Update to 2021-12-01 19:13

roles/akeneo_pim/README.md

@@ -0,0 +1,34 @@
+# Akeneo PIM
+
+[Akeneo PIM](https://www.akeneo.com/) A Product Information Management (PIM) solution is aimed to centralize all the marketing data
+
+## Settings
+
+Akeneo requires a few settings at the host level. Something like this
+```
+# This should be defined on the server which will host the database
+# It's not mandatory to be on the same host as the PIM itself. But the important thing is that AKeneo PIM
+# requires MySQL. It'll not work with MariaDB
+mysql_engine: mysql
+
+# Prevent an error when checking system requirements. Note that this is only for the CLI
+# as web access will use it's own FPM pool
+php_conf_memory_limit: 512M
+
+# We need Elasticsearch 7. Same foir MySQL, it's not required to be on the same host
+es_major_version: 7
+
+# Define a vhost to expose the PIM. Note that this is a minimal example
+# And you will most likely want to put a reverse proxy (look at the nginx role) in front of it
+httpd_ansible_vhosts:
+  - name: pim.example.org
+    document_root: /opt/pim_1/app/public
+
+```
+
+## Installation
+Installation should be fully automatic
+
+## Upgrade
+Major upgrades might require some manual steps, as detailed on https://docs.akeneo.com/5.0/migrate_pim/upgrade_major_version.html
+

roles/akeneo_pim/defaults/main.yml

@@ -0,0 +1,36 @@
+---
+
+# Version to deploy
+pim_version: 5.0.43
+# User under which the PIM will run
+pim_user: php-pim_{{ pim_id }}
+# If you install several pim instance on the same host, you should change the ID for each of them
+pim_id: 1
+# Root directory of the installation
+pim_root_dir: /opt/pim_{{ pim_id }}
+# Should anisble handle upgrades or just initial install
+pim_manage_upgrade: True
+
+# PHP version to use
+pim_php_version: 74
+
+# Database settings
+pim_db_server: "{{ mysql_server | default('localhost') }}"
+pim_db_port: 3306
+pim_db_name: akeneopim_{{ pim_id }}
+pim_db_user: akeneopim_{{ pim_id }}
+# A random pass will be generated and stored in {{ pim_root_dir }}/meta/ansible_dbpass if not defined
+# pim_db_pass: S3cr3t.
+
+# A secret used to sign cookies. A random one will be generated and stored in {{ pim_root_dir }}/meta/ansible_secret if not defined
+# pim_secret: ChangeMe
+
+# Elasticsearch host
+pim_es_server: localhost:9200
+
+# Public URL used to reach AKeneo. Note that you'll have to define a vhost for Akeneo PIM to be reachable
+pim_public_url: http://pim.{{ inventory_hostname }}/
+
+# Define the initial admin password. If not defined, a random one will be generated ans stored under {{ pim_root_dir }}/meta/ansible_admin_pass
+# Note that this is only used on initial install, and will be ignored for upgrades
+# pim_admin_pass: p@ssw0rd

roles/akeneo_pim/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+
+- name: restart akeneo-pim
+  service: name={{ item }} state=restarted
+  loop:
+    - akeneo-pim_{{ pim_id }}-jobs
+    - akeneo-pim_{{ pim_id }}-events-api

roles/akeneo_pim/meta/main.yml

@@ -0,0 +1,12 @@
+---
+
+allow_duplicates: True
+dependencies:
+  - role: mkdir
+  - role: composer
+  - role: mysql_server
+    when: pim_db_server in ['localhost','127.0.0.1']
+  - role: httpd_php
+  - role: nodejs
+  - role: elasticsearch
+    when: pim_es_server | regex_replace('(.*):\d+','\\1') in ['localhost','127.0.0.1']

roles/akeneo_pim/tasks/archive_post.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Compress previous version
+  command: tar cf {{ pim_root_dir }}/archives/{{ pim_current_version }}.tar.zst ./ --use-compress-program=zstd
+  args:
+    chdir: "{{ pim_root_dir }}/archives/{{ pim_current_version }}"
+    warn: False
+  environment:
+    ZSTD_CLEVEL: 10
+  tags: pim

