initial commit of file from CVS for smeserver-php on Sat Mar 23 15:31:58 AEDT 2024

This commit is contained in:
Trevor Batley
2024-03-23 15:31:58 +11:00
parent ba0cd7fb70
commit e590ff9746
164 changed files with 2705 additions and 2 deletions

View File

@@ -0,0 +1,8 @@
for VER in php php55 php56 php70 php71 php72 php73 php74 php80 php81 php82 php83; do
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$VER/tmp
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$VER/opcache
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$VER/wsdlcache
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$VER/opcache
done

View File

@@ -0,0 +1,14 @@
{
use esmith::AccountsDB;
my $a = esmith::AccountsDB->open_ro || die "Couldn't open the accounts database\n";
foreach my $ibay ($a->get_all_by_prop(type => 'ibay')){
next unless (($ibay->prop('CgiBin') || 'disabled') =~ m/^enabled|on|yes|1$/);
my $key = $ibay->key;
$OUT .=_EOF;
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$key/tmp
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$key/opcache
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$key/wsdlcache
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$key/opcache
_EOF
}
}

View File

@@ -0,0 +1,14 @@
{
use esmith::AccountsDB;
my $a = esmith::AccountsDB->open_ro || die "Couldn't open the accounts database\n";
foreach my $share ($a->get_all_by_prop(type => 'share')){
next unless (($share->prop('DynamicContent') || 'disabled') =~ m/^enabled|on|yes|1$/);
my $key = $share->key;
$OUT .=_EOF;
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$key/tmp
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$key/opcache
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$key/wsdlcache
/usr/sbin/tmpwatch -umc --nodirs -q 7d /var/lib/php/$key/opcache
_EOF
}
}

View File

@@ -0,0 +1,17 @@
{
$phpModule = $php{phpModule} || 'disabled';
# default we return with nothing activated
return "#PHP mod is disabled by default, please use PHP-fpm" unless (exists $php{status} and $php{status} eq "enabled" and $phpModule eq "enabled");
use esmith::php;
our $PHPVersion = PHPdefault(1);
my $phpMR = substr($PHPVersion,0,1) || '';
#php7 software collection libphp72.so
return "LoadModule php$\{phpMR\}_module modules/libphp$PHPVersion.so\n" if (-r "/usr/lib64/httpd/modules/libphp$PHPVersion.so");
#php5 software collection libphp56-php5.so
return "LoadModule php$\{phpMR\}_module modules/libphp$PHPVersion-php$phpMR.so\n" if (-r "/usr/lib64/httpd/modules/libphp$PHPVersion-php$phpMR.so");
# else we default to base php
return "LoadModule php5_module modules/libphp5.so" if ( -r "/usr/lib/httpd/modules/libphp5.so" ||
-r "/usr/lib64/httpd/modules/libphp5.so" );
return "#no PHP module found";
}

View File

@@ -0,0 +1,6 @@
{
$fastcgi_mod = 'mod_proxy_fcgi';
$OUT .=<<_EOF;
LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
_EOF
}

View File

@@ -0,0 +1,10 @@
{
return "" unless (defined $php{'status'} and $php{'status'} eq 'enabled');
my @directives = qw(
index.htm index.html index.shtml index.cgi
index.php index.phtml
);
$OUT = "DirectoryIndex @directives\n";
}

View File

@@ -0,0 +1,15 @@
{
return "" unless (exists $php{status} and $php{status} eq "enabled");
$OUT =<<HERE;
<IfModule mod_php5.c>
AddIcon /icons/php.gif .phps .php .phtml
</IfModule>
<IfModule mod_php7.c>
AddIcon /icons/php.gif .phps .php .phtml
</IfModule>
HERE
}

View File

@@ -0,0 +1,35 @@
{
$OUT = '';
use esmith::DomainsDB;
my $db = esmith::DomainsDB->open_ro;
unless ($db){
warn "Couldn't open domains DB in VirtualHosts template fragment";
return;
}
my @vhosts = $db->get_all_by_prop('type' => 'vhost');
foreach my $vhost (@vhosts) {
my $templatePath = $vhost->prop('TemplatePath') || 'WebAppVirtualHost';
foreach my $port ($httpPort, $httpsPort){
my %virtualHost = (
ipAddress => '0.0.0.0',
port => $port,
localAccess => $localAccess,
externalSSLAccess => $externalSSLAccess,
domain => $vhost,
httpPort => $httpPort,
httpsPort => $httpsPort
);
$OUT .= esmith::templates::processTemplate (
{
MORE_DATA => \%virtualHost,
TEMPLATE_PATH =>
"/etc/httpd/conf/httpd.conf/$templatePath",
OUTPUT_TYPE => 'string',
});
}
}
}

