan level 5 enforced in CI, so a whole class of bugs is caught before it can land.

Real CI matrix

Every change runs on PHP 8.1, 8.2 and 8.3 against a live MySQL 8 service, not a mock.

One consistent style

PSR-12 kept clean automatically with PHP-CS-Fixer, so the codebase reads as one hand.

Audited dependencies

A security dependency audit gate runs in CI, so a vulnerable package cannot slip in unnoticed.

Documented for humans

PHPDoc on every public API, plus long form guides and a step by step tutorial, so nobody is left guessing.

By the numbers

Depth where it counts.

Batteries included is a promise you can count. Here is what is in the box before you write a line.

0+
Validation rules ready to use.
0+
Predefined error codes.
0+
Chainable collection methods.
0
Cache drivers: Redis, Memcached, File, APCu.
0
Storage backends: Local, S3, FTP.
0
Shipped locales: en, es, fr, de.
0
Step middleware pipeline.
0
Resource routes per resource().
Secure by default

Safe on the first request, not the tenth.

The protections that get bolted on late, or forgotten, are switched on from the start. You would have to go out of your way to make a request unsafe.

CSRF on forms

Tokens issued and checked on state changing requests, wired into the csrf middleware.

Parameterized queries

Every query the builder and models run is bound, so input never becomes SQL.

Auto escaping templates

The {{ }} syntax escapes output by default, so rendering data is safe unless you opt out.

Rate limiting

Throttle abusive traffic per route or client before it reaches your code.

Secure sessions

Cookies set HTTPOnly, Secure over HTTPS and SameSite strict out of the box.

Password hashing

Credentials are hashed with modern algorithms, never stored in the clear.

Why we built our own

Own the foundation, own the outcome.

Building on a foundation we control means no vendor to wait on, no surprise breaking change, and no dependency we cannot audit. When we hand a system over, it stands on code you can read, patch and run without renting anything from anyone.

It is free under GPL-3.0, with no lock in. Fork it, extend it, keep it for as long as you want it.

No vendor to wait on

The roadmap is ours, so a fix ships when it needs to, not when someone else gets to it.

No surprise breaking change

Nothing shifts under a live system because a third party decided to move on.

Nothing we cannot audit

Every line is open and readable, so there is no black box quietly deciding how your app behaves.

Handover ready

Your team can read, patch and run it without us, and without renting anything from anyone.

Want us to build on it for you?

OmnioPHP is the foundation under the platforms and portals we build. If you have a system in mind, the next step is a short call with the person who would build it.