roles/akeneo_pim/tasks/archive_pre.yml

@@ -0,0 +1,40 @@
+---
+
+- name: Create the archive dir
+  file: path={{ pim_root_dir }}/archives/{{ pim_current_version }} state=directory
+  tags: pim
+
+- name: Stop jobs and event API services
+  service: name={{ item }} state=stopped
+  loop:
+    - akeneo-pim_{{ pim_id }}-jobs
+    - akeneo-pim_{{ pim_id }}-events-api
+  tags: pim
+
+- name: Disable cron jobs
+  file: path=/etc/cron.d/akeneopim_{{ pim_id }} state=absent
+  tags: pim
+
+- name: Archive current version
+  synchronize:
+    src: "{{ pim_root_dir }}/app"
+    dest: "{{ pim_root_dir }}/archives/{{ pim_current_version }}/"
+    compress: False
+    delete: True
+  delegate_to: "{{ inventory_hostname }}"
+  tags: pim
+
+- name: Dump the database
+  mysql_db:
+    state: dump
+    name: "{{ pim_db_name }}"
+    target: "{{ pim_root_dir }}/archives/{{ pim_current_version }}/{{ pim_db_name }}.sql.xz"
+    login_host: "{{ pim_db_server }}"
+    login_port: "{{ pim_db_port }}"
+    login_user: "{{ pim_db_user }}"
+    login_password: "{{ pim_db_pass }}"
+    quick: True
+    single_transaction: True
+  environment:
+    XZ_OPT: -T0
+  tags: pim

roles/akeneo_pim/tasks/cleanup.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Remove tmp and obsolete files
+  file: path={{ item }} state=absent
+  loop:
+    - "{{ pim_root_dir }}/archives/{{ pim_current_version }}"
+  tags: pim
+

roles/akeneo_pim/tasks/conf.yml

@@ -0,0 +1,117 @@
+---
+
+- name: Deploy configuration
+  template: src=env.j2 dest={{ pim_root_dir }}/app/.env.local group={{ pim_user }} mode=640
+  tags: pim
+
+- import_tasks: ../includes/webapps_webconf.yml
+  vars:
+    - app_id: pim_{{ pim_id }}
+    - php_version: "{{ pim_php_version }}"
+    - php_fpm_pool: "{{ pim_php_fpm_pool | default('') }}"
+  tags: pim
+
+- name: Build and update frontend components
+  command: scl enable php{{ pim_php_version }} -- make upgrade-front
+  args:
+    chdir: "{{ pim_root_dir }}/app"
+  environment:
+    NO_DOCKER: true
+    APP_ENV: prod
+  become_user: "{{ pim_user }}"
+  when: pim_install_mode != 'none'
+  tags: pim
+
+- name: Initialize the database
+  command: scl enable php{{ pim_php_version }} -- make database O="--catalog vendor/akeneo/pim-community-dev/src/Akeneo/Platform/Bundle/InstallerBundle/Resources/fixtures/minimal"
+  args:
+    chdir: "{{ pim_root_dir }}/app"
+  environment:
+    NO_DOCKER: true
+    APP_ENV: prod
+  become_user: "{{ pim_user }}"
+  when: pim_install_mode == 'install'
+  tags: pim
+
+- name: Upgrade database
+  command: /bin/php{{ pim_php_version }} {{ pim_root_dir }}/app/bin/console doctrine:migrations:migrate --no-interaction
+  args:
+    chdir: "{{ pim_root_dir }}/app"
+  become_user: "{{ pim_user }}"
+  when: pim_install_mode == 'upgrade'
+  tags: pim
+
+- name: Deploy permission script
+  template: src=perms.sh.j2 dest={{ pim_root_dir }}/perms.sh mode=755
+  register: pim_perm_script
+  tags: pim
+
+- name: Apply permissions
+  command: "{{ pim_root_dir }}/perms.sh"
+  when: pim_perm_script.changed or pim_install_mode != 'none'
+  tags: pim
+
+- name: Setup cron jobs
+  cron:
+    cron_file: akeneopim_{{ pim_id }}
+    user: "{{ pim_user }}"
+    name: "{{ item.name }}"
+    job: /bin/php{{ pim_php_version }} {{ pim_root_dir }}/app/bin/console {{ item.job }}
+    minute: "{{ item.minute | default('*') }}"
+    hour: "{{ item.hour | default('*') }}"
+    weekday: "{{ item.weekday | default('*') }}"
+    day: "{{ item.day | default('*') }}"
+    month: "{{ item.month | default('*') }}"
+  loop:
+    - name: refresh
+      job: pim:versioning:refresh
+      minute: 30
+      hour: 1
+    - name: purge
+      job: pim:versioning:purge --more-than-days 90 --no-interaction --force
+      minute: 30
+      hour: 2
+    - name: update-data
+      job: akeneo:connectivity-audit:update-data
+      minute: 1
+    - name: purge-errors
+      job: akeneo:connectivity-connection:purge-error
+      minute: 10
+    - name: purge-job-execution
+      job: akeneo:batch:purge-job-execution
+      minute: 20
+      hour: 0
+      day: 1
+    - name: purge-error-count
+      job: akeneo:connectivity-audit:purge-error-count
+      minute: 40
+      hour: 0
+    - name: aggregate
+      job: pim:volume:aggregate
+      minute: 30
+      hour: 4
+    - name: schedule-periodic-tasks
+      job: pim:data-quality-insights:schedule-periodic-tasks
+      minute: 15
+      hour: 0
+    - name: prepare-evaluations
+      job: pim:data-quality-insights:prepare-evaluations
+      minute: '*/10'
+    - name: evaluations
+      job: pim:data-quality-insights:evaluations
+      minute: '*/30'
+    - name: purge-messages
+      job: akeneo:messenger:doctrine:purge-messages messenger_messages default
+      minute: 0
+      hour: '*/2'
+  tags: pim
+
+- name: Create the admin user
+  command: /bin/php{{ pim_php_version }} {{ pim_root_dir }}/app/bin/console pim:user:create --admin -n -- admin {{ pim_admin_pass | quote }} admin@example.org Admin Admin fr_FR
+  when: pim_install_mode == 'install'
+  become_user: "{{ pim_user }}"
+  tags: pim
+
+- name: Deploy logrotate conf
+  template: src=logrotate.conf.j2 dest=/etc/logrotate.d/akeneopim_{{ pim_id }}
+  tags: pim