View File

@@ -0,0 +1,92 @@
{
use esmith::php;
my $status = $php{status} || 'disabled';
if ($status eq 'enabled')
{
use esmith::AccountsDB;
my $adb = esmith::AccountsDB->open_ro();
foreach my $ibay ($adb->ibays)
{
my %properties = $ibay->props;
my $key = $ibay->key;
local $dynamicContent = $ibay->prop('CgiBin') || 'disabled';
if ($dynamicContent eq 'enabled')
{
$OUT .= "\n<Directory /home/e-smith/files/ibays/" . $ibay->key . "/html>\n";
# configuration to enable php-fpm for the ibay
my $version = PhpFpmVersionToUse($ibay);
if ($fastcgi_mod eq 'mod_proxy_fcgi')
{
my $name = lc $key;
my $FilesMathes = ( ($ibay->prop('AllowPHTML') || $defaultPHPproperties{'AllowPHTML'}) eq 'enabled' ) ? '(xml|phtml|html|htm|php|phar)': '(phar|php)';
$OUT .=<<"_EOF";
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=\$1
<FilesMatch \\.$FilesMathes\$>
<If "-f \%\{SCRIPT_FILENAME\}">
SetHandler "proxy:unix:/var/run/php-fpm/php$version-$name.sock|fcgi://localhost"
</If>
</FilesMatch>
_EOF
}
else
{
my $FilesMathes = ( ($ibay->prop('AllowPHTML') || $defaultPHPproperties{'AllowPHTML'}) eq 'enabled' ) ? '.xml .phtml .html .htm ': '';
$OUT .= " AddType application/x-httpd-php .php .phar $FilesMathes\n";
$OUT .= " AddType application/x-httpd-php-source .phps\n";
# the following block is only in case phpmodule is enabled.
if (exists $php{status} and $php{status} eq "enabled" and $phpModule eq "enabled")
{
my $allow_url_fopen = $properties{'AllowUrlFopen'} || $defaultPHPproperties{'AllowUrlFopen'} ;
my $memoryLimit = $properties{'MemoryLimit'} || $defaultPHPproperties{'MemoryLimit'};
my $upmaxfileSize = $properties{'UploadMaxFilesize'} || $defaultPHPproperties{'UploadMaxFilesize'};
my $postmaxSize = $properties{'PostMaxSize'} || $defaultPHPproperties{'PostMaxSize'};
my $file_upload = $properties{'FileUpload'} || $defaultPHPproperties{'FileUpload'};
my $maxexecutionTime = (defined $properties{'MaxExecutionTime'}) ? $properties{'MaxExecutionTime'} : $defaultPHPproperties{'MaxExecutionTime'};
my $max_input_time = (defined $properties{'MaxInputTime'}) ? $properties{'MaxInputTime'} : $defaultPHPproperties{'MaxInputTime'};
my $display_errors = $properties{'DisplayErrors'} || 'off';
my $error_reporting = $properties{'ErrorReporting'} || 'E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT';
$maxexecutionTime = '0' if $maxexecutionTime eq 'unlimited';
$file_upload = ($file_upload =~ m/^1|yes|on|enabled$/) ? 'on' : 'off';
$allow_url_fopen = ($allow_url_fopen =~ m/^1|yes|on|enabled$/) ? 'on' : 'off';
$display_errors = ($display_errors =~ m/^1|yes|on|enabled$/) ? 'on' : 'off';
$error_reporting = ($error_reporting eq 'E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT') ? '; default error_reporting' : "php_value[error_reporting] = $error_reporting";
$OUT .= " php_admin_flag allow_url_fopen $allow_url_fopen\n";
$OUT .= " php_admin_value memory_limit $memoryLimit\n";
$OUT .= " php_admin_value upload_max_filesize $upmaxfileSize\n";
$OUT .= " php_admin_value post_max_size $postmaxSize\n" ;
$OUT .= " php_admin_flag file_upload $file_upload\n";
$OUT .= " php_admin_value max_input_time $max_input_time\n";
$OUT .= " php_admin_value max_execution_time $maxexecutionTime\n";
$OUT .= " php_flag display_errors $display_errors\n";
$OUT .= " $error_reporting\n";
# Set upload_tmp_dir and sys_temp_dir where php can upload files or write tmp files
$tmpdir= "/var/lib/php/$key/tmp";
$OUT .= " php_admin_value upload_tmp_dir $tmpdir\n";
$OUT .= " php_admin_value sys_temp_dir $tmpdir\n";
# Set the session folder where php can store its session instead of in global dir
$sessdir = "/var/lib/php/$key/session";
$OUT .= " php_admin_value session.save_path $sessdir\n";
# Set the sandbox within which PHP is confined to play
my $basedir = $ibay->prop('PHPBaseDir')
|| ("/home/e-smith/files/ibays/$key/");
$basedir .= ":/var/lib/php/$key/";
$basedir .= ":/usr/share/php/:/usr/share/pear/";
if ( -d "/opt/remi/php$version/root/usr/share/pear/" && -d "/opt/remi/php$version/root/usr/share/php/")
{
$basedir .= ":/opt/remi/php$version/root/usr/share/pear/:/opt/remi/php$version/root/usr/share/php/";
}
$OUT .= " php_admin_value open_basedir $basedir\n";
}
}
$OUT .= "</Directory>\n";
}
}
}
}

View File

@@ -0,0 +1,9 @@
{
use esmith::DomainsDB;
# Convert the passed hash for the domain object back into an object.
$domain = bless \%domain, 'esmith::DB::db::Record';
# Make scalars from some of the properties of the domain
$virtualHost = $domain->key;
$OUT = "";
}

View File

@@ -0,0 +1 @@
ServerName {$virtualHost}

View File

@@ -0,0 +1,13 @@
ServerAlias {
use esmith::HostsDB;
use esmith::DomainsDB;
my $hdb = esmith::HostsDB->open_ro();
my %domains = map { $_->key => 1 } esmith::DomainsDB->open_ro->domains;
my @hosts = grep {
my $h = $_;
($h->prop('HostType') eq 'Self') && !$domains{$h->key}
} $hdb->get_hosts_by_domain($virtualHost);
$OUT = join " ", map { $_->key } @hosts;
}

View File

@@ -0,0 +1,28 @@
{
my $ssl = $domain->prop('RequireSSL') || 'disabled';
my $auth = $domain->prop('Authentication') || 'none';
if ($httpsPort eq $port){
$OUT .= " SSLEngine on\n";
}
elsif (($ssl =~ m/^enabled|yes|on|1$/i) || ($auth =~ /^LemonLDAP/)){
$OUT .=<<'EOF';
RewriteEngine on
RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge/.*
RewriteRule ^/(.*|$) https://%{HTTP_HOST}/$1 [L,R]
EOF
}
elsif ($ssl =~ m#/#){
$OUT .= " RewriteEngine on\n";
foreach my $loc (split(/[;,]/, $ssl)){
$OUT .= " # Rewriting $loc to use SSL\n";
$loc =~ s#^/##;
$OUT .= " RewriteRule ^/$loc(/.*|\$) https://%\{HTTP_HOST\}/$loc\$1 \[L,R\]\n";
}
}
else{
$OUT .= '';
}
}

