Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

phpfpm service: one service per pool for isolation #22154

Merged
merged 2 commits into from Feb 27, 2017
Merged

phpfpm service: one service per pool for isolation #22154

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e3d58da
phpfpm service: one service per pool for isolation
fpletz Jan 25, 2017
ec4ead0
phpfpm service: add target and slice
fpletz Feb 27, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
54 changes: 39 additions & 15 deletions nixos/modules/services/web-servers/phpfpm/default.nix
View file
Open in desktop
Expand Up @@ -4,24 +4,25 @@ with lib;

let
cfg = config.services.phpfpm;
enabled = cfg.poolConfigs != {} || cfg.pools != {};

stateDir = "/run/phpfpm";

poolConfigs = cfg.poolConfigs // mapAttrs mkPool cfg.pools;

mkPool = n: p: ''
[${n}]
listen = ${p.listen}
${p.extraConfig}
'';

cfgFile = pkgs.writeText "phpfpm.conf" ''
fpmCfgFile = pool: poolConfig: pkgs.writeText "phpfpm-${pool}.conf" ''
[global]
error_log = syslog
daemonize = no
${cfg.extraConfig}

${concatStringsSep "\n" (mapAttrsToList mkPool cfg.pools)}

${concatStringsSep "\n" (mapAttrsToList (n: v: "[${n}]\n${v}") cfg.poolConfigs)}
[${pool}]
${poolConfig}
'';

phpIni = pkgs.runCommand "php.ini" {
Expand Down Expand Up @@ -119,18 +120,41 @@ in {
};
};

config = mkIf (cfg.pools != {} || cfg.poolConfigs != {}) {
config = mkIf enabled {

systemd.slices.phpfpm = {
description = "PHP FastCGI Process manager pools slice";
};

systemd.services.phpfpm = {
systemd.targets.phpfpm = {
description = "PHP FastCGI Process manager pools target";
wantedBy = [ "multi-user.target" ];
preStart = ''
mkdir -p "${stateDir}"
'';
serviceConfig = {
Type = "notify";
ExecStart = "${cfg.phpPackage}/bin/php-fpm -y ${cfgFile} -c ${phpIni}";
ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
};
};

systemd.services = flip mapAttrs' poolConfigs (pool: poolConfig:
nameValuePair "phpfpm-${pool}" {
description = "PHP FastCGI Process Manager service for pool ${pool}";
after = [ "network.target" ];
wantedBy = [ "phpfpm.target" ];
partOf = [ "phpfpm.target" ];
preStart = ''
mkdir -p ${stateDir}
'';
serviceConfig = let
cfgFile = fpmCfgFile pool poolConfig;
in {
Slice = "phpfpm.slice";
PrivateTmp = true;
PrivateDevices = true;
ProtectSystem = "full";
ProtectHome = true;
NoNewPrivileges = true;
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
Type = "notify";
ExecStart = "${cfg.phpPackage}/bin/php-fpm -y ${cfgFile} -c ${phpIni}";
ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
};
}
);
};
}