alternc / alternc-php-fpm Goto Github PK
View Code? Open in Web Editor NEWPHP 5.6/7.x/... FPM module for AlternC
License: GNU General Public License v2.0
PHP 5.6/7.x/... FPM module for AlternC
License: GNU General Public License v2.0
php7-fpm must do a check before to reload pool.
To each php-fpm service will must check it before to reload.
We have --test argument to check configuration
Note : reload act as a restart and any check is done.
Default vhost allow to read .php.in file
Could be interessting to prevent this and add some rules on apache as
<Files ".user.ini">
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</Files>
Hello
we have yet a project to manage our alternc account as posix
alternc-nss
Could be interessting to mutualize our work :)
As we isolate php by account, could be interresting to enable .php.ini file in local directory.
Could be done by enabling in each pool configuration :
php_value[user_ini.filename] = ".php.ini"
php_value[user_ini.cache_ttl] = 300
Hello
Could be interesting to backport AlternC/AlternC#340 to these template
Names for domaines_type in BDD are made whit a "-":
alternc-php-fpm/debian/postinst
Lines 10 to 15 in 392f45c
AlternC doesn't apreciate this:
https://github.com/AlternC/AlternC/blob/3c83f33935bdaf0f601b5d5ba096936cfcac0597/bureau/class/m_dom.php#L552
Now three choices:
ERROR 1136 (21S01) at line 2: Column count doesn't match value count at row 1
alternc-php-fpm/debian/postinst
Line 10 in ea3951c
Les requêtes d'insertion ont un champ trop peu:
#1136 - Column count doesn't match value count at row 1
Alternc-certbot qui ajoute cette colonne?
J'ai rajouté un 1 en dernière colonne pour avoir l'accès http et/ou https pour les vhost php-fpm
INSERT IGNORE INTO domaines_type VALUES ('php70-fpm','PHP 7.0 FPM','DIRECTORY','%SUB% IN A @@PUBLIC_IP@@','txt,defmx,defmx2,mx,mx2','ALL',0,0,0,0,0,1)
Commit #27c3b5e introduces PHP 8.0 support, but the dependencies are missing in debian/control.
I'll push a PR for that.
Hi,
you have to define the timezone of php8.2 now: php/php-src#11496
If the services are not running, /usr/lib/alternc/php7-fpm will fail with, for instance:
Reloading phpx.x-fpm configuration (via systemctl): phpx.x-fpm.servicephpx.x-fpm.service is not active, cannot reload.
failed!
An easy way is to add an OR in the reload call to ensure the service is started if not running:
passthru("/etc/init.d/php".$service."-fpm reload || /etc/init.d/php".$service."-fpm start");
Which works properly:
Reloading php8.2-fpm configuration (via systemctl): php8.2-fpm.servicephp8.2-fpm.service is not active, cannot reload.
failed!
Starting php8.2-fpm (via systemctl): php8.2-fpm.service.
Hi
For different reason, mysql could be down during php7-fpm execution.
In this case, all pool are deleted and break all sites hosted.
We must check mysql state and ran script only we are sure mysql state
C'est vraiment chouette !
Deux petites choses:
Hébergé localement /www/monsite.tld / Selection HTTP-S / Selection version PHP
ln: impossible de créer le lien symbolique '/etc/php7.3/apache2/conf.d/alternc.ini': Aucun fichier ou dossier de ce type
ln: impossible de créer le lien symbolique '/etc/php7.3/cli/conf.d/alternc.ini': Aucun fichier ou dossier de ce type
with master branch
Hi
On some case if an user try to override ErroDocument feature in its .htacess, As ErrorDocument 404 /404.php
Any wrong url with php extension will be catch by fpm and not errordocument, as we have set a <FilesMatch \.php$>
on Virtualhost. This directive as precedence about .htaccess
Looks natural to change this behavior and we have two options to change fpm template :
<FilesMatch \.php$>
<If \"-f %{REQUEST_FILENAME}\">
SetHandler "proxy:unix:/run/php/php7.3-user.sock|fcgi://localhost"
</If>
</FilesMatch>
ProxyErrorOverride On
ProxyErrorOverride looks easier, but I'm not sure about errodocument managed directly by an CMS.
If test looks more accurate but could impact performance.
To discuss before provide any global solution
Dans certains cas précis (instance Nextcloud par exemple) on devrait être en mesure de pourvoir modifier le pool PHP=FPM manuellement sans que sa config soit écrasée lors du prochain cron.
En gros faire en sorte que cela fonctionne comme les VHOST Nginx notamment quand le nom du fichier de config ne contient pas .alternc. mais .manual.
Hi
We can't enable mail service after a php-fpm activation.
mx type is not compatible with any php-fpm version, could break when site is hosting on root domain and not as www subdomain.
Quelques améliorations, corrections de bugs et une proposition de changement de présentation des options fpm dan l'interface Alternc.