View File

@@ -0,0 +1,8 @@
{
$OUT =<<'HERE';
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
HERE
}

View File

@@ -0,0 +1,13 @@
{
my $alias = $domain->prop('IconAlias') || 'enabled';
$OUT .= '';
unless ($alias =~ m/disabled|off|no|0/i){
$OUT .=<<'EOF';
# alias for Apache icons
Alias /icons/ /var/www/icons/
EOF
}
}

View File

@@ -0,0 +1,161 @@
{
use esmith::util;
my $base = esmith::util::ldapBase($DomainName);
my $name = $domain->key;
my $target = $domain->prop('ProxyPassTarget') || '';
my $proxy_acme = $domain->prop('ProxyPassACMEChallenges') || 'disabled';
my $redirect = $domain->prop('Redirect') || '';
my $rewrite = $domain->prop('Rewrite') || '';
my $allow = $domain->prop('AllowHosts') || '';
my $preserve = $domain->prop('ProxyPreserveHost') || 'no';
my $keepalive = $domain->prop('ProxyNoKeepAlive') || 'no';
my $timeout = $domain->prop('Timeout') || '';
my $index = $domain->prop('DirectoryIndex') || '';
my @alias = split /[,;]/, ($domain->prop('Alias') || '');
my @env = split(/[;,]/, ($domain->prop('SetEnv') || ''));
my $auth = $domain->prop('Authentication') || 'none';
my @groups = split(/[;,]/, ($domain->prop('AllowGroups') || ''));
my $ssl_port = $httpsPort;
my $proto = ($port eq $ssl_port ) ? 'https' : 'http';
my $socketio = $domain->prop('ProxySocketIO') || 'disabled';
my @proxyrules = split /[,;]/, ($domain->prop('ProxyPassRules') || '');
# Custom proxypass rules
foreach my $rule (@proxyrules){
my ($from, $to) = split /=/, $rule;
$OUT .= " ProxyPass $from $to\n";
}
if (@proxyrules > 0 || $target =~ m|https?://[\d\w\.\-/]*|){
$OUT .= " ProxyPreserveHost on\n" if ($preserve eq 'yes');
$OUT .= " RequestHeader set X-Forwarded-Proto \"$proto\"\n";
}
# ProxyPass ?
if ($target =~ m|https?://[\d\w\.\-/]*|){
$OUT .= " SetEnv proxy-nokeepalive 1\n" if ($keepalive eq 'yes');
if ($proxy_acme eq 'only'){
$OUT .= " ProxyPass /.well-known/acme-challenge/ $target" . ".well-known/acme-challenge/\n";
$OUT .= " ProxyPassReverse / $target" . ".well-known/acme-challenge/\n";
}
else{
if ($proxy_acme eq 'disabled'){
$OUT .= " ProxyPass /.well-known/acme-challenge/ !\n";
}
if ($socketio eq 'enabled'){
# Try to handle Socket.IO
my $wstarget = $target;
$wstarget =~ s/^http:/ws:/;
$wstarget =~ s/^https:/wss:/;
$OUT .=<<"_EOF"
<IfModule mod_proxy_wstunnel.c>
RewriteCond %{QUERY_STRING} transport=polling [NC]
RewriteRule /socket.io/(.*) ${target}socket.io/\$1 [P,L]
ProxyPass /socket.io/socket.io.js ${target}socket.io/socket.io.js
ProxyPassReverse /socket.io/socket.io.js ${target}socket.io/socket.io.js
ProxyPass /socket.io/ ${wstarget}socket.io/
ProxyPassReverse /socket.io/ ${wstarget}socket.io/
</IfModule>
_EOF
}
$OUT .= " ProxyPass / $target\n";
$OUT .= " ProxyPassReverse / $target\n";
}
}
# Rewrite ?
elsif ($rewrite =~ m|https?://[\d\w\.\-/]*|){
$OUT .=<<"HERE";
RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge/.*
RewriteRule /(.*|\$) $rewrite/\$1 [L,R]
HERE
}
# Redirect ?
elsif ($redirect =~ m|https?://[\d\w\.\-/]*|){
$OUT .=<<"HERE";
RedirectMatch permanent ^/(.*|\$) $redirect/\$1
HERE
}
else{
my $root = $domain->prop('DocumentRoot') ||
'/home/e-smith/files/ibays/Primary/html';
$OUT .= " DocumentRoot $root\n";
}
if ($timeout =~ m/^\d+$/){
$OUT .= " Timeout $timeout\n";
}
if ($index ne ''){
$OUT .= " DirectoryIndex $index\n";
}
foreach (@alias){
next unless $_ =~ m/^(\/\w+)=(\/.*)/;
my ($al, $targ) = ($1, $2);
next unless (-e $2);
$OUT .= " Alias $al $targ\n";
}
foreach (@env){
next unless (m/^(.*)=(.*)$/);
$OUT .= " SetEnv $1 $2\n";
}
if ($allow ne ''){
if ($allow eq 'local'){
$allow = "$localAccess $externalSSLAccess";
}
else{
$allow =~ s/[,;]/ /g;
}
$OUT .=<<"EOF";
<Location />
Require ip $allow
</Location>
<Location /.well-known/acme-challenge/>
Require all granted
</Location>
EOF
}
if ($auth =~ m/^Basic$/i){
my $require = "Require valid-user";
if (scalar(@groups) > 0){
$require = "Require ldap-group ";
$require .= "cn=$_,ou=Groups,$base " foreach(@groups);
}
$OUT .=<<"EOF";
SetEnvIf %{Request_URI} "^/\.well\-known/acme\-challenge" granted
<Location />
Require env granted
AuthType basic
AuthName "$name"
AuthBasicProvider ldap
AuthLDAPURL ldap://localhost/ou=Users,$base?uid
AuthLDAPGroupAttribute memberUid
AuthLDAPGroupAttributeIsDN off
$require
</location>
EOF
}
}

