[ { "path": ".gitignore", "content": "# Ignore paths from OS X\n.DS_Store\n" }, { "path": "ANNOUNCEMENT.md", "content": "# The Future of Ægir 3 is Bryght!\n*Announcement from Omega8.cc*\n\nOmega8.cc is now the lead developer team for Ægir 3 running on BOA (Barracuda-Octopus-Ægir stack). We want to thank all past contributors who brought Ægir to life – your work makes today’s progress possible. Because of you, there is still a Bryght Future for Ægir.\n\n\"Ægir-Sector\"\n\n## What to Expect\n\n- **Active maintenance and development**: Ægir 3 on BOA is alive and under active development. [See Adam’s comments here](https://www.drupal.org/project/hostmaster/issues/3517915).\n- **Migration made easier**: We are working to make it simple to migrate entire legacy Ægir instances (Apache or Nginx) into self-hosted BOA as Octopus Ægir.\n- **Standalone Ægir with BOA features**: We are doing our best to enable many BOA-derived features within Ægir standalone, so users can pick their flavour without adopting the full BOA stack.\n- **Modern compatibility**: The BOA-based fork already supports **Drupal 11** and **PHP 8.4**, using vanilla **Drush 13** for site installs and updates while still relying on forked and improved **Drush 8** for daily operations.\n\n## Development & Community\n\nDevelopment of BOA stack components continues here on GitHub:\n👉 https://github.com/omega8cc/boa\n\nAt the same time, we continue to leverage the Drupal.org issue queues so **the community effort continues there** too, and all BOA improvements can be systematically **backported**.\n\nÆgir is still very much alive, and together we can keep its **Bryght** Future shining!\n" }, { "path": "BARRACUDA.sh.txt", "content": "#!/bin/bash\n\n\n###----------------------------------------###\n###\n### Barracuda Ægir Installer\n###\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n### This program is free software. You can\n### redistribute it and/or modify it under\n### the terms of the GNU GPL as published by\n### the Free Software Foundation, version 2\n### or later.\n###\n### This program is distributed in the hope\n### that it will be useful, but WITHOUT ANY\n### WARRANTY; without even the implied\n### warranty of MERCHANTABILITY or FITNESS\n### FOR A PARTICULAR PURPOSE. See the GNU GPL\n### for more details.\n###\n### You should have received a copy of the\n### GNU GPL along with this program.