Commit b35d644bb3b5d307603ebb9cbea71bbc74580a68

Authored by Julien Malik
1 parent a128ef57f8
Exists in master

[fix] php settings do not leak

Showing 2 changed files with 3 additions and 2 deletions Inline Diff

1 ; Start a new pool named 'www'. 1 ; Start a new pool named 'www'.
2 ; the variable $pool can we used in any directive and will be replaced by the 2 ; the variable $pool can we used in any directive and will be replaced by the
3 ; pool name ('www' here) 3 ; pool name ('www' here)
4 [NAMETOCHANGE] 4 [NAMETOCHANGE]
5 5
6 ; Per pool prefix 6 ; Per pool prefix
7 ; It only applies on the following directives: 7 ; It only applies on the following directives:
8 ; - 'slowlog' 8 ; - 'slowlog'
9 ; - 'listen' (unixsocket) 9 ; - 'listen' (unixsocket)
10 ; - 'chroot' 10 ; - 'chroot'
11 ; - 'chdir' 11 ; - 'chdir'
12 ; - 'php_values' 12 ; - 'php_values'
13 ; - 'php_admin_values' 13 ; - 'php_admin_values'
14 ; When not set, the global prefix (or /usr) applies instead. 14 ; When not set, the global prefix (or /usr) applies instead.
15 ; Note: This directive can also be relative to the global prefix. 15 ; Note: This directive can also be relative to the global prefix.
16 ; Default Value: none 16 ; Default Value: none
17 ;prefix = /path/to/pools/$pool 17 ;prefix = /path/to/pools/$pool
18 18
19 ; The address on which to accept FastCGI requests. 19 ; The address on which to accept FastCGI requests.
20 ; Valid syntaxes are: 20 ; Valid syntaxes are:
21 ; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific address on 21 ; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific address on
22 ; a specific port; 22 ; a specific port;
23 ; 'port' - to listen on a TCP socket to all addresses on a 23 ; 'port' - to listen on a TCP socket to all addresses on a
24 ; specific port; 24 ; specific port;
25 ; '/path/to/unix/socket' - to listen on a unix socket. 25 ; '/path/to/unix/socket' - to listen on a unix socket.
26 ; Note: This value is mandatory. 26 ; Note: This value is mandatory.
27 listen = /var/run/php5-fpm-NAMETOCHANGE.sock 27 listen = /var/run/php5-fpm-NAMETOCHANGE.sock
28 28
29 ; Set listen(2) backlog. A value of '-1' means unlimited. 29 ; Set listen(2) backlog. A value of '-1' means unlimited.
30 ; Default Value: 128 (-1 on FreeBSD and OpenBSD) 30 ; Default Value: 128 (-1 on FreeBSD and OpenBSD)
31 ;listen.backlog = -1 31 ;listen.backlog = -1
32 32
33 ; List of ipv4 addresses of FastCGI clients which are allowed to connect. 33 ; List of ipv4 addresses of FastCGI clients which are allowed to connect.
34 ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original 34 ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
35 ; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address 35 ; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
36 ; must be separated by a comma. If this value is left blank, connections will be 36 ; must be separated by a comma. If this value is left blank, connections will be
37 ; accepted from any ip address. 37 ; accepted from any ip address.
38 ; Default Value: any 38 ; Default Value: any
39 ;listen.allowed_clients = 127.0.0.1 39 ;listen.allowed_clients = 127.0.0.1
40 40
41 ; Set permissions for unix socket, if one is used. In Linux, read/write 41 ; Set permissions for unix socket, if one is used. In Linux, read/write
42 ; permissions must be set in order to allow connections from a web server. Many 42 ; permissions must be set in order to allow connections from a web server. Many
43 ; BSD-derived systems allow connections regardless of permissions. 43 ; BSD-derived systems allow connections regardless of permissions.