View File

@@ -0,0 +1,2 @@
<VirtualHost {$ipAddress}:{$port}>

View File

@@ -0,0 +1,2 @@
</VirtualHost>

View File

@@ -0,0 +1,52 @@
{
return "# all versions in php-fpm file" unless $PHP_VERSION eq "";
$OUT = "/var/log/php/*/php*fpm.log {
missingok
notifempty
sharedscripts
delaycompress
su root root
create 600 root root
postrotate
/sbin/e-smith/service php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php55-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php56-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php70-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php71-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php72-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php73-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php74-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php80-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php81-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php82-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php83-php-fpm reload >/dev/null 2>&1 || true
endscript
}
/var/log/php/*/[!php]*.log {
missingok
notifempty
sharedscripts
delaycompress
su www www
create 600 www www
postrotate
/sbin/e-smith/service php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php55-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php56-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php70-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php71-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php72-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php73-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php74-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php80-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php81-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php82-php-fpm reload >/dev/null 2>&1 || true
/sbin/e-smith/service php83-php-fpm reload >/dev/null 2>&1 || true
endscript
}
";
}

View File

@@ -0,0 +1 @@
include={ $FPM_POOL_DIR }/*.conf

View File

@@ -0,0 +1 @@
[global]

View File

@@ -0,0 +1 @@
pid = /var/run/php-fpm/php{ $PHP_VERSION }-fpm.pid

View File

@@ -0,0 +1,4 @@
error_log = syslog
syslog.facility = daemon
syslog.ident = php{ $PHP_VERSION }-fpm

View File

@@ -0,0 +1 @@
daemonize = yes

View File

@@ -0,0 +1,87 @@
{
use esmith::ConfigDB;
my $pool_db = esmith::ConfigDB->open_ro('php') || esmith::ConfigDB->create('php');
foreach my $pool ($pool_db->get_all_by_prop(type => 'pool')){
my $version = $pool->prop('Version') || '';
my $status = $pool->prop('status') || 'enabled';
next unless ($version eq $PHP_VERSION && $status eq 'enabled');
my $key = $pool->key;
my $pool_name = 'php' . $version . '-' . $key;
my $memory_limit = $pool->prop('MemoryLimit') || '128M';
my $max_execution_time = $pool->prop('MaxExecutionTime') || '30';
my $max_input_time = $pool->prop('MaxInputTime') || '60';
my $allow_url_fopen = $pool->prop('AllowUrlFopen') || 'disabled';
my $post_max_size = $pool->prop('PostMaxSize') || '10M';
my $upload_max_filesize = $pool->prop('UploadMaxFilesize') || '10M';
my $file_upload = $pool->prop('FileUpload') || 'enabled';
my $open_basedir = $pool->prop('BaseDir') || undef;
my $disabled_functions = $pool->prop('DisabledFunctions') || 'system,show_source,' .
'symlink,exec,dl,shell_exec,' .
'passthru,phpinfo,' .
'escapeshellarg,escapeshellcmd';
my $user = $pool->prop('User') || 'www';
my $group = $pool->prop('Group') || $user;
my $max_children = $pool->prop('MaxChildren') || '15';
my $display_errors = $pool->prop('DisplayErrors') || 'disabled';
my $log_errors = $pool->prop('LogErrors') || 'disabled';
my $autoprepend = $pool->prop('AutoPrependFile') || 'enabled';
my $MailForceSender = $pool->prop('MailForceSender') || "php\@$DomainName";
# Format vars
my $autoprep = ( $autoprepend eq "disabled") ? "" : "/usr/share/php/auth_translation.php";
my $autoprepath = ( $autoprepend eq "disabled") ? "" : ",/usr/share/php/";
$file_upload = ($file_upload =~ m/^1|yes|on|enabled$/) ? 'on' : 'off';
$allow_url_fopen = ($allow_url_fopen =~ m/^1|yes|on|enabled$/) ? 'on' : 'off';
$display_errors = ($display_errors =~ m/^1|yes|on|enabled$/) ? 'on' : 'off';
$log_errors = ($log_errors =~ m/^1|yes|on|enabled$/) ? 'on' : 'off';
$disabled_functions = join(', ', split /[,;:]/, $disabled_functions);
$open_basedir = (defined $open_basedir) ? 'php_admin_value[open_basedir] = ' . join(':', split(/[,;:]/, $open_basedir . $autoprepath)) :
'; open_basedir is not set';
$OUT .=<<"_EOF";
[$pool_name]
user = $user
group = $group
listen.owner = root
listen.group = www
listen.mode = 0660
listen = /var/run/php-fpm/$pool_name.sock
pm = dynamic
pm.max_children = $max_children
pm.start_servers = 3
pm.min_spare_servers = 3
pm.max_spare_servers = 4
pm.max_requests = 1000
slowlog = /var/log/php/$key/slow.log
php_admin_value[session.save_path] = /var/lib/php/$key/session
php_admin_value[opcache.file_cache] = /var/lib/php/$key/opcache
php_admin_value[upload_tmp_dir] = /var/lib/php/$key/tmp
php_admin_value[sys_temp_dir] = /var/lib/php/$key/tmp
php_admin_value[mail.force_extra_parameters] = '-f $MailForceSender'
php_admin_flag[display_errors] = $display_errors
php_admin_flag[log_errors] = $log_errors
php_admin_value[error_log] = /var/log/php/$key/error.log
php_admin_value[memory_limit] = $memory_limit
php_admin_value[max_execution_time] = $max_execution_time
php_admin_value[post_max_size] = $post_max_size
php_admin_value[upload_max_filesize] = $upload_max_filesize
php_admin_value[max_input_time] = $max_input_time
php_admin_value[disable_functions] = $disabled_functions
php_admin_flag[allow_url_fopen] = $allow_url_fopen
php_admin_flag[file_upload] = $file_upload
php_admin_flag[session.cookie_httponly] = on
php_admin_flag[allow_url_include] = off
php_admin_value[auto_prepend_file] = $autoprep
php_value[session.save_handler] = files
$open_basedir
_EOF
}
}