roles/akeneo_pim/tasks/directories.yml

@@ -0,0 +1,30 @@
+---
+
+- name: Create nedded directories
+  file: path={{ item.dir }} state=directory owner={{ item.owner | default(omit) }} group={{ item.group | default(omit) }} mode={{ item.mode | default(omit) }}
+  loop:
+    - dir: "{{ pim_root_dir }}/meta"
+      mode: 700
+    - dir: "{{ pim_root_dir }}/archives"
+      mode: 700
+    - dir: "{{ pim_root_dir }}/backup"
+      mode: 700
+    - dir: "{{ pim_root_dir }}/data"
+      owner: "{{ pim_user }}"
+      mode: 700
+    - dir: "{{ pim_root_dir }}/app"
+      owner: "{{ pim_user }}"
+      group: "{{ pim_user }}"
+    - dir: "{{ pim_root_dir }}/tmp"
+      owner: "{{ pim_user }}"
+      group: "{{ pim_user }}"
+      mode: 700
+    - dir: "{{ pim_root_dir }}/sessions"
+      owner: "{{ pim_user }}"
+      group: "{{ pim_user }}"
+      mode: 700
+  tags: pim
+
+- name: Link the var directory to the data dir
+  file: src={{ pim_root_dir }}/data dest={{ pim_root_dir }}/app/var state=link
+  tags: pim

roles/akeneo_pim/tasks/facts.yml

@@ -0,0 +1,38 @@
+---
+
+# Detect installed version (if any)
+- block:
+    - import_tasks: ../includes/webapps_set_install_mode.yml
+      vars:
+        - root_dir: "{{ pim_root_dir }}"
+        - version: "{{ pim_version }}"
+    - set_fact: pim_install_mode={{ (install_mode == 'upgrade' and not pim_manage_upgrade) | ternary('none',install_mode) }}
+    - set_fact: pim_current_version={{ current_version | default('') }}
+  tags: pim
+
+# Create a random pass for the DB if needed
+- block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ pim_root_dir }}/meta/ansible_dbpass"
+    - set_fact: pim_db_pass={{ rand_pass }}
+  when: pim_db_pass is not defined
+  tags: pim
+
+# Create a random secret if needed
+- block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ pim_root_dir }}/meta/ansible_secret"
+    - set_fact: pim_secret={{ rand_pass }}
+  when: pim_secret is not defined
+  tags: pim
+
+# Create a random admin pass if needed
+- block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ pim_root_dir }}/meta/ansible_admin_pass"
+    - set_fact: pim_admin_pass={{ rand_pass }}
+  when: pim_admin_pass is not defined
+  tags: pim