44 ; Default Values: user and group are set as the running user 44 ; Default Values: user and group are set as the running user
45 ; mode is set to 0666 45 ; mode is set to 0666
46 listen.owner = www-data 46 listen.owner = www-data
47 listen.group = www-data 47 listen.group = www-data
48 listen.mode = 0600 48 listen.mode = 0600
49 49
50 ; Unix user/group of processes 50 ; Unix user/group of processes
51 ; Note: The user is mandatory. If the group is not set, the default user's group 51 ; Note: The user is mandatory. If the group is not set, the default user's group
52 ; will be used. 52 ; will be used.
53 user = NAMETOCHANGE 53 user = NAMETOCHANGE
54 group = NAMETOCHANGE 54 group = NAMETOCHANGE
55 55
56 ; Choose how the process manager will control the number of child processes. 56 ; Choose how the process manager will control the number of child processes.
57 ; Possible Values: 57 ; Possible Values:
58 ; static - a fixed number (pm.max_children) of child processes; 58 ; static - a fixed number (pm.max_children) of child processes;
59 ; dynamic - the number of child processes are set dynamically based on the 59 ; dynamic - the number of child processes are set dynamically based on the
60 ; following directives: 60 ; following directives:
61 ; pm.max_children - the maximum number of children that can 61 ; pm.max_children - the maximum number of children that can
62 ; be alive at the same time. 62 ; be alive at the same time.
63 ; pm.start_servers - the number of children created on startup. 63 ; pm.start_servers - the number of children created on startup.
64 ; pm.min_spare_servers - the minimum number of children in 'idle' 64 ; pm.min_spare_servers - the minimum number of children in 'idle'
65 ; state (waiting to process). If the number 65 ; state (waiting to process). If the number
66 ; of 'idle' processes is less than this 66 ; of 'idle' processes is less than this
67 ; number then some children will be created. 67 ; number then some children will be created.
68 ; pm.max_spare_servers - the maximum number of children in 'idle' 68 ; pm.max_spare_servers - the maximum number of children in 'idle'
69 ; state (waiting to process). If the number 69 ; state (waiting to process). If the number
70 ; of 'idle' processes is greater than this 70 ; of 'idle' processes is greater than this
71 ; number then some children will be killed. 71 ; number then some children will be killed.
72 ; Note: This value is mandatory. 72 ; Note: This value is mandatory.
73 pm = dynamic 73 pm = dynamic
74 74
75 ; The number of child processes to be created when pm is set to 'static' and the 75 ; The number of child processes to be created when pm is set to 'static' and the
76 ; maximum number of child processes to be created when pm is set to 'dynamic'. 76 ; maximum number of child processes to be created when pm is set to 'dynamic'.
77 ; This value sets the limit on the number of simultaneous requests that will be 77 ; This value sets the limit on the number of simultaneous requests that will be
78 ; served. Equivalent to the ApacheMaxClients directive with mpm_prefork. 78 ; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
79 ; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP 79 ; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
80 ; CGI. 80 ; CGI.
81 ; Note: Used when pm is set to either 'static' or 'dynamic' 81 ; Note: Used when pm is set to either 'static' or 'dynamic'
82 ; Note: This value is mandatory. 82 ; Note: This value is mandatory.
83 pm.max_children = 6 83 pm.max_children = 6
84 84
85 ; The number of child processes created on startup. 85 ; The number of child processes created on startup.
86 ; Note: Used only when pm is set to 'dynamic' 86 ; Note: Used only when pm is set to 'dynamic'
87 ; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2 87 ; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
88 pm.start_servers = 3 88 pm.start_servers = 3
89 89
90 ; The desired minimum number of idle server processes. 90 ; The desired minimum number of idle server processes.
91 ; Note: Used only when pm is set to 'dynamic' 91 ; Note: Used only when pm is set to 'dynamic'
92 ; Note: Mandatory when pm is set to 'dynamic' 92 ; Note: Mandatory when pm is set to 'dynamic'
93 pm.min_spare_servers = 3 93 pm.min_spare_servers = 3
94 94
95 ; The desired maximum number of idle server processes. 95 ; The desired maximum number of idle server processes.
96 ; Note: Used only when pm is set to 'dynamic' 96 ; Note: Used only when pm is set to 'dynamic'
97 ; Note: Mandatory when pm is set to 'dynamic' 97 ; Note: Mandatory when pm is set to 'dynamic'
98 pm.max_spare_servers = 5 98 pm.max_spare_servers = 5
99 99
100 ; The number of requests each child process should execute before respawning. 100 ; The number of requests each child process should execute before respawning.
