New httpd and PHP

[morophla]

Is someone knows how to setup PHP with the new httpd web server on OpenBSD 5.6?

It's really boring how there's is no documentation for this new webserver... The man page says nothing about PHP and the example httpd.conf file is very incomplete not showing all commented (#) availables options.

Why the developper doesn't give all availables options in the example conf file?

So I want to setup PHP with this server. Anyone knows how to?

[jggimi]

See /etc/examples/httpd.conf for an example that uses php-fpm.

[jggimi]

Reyk Flöter presented this slide deck at AsiaBSDCon 2015. (Related paper.).

It not only covers the development of the FastCGI interface used by php-fpm, mentioned above, but may be of general interest to OpenBSD users, as it discusses the history of all of the webservers that have been included in the base, and gives clear reasoning for the removal of nginx from base.

[jjthomas]

Here is how I got it going:
I had to install the php-fpm package.
I restarted httpd
I started fpm with

/etc/rc.d/php_fpm start

If I understand correctly, in order to start after reboot I need to have this in my rc.conf.local file:

pkg_scripts="php_fpm"

I hope that helps.

-JJ

[hanzer]

The default /etc/php-fpm.conf doesn't seem to be adequate to start the service.

$ sudo php-fpm-5.6

                                                              
[17-Aug-2015 12:16:30] ALERT: [pool www] user has not been defined
[17-Aug-2015 12:16:30] ERROR: failed to post process the configuration
[17-Aug-2015 12:16:30] ERROR: FPM initialization failed

Is anyone willing to post their php config files?

Also, I didn't know what might be needed during my PHP dev explorations so I installed everything. Are there any conflicts or contradictions in here?

$ pkg_info | grep php

php-5.6.5           server-side HTML-embedded scripting language
php-bz2-5.6.5       bzip2 compression extensions for php5
php-curl-5.6.5      curl URL library extensions for php5
php-fastcgi-5.6.5   stand-alone FastCGI version of PHP
php-fpm-5.6.5       stand-alone FPM version of PHP
php-gd-5.6.5        image manipulation extensions for php5
php-gmp-5.6.5       gmp math library support for php5
php-markdown-1.0.1np0 Markdown implementation for PHP
php-mcrypt-5.6.5    mcrypt encryption/decryption extensions for php5
php-odbc-5.6.5      odbc database access extensions for php5
php-pgsql-5.6.5     pgsql database access extensions for php5
php-pspell-5.6.5    pspell library extensions for php5
php-shmop-5.6.5     shared memory extensions for php5
php-tidy-5.6.5      tidy HTML cleaner bindings
php-xmlrpc-5.6.5    XML RPC functions for php5
php-xsl-5.6.5       XSL functions for php5
php-zip-5.6.5       zip functions for php5

[jggimi]

I use php-fpm with nginx, but the settings should be similar. I'll dig through my configuration files when I'm out from behind $DAYJOB's Great Corporate Firewall (tm).

Meanwhile, I note there was a -stable update to php 5.6 which affecting this configuration file, and it was committed on May 18. You'll want the -stable php 5.6, as it may resolve your problem.

(My system running php with nginx is 5.7-stable/i386.)

[hanzer]

Originally Posted by jggimi

Meanwhile, I note there was a -stable update to php 5.6 which affecting this configuration file, and it was committed on May 18. You'll want the -stable php 5.6, as it may resolve your problem.

(My system running php with nginx is 5.7-stable/i386.)

The system I am working with is also a 5.7-stable/i386. PHP was installed with pkg_add.
$ echo $PKG_PATH

ftp://ftp.openbsd.org/pub/OpenBSD/5.7/packages/i386/

Does PHP need to be built from an updated /usr/ports tree to get the -stable version? That should only take a day or two Updating src, ports, and xenocara now. Will build all tonight and take another crack at configuring PHP tomorrow. Looking forward to seeing your config

[jggimi]

You'll note the date on that package is May 9, which predates the commit. The Project does not build -stable packages; we -stable users must build them ourselves or use M:Tier's services.

Here is the -stable php-fpm.conf file, with the bazillion comments removed:

[global]
[www]
user = www
group = www
listen = /var/www/run/php-fpm.sock
listen.owner = www
listen.group = www
listen.mode = 0660
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
chroot = /var/www

Here is my php-fpm.conf file, with the bazillion comments removed. The only difference from the default is I am using the loopback address rather than a filesystem TCP socket, so I have a different listen value, and I do not use the listen.* filesystem options.