View File

@@ -0,0 +1,84 @@
{
use esmith::AccountsDB;
use esmith::php;
my $a = esmith::AccountsDB->open_ro || die "Couldn't open the accounts database";
foreach my $ibay ($a->get_all_by_prop(type => 'ibay')){
my $version = PhpFpmVersionToUse($ibay);
my $dynamic = $ibay->prop('CgiBin') || 'disabled';
my $custom = $ibay->prop('CustomPool') || undef;
next unless ($dynamic eq 'enabled' && $version eq $PHP_VERSION && !$custom);
my $key = $ibay->key;
my $name = lc $key;
my $pool_name = 'php' . $version . '-' . $name;
my $memory_limit = $ibay->prop('MemoryLimit') || $defaultPHPproperties{'MemoryLimit'};
my $max_execution_time = (defined $ibay->prop('MaxExecutionTime') ) ? $ibay->prop('MaxExecutionTime') : $defaultPHPproperties{'MaxExecutionTime'};
my $max_input_time = (defined $ibay->prop('MaxInputTime'))? $ibay->prop('MaxInputTime') : $defaultPHPproperties{'MaxInputTime'};
my $allow_url_fopen = $ibay->prop('AllowUrlFopen') || $defaultPHPproperties{'AllowUrlFopen'};
my $post_max_size = $ibay->prop('PostMaxSize') || $defaultPHPproperties{'PostMaxSize'};
my $upload_max_filesize = $ibay->prop('UploadMaxFilesize') || $defaultPHPproperties{'UploadMaxFilesize'};
my $file_upload = $ibay->prop('FileUpload') || $defaultPHPproperties{'FileUpload'};
my $display_errors = $ibay->prop('DisplayErrors') || 'off'; #we do not set this one at php level to avoid to have a whole server displaying errors and security issues
my $error_reporting = $ibay->prop('ErrorReporting') || 'E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT'; #same reason, we hardcoded the default
my $open_basedir = $ibay->prop('PHPBaseDir') || '/home/e-smith/files/ibays/' . $key . '/' . ':/var/lib/php/' . $key . '/';
my $disabled_functions = (defined $ibay->prop('DisabledFunctions')) ? $ibay->prop('DisabledFunctions') : $defaultPHPproperties{'DisabledFunctions'};
my $autoprepend = $ibay->prop('AutoPrependFile') || $defaultPHPproperties{'AutoPrependFile'};
my $MailForceSender = $ibay->prop('MailForceSender') || "$name\@$DomainName"; # TODO => check ibay associated domains.
my $limitExtensions = ( ($ibay->prop('AllowPHTML') || $defaultPHPproperties{'AllowPHTML'} ) eq 'enabled' ) ? "security.limit_extensions= .php .htm .html .phar .phtml .xml " : "";
# Format vars
my $autoprep = ( $autoprepend eq "disabled") ? "" : "/usr/share/php/auth_translation.php";
my $autoprepath = ( -d "/opt/remi/php$version/root/usr/share/pear/" && -d "/opt/remi/php$version/root/usr/share/php/" ) ? ":/usr/share/php/:/usr/share/pear/:/opt/remi/php$version/root/usr/share/pear/:/opt/remi/php$version/root/usr/share/php/" : ":/usr/share/php/:/usr/share/pear/";
$file_upload = ($file_upload =~ m/^1|yes|on|enabled$/) ? 'on' : 'off';
$allow_url_fopen = ($allow_url_fopen =~ m/^1|yes|on|enabled$/) ? 'on' : 'off';
$disabled_functions = join(', ', split /[,;:]/, $disabled_functions);
$display_errors = ($display_errors =~ m/^1|yes|on|enabled$/) ? 'on' : 'off';
$error_reporting = ($error_reporting eq 'E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT') ? '; default error_reporting' : "php_value[error_reporting] = $error_reporting";
$open_basedir = join(':', split(/[,;:]/, $open_basedir . $autoprepath));
$OUT .=<<"_EOF" if ($version eq $PHP_VERSION);
[$pool_name]
user = www
group = www
listen.owner = root
listen.group = www
listen.mode = 0660
listen = /var/run/php-fpm/$pool_name.sock
pm = dynamic
pm.max_children = 15
pm.start_servers = 3
pm.min_spare_servers = 3
pm.max_spare_servers = 4
pm.max_requests = 1000
$limitExtensions
slowlog = /var/log/php/$key/slow.log
php_admin_value[session.save_path] = /var/lib/php/$key/session
php_admin_value[opcache.file_cache] = /var/lib/php/$key/opcache
php_admin_value[upload_tmp_dir] = /var/lib/php/$key/tmp
php_admin_value[sys_temp_dir] = /var/lib/php/$key/tmp
php_admin_value[mail.force_extra_parameters] = '-f $MailForceSender'
php_flag[display_errors] = $display_errors
$error_reporting
php_admin_flag[log_errors] = on
php_admin_value[error_log] = /var/log/php/$key/error.log
php_admin_value[memory_limit] = $memory_limit
php_admin_value[max_execution_time] = $max_execution_time
php_admin_value[post_max_size] = $post_max_size
php_admin_value[upload_max_filesize] = $upload_max_filesize
php_admin_value[max_input_time] = $max_input_time
php_admin_value[disable_functions] = $disabled_functions
php_admin_flag[allow_url_fopen] = $allow_url_fopen
php_admin_flag[file_upload] = $file_upload
php_admin_flag[session.cookie_httponly] = on
php_admin_flag[allow_url_include] = off
php_value[session.save_handler] = files
php_admin_value[auto_prepend_file] = $autoprep
php_admin_value[open_basedir] = $open_basedir
_EOF
}
}