101 ; This can be useful to work around memory leaks in 3rd party libraries. For 101 ; This can be useful to work around memory leaks in 3rd party libraries. For
102 ; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS. 102 ; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
103 ; Default Value: 0 103 ; Default Value: 0
104 pm.max_requests = 500 104 pm.max_requests = 500
105 105
106 ; The URI to view the FPM status page. If this value is not set, no URI will be 106 ; The URI to view the FPM status page. If this value is not set, no URI will be
107 ; recognized as a status page. By default, the status page shows the following 107 ; recognized as a status page. By default, the status page shows the following
108 ; information: 108 ; information:
109 ; accepted conn - the number of request accepted by the pool; 109 ; accepted conn - the number of request accepted by the pool;
110 ; pool - the name of the pool; 110 ; pool - the name of the pool;
111 ; process manager - static or dynamic; 111 ; process manager - static or dynamic;
112 ; idle processes - the number of idle processes; 112 ; idle processes - the number of idle processes;
113 ; active processes - the number of active processes; 113 ; active processes - the number of active processes;
114 ; total processes - the number of idle + active processes. 114 ; total processes - the number of idle + active processes.
115 ; max children reached - number of times, the process limit has been reached, 115 ; max children reached - number of times, the process limit has been reached,
116 ; when pm tries to start more children (works only for 116 ; when pm tries to start more children (works only for
117 ; pm 'dynamic') 117 ; pm 'dynamic')
118 ; The values of 'idle processes', 'active processes' and 'total processes' are 118 ; The values of 'idle processes', 'active processes' and 'total processes' are
119 ; updated each second. The value of 'accepted conn' is updated in real time. 119 ; updated each second. The value of 'accepted conn' is updated in real time.
120 ; Example output: 120 ; Example output:
121 ; accepted conn: 12073 121 ; accepted conn: 12073
122 ; pool: www 122 ; pool: www
123 ; process manager: static 123 ; process manager: static
124 ; idle processes: 35 124 ; idle processes: 35
125 ; active processes: 65 125 ; active processes: 65
126 ; total processes: 100 126 ; total processes: 100
127 ; max children reached: 1 127 ; max children reached: 1
128 ; By default the status page output is formatted as text/plain. Passing either 128 ; By default the status page output is formatted as text/plain. Passing either
129 ; 'html' or 'json' as a query string will return the corresponding output 129 ; 'html' or 'json' as a query string will return the corresponding output
130 ; syntax. Example: 130 ; syntax. Example:
131 ; http://www.foo.bar/status 131 ; http://www.foo.bar/status
132 ; http://www.foo.bar/status?json 132 ; http://www.foo.bar/status?json
133 ; http://www.foo.bar/status?html 133 ; http://www.foo.bar/status?html
134 ; Note: The value must start with a leading slash (/). The value can be 134 ; Note: The value must start with a leading slash (/). The value can be
135 ; anything, but it may not be a good idea to use the .php extension or it 135 ; anything, but it may not be a good idea to use the .php extension or it
136 ; may conflict with a real PHP file. 136 ; may conflict with a real PHP file.
137 ; Default Value: not set 137 ; Default Value: not set
138 pm.status_path = /fpm-status 138 pm.status_path = /fpm-status
139 139
140 ; The ping URI to call the monitoring page of FPM. If this value is not set, no 140 ; The ping URI to call the monitoring page of FPM. If this value is not set, no
141 ; URI will be recognized as a ping page. This could be used to test from outside 141 ; URI will be recognized as a ping page. This could be used to test from outside
142 ; that FPM is alive and responding, or to 142 ; that FPM is alive and responding, or to
143 ; - create a graph of FPM availability (rrd or such); 143 ; - create a graph of FPM availability (rrd or such);
144 ; - remove a server from a group if it is not responding (load balancing); 144 ; - remove a server from a group if it is not responding (load balancing);
145 ; - trigger alerts for the operating team (24/7). 145 ; - trigger alerts for the operating team (24/7).
