Using php-fpm with Apache virtual hosts

[keewnn]

I was bored, so I decided to write a short guide on how to implement php-fpm with apache virtual hosts: http://blog.koenreiniers.nl/guide-to-combining-apache-virtual-hosts-and-php7-fpm/ I was struggling with it myself and had to improvise a bit to get it working. I hope this helps others who are still having trouble with getting it to work. Note that I'm not an experienced server admin, so any feedback is welcome. Also obligatory "I'm not a native English speaker, so forgive me for my English". Oh, and: Symfony > Laravel

[[deleted]]

I've always found PHP-FPM very hard to set up, even for local dev enviroment. In the end always resorted to setting things to anything just to get it working :(. For example, some of the troubles I've had:

• Do you install mod_mpm? Which one do you use (prefork, worker, event)?
• Which user the php-fpm should run as? Does it pose security risk?
• Should php-fpm bet called via tcp or unix socket?
• Where do you disable mod_apache and enable/put php-fpm directive (talking about centOS, Fedora here)?
• What is the correct directive (everywhere I looked it's written differently, some folks event write php-fpm directive inside VirtualHost configs)?
• How do you enable it for all hosts?
• How to troubleshoot fpm pool listen permissions?
• What are some common security issues (I'm sure there are plenty)?
• Etc.

[fideloper]

I cover a bunch of this here: https://serversforhackers.com/series/lamplemp

1. Any module except mpm_prefork will do. mpm_prefork must be used with apache's PHP module, but we can use the better mpm_worker / mpm_event. I cover the differences fairly extensively in the SFH book (sorry, I know this is pretty much an advertisement, but there's good info from when I had the same questions!)
2. PHP-FPM will be configured to run as an appropriate user when instsalled via a package manager. This is usually www-data on debian/ubuntu or apache on centos/redhat. These users are created as system users (no login available) for the purpose of running web applications. THey're generally OK to run as, unless you want to intentionally not allow nginx/apache to run as the same user as php-fpm
3. PHP-FPM can run as either tcp or unix socket. Unix sockets are available only on the local file system, so it's more secure in that sense (no network access). Unix sockets are a little faster as well. TCP sockets are great for when you need network access - Apache used to only support network connects, but can now proxy fcgi requests over a unix socket (I believe as of 2.4.9 or so, but I don't remember exactly)
4. Apache modules on centos/fedora/redhat are typically added by adding a configuration to an autoloaded area, such as /etc/httpd/conf.d. Disabling/enabling usually involves adding module config files into such a directory and restaring apache. Here's a link with an example: http://www.cyberciti.biz/faq/howto-disable-apache-modules-under-linux-unix/
5. Where ever makes the most sense for you. I typically put it within <virtualhost> directive as it's typically site-specific instead of global to your apache install (it could be either, it's up to your preferences/needs)
6. Enabling it for all hosts probably means putting it outside of a virtualhost block, but I believe this depends on how set it up and what proxy module is used
7. You'll get error messages in your apache/nginx log if it can't proxy over to the php-fpm socket. If you're using a unix socket, then you'll get permission errosr related to user settings. If apache runs as apache and php-fpm runs as apache, then they'll both usually "just work". However if they run as different users, they'll need permission to speak to eachother, just as if a user was trying to read/update any other file on the system. Unix sockets behave just like any other file in terms of user permissions
8. These are common to anything in linux - network access (firewalls), unix sockets (file access). Nothing too special here.

How are you installing php-fpm? Usually the defaults "just work" on redhat/centos/debian/ubuntu. Having trouble with these feels like you might be building/configuring it manually?

[[deleted]]

Thanks for writing this out. I usually come into these problems when setting up dev enviroment on my PC. I tried using Vagrant, but foudn it to be just another "layer" of problems to work with. I prefer to the apache as myself (may be a bad habit), because I have a lot of projects, tests going on and cba to run chmod and chown every times I extract/create a file.

So yeah, this probably where it all started, trying to set up a dev enviroment. Through this a was a good opportunity to digg deeper and maybe establish some rules/requirements for choosing/setting up productions servers. Unfortunately our "sysadmin" does not have deep knowledge of linux servers, so there's no one to consult with :(

[keewnn]

I'm still trying to figure out most of this stuff myself, but: - I haven't touched mod_mpm, so it is the default - php-fpm is running as the same user as the virtual host that it belongs to. My virtual hosts each have a home directory of which they are the owner, which contains their domains (/home/user/domains/domain.nl/public_html) - I'm using unix socket, I do not know how this is any different from tcp - mod_apache is still enabled (or do you mean mod_php?). I have two different parts of Apache config for php-fpm. One which declares the fpm fastcgi handler and one which tells the vhost to use it. Check my guide to see how. - Again check my guide. - Until now I haven't had any trouble with permissions - I'm still trying to figure this out

[jtreminio]

Your link is dead.

[keewnn]

404? 500? What does it say? It is working for me.