I'm using the loopback NIC for historical reasons -- the nginx webserver and the PHP application server used to be on separate systems.

[global]
[www]
user = www
group = www
listen = 127.0.0.1:9000
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
chroot = /var/www

Comparing the -stable and -release versions of /usr/local/share/examples/php5.6/php-fpm.conf, the only differences I note are in the comments.

[hanzer]

Thanks, jggimi! The recent 5.7-stable version (php-fpm-5.6.10) starts and works just fine with the default conf file settings.

[hanzer]

This might be a resources issue. Here's my test setup (unbound resolves names):

/etc/httpd.conf

prefork 1

server "lucidrine.bohemia.net" {
        listen on 192.168.0.1 port 80

        directory { no auto index, index "index.php" }

        location "*.php" {
                fastcgi socket "/run/php-fpm.sock"
        }

        root "/htdocs/lucidrine.bohemia.net"
}

/var/www/htdocs/lucidrine.bohemia.net/index.php

<!DOCTYPE html>
<html>
  <head>
         <title>Test</title>
  </head>
  <body>
        <?php
                echo "<h1>Hello World!</h1>";
                phpinfo(); 
        ?>
  </body>
</html>

$ curl http://lucidrine.bohemia.net/

curl: (52) Empty reply from server

/var/log/php-fpm.log

[19-Aug-2015 16:05:54] NOTICE: fpm is running, pid 7052
[19-Aug-2015 16:05:54] NOTICE: ready to handle connections
[19-Aug-2015 16:06:51] WARNING: [pool www] child 13258 exited on signal 11 (SIGSEGV) after 56.000000 seconds from start
[19-Aug-2015 16:06:51] NOTICE: [pool www] child 637 started
[19-Aug-2015 16:07:41] WARNING: [pool www] child 32699 exited on signal 11 (SIGSEGV) after 106.000000 seconds from start
[19-Aug-2015 16:07:41] NOTICE: [pool www] child 22138 started

Is there a tuning guide anywhere? The default settings don't seem to utilize the machine's resources and sometimes programs seem to hit the limit and either fail to start or coredump.

$ top

Memory: Real: 63M/139M act/tot Free: 856M Cache: 44M Swap: 0K/2045M

Edit2: It works without the phpinfo() function.

[jggimi]

I just did this in a virtual machine, using your httpd.conf and index.php, and was successful. I used i386-stable, and the -stable packages I'd built. However, I used php 5.5, not 5.6.

If I recall correctly, I'm on 5.5 because of a php-<something> sub package dependency which was not available with 5.6.

[hanzer]

If it's a resource issue, is there a way to coax OpenBSD into using more of what's available? I haven't found a decent explanation of how to do that (yet). The defaults seem to assume a very limited machine. Often, programs seem to hit that very low ceiling. Any doc pointers and maybe suggestions for conf files? (jeez, does it sound like I'm getting lazy? )

/etc/login.conf

default:\
        :path=/usr/bin /bin /usr/sbin /sbin /usr/X11R6/bin /usr/local/bin /usr/local/sbin:\
        :umask=022:\
        :datasize-max=512M:\
        :datasize-cur=512M:\
        :maxproc-max=256:\
        :maxproc-cur=128:\
        :openfiles-cur=512:\
        :stacksize-cur=4M:\
        :localcipher=blowfish,8:\
        :ypcipher=old:\
        :tc=auth-defaults:\
        :tc=auth-ftp-defaults:

#
# Settings used by /etc/rc and root
# This must be set properly for daemons started as root by inetd as well.
# Be sure reset these values back to system defaults in the default class!
#
daemon:\
        :ignorenologin:\
        :datasize=infinity:\
        :maxproc=infinity:\
        :openfiles-cur=1024:\
        :stacksize-cur=8M:\
        :localcipher=blowfish,9:\
        :tc=default:

#
# Staff have fewer restrictions and can login even when nologins are set.
#
staff:\
        :datasize-cur=infinity:\
        :datasize-max=infinity:\
        :datasize=infinity:\
        :openfiles-cur=4096:\
        :maxproc-max=512:\
        :maxproc-cur=512:\
        :ignorenologin:\
        :requirehome@:\
        :tc=default:

#
# Authpf accounts get a special motd and shell
#
authpf:\
        :welcome=/etc/motd.authpf:\
        :shell=/usr/sbin/authpf:\
        :tc=default:

#
# Override resource limits for certain daemons started by rc.d(8)
#
bgpd:\
        :openfiles-cur=512:\
        :tc=daemon:

unbound:\
        :openfiles-cur=512:\
        :tc=daemon:

/etc/sysctl.conf

net.inet.ip.forwarding=1
hw.allowpowerdown=1
kern.usermount=1
machdep.allowaperture=2

[jggimi]

I just built 5.6.10 on my i386-stable build machine, and installed it in the -stable virtual machine. I cannot reproduce your problem.