146 ; Note: The value must start with a leading slash (/). The value can be 146 ; Note: The value must start with a leading slash (/). The value can be
147 ; anything, but it may not be a good idea to use the .php extension or it 147 ; anything, but it may not be a good idea to use the .php extension or it
148 ; may conflict with a real PHP file. 148 ; may conflict with a real PHP file.
149 ; Default Value: not set 149 ; Default Value: not set
150 ping.path = /ping 150 ping.path = /ping
151 151
152 ; This directive may be used to customize the response of a ping request. The 152 ; This directive may be used to customize the response of a ping request. The
153 ; response is formatted as text/plain with a 200 response code. 153 ; response is formatted as text/plain with a 200 response code.
154 ; Default Value: pong 154 ; Default Value: pong
155 ;ping.response = pong 155 ;ping.response = pong
156 156
157 ; The timeout for serving a single request after which the worker process will 157 ; The timeout for serving a single request after which the worker process will
158 ; be killed. This option should be used when the 'max_execution_time' ini option 158 ; be killed. This option should be used when the 'max_execution_time' ini option
159 ; does not stop script execution for some reason. A value of '0' means 'off'. 159 ; does not stop script execution for some reason. A value of '0' means 'off'.
160 ; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) 160 ; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
161 ; Default Value: 0 161 ; Default Value: 0
162 request_terminate_timeout = 120s 162 request_terminate_timeout = 120s
163 163
164 ; The timeout for serving a single request after which a PHP backtrace will be 164 ; The timeout for serving a single request after which a PHP backtrace will be
165 ; dumped to the 'slowlog' file. A value of '0s' means 'off'. 165 ; dumped to the 'slowlog' file. A value of '0s' means 'off'.
166 ; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) 166 ; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
167 ; Default Value: 0 167 ; Default Value: 0
168 request_slowlog_timeout = 5s 168 request_slowlog_timeout = 5s
169 169
170 ; The log file for slow requests 170 ; The log file for slow requests
171 ; Default Value: not set 171 ; Default Value: not set
172 ; Note: slowlog is mandatory if request_slowlog_timeout is set 172 ; Note: slowlog is mandatory if request_slowlog_timeout is set
173 slowlog = /var/log/nginx/NAMETOCHANGE.slow.log 173 slowlog = /var/log/nginx/NAMETOCHANGE.slow.log
174 174
175 ; Set open file descriptor rlimit. 175 ; Set open file descriptor rlimit.
176 ; Default Value: system defined value 176 ; Default Value: system defined value
177 rlimit_files = 4096 177 rlimit_files = 4096
178 178
179 ; Set max core size rlimit. 179 ; Set max core size rlimit.
180 ; Possible Values: 'unlimited' or an integer greater or equal to 0 180 ; Possible Values: 'unlimited' or an integer greater or equal to 0
181 ; Default Value: system defined value 181 ; Default Value: system defined value
182 rlimit_core = 0 182 rlimit_core = 0
183 183
184 ; Chroot to this directory at the start. This value must be defined as an 184 ; Chroot to this directory at the start. This value must be defined as an
185 ; absolute path. When this value is not set, chroot is not used. 185 ; absolute path. When this value is not set, chroot is not used.
186 ; Note: you can prefix with '$prefix' to chroot to the pool prefix or one 186 ; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
187 ; of its subdirectories. If the pool prefix is not set, the global prefix 187 ; of its subdirectories. If the pool prefix is not set, the global prefix
188 ; will be used instead. 188 ; will be used instead.
189 ; Note: chrooting is a great security feature and should be used whenever 189 ; Note: chrooting is a great security feature and should be used whenever
190 ; possible. However, all PHP paths will be relative to the chroot 190 ; possible. However, all PHP paths will be relative to the chroot
191 ; (error_log, sessions.save_path, ...). 191 ; (error_log, sessions.save_path, ...).
192 ; Default Value: not set 192 ; Default Value: not set
193 ;chroot = 193 ;chroot =
194 194
195 ; Chdir to this directory at the start. 195 ; Chdir to this directory at the start.
196 ; Note: relative path can be used. 196 ; Note: relative path can be used.
197 ; Default Value: current directory or / when chroot 197 ; Default Value: current directory or / when chroot
198 chdir = /var/www/NAMETOCHANGE 198 chdir = /var/www/NAMETOCHANGE
199 199
200 ; Redirect worker stdout and stderr into main error log. If not set, stdout and 200 ; Redirect worker stdout and stderr into main error log. If not set, stdout and
201 ; stderr will be redirected to /dev/null according to FastCGI specs. 201 ; stderr will be redirected to /dev/null according to FastCGI specs.
202 ; Note: on highloaded environement, this can cause some delay in the page 202 ; Note: on highloaded environement, this can cause some delay in the page
203 ; process time (several ms). 203 ; process time (several ms).
204 ; Default Value: no 204 ; Default Value: no
205 catch_workers_output = yes 205 catch_workers_output = yes
206 206
207 ; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from 207 ; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
208 ; the current environment. 208 ; the current environment.
209 ; Default Value: clean env 209 ; Default Value: clean env
210 ;env[HOSTNAME] = $HOSTNAME 210 ;env[HOSTNAME] = $HOSTNAME
211 ;env[PATH] = /usr/local/bin:/usr/bin:/bin 211 ;env[PATH] = /usr/local/bin:/usr/bin:/bin
212 ;env[TMP] = /tmp 212 ;env[TMP] = /tmp
213 ;env[TMPDIR] = /tmp 213 ;env[TMPDIR] = /tmp
214 ;env[TEMP] = /tmp 214 ;env[TEMP] = /tmp
215 215
216 ; Additional php.ini defines, specific to this pool of workers. These settings 216 ; Additional php.ini defines, specific to this pool of workers. These settings
217 ; overwrite the values previously defined in the php.ini. The directives are the 217 ; overwrite the values previously defined in the php.ini. The directives are the
218 ; same as the PHP SAPI: 218 ; same as the PHP SAPI:
219 ; php_value/php_flag - you can set classic ini defines which can 219 ; php_value/php_flag - you can set classic ini defines which can
220 ; be overwritten from PHP call 'ini_set'. 220 ; be overwritten from PHP call 'ini_set'.
221 ; php_admin_value/php_admin_flag - these directives won't be overwritten by 221 ; php_admin_value/php_admin_flag - these directives won't be overwritten by
222 ; PHP call 'ini_set' 222 ; PHP call 'ini_set'
223 ; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no. 223 ; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
224 224
225 ; Defining 'extension' will load the corresponding shared extension from 225 ; Defining 'extension' will load the corresponding shared extension from
226 ; extension_dir. Defining 'disable_functions' or 'disable_classes' will not 226 ; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
227 ; overwrite previously defined php.ini values, but will append the new value 227 ; overwrite previously defined php.ini values, but will append the new value
228 ; instead. 228 ; instead.
229 229
230 ; Note: path INI options can be relative and will be expanded with the prefix 230 ; Note: path INI options can be relative and will be expanded with the prefix
231 ; (pool, global or /usr) 231 ; (pool, global or /usr)
232 232
233 ; Default Value: nothing is defined by default except the values in php.ini and 233 ; Default Value: nothing is defined by default except the values in php.ini and
234 ; specified at startup with the -d argument 234 ; specified at startup with the -d argument
235 ;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com 235 ;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
236 ;php_flag[display_errors] = off 236 ;php_flag[display_errors] = off
237 ;php_admin_value[error_log] = /var/log/fpm-php.www.log 237 ;php_admin_value[error_log] = /var/log/fpm-php.www.log
238 ;php_admin_flag[log_errors] = on 238 ;php_admin_flag[log_errors] = on
239 ;php_admin_value[memory_limit] = 32M 239 ;php_admin_value[memory_limit] = 32M
240
241 php_value[upload_max_filesize] = 10G
242 php_value[post_max_size] = 10G
240 243
conf/php-fpm.ini
1 upload_max_filesize=10G File was deleted
2 post_max_size=10G
3 1 upload_max_filesize=10G