roles/akeneo_pim/tasks/install.yml

@@ -0,0 +1,95 @@
+---
+
+- name: Install needed tools
+  package:
+    name:
+      - make
+      - ghostscript
+      - aspell
+  tags: pim
+
+- when: pim_install_mode == 'upgrade'
+  block:
+    - name: Wipe install on upgrades
+      file: path={{ pim_root_dir }}/app state=absent
+
+    - name: Create app subdir
+      file: path={{ pim_root_dir }}/app state=directory owner={{ pim_user }} group={{ pim_user }}
+
+    - name: Link the var directory 
+      file: src={{ pim_root_dir }}/data dest={{ pim_root_dir }}/app/var state=link
+
+  tags: pim
+
+- when: pim_install_mode != 'none'
+  block:
+    - name: Deploy composer.json
+      template: src=composer.json.j2 dest={{ pim_root_dir }}/app/composer.json owner={{ pim_user }}
+      become_user: root
+
+    - name: Install Akeneo with Composer
+      composer:
+        working_dir: "{{ pim_root_dir }}/app"
+        executable: /bin/php{{ pim_php_version }}
+        command: install
+      become_user: "{{ pim_user }}"
+
+    - name: Install yarn globaly
+      npm:
+        name: yarn
+        path: "{{ pim_root_dir }}/app"
+        global: True
+        state: latest
+
+    - name: Install typescript globaly
+      npm:
+        name: typescript
+        path: "{{ pim_root_dir }}/app"
+        global: True
+        state: latest
+
+  tags: pim
+
+  # the PIM makefile has /usr/local/bin/composer hardcoded
+- name: Link composer in /usr/local/bin
+  file: src=/bin/composer dest=/usr/local/bin/composer state=link
+  tags: pim
+
+- import_tasks: ../includes/webapps_create_mysql_db.yml
+  vars:
+    - db_name: "{{ pim_db_name }}"
+    - db_user: "{{ pim_db_user }}"
+    - db_server: "{{ pim_db_server }}"
+    - db_pass: "{{ pim_db_pass }}"
+  tags: pim
+
+- name: Set correct SELinux context
+  sefcontext:
+    target: "{{ pim_root_dir }}(/.*)?"
+    setype: httpd_sys_content_t
+    state: present
+  when: ansible_selinux.status == 'enabled'
+  tags: pim
+
+- name: Install pre/post backup hooks
+  template: src={{ item }}-backup.j2 dest=/etc/backup/{{ item }}.d/pim_{{ pim_id }} mode=700
+  loop:
+    - pre
+    - post
+  tags: pim
+
+- name: Install job consumer and events api service units
+  template: src={{ item.src }} dest=/etc/systemd/system/{{ item.dest }}
+  loop:
+    - src: akeneo-pim-jobs.service.j2
+      dest: akeneo-pim_{{ pim_id }}-jobs.service
+    - src: akeneo-pim-events-api.service.j2
+      dest: akeneo-pim_{{ pim_id }}-events-api.service
+  register: pim_job_unit
+  notify: restart akeneo-pim
+  tags: pim
+
+- name: Reload systemd
+  systemd: daemon_reload=True
+  when: pim_job_unit.results | selectattr('changed','equalto',True) | list | length > 0
+  tags: pim

roles/akeneo_pim/tasks/main.yml

@@ -0,0 +1,13 @@
+---
+
+- include: user.yml
+- include: directories.yml
+- include: facts.yml
+- include: archive_pre.yml
+  when: pim_install_mode == 'upgrade'
+- include: install.yml
+- include: conf.yml
+- include: write_version.yml
+- include: archive_post.yml
+  when: pim_install_mode == 'upgrade'
+- include: cleanup.yml

roles/akeneo_pim/tasks/services.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Start services
+  service: name={{ item }} state=started enabled=True
+  loop:
+    - akeneo-pim_{{ pim_id }}-jobs
+    - akeneo-pim_{{ pim_id }}-events-api
+  tags: pim

roles/akeneo_pim/tasks/user.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Create user
+  user:
+    name: "{{ pim_user }}"
+    system: True
+    home: "{{ pim_root_dir }}"
+    shell: /sbin/nologin
+  tags: pim

roles/akeneo_pim/tasks/write_version.yml

@@ -0,0 +1,5 @@
+---
+
+- name: Write current installed version
+  copy: content={{ pim_version }} dest={{ pim_root_dir }}/meta/ansible_version
+  tags: pim