Les propositions de changements liés à l'interface Alternc sont ici: AlternC/AlternC#351
Du côté du paquet alternc-php-fpm:
# %%fqdn%%
<Virtualhost *:443>
ServerName %%fqdn%%
AssignUserId #%%UID%% #%%GID%%
SetEnv LOGIN "%%UID%%-%%LOGIN%%"
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
KeepAlive Off
<FilesMatch \.php$>
SetHandler "proxy:unix:/run/php/php7.0-%%LOGIN%%.sock|fcgi://localhost"
</FilesMatch>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !/cgi-bin/
RewriteCond %{REQUEST_FILENAME} !/.well-known/acme-challenge/
RewriteRule ^/(.*)$ http://%%fqdn%%/$1 [R=301,L]
SSLEngine On
SSLCertificateFile %%CRT%%
SSLCertificateKeyFile %%KEY%%
%%CHAINLINE%%
</Virtualhost>
<VirtualHost *:80>
ServerName %%fqdn%%
DocumentRoot "%%document_root%%"
AssignUserId #%%UID%% #%%GID%%
SetEnv LOGIN "%%UID%%-%%LOGIN%%"
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
<FilesMatch \.php$>
SetHandler "proxy:unix:/run/php/php7.0-%%LOGIN%%.sock|fcgi://localhost"
</FilesMatch>
RewriteEngine on
RewriteCond %{QUERY_STRING} (%2d|-)d.*auto_prepend [NC]
RewriteRule .? - [F,L]
<Directory "%%document_root%%">
require all granted
Options +MultiViews -FollowSymLinks +SymLinksIfOwnerMatch
AllowOverride AuthConfig FileInfo Limit Options Indexes
php_admin_flag engine off
</Directory>
</VirtualHost>
# %%fqdn%%
<Virtualhost *:80>
ServerName %%fqdn%%
AssignUserId #%%UID%% #%%GID%%
SetEnv LOGIN "%%UID%%-%%LOGIN%%"
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
KeepAlive Off
<FilesMatch \.php$>
SetHandler "proxy:unix:/run/php/php7.0-%%LOGIN%%.sock|fcgi://localhost"
</FilesMatch>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !/cgi-bin/
RewriteCond %{REQUEST_FILENAME} !/.well-known/acme-challenge/
RewriteRule ^/(.*)$ https://%%fqdn%%/$1 [R=301,L]
</Virtualhost>
<VirtualHost *:443>
ServerName %%fqdn%%
DocumentRoot "%%document_root%%"
AssignUserId #%%UID%% #%%GID%%
SetEnv LOGIN "%%UID%%-%%LOGIN%%"
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
<FilesMatch \.php$>
SetHandler "proxy:unix:/run/php/php7.0-%%LOGIN%%.sock|fcgi://localhost"
</FilesMatch>
RewriteEngine on
RewriteCond %{QUERY_STRING} (%2d|-)d.*auto_prepend [NC]
RewriteRule .? - [F,L]
<Directory "%%document_root%%">
require all granted
Options +MultiViews -FollowSymLinks +SymLinksIfOwnerMatch
AllowOverride AuthConfig FileInfo Limit Options Indexes
php_admin_flag engine off
</Directory>
SSLEngine On
SSLCertificateFile %%CRT%%
SSLCertificateKeyFile %%KEY%%
%%CHAINLINE%%
</VirtualHost>
# %%fqdn%%
<VirtualHost *:80>
ServerName %%fqdn%%
DocumentRoot "%%document_root%%"
AssignUserId #%%UID%% #%%GID%%
SetEnv LOGIN "%%UID%%-%%LOGIN%%"
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
<FilesMatch \.php$>
SetHandler "proxy:unix:/run/php/php7.0-%%LOGIN%%.sock|fcgi://localhost"
</FilesMatch>
RewriteEngine on
RewriteCond %{QUERY_STRING} (%2d|-)d.*auto_prepend [NC]
RewriteRule .? - [F,L]
<Directory "%%document_root%%">
require all granted
Options +MultiViews -FollowSymLinks +SymLinksIfOwnerMatch
AllowOverride AuthConfig FileInfo Limit Options Indexes
php_admin_flag engine off
</Directory>
</VirtualHost>
<VirtualHost *:443>
ServerName %%fqdn%%
DocumentRoot "%%document_root%%"
AssignUserId #%%UID%% #%%GID%%
SetEnv LOGIN "%%UID%%-%%LOGIN%%"
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
<FilesMatch \.php$>
SetHandler "proxy:unix:/run/php/php7.0-%%LOGIN%%.sock|fcgi://localhost"
</FilesMatch>
RewriteEngine on
RewriteCond %{QUERY_STRING} (%2d|-)d.*auto_prepend [NC]
RewriteRule .? - [F,L]
<Directory "%%document_root%%">
require all granted
Options +MultiViews -FollowSymLinks +SymLinksIfOwnerMatch
AllowOverride AuthConfig FileInfo Limit Options Indexes
php_admin_flag engine off
</Directory>
SSLEngine On
SSLCertificateFile %%CRT%%
SSLCertificateKeyFile %%KEY%%
%%CHAINLINE%%
</VirtualHost>
# %%fqdn%%
<VirtualHost *:80>
ServerName %%fqdn%%
DocumentRoot "%%document_root%%"
AssignUserId #%%UID%% #%%GID%%
SetEnv LOGIN "%%UID%%-%%LOGIN%%"
