; Exponential 6: a PHP-FPM pool for one installation
;
; Free documentation: GFDL 1.3 or later, see doc/eng-us/README-LICENSE.md.
;
; Derived from doc/eng-us/install/08-serving-the-site.md (8.5.2) and 13 (security
; hardening); not shipped by the kernel. Explained in php-fpm.md next to this
; file. One pool per site, running as the user the installation's files
; belong to, listening on a socket only the web server can open.
;
; Install: copy to the pool directory of the PHP that serves the site
; (/etc/php-fpm.d/ on Red Hat style systems, /etc/php/8.x/fpm/pool.d/ on
; Debian, /opt/plesk/php/8.x/etc/php-fpm.d/ is Plesk's own and written by
; Plesk), replace "example" and the paths, check with "php-fpm -t" and reload
; the master that serves the site ("systemctl reload php-fpm", or the unit
; [DeploySettings] PhpFpmService=auto finds: exp:velocity deploy --dry-run).

[example.com]
; The user and group the installation's files belong to (8.7)
user = example
group = example

; The socket the web server passes requests to: the same path as
; "proxy:unix:...|fcgi://localhost" (Apache), fastcgi_pass (nginx) or
; reverse_proxy unix//... (Caddy). Only the web server's user may open it.
listen = /run/php-fpm/example.com.sock
listen.owner = apache
listen.group = apache
listen.mode = 0660

; Workers: "ondemand" starts them when requests come and suits small sites;
; "dynamic" keeps spares for busy ones. Size max_children by memory: each
; worker can use up to memory_limit.
pm = dynamic
pm.max_children = 16
pm.start_servers = 4
pm.min_spare_servers = 2
pm.max_spare_servers = 6
pm.max_requests = 1000

; Requests slower than this are logged with a backtrace
request_slowlog_timeout = 10s
slowlog = /var/log/php-fpm/example.com-slow.log
; A hard limit per request, a little above max_execution_time
request_terminate_timeout = 300s

; The front controllers are .php files; no other extension runs
security.limit_extensions = .php

; Environment: FPM clears it by default, which is right; PATH for the
; programs the kernel may start (image conversion, git for the help)
clear_env = yes
env[PATH] = /usr/local/bin:/usr/bin:/bin

; PHP settings of this pool (php_admin_*: a script cannot change them)
php_admin_value[memory_limit] = 256M
php_admin_value[max_execution_time] = 120
php_admin_value[upload_max_filesize] = 32M
php_admin_value[post_max_size] = 64M
php_admin_value[max_input_vars] = 10000
php_admin_flag[display_errors] = off
php_admin_flag[log_errors] = on
php_admin_value[error_log] = /var/log/php-fpm/example.com-error.log
php_admin_flag[expose_php] = off
php_admin_value[date.timezone] = UTC

; Sessions: with site.ini [Session] Handler empty (the default) PHP keeps
; them, in files. A directory of this site only, owned by the pool's user,
; mode 0700 (not shared with other sites on the machine). With
; Handler=ezpSessionHandlerDB the database keeps them and this is unused.
php_value[session.save_handler] = files
php_value[session.save_path] = /var/lib/php/session/example.com
php_admin_flag[session.cookie_httponly] = on
php_admin_flag[session.use_strict_mode] = on

; OPcache: on, with room for the kernel and the extensions. After a change of
; a PHP class, reload the pool (or set revalidate_freq above 0 and wait).
php_admin_flag[opcache.enable] = on
php_admin_value[opcache.memory_consumption] = 256
php_admin_value[opcache.max_accelerated_files] = 20000
php_admin_value[opcache.interned_strings_buffer] = 32
php_admin_value[opcache.revalidate_freq] = 2

php bin/php/console exp:velocity deploy --dry-run --no-velocity --allow-root-user   # shows the unit it found and why
php bin/php/console exp:velocity deploy --no-velocity --allow-root-user