roles/akeneo_pim/templates/akeneo-pim-events-api.service.j2

@@ -0,0 +1,22 @@
+[Unit]
+Description=Akeneo Events API worker for PIM {{ pim_id }}
+
+[Service]
+User={{ pim_user }}
+Group={{ pim_user }}
+WorkingDirectory={{ pim_root_dir }}/app
+ExecStart=/bin/php{{ pim_php_version }} bin/console messenger:consume webhook --env=prod
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=full
+ProtectHome=yes
+NoNewPrivileges=yes
+MemoryLimit=1024M
+SyslogIdentifier=akeneo-pim_{{ pim_id }}-events-api
+Restart=on-failure
+StartLimitInterval=0
+RestartSec=30
+
+[Install]
+WantedBy=multi-user.target
+

roles/akeneo_pim/templates/akeneo-pim-jobs.service.j2

@@ -0,0 +1,22 @@
+[Unit]
+Description=Akeneo jobs worker for PIM {{ pim_id }}
+
+[Service]
+User={{ pim_user }}
+Group={{ pim_user }}
+WorkingDirectory={{ pim_root_dir }}/app
+ExecStart=/bin/php{{ pim_php_version }} bin/console akeneo:batch:job-queue-consumer-daemon --env=prod
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=full
+ProtectHome=yes
+NoNewPrivileges=yes
+MemoryLimit=1024M
+SyslogIdentifier=akeneo-pim_{{ pim_id }}-jobs
+Restart=on-failure
+StartLimitInterval=0
+RestartSec=30
+
+[Install]
+WantedBy=multi-user.target
+

roles/akeneo_pim/templates/composer.json.j2

@@ -0,0 +1,44 @@
+{
+    "name": "akeneo/pim-community-standard",
+    "description": "The \"Akeneo Community Standard Edition\" distribution",
+    "license": "OSL-3.0",
+    "type": "project",
+    "authors": [
+        {
+            "name": "Akeneo",
+            "homepage": "http://www.akeneo.com"
+        }
+    ],
+    "autoload": {
+        "psr-0": {
+            "": "src/"
+        },
+        "psr-4": {
+            "Pim\\Upgrade\\": "upgrades/"
+        },
+        "exclude-from-classmap": [
+            "vendor/akeneo/pim-community-dev/src/Kernel.php"
+        ]
+    },
+    "require": {
+        "akeneo/pim-community-dev": "^{{ pim_version }}"
+    },
+    "require-dev": {
+        "doctrine/doctrine-migrations-bundle": "1.3.2",
+        "symfony/debug-bundle": "^4.4.7",
+        "symfony/web-profiler-bundle": "^4.4.7",
+        "symfony/web-server-bundle": "^4.4.7"
+    },
+    "scripts": {
+        "post-update-cmd": [
+            "bash vendor/akeneo/pim-community-dev/std-build/install-required-files.sh"
+        ],
+        "post-install-cmd": [
+            "bash vendor/akeneo/pim-community-dev/std-build/install-required-files.sh"
+        ],
+        "post-create-project-cmd": [
+            "bash vendor/akeneo/pim-community-dev/std-build/install-required-files.sh"
+        ]
+    },
+    "minimum-stability": "stable"
+}

roles/akeneo_pim/templates/env.j2

@@ -0,0 +1,17 @@
+APP_ENV=prod
+APP_DEBUG=0
+APP_DATABASE_HOST={{ pim_db_server }}
+APP_DATABASE_PORT={{ pim_db_port }}
+APP_DATABASE_NAME={{ pim_db_name }}
+APP_DATABASE_USER={{ pim_db_user }}
+APP_DATABASE_PASSWORD={{ pim_db_pass | quote }}
+APP_DEFAULT_LOCALE=en
+APP_SECRET={{ pim_secret | quote }}
+APP_INDEX_HOSTS={{ pim_es_server }}
+APP_PRODUCT_AND_PRODUCT_MODEL_INDEX_NAME=akeneo_pim_product_and_product_model
+APP_CONNECTION_ERROR_INDEX_NAME=akeneo_connectivity_connection_error
+MAILER_URL=null://localhost&sender_address=no-reply@{{ ansible_domain }}
+AKENEO_PIM_URL={{ pim_public_url }}
+LOGGING_LEVEL=NOTICE
+APP_EVENTS_API_DEBUG_INDEX_NAME=akeneo_connectivity_connection_events_api_debug
+APP_PRODUCT_AND_PRODUCT_MODEL_INDEX_NAME=akeneo_pim_product_and_product_model