\n### If not, see http://www.gnu.org/licenses/\n###\n### Code: https://github.com/omega8cc/boa\n###\n###----------------------------------------###\n\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nexport SHELL=/bin/bash\n\n###\n### Software versions\n###\n_ADMINER_VRN=4.8.1\n_BZR_VRN=2.6.0\n_CGP_VRN=master-22-07-2020\n_CHIVE_VRN=1.3\n_COMPOSER_VRN=2.8.2\n_CSF_VRN=15.00\n_CURL_VRN=8.20.0\n_DB_SRC=repo.percona.com\n###\n###\n_DRUSH_ELEVEN_VRN=11.6.0.9\n_DRUSH_TEN_VRN=10.6.2.9\n_DRUSH_EIGHT_VRN=8.5.0.5\n_DRUSH_EIGHT_TEST_VRN=8.5.0-force\n###\n###\n_GEOS_VRN=3.7.1\n_GIT_VRN=2.51.0\n_GOACCESS_VRN=1.9.4\n_ICU_LEGACY_VRN=52_2\n_ICU_MODERN_VRN=73-1\n_IMAGE_MAGICK_VRN=7.1.1-7\n_IMAGICK_OLD_VRN=3.1.2\n_IMAGICK_VRN=3.8.1\n_IONCUBE_VRN=15.0.0\n_JETTY_7_VRN=7.6.17.v20150415\n_JETTY_8_VRN=8.1.17.v20150415\n_JETTY_9_VRN=9.2.16.v20160414\n_JSMIN_PHP_LEGACY_VRN=2.0.1\n_JSMIN_PHP_MODERN_VRN=3.1.0\n_LIB_TIDY_VRN=5.2.0\n_LIB_YAML_VRN=0.2.5\n_LOGJ4_VRN=1.2.17\n_LSHELL_VRN=0.10\n_MAILPARSE_VRN=2.1.6\n_NEW_RELIC_VRN=12.6.0.34\n_NODE_VRN=v22.21.0\n_MONGO_VRN=1.6.14\n_MONGODB_VRN=1.2.5\n_MSS_VRN=master-29-06-2024\n_MYQUICK_VRN_ONE=0.19.3-3\n_MYQUICK_VRN_TWO=0.21.3-2\n_MYSQLTUNER_VRN=1.9.4\n_NGINX_VRN=1.29.8\n_OPENSSH_VRN=10.3p1\n_OPENSSL_LEGACY_VRN=1.0.2u\n_OPENSSL_EOL_VRN=1.1.1w\n_OPENSSL_MODERN_VRN=3.5.6\n_PERCONA_5_7_VRN=5.7\n_PERCONA_8_0_VRN=8.0\n_PERCONA_8_4_VRN=8.4\n_PHP56_API=20131226\n_PHP56_VRN=5.6.40\n_PHP70_API=20151012\n_PHP70_VRN=7.0.33\n_PHP71_API=20160303\n_PHP71_VRN=7.1.33\n_PHP72_API=20170718\n_PHP72_VRN=7.2.34\n_PHP73_API=20180731\n_PHP73_VRN=7.3.33\n_PHP74_API=20190902\n_PHP74_VRN=7.4.33\n_PHP80_API=20200930\n_PHP80_VRN=8.0.30\n_PHP81_API=20210902\n_PHP81_VRN=8.1.34\n_PHP82_API=20220829\n_PHP82_VRN=8.2.31\n_PHP83_API=20230831\n_PHP83_VRN=8.3.31\n_PHP84_API=20240924\n_PHP84_VRN=8.4.21\n_PHP85_API=20250925\n_PHP85_VRN=8.5.6\n_PHP_APCU=5.1.27\n_PHP_IGBINARY_EIGHT_FIVE=3.2.17\n_PHP_IGBINARY_THREE=3.2.16\n_PHP_IGBINARY_TWO=2.0.8\n_PHP_MCRYPT=1.0.9\n_PHPREDIS_SIX_LATEST_VRN=6.3.0\n_PHPREDIS_SIX_MODERN_VRN=6.3.0\n_PHPREDIS_SIX_LEGACY_VRN=6.0.2\n_PHPREDIS_FIVE_VRN=5.3.7\n_PHPREDIS_FOUR_VRN=4.3.0\n_PHPREDIS_THREE_VRN=3.1.6\n_PURE_FTPD_VRN=1.0.52\n_PXC_VRN=1.4.16\n_VALKEY_NINE_VRN=9.0.3\n_VALKEY_EIGHT_VRN=8.1.4\n_VALKEY_SEVEN_VRN=7.2.11\n_REDIS_FOUR_VRN=4.0.14\n_REDIS_FIVE_VRN=5.0.9\n_REDIS_SIX_VRN=6.2.7\n_REDIS_SEVEN_VRN=7.0.15\n_RUBY_VRN=3.3.4\n_SLF4J_VRN=1.7.21\n_SOLR_1_VRN=1.4.1\n_SOLR_3_VRN=3.6.2\n_SOLR_4_VRN=4.9.1\n_SOLR_7_VRN=7.7.3\n_SOLR_9_VRN=9.8.1\n_TWIGC_VRN=1.24.0\n_UNBOUND_VRN=1.24.2\n_UPROGRESS_LEGACY_VRN=1.0.3.1\n_UPROGRESS_SEVEN_VRN=2.0.1.6\n_UPROGRESS_EIGHT_VRN=2.0.2\n_VNSTAT_VRN=2.13\n_WKHTMLTOX_VRN=12.6-1\n_YAML_PHP_LEGACY_VRN=1.3.2\n_YAML_PHP_SEVENO_VRN=2.1.0\n_YAML_PHP_MODERN_VRN=2.2.5\n_ZLIB_VRN=1.3.1\n\n\n###\n### Default variables\n###\n_CUSTOM_NAME=\"nginx\"\n_DRUSH_VERSION=\"${_DRUSH_EIGHT_VRN}\"\n_DRUSH_VERSION_TEST=\"${_DRUSH_EIGHT_TEST_VRN}\"\n_FORCE_REDIS_RESTART=NO\n_LOC_OS_CODE=\"\"\n_PURGE_ALL_THISHTIP=NO\nexport _SMALLCORE7_V=7.105.1\nexport _DRUPAL7=\"drupal-${_SMALLCORE7_V}\"\n_SPINNER=NO\n_THIS_DB_PORT=3306\nif [ -n \"${STY+x}\" ]; then\n _SPINNER=NO\nfi\n\n\n###\n### Helper variables\n###\n_aptLiSys=\"/etc/apt/sources.list\"\n_barCnf=\"/root/.barracuda.cnf\"\n_bldPth=\"/opt/tmp/boa\"\n_crlGet=\"-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab\"\n_wgetGet=\"--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'\"\n_aptAllow=\"--allow-unauthenticated\"\n_aptYesUnth=\"-y ${_aptAllow}\"\n_filIncB=\"barracuda.sh.cnf\"\n_gitHub=\"https://github.com/omega8cc\"\n_gitLab=\"https://gitlab.com/omega8cc\"\n_libFnc=\"${_bldPth}/lib/functions\"\n_locCnf=\"${_bldPth}/aegir/conf\"\n_mtrInc=\"/var/aegir/config/includes\"\n_mtrNgx=\"/var/aegir/config/server_master/nginx\"\n_mtrTpl=\"/var/aegir/.drush/sys/provision/http/Provision/Config/Nginx\"\n_pthLog=\"/var/log/boa\"\n_vBs=\"/var/backups\"\n\n\n###\n### SA variables\n###\n_saCoreN=\"SA-CORE-2014-005\"\n_saCoreS=\"${_saCoreN}-D7\"\n_saIncDb=\"includes/database/database.inc\"\n_saPatch=\"/var/xdrago/conf/${_saCoreS}.patch\"\n\n\n###\n### Avoid too many questions\n###\nexport DEBIAN_FRONTEND=noninteractive\nexport APT_LISTCHANGES_FRONTEND=none\nif [ -z \"${TERM+x}\" ]; then\n export TERM=vt100\nfi\n\n\n###\n### Clean pid files on exit\n###\n_clean_pid_exit() {\n if [ -n \"${1}\" ]; then\n echo \"REASON ${1} on $(date)\" >> /root/.barracuda.sh.exit.exceptions.log\n [ -e \"/opt/tmp/boa\" ] && rm -rf /opt/tmp/*\n fi\n [ -e \"/run/boa_wait.pid\" ] && rm -f /run/boa_wait.pid\n [ -e \"/run/boa_run.pid\" ] && rm -f /run/boa_run.pid\n service cron start &> /dev/null\n _CNT=$(pgrep -fc 'tee -a /var/backups/barracuda-')\n if (( _CNT > 1 )); then\n pkill -f 'tee -a /var/backups/barracuda-'\n fi\n exit 1\n}\n\n\n###\n### Panic on missing include\n###\n_panic_exit() {\n echo\n echo \" EXIT: Required lib file not available?\"\n echo \" EXIT: $1\"\n echo \" EXIT: Cannot continue\"\n echo \" EXIT: Bye (0)\"\n echo\n _clean_pid_exit _panic_exit_a\n}\n\n\n###\n### Include default settings and basic functions\n###\n[ -r \"${_vBs}/${_filIncB}\" ] || _panic_exit \"${_vBs}/${_filIncB}\"\n source \"${_vBs}/${_filIncB}\"\n\n\n###\n### Download helpers and libs\n###\nif [ \"${_OS_CODE}\" = \"excalibur\" ]; then\n _DB_SERVER=Percona\nelse\n _DB_SERVER=Percona\nfi\nif [ \"$(boa info | grep -c ${_DB_SERVER})\" -lt 3 ] || [ ! -e \"/usr/sbin/csf\" ]; then\n if [ ! -e \"/opt/tmp/boa/aegir/helpers/apt.conf.noi.nrml\" ] \\\n || [ ! -e \"/opt/tmp/boa/aegir/helpers/apt.conf.noi.dist\" ]; then\n _download_helpers_libs\n fi\nelse\n _download_helpers_libs\nfi\n\n\n###\n### Include shared functions\n###\n_FL=\"helper dns system sql valkey redis nginx php solr master xtra firewall hotfix\"\nfor f in ${_FL}; do\n [ -r \"${_libFnc}/${f}.sh.inc\" ] || _panic_exit \"${f}\"\n source \"${_libFnc}/${f}.sh.inc\"\ndone\n\n\n###\n### Make sure we are running as root\n###\n_if_running_as_root_barracuda\n\n\n###\n### Welcome msg\n###\necho \" \"\n_msg \"Skynet Agent v.