View File

@@ -0,0 +1,22 @@
{
use esmith::ConfigDB;
my $c = esmith::ConfigDB->open_ro || die "Couldn't opeen the configuration database\n";
my $srv = ( $PHP_VERSION ne '') ? 'php' . $PHP_VERSION . '-php-fpm' : 'php-fpm';
my $php = $c->get( $srv );
if ($php){
$MemoryLimit = $php->prop('MemoryLimit') || '128M';
$MaxExecutionTime = $php->prop('MaxExecutionTime') || '30';
$MaxInputTime = $php->prop('MaxInputTime') || '60';
$AllowUrlFopen = $php->prop('AllowUrlFopen') || 'off';
$MaxChildren = $php->prop('MaxChildren') || '15';
$PostMaxSize = $php->prop('PostMaxSize') || '10M';
$UploadMaxFilesize = $php->prop('UploadMaxFilesize') || '10M';
$OpenBasedir = $php->prop('OpenBasedir') || undef;
$DisableFunctions = $php->prop('DisableFunctions') || 'system,show_source,' .
'symlink,exec,dl,shell_exec,' .
'passthru,phpinfo,' .
'escapeshellarg,escapeshellcmd';
}
return "";
}
[php{ $PHP_VERSION }]

View File

@@ -0,0 +1,2 @@
user = www
group = www

View File

@@ -0,0 +1,4 @@
listen.owner = root
listen.group = www
listen.mode = 0660
listen = /var/run/php-fpm/php{ $PHP_VERSION }.sock

View File

@@ -0,0 +1,7 @@
pm = dynamic
pm.max_children = { $MaxChildren }
pm.start_servers = 3
pm.min_spare_servers = 3
pm.max_spare_servers = 4
pm.max_requests = 5000
request_terminate_timeout = { $MaxExecutionTime }

View File

@@ -0,0 +1,11 @@
{
$OUT .=<<_EOF;
php_admin_value[session.save_path] = /var/lib/php/php$PHP_VERSION/session
php_admin_value[soap.wsdl_cache_dir] = /var/lib/php/php$PHP_VERSION/wsdlcache
php_admin_value[opcache.file_cache] = /var/lib/php/php$PHP_VERSION/opcache
php_admin_value[upload_tmp_dir] = /var/lib/php/php$PHP_VERSION/tmp
php_admin_value[sys_temp_dir] = /var/lib/php/php$PHP_VERSION/tmp
_EOF
}
php_admin_value[error_log] = /var/log/php/php{ $PHP_VERSION }/error.log
slowlog = /var/log/php/php{ $PHP_VERSION }/slow.log

View File

@@ -0,0 +1,22 @@
php_admin_value[mail.force_extra_parameters] = '-f { "php\@$DomainName" }'
php_admin_flag[display_errors] = off
php_admin_flag[log_errors] = on
php_admin_value[memory_limit] = { $MemoryLimit }
php_admin_value[max_execution_time] = { $MaxExecutionTime }
php_admin_value[post_max_size] = { $PostMaxSize }
php_admin_value[upload_max_filesize] = { $UploadMaxFilesize }
php_admin_value[max_input_time] = { $MaxInputTime }
{
if ($OpenBasedir){
$OUT .= "php_admin_value[open_basedir] = " . join( ':', (split(/[;,:]/, "$OpenBasedir,/usr/share/php/")) ) . "\n";
}
if ($DisableFunctions){
$OUT .= "php_admin_value[disable_functions] = " . join( ', ', (split(/[;,:]/, $DisableFunctions)) ) . "\n";
}
}
php_admin_flag[allow_url_fopen] = { $AllowUrlFopen }
php_admin_flag[file_upload] = { $FileUpload }
php_admin_flag[session.cookie_httponly] = on
php_admin_flag[allow_url_include] = off
php_admin_value[auto_prepend_file] = /usr/share/php/auth_translation.php
php_admin_value[session.save_handler] = files

View File

@@ -0,0 +1,7 @@
[PHP]{
use esmith::ConfigDB;
my $c = esmith::ConfigDB->open_ro || die "Couldn't open the configuration database\n";
my $srv = ( $PHP_VERSION ne '') ? 'php' . $PHP_VERSION : 'php';
our $phpcur = $c->get( $srv );
$OUT .= '';
}

View File

@@ -0,0 +1,41 @@
{#;;;;;;;;;;;;;;;;;;
# Language Options ;
#;;;;;;;;;;;;;;;;;;;}
engine = On
short_open_tag = {
my $short = $phpcur->prop(ShortOpenTag) || $php{ShortOpenTag} || "On";
$OUT .= "$short";
}
asp_tags = Off
precision = 14
output_buffering = 4096
output_handler =
zlib.output_compression = Off
implicit_flush = Off
unserialize_callback_func =
serialize_precision = 17
disable_functions =
disable_classes =
safe_mode = Off
safe_mode_exec_dir =
safe_mode_allowed_env_vars = PHP_
safe_mode_protected_env_vars = LD_LIBRARY_PATH
disable_functions =
highlight.string = #DD0000
highlight.comment = #FF8000
highlight.keyword = #007700
highlight.bg = #FFFFFF
highlight.default = #0000BB
highlight.html = #000000
zend.enable_gc = On
{
return "" if $PHP_VERSION eq "";
if ( $PHP_VERSION >= 70)
{
$OUT .="zend.assertions = -1\n";
}
if ( $PHP_VERSION >= 74)
{
$OUT .="zend.exception_ignore_args = On\n";
}
}

View File

@@ -0,0 +1,5 @@
; Default expose_php to Off for security reasons
expose_php = {
my $ep = $phpcur->prop(ExposePHP) || $php{ExposePHP} || "Off";
$OUT .= "$ep";
}

View File

@@ -0,0 +1,12 @@
max_execution_time = {
my $et = $phpcur->prop(MaxExecutionTime) || $php{MaxExecutionTime} || "30";
$OUT .= "$et";
}
max_input_time = {
my $it = $phpcur->prop(MaxInputTime) || $php{MaxInputTime} || "60";
$OUT .= "$it";
}
memory_limit = {
my $ml = $phpcur->prop(MemoryLimit) || $php{MemoryLimit} || "128M";
$OUT .= "$ml";
}

View File

@@ -0,0 +1,11 @@
error_reporting = E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT
display_errors = Off
display_startup_errors = Off
log_errors = On
log_errors_max_len = 1024
ignore_repeated_errors = Off
ignore_repeated_source = Off
report_memleaks = On
track_errors = Off
html_errors = On
error_log = syslog

View File

@@ -0,0 +1,12 @@
variables_order = "EGPCS"
request_order = "GP"
register_argc_argv = On
auto_globals_jit = On
post_max_size = {
my $ms = $phpcur->prop(PostMaxSize) || $php{PostMaxSize} || "20M";
$OUT .= "$ms";
}
auto_prepend_file =
auto_append_file =
default_mimetype = "text/html"
default_charset = "UTF-8"

View File

@@ -0,0 +1,8 @@
include_path = {($phpcur->prop(IncludePath)||$php{IncludePath}||$INCLUDE_PATH)}
doc_root =
user_dir =
extension_dir = { return "$EXTENSION_DIR" if ("$EXTENSION_DIR" ne "" && -d "$EXTENSION_DIR");
return "/usr/lib64/php/modules" if -d "/usr/lib64/php/modules";
return "/usr/lib/php/modules" if -d "/usr/lib/php/modules";
return "/usr/lib/php"; }
enable_dl = On

View File

@@ -0,0 +1,10 @@
file_uploads = On
upload_max_filesize = {
my $mf = $phpcur->prop(UploadMaxFilesize) || $php{UploadMaxFilesize} || "10M";
$OUT .= "$mf";
}
upload_tmp_dir = {"/var/lib/php/php$PHP_VERSION/tmp"}
max_file_uploads = {
my $mfu = $phpcur->prop(MaxFileUpload) || $php{MaxFileUpload} || "20";
$OUT .= "$mfu";
}

View File

@@ -0,0 +1,3 @@
allow_url_fopen = {($phpcur->prop(AllowUrlFopen) || $php{AllowUrlFopen} || 'Off')}
allow_url_include = Off
default_socket_timeout = 60

View File

@@ -0,0 +1,2 @@
date.timezone = "{$TimeZone}"

View File

@@ -0,0 +1,3 @@
[ Server]
cli_server.color = On

View File

@@ -0,0 +1,3 @@
[Syslog]
define_syslog_variables = Off

View File

@@ -0,0 +1,18 @@
[mail function]
SMTP = localhost
smtp_port = {($qpsmtpd{TCPPort} || '25')}
; windows setting, but in case :
sendmail_from = '{$phpcur->prop(MailForceSender)|| $php{'MailForceSender'} || "root\@$DomainName" }'
sendmail_path = {($phpcur->prop(SendmailPath) || $php{"SendmailPath"} || '/usr/sbin/sendmail -t -i')}
mail.force_extra_parameters = '-f {$phpcur->prop(MailForceSender)|| $php{'MailForceSender'} || "root\@$DomainName" }'
mail.log = {
my $mailog = $phpcur->prop(MailLog) || $php{"MailLog"} || "disabled";
my $mlog = ($mailog eq "enabled")? "/var/log/php/php$PHP_VERSION/mail.log" : "";
$OUT .= "$mlog";
}
mail.add_x_header = {
my $axh = $php{MailAddXHeader} || "disabled";
my $ax = ($axh eq "enabled") ? "Yes" : "No";
$OUT .= "$ax";
}

View File

@@ -0,0 +1,8 @@
[Pcre]
{
return "" if $PHP_VERSION eq "";
if ( $PHP_VERSION >= 70)
{
$OUT .="pcre.jit = Off\n";
}
}

View File

@@ -0,0 +1,4 @@
[Pdo_mysql]
pdo_mysql.cache_size = 2000
pdo_mysql.default_socket =

View File

@@ -0,0 +1,3 @@
[SQL]
sql.safe_mode = Off

View File

@@ -0,0 +1,8 @@
[Interbase]
ibase.allow_persistent = On
ibase.max_persistent = -1
ibase.max_links = -1
ibase.timestampformat = "%Y-%m-%d %H:%M:%S"
ibase.dateformat = "%Y-%m-%d"
ibase.timeformat = "%H:%M:%S"

View File

@@ -0,0 +1,8 @@
[ODBC]
odbc.allow_persistent = On
odbc.check_persistent = On
odbc.max_persistent = -1
odbc.max_links = -1
odbc.defaultlrl = 4096
odbc.defaultbinmode = 1