This was a 5.7-stable installation. The only changes from default install were the addition of your httpd.conf (with an address on my local network) , your index.php, and an /etc/rc.conf.local file containing only:

http_flags=
pkg_scripts=php_fpm

The browser was tested against the listening IP address, so DNS was not involved.

It's a default Qemu virtual machine, with 128MB of virtual RAM, with virtio(4) drivers used for storage and for network interconnect. I ran the network in tap mode, so the virtual machine is on the local network and I could reach it from my browser. The vlan2 NIC is the local subnet.

sudo ifconfig tun0 link0
sudo ifconfig bridge0 add tun0 add vlan2 up

sudo sh -c "qemu-system-i386 -runas $USER \
-nographic \
-net nic,model=virtio -net tap \
-drive file=i386.img,if=virtio,format=raw"

You are getting SIGSEGV - segmentation violations. This doesn't appear to be resources. I suspect a misconfiguration of software of some kind. Double check libraries. Here's the output from $ ldd /usr/local/sbin/php-fpm-5.6 on that functioning -stable test system. Do you have the same levels of libraries in yours?

php-fpm-5.6:
    Start    End      Type Open Ref GrpRef Name
    145a5000 34aed000 exe  1    0   0      /usr/local/sbin/php-fpm-5.6
    095f8000 29601000 rlib 0    1   0      /usr/lib/libreadline.so.4.0
    0f30a000 2f31a000 rlib 0    1   0      /usr/lib/libncurses.so.14.0
    02653000 22683000 rlib 0    1   0      /usr/lib/libstdc++.so.57.0
    0c18f000 2c193000 rlib 0    1   0      /usr/local/lib/libintl.so.6.0
    0afd2000 2b001000 rlib 0    1   0      /usr/lib/libc.so.78.1
    0d08b000 2d093000 rlib 0    2   0      /usr/lib/libz.so.5.0
    02a95000 22a9e000 rlib 0    3   0      /usr/lib/libm.so.9.0
    05274000 25281000 rlib 0    1   0      /usr/lib/libssl.so.32.0
    0d099000 2d0e1000 rlib 0    1   0      /usr/lib/libcrypto.so.32.0
    008da000 20902000 rlib 0    1   0      /usr/local/lib/libxml2.so.15.1
    0d7e8000 2d7f2000 rlib 0    2   0      /usr/local/lib/liblzma.so.2.0
    014f5000 215d5000 rlib 0    3   0      /usr/local/lib/libiconv.so.6.0
    0ef4b000 2ef50000 rlib 0    2   0      /usr/lib/libpthread.so.18.1
    037d4000 037d4000 rtld 0    1   0      /usr/libexec/ld.so

[hanzer]

Originally Posted by jggimi

You are getting SIGSEGV - segmentation violations. This doesn't appear to be resources. I suspect a misconfiguration of software of some kind. Double check libraries. Here's the output from $ ldd /usr/local/sbin/php-fpm-5.6 on that functioning -stable test system. Do you have the same levels of libraries in yours?

I updated src, xenocara, and ports two days ago then compiled the kernel, userland, xenocara, and php.

OpenBSD 5.7-stable (GENERIC.MP) #1: Mon Aug 17 22:10:29 EDT 2015

/usr/local/sbin/php-fpm-5.6:
        Start    End      Type Open Ref GrpRef Name
        1506e000 355b5000 exe  1    0   0      /usr/local/sbin/php-fpm-5.6
        04234000 2423d000 rlib 0    1   0      /usr/lib/libreadline.so.4.0
        05e57000 25e67000 rlib 0    1   0      /usr/lib/libncurses.so.14.0
        01396000 213c6000 rlib 0    1   0      /usr/lib/libstdc++.so.57.0
        0d465000 2d469000 rlib 0    1   0      /usr/local/lib/libintl.so.6.0
        01747000 21776000 rlib 0    1   0      /usr/lib/libc.so.78.1
        0db86000 2db8e000 rlib 0    2   0      /usr/lib/libz.so.5.0
        01024000 2102d000 rlib 0    3   0      /usr/lib/libm.so.9.0
        0c858000 2c865000 rlib 0    1   0      /usr/lib/libssl.so.32.0
        08d96000 28dde000 rlib 0    1   0      /usr/lib/libcrypto.so.32.0
        0de35000 2de5d000 rlib 0    1   0      /usr/local/lib/libxml2.so.15.1
        010f4000 210fe000 rlib 0    2   0      /usr/local/lib/liblzma.so.2.0
        0d120000 2d200000 rlib 0    3   0      /usr/local/lib/libiconv.so.6.0
        09015000 2901a000 rlib 0    2   0      /usr/lib/libpthread.so.18.1
        0c08f000 0c08f000 rtld 0    1   0      /usr/libexec/ld.so

[jggimi]

OK, then I'm at a loss to explain the errors, as the libraries match. And, since I can't replicate the error, I can't help with debugging it.

According to signal(3), SIGSEGV should create a core(5) image. There may be .core files available.

[hanzer]

$ pkg_info | grep -i php

php-5.6.10          server-side HTML-embedded scripting language
php-bz2-5.6.10      bzip2 compression extensions for php5
php-curl-5.6.10     curl URL library extensions for php5
php-fpm-5.6.10      stand-alone FPM version of PHP
php-pspell-5.6.10   pspell library extensions for php5
php-tidy-5.6.10     tidy HTML cleaner bindings
php-zip-5.6.10      zip functions for php5

$ php-5.6 -a

Interactive shell

php > phpinfo();
php-5.6:/usr/local/lib/php-5.6/modules/tidy.so: undefined symbol 'tidyReleaseDate'
lazy binding failed!
Segmentation fault (core dumped)

$ sudo pkg_delete php-tidy-5.6.10
$ sudo /etc/rc.d/php_fpm restart

Success, httpd returns the phpinfo page!

Hmm, so what's wrong with php-tidy-5.6.10? Or what did I do wrong?

[hanzer]

Thanks, jggimi! Your help is always awesome. I learn new stuff with every interaction.

[jggimi]

Well, I installed php-tidy, and still could not replicate the failure. And ldd(1) shows tidy was built with libpthread.so.18.1. I'll assume yours was too, but before digging through .core files with gdb(1), you might double-check that.

I always double-check libraries ... probably because mismatches are a common thing to check when running -current. (I run -current on workstations, where I only keep -stable for building.)

[hanzer]

$ ldd /usr/local/bin/tidy

/usr/local/bin/tidy:
        Start    End      Type Open Ref GrpRef Name
        1a5b7000 3a5bc000 exe  1    0   0      /usr/local/bin/tidy
        08f87000 28f9e000 rlib 0    1   0      /usr/local/lib/libtidyp-1.04.so.0.0
        01f62000 21f91000 rlib 0    1   0      /usr/lib/libc.so.78.1
        0c3eb000 0c3eb000 rtld 0    1   0      /usr/libexec/ld.so

Many of the installed packages are probably out of date with the current ports. I guess the problem has to do with that. Is there a canonical way to update (build from ports) all installed packages after each src,xenocara,ports update?

[jggimi]

Wrong tidy. That's a binary from www/tidyp. I know, because I have databases/pkglocatedb installed.

$ pkglocate bin/tidy
tidyp-1.04p1v0:www/tidyp:/usr/local/bin/tidy
tidyp-1.04p1v0:www/tidyp:/usr/local/bin/tidyp
$

Here's what I know about the php-tidy I installed:

$ pkg_info -L php-tidy
Information for inst:php-tidy-5.6.10

Files:
/usr/local/lib/php-5.6/modules/tidy.so
/usr/local/share/examples/php-5.6/tidy.ini


$ ldd /usr/local/lib/php-5.6/modules/tidy.so
/usr/local/lib/php-5.6/modules/tidy.so:
    Start     End      Type Open Ref GrpRef Name
    09bf5000 29bfa000 dlib 1    0    0      /usr/local/lib/php-5.6/modules/tidy.so
    0ad31000 2ad48000 rlib 0    1    0      /usr/local/lib/libtidyp.so.0.0
    043da000 243df000 rlib 0    2    0      /usr/lib/libpthread.so.18.1
$