${_X_VERSION} on $(dmidecode -s system-manufacturer 2>&1) welcomes you aboard!\"\necho \" \"\nsleep 3\n\n\n###\n### Early procedures\n###\n_normalize_ip_name_variables\n_mode_detection\n_check_exception_mycnf\n_virt_detection\n_os_detection\n_os_detection_minimal\n_if_rebuild_src_on_major_os_upgrade\n_if_long_generate_on_major_os_upgrade\n\n\n###\n### Quick php-idle ON/OFF procedure only\n###\n_if_php_idle_on_off\n\n\n###\n### Packages install/update on init\n###\n_sources_list_update\n_basic_packages_install_on_init\n_more_packages_install_on_init\n_run_aptitude_full_upgrade\n\n\n###\n### Misc checks\n###\n_check_boa_php_compatibility\n_check_boa_version\nif [ \"${_CHECKS_REMOTE_REPOS}\" = \"YES\" ]; then\n _check_github_for_aegir_head_mode\n _check_db_src\n _check_git_repos\nfi\n_check_ip_hostname\n_check_prepare_dirs_permissions\n\n\n###\n### Turn Off AppArmor temporarily while running barracuda\n###\nif [ \"${_OS_CODE}\" = \"stretch\" ] || [ \"${_OS_CODE}\" = \"jessie\" ]; then\n [ ! -e \"/root/.turn_off_apparmor_in_octopus.cnf\" ] && touch /root/.turn_off_apparmor_in_octopus.cnf\nelse\n _turn_off_apparmor_temporarily\nfi\n\n\n###\n### Optional major system upgrades\n###\n_early_sys_ctrl_mark\n_if_post_major_os_upgrade\n_if_major_os_upgrade\n_normal_sys_ctrl_mark\n\n\n###\n### Upgrade only Ægir Master Instance (obsolete mode)\n###\nif [ \"${_ALLOW_HEAVY_REBUILDS}\" = \"YES\" ]; then\n _if_upgrade_only_aegir_master\nfi\n\n###\n### System packages install and update\n###\n_sys_packages_update\n_if_proxysql_update\n_sys_packages_install\n_java_check_fix\n_locales_check_fix\n\n\n###\n### Do not allow strong passwords until locales work properly\n###\nif [ \"${_LOCALE_TEST}\" = \"BROKEN\" ]; then\n _STRONG_PASSWORDS=NO\nfi\n\n\n###\n### Install key packages first\n###\n_run_aptitude_full_upgrade\n_run_aptitude_deps_install\n_kill_nash\n\n\n###\n### OpenSSL modern and legacy support\n###\n_LC_SSL_CTRL=\"/root/.install.legacy.openssl.cnf\"\n_MD_SSL_CTRL=\"/root/.install.modern.openssl.cnf\"\nif [ \"${_STATUS}\" = \"INIT\" ] || [ ! -x \"/usr/local/ssl/bin/openssl\" ]; then\n if [ -e \"${_MD_SSL_CTRL}\" ]; then\n chattr -i ${_MD_SSL_CTRL}\n rm -f ${_MD_SSL_CTRL}\n fi\n touch ${_LC_SSL_CTRL}\n _if_ssl_install_src\n _sync_system_ssl_certs\n _ssl_paths_sync\n _ssl_crypto_lib_fix\n _curl_install_src\nfi\nif [ -x \"/usr/local/ssl/bin/openssl\" ]; then\n [ -e \"${_LC_SSL_CTRL}\" ] && rm -f ${_LC_SSL_CTRL}\nfi\nif [ \"${_STATUS}\" = \"INIT\" ] || [ ! -x \"/usr/local/ssl3/bin/openssl\" ]; then\n