View File

@@ -0,0 +1,14 @@
[MySQL]
mysql.allow_local_infile = On
mysql.allow_persistent = On
mysql.cache_size = 2000
mysql.max_persistent = -1
mysql.max_links = -1
mysql.default_port =
mysql.default_socket =
mysql.default_host =
mysql.default_user =
mysql.default_password =
mysql.connect_timeout = 60
mysql.trace_mode = Off

View File

@@ -0,0 +1,11 @@
[MySQLi]
mysqli.allow_persistent = On
mysqli.cache_size = 2000
mysqli.max_persistent = -1
mysqli.max_links = -1
mysqli.default_port =
mysqli.default_socket =
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off

View File

@@ -0,0 +1,4 @@
[mysqlnd]
mysqlnd.collect_statistics = On
mysqlnd.collect_memory_statistics = Off

View File

@@ -0,0 +1,5 @@
[mSQL]
msql.allow_persistent = On
msql.max_persistent = -1
msql.max_links = -1

View File

@@ -0,0 +1,8 @@
[PostgresSQL]
pgsql.allow_persistent = On
pgsql.auto_reset_persistent = Off
pgsql.max_persistent = -1
pgsql.max_links = -1
pgsql.ignore_notice = Off
pgsql.log_notice = Off

View File

@@ -0,0 +1,8 @@
[Sybase]
sybase.allow_persistent = On
sybase.max_persistent = -1
sybase.max_links = -1
sybase.min_error_severity = 10
sybase.min_message_severity = 10
sybase.compatability_mode = Off

View File

@@ -0,0 +1,7 @@
[Sybase-CT]
sybct.allow_persistent = On
sybct.max_persistent = -1
sybct.max_links = -1
sybct.min_server_severity = 10
sybct.min_client_severity = 10

View File

@@ -0,0 +1,3 @@
[bcmath]
bcmath.scale = 0

View File

@@ -0,0 +1,2 @@
[browscap]

View File

@@ -0,0 +1,49 @@
[Session]
session.save_handler = files
session.save_path = {"/var/lib/php/php$PHP_VERSION/session"}
session.use_cookies = On
session.use_only_cookies = On
session.name = PHPSESSID
session.auto_start = Off
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.cookie_httponly =
session.serialize_handler = php
session.gc_probability = 1
session.gc_divisor = 1000
session.gc_maxlifetime = 1440
session.bug_compat_42 = Off
session.bug_compat_warn = Off
session.referer_check =
session.entropy_length = 0
session.entropy_file =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = On
url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"
{
return "" if $PHP_VERSION eq "";
if ( $PHP_VERSION >= 55)
{
$OUT .= "session.use_strict_mode = Off\n";
$OUT .= "sys_temp_dir = /var/lib/php/php$PHP_VERSION/tmp\n";
}
if ( $PHP_VERSION < 71)
{
$OUT .= "session.hash_bits_per_character = 5
session.hash_function = 0
session.entropy_file =
session.entropy_length = 0\n";
}
if ( $PHP_VERSION >= 71)
{
$OUT .= "session.sid_bits_per_character = 4
session.sid_length = 32
session.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n";
}
if ( $PHP_VERSION >= 73)
{
$OUT .= "session.cookie_samesite = \"Strict\"\n";
}
}

View File

@@ -0,0 +1,9 @@
[MSSQL]
mssql.allow_persistent = On
mssql.max_persistent = -1
mssql.max_links = -1
mssql.min_error_severity = 10
mssql.min_message_severity = 10
mssql.compatability_mode = Off
mssql.secure_connection = Off

View File

@@ -0,0 +1,2 @@
[Assertion]

View File

@@ -0,0 +1,8 @@
[Ingres II]
ingres.allow_persistent = On
ingres.max_persistent = -1
ingres.max_links = -1
ingres.default_database =
ingres.default_user =
ingres.default_password =

View File

@@ -0,0 +1,3 @@
[Sockets]
sockets.use_system_read = On

View File

@@ -0,0 +1,3 @@
[Tidy]
tidy.clean_output = Off

View File

@@ -0,0 +1,6 @@
[soap]
soap.wsdl_cache_enabled = On
soap.wsdl_cache_dir = {"/var/lib/php/php$PHP_VERSION/wsdlcache"}
soap.wsdl_cache_ttl = 86400
soap.wsdl_cache_limit = 5

View File

@@ -0,0 +1,3 @@
[ldap]
ldap.max_links = -1

View File

@@ -0,0 +1,28 @@
#php logging
:programname, isequal, "php" /var/log/php/php/error.log
& stop
:programname, startswith, "php-fpm" /var/log/php/php/php-fpm.log
& stop
:programname, startswith, "php55-fpm" /var/log/php/php55/php55-fpm.log
& stop
:programname, startswith, "php56-fpm" /var/log/php/php56/php56-fpm.log
& stop
:programname, startswith, "php70-fpm" /var/log/php/php70/php70-fpm.log
& stop
:programname, startswith, "php71-fpm" /var/log/php/php71/php71-fpm.log
& stop
:programname, startswith, "php72-fpm" /var/log/php/php72/php72-fpm.log
& stop
:programname, startswith, "php73-fpm" /var/log/php/php73/php73-fpm.log
& stop
:programname, startswith, "php74-fpm" /var/log/php/php74/php74-fpm.log
& stop
:programname, startswith, "php80-fpm" /var/log/php/php80/php80-fpm.log
& stop
:programname, startswith, "php81-fpm" /var/log/php/php81/php81-fpm.log
& stop
:programname, startswith, "php82-fpm" /var/log/php/php82/php82-fpm.log
& stop
:programname, startswith, "php83-fpm" /var/log/php/php83/php83-fpm.log
& stop

View File

@@ -0,0 +1 @@
PIDFILE=/var/run/php-fpm/php{ $PHP_VERSION }-fpm.pid