roles/akeneo_pim/templates/httpd.conf.j2

@@ -0,0 +1,31 @@
+<Directory {{ pim_root_dir }}/app/public>
+  AllowOverride All
+  Options FollowSymLinks
+{% if pim_src_ip is defined and pim_src_ip | length > 0 %}
+  Require ip {{ pim_src_ip | join(' ') }}
+{% else %}
+  Require all granted
+{% endif %}
+  <FilesMatch \.php$>
+    SetHandler "proxy:unix:/run/php-fpm/{{ pim_php_fpm_pool | default('pim_' + pim_id | string) }}.sock|fcgi://localhost"
+  </FilesMatch>
+
+  RewriteEngine On
+
+  # Handle Authorization Header
+  RewriteCond %{HTTP:Authorization} .
+  RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+
+  # Send Requests To Front Controller...
+  RewriteCond %{REQUEST_FILENAME} !-f
+  RewriteRule ^ index.php [QSA,L]
+
+  <FilesMatch "(\.git.*)">
+    Require all denied
+  </FilesMatch>
+
+</Directory>
+
+<Directory {{ pim_root_dir }}/app/public/bundles>
+  RewriteEngine Off
+</Directory>

roles/akeneo_pim/templates/logrotate.conf.j2

@@ -0,0 +1,6 @@
+{{ pim_root_dir }}/data/logs/*.log {
+  daily
+  rotate 90
+  compress
+  missingok
+}

roles/akeneo_pim/templates/perms.sh.j2

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+restorecon -R {{ pim_root_dir }}
+chown root:root {{ pim_root_dir }}
+chmod 700 {{ pim_root_dir }}
+setfacl -R -k -b {{ pim_root_dir }}
+setfacl -m u:{{ pim_user | default('apache') }}:rx,u:{{ httpd_user | default('apache') }}:x {{ pim_root_dir }}
+find {{ pim_root_dir }}/app -type f -exec chmod 644 "{}" \;
+find {{ pim_root_dir }}/app -type d -exec chmod 755 "{}" \;
+chown -R {{ pim_user }}:{{ pim_user }} {{ pim_root_dir }}/app
+

roles/akeneo_pim/templates/php.conf.j2

@@ -0,0 +1,35 @@
+[pim_{{ pim_id }}]
+
+listen.owner = root
+listen.group = apache
+listen.mode = 0660
+listen = /run/php-fpm/pim_{{ pim_id }}.sock
+user = {{ pim_user }}
+group = {{ pim_user }}
+catch_workers_output = yes
+
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 3
+pm.min_spare_servers = 3
+pm.max_spare_servers = 6
+pm.max_requests = 5000
+request_terminate_timeout = 5m
+
+php_flag[display_errors] = off
+php_admin_flag[log_errors] = on
+php_admin_value[error_log] = syslog
+php_admin_value[memory_limit] = 1024M
+php_admin_value[session.save_path] = {{ pim_root_dir }}/sessions
+php_admin_value[upload_tmp_dir] = {{ pim_root_dir }}/tmp
+php_admin_value[sys_temp_dir] = {{ pim_root_dir }}/tmp
+php_admin_value[post_max_size] = 200M
+php_admin_value[upload_max_filesize] = 200M
+php_admin_value[disable_functions] = system, show_source, symlink, exec, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd
+php_admin_value[open_basedir] = {{ pim_root_dir }}:/usr/share/pear/:/usr/share/php/
+php_admin_value[max_execution_time] = 1200
+php_admin_value[max_input_time] = 1200
+php_admin_flag[allow_url_include] = off
+php_admin_flag[allow_url_fopen] = off
+php_admin_flag[file_uploads] = on
+php_admin_flag[session.cookie_httponly] = on

roles/akeneo_pim/templates/post-backup.j2

@@ -0,0 +1,3 @@
+#!/bin/bash -e
+
+rm -f {{ pim_root_dir }}/backup/*.sql.zst

roles/akeneo_pim/templates/pre-backup.j2

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+set -eo pipefail
+
+/usr/bin/mysqldump \
+{% if pim_db_server not in ['localhost','127.0.0.1'] %}
+  --user={{ pim_db_user | quote }} \
+  --password={{ pim_db_pass | quote }} \
+  --host={{ pim_db_server | quote }} \
+  --port={{ pim_db_port | quote }} \
+{% endif %}
+  --quick --single-transaction \
+  --add-drop-table {{ pim_db_name | quote }} | zstd -c > {{ pim_root_dir }}/backup/{{ pim_db_name }}.sql.zst
+