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
<FilesMatch \.php$>
SetHandler "proxy:unix:/run/php/php7.0-%%LOGIN%%.sock|fcgi://localhost"
</FilesMatch>
RewriteEngine on
RewriteCond %{QUERY_STRING} (%2d|-)d.*auto_prepend [NC]
RewriteRule .? - [F,L]
<Directory "%%document_root%%">
require all granted
Options +MultiViews -FollowSymLinks +SymLinksIfOwnerMatch
AllowOverride AuthConfig FileInfo Limit Options Indexes
php_admin_flag engine off
</Directory>
</VirtualHost>
[%%LOGIN%%]
user = %%LOGIN%%
group = %%LOGIN%%
listen = /run/php/php7.0-%%LOGIN%%.sock
listen.owner = %%LOGIN%%
listen.group = %%LOGIN%%
pm = ondemand
pm.max_children = 10
pm.process_idle_timeout = 60s
pm.max_requests = 1000
catch_workers_output = yes
php_admin_value[open_basedir] = "%%account_root%%"
php_admin_value[upload_tmp_dir] = %%account_root%%/tmp
env[TMP] = %%account_root%%/tmp
env[TMPDIR] = %%account_root%%/tmp
env[TEMP] = %%account_root%%/tmp
php_admin_value[sys_temp_dir] = %%account_root%%/tmp
php_admin_value[sendmail_path] = '/usr/lib/alternc/sendmail "%%mail_account%%" '
php_admin_flag[mail.add_x_header] = on
J'ai changé les droits vers 0755.
Il existe peut-être une meilleure approche. Niveau sécurité, c'est peut-être pas bon de faire comme-ceci.
while ($db->next_record()) {
$version=substr($db->f("type"),3,1).".".substr($db->f("type"),4,1);
$user=$db->f("login");
$allpools[$version][]=$user;
if ($force || !is_file("/etc/php/".$version."/fpm/pool.d/".$user.".alternc.conf")) {
myecho("Creating php $version fpm pool for user $user");
$content=file_get_contents("/etc/alternc/templates/php/fpm-".$version);
$content=str_replace("%%LOGIN%%",$user,$content);
$account_root=ALTERNC_HTML . substr($user, 0, 1) . "/" . $user;
$content=str_replace("%%account_root%%",$account_root,$content);
$mail_account=$user."@".$L_FQDN;
$content=str_replace("%%mail_account%%",$mail_account,$content);
file_put_contents("/etc/php/".$version."/fpm/pool.d/".$user.".alternc.conf",$content);
$reload[$version]=$version;
}
}
// now delete pools we don't need anymore
foreach($allversions as $version) {
$d=opendir("/etc/php/$version/fpm/pool.d" );
while (($c=readdir($d))!==false) {
if (preg_match('#/?([^\.]*).alternc.conf$#',$c,$mat)) {
$user=$mat[1];
if (! isset($allpools[$version]) || !in_array($user,$allpools[$version])) {
echo("Deleting php $version fpm pool for user $user");
@unlink("/etc/php/".$version."/fpm/pool.d/".$user.".alternc.conf");
$reload[$version]=$version;
}
}
}
}
// now reloads php fpm versions
foreach($reload as $service) {
passthru("systemctl reload php".$service."-fpm");
}
Avec tout ça, on a maintenant un php-fpm + certbot fonctionnels et les utilisateurs peuvent choisir la version php qu'ils veulent, c'est vraiment chouette.
We can't code all php version on the world
dpkg provide a trigger sytem, then when we should be detect any php installation and enable relative vhost about this.
http://mpm-itk.sesse.net/ says :
MaxClientsVHost: A separate MaxClients for the vhost. This can be useful if, say, half of your vhosts depend on some NFS server; if the NFS server goes down, you do not want the children waiting forever on NFS to take the non-NFS-dependent hosts down. This can thus act as a safety measure, giving “server too busy” on the NFS-dependent vhosts while keeping the other ones happily running. (Of course, you could use it to simply keep one site from eating way too much resources, but there are probably better ways of doing that.)
AlternC used to have this in the vhost configuration file for apache (with a limit of 40)
we should add those to the FPM configuration templates for apache too
Hello
As seen during an update process, template are overrided as a simple cp is use to create template type apache
We don't want override them.
During this process only new file should be created.
If we delete an account, theirs php configuration remain.
We must delete them.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.