if [ ! -e \"${_LC_SSL_CTRL}\" ]; then\n if [ ! -e \"${_MD_SSL_CTRL}\" ]; then\n touch ${_MD_SSL_CTRL}\n chattr +i ${_MD_SSL_CTRL}\n fi\n fi\nelif [ \"${_STATUS}\" = \"UPGRADE\" ]; then\n if [ ! -e \"/opt/php73/bin/php\" ] \\\n && [ ! -e \"/opt/php72/bin/php\" ] \\\n && [ ! -e \"/opt/php71/bin/php\" ] \\\n && [ ! -e \"/opt/php70/bin/php\" ] \\\n && [ ! -e \"/opt/php56/bin/php\" ]; then\n if [ ! -e \"${_MD_SSL_CTRL}\" ] \\\n && [ ! -e \"${_LC_SSL_CTRL}\" ]; then\n touch ${_MD_SSL_CTRL}\n chattr +i ${_MD_SSL_CTRL}\n fi\n fi\n if [ ! -x \"/usr/local/ssl/bin/openssl\" ] \\\n && [ -e \"${_LC_SSL_CTRL}\" ]; then\n if [ -e \"${_MD_SSL_CTRL}\" ]; then\n chattr -i ${_MD_SSL_CTRL}\n rm -f ${_MD_SSL_CTRL}\n fi\n fi\nfi\nif [ -x \"/usr/local/ssl/bin/openssl\" ] \\\n && [ -x \"/usr/local/ssl3/bin/openssl\" ]; then\n if [ ! -e \"${_MD_SSL_CTRL}\" ]; then\n touch ${_MD_SSL_CTRL}\n chattr +i ${_MD_SSL_CTRL}\n fi\nfi\n\n\n###\n### Install OpenSSL and cURL from sources\n###\nif [ \"${_ALLOW_HEAVY_REBUILDS}\" = \"YES\" ] || [ ! -x \"/usr/local/ssl3/bin/openssl\" ]; then\n _if_ssl_install_src\n _sync_system_ssl_certs\n _ssl_paths_sync\n _ssl_crypto_lib_fix\n _curl_install_src\nfi\n\n\n###\n### Install OpenSSH from sources\n###\nif [ \"${_SSH_FROM_SOURCES}\" = \"YES\" ] && [ \"${_ALLOW_HEAVY_REBUILDS}\" = \"YES\" ]; then\n if [ \"${_STATUS}\" = \"INIT\" ] || [ \"${_STATUS}\" = \"UPGRADE\" ]; then\n if [ \"${_OS_DIST}\" = \"Debian\" ] || [ \"${_OS_DIST}\" = \"Devuan\" ]; then\n _sshd_install_src\n _sshd_armour\n fi\n fi\nfi\n\n\n###\n### Install Percona server\n###\n_db_server_install\n\n\n###\n### Finalize initial Percona server and tools setup\n###\n_init_sql_root_credentials\n_sql_root_credentials_update\n_myquick_install_upgrade\n\n\n###\n### Install other services\n###\nif [ \"${_ALLOW_HEAVY_REBUILDS}\" = \"YES\" ]; then\n _nginx_install_upgrade\n _nginx_initd_check\n _nginx_mime_check_fix\n if [ \"${_VALKEY_MAJOR_RELEASE}\" = \"7\" ] \\\n || [ \"${_VALKEY_MAJOR_RELEASE}\" = \"8\" ] \\\n || [ \"${_VALKEY_MAJOR_RELEASE}\" = \"9\" ]; then\n _valkey_install_upgrade\n else\n _redis_install_upgrade\n fi\n _lshell_install_upgrade\n _magick_install_upgrade\n _php_install_deps\n _php_libs_fix\n _php_if_versions_cleanup_cnf\n if [ \"${_STATUS}\" = \"UPGRADE\" ]; then\n _php_ioncube_check_if_update\n _php_check_if_rebuild\n _mytop_install\n fi\n _php_install_upgrade\n _php_config_check_update\n _php_upgrade_all\n _if_install_php_newrelic\n _newrelic_check_fix\nfi\n_smtp_check\n_xdrago_install_upgrade\n_if_drupal_patches_update\n_mc_panels_ini_update\n\n\n###\n### Download system-wide Drush versions\n###\n_drush_system_install_update\n\n\n###\n### Install or upgrade Ægir Master Instance\n###\nif [ \"${_ALLOW_HEAVY_REBUILDS}\" = \"YES\" ]; then\n _aegir_master_install_upgrade\n _aegir_bin_extra_check_fix\n _nginx_wildcard_ssl_install\n _nginx_config_update_fix\n _aegir_master_display_login_link\nfi\n\n\n###\n### Install or upgrade DNS cache server\n###\nif [ \"${_STATUS}\" = \"UPGRADE\" ]; then\n _dns_unbound_install_upgrade\nfi\n\n\n###\n### Install or upgrade csf/lfd monitoring\n###\nif [ \"${_STATUS}\" = \"UPGRADE\" ]; then\n _csf_lfd_install_upgrade\nfi\n\n\n###\n### Optional add-on services\n###\nif [ \"${_STATUS}\" = \"INIT\" ] || [ \"${_STATUS}\" = \"UPGRADE\" ]; then\n if [ \"${_ALLOW_HEAVY_REBUILDS}\" = \"YES\" ]; then\n _if_install_ftpd\n _if_install_vnstat\n _if_install_wkhtmltox\n _if_install_chromium\n _if_install_git_src\n _if_install_ffmpeg\n _if_install_bzr\n [ ! -e \"/root/.deny.java.cnf\" ] && _if_install_upgrade_solr\n _if_install_adminer\n _if_install_chive\n _if_install_sqlbuddy\n _if_install_collectd\n _if_install_webmin\n _if_install_bind\n _if_install_ruby\n _if_install_node\n _sftp_ftps_modern_fix\n fi\nfi\n\n\n###\n### Update rsyslog configuration\n###\n_rsyslog_config_update\n\n\n###\n### Install or uninstall AppArmor after barracuda install and upgrade\n###\nif [ -e \"/root/.keep_apparmor_on.cnf\" ] && [ ! -e \"/root/.deny.apparmor.cnf\" ]; then\n [ ! -e \"/root/.allow.apparmor.cnf\" ] && touch /root/.allow.apparmor.cnf\n if [ ! -e \"/root/.run-to-excalibur.cnf\" ] \\\n && [ ! -e \"/root/.run-to-daedalus.cnf\" ] \\\n && [ ! -e \"/root/.run-to-chimaera.cnf\" ] \\\n && [ ! -e \"/root/.run-to-beowulf.cnf\" ]; then\n if [ \"${_OS_CODE}\" != \"stretch\" ] && [ \"${_OS_CODE}\" != \"jessie\" ]; then\n _if_install_apparmor\n fi\n fi\nelse\n [ -e \"/root/.allow.apparmor.cnf\" ] && rm -f /root/.allow.apparmor.cnf\n [ ! -e \"/root/.deny.apparmor.cnf\" ] && touch /root/.deny.apparmor.cnf\n if [ \"${_OS_CODE}\" != \"stretch\" ] && [ \"${_OS_CODE}\" != \"jessie\" ]; then\n _if_remove_apparmor\n fi\nfi\n\n\n###\n### Update barracuda log, tools and system settings\n###\n_pam_umask_check_fix\n_pam_many_check_fix\n_avatars_check_fix\n_sysctl_update\n_initd_update\n_apticron_update\n_barracuda_log_update\n_find_server_city\n\n\n###\n### Complete system checks and cleanup\n###\n_complete\nexit 0\n\n\n###----------------------------------------###\n###\n### Barracuda Ægir Installer\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n###----------------------------------------###\n" }, { "path": "BOA.sh.txt", "content": "#!/bin/bash\n\n\n###----------------------------------------###\n###\n### BOA Meta Installer\n###\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n### This program is free software. You can\n### redistribute it and/or modify it under\n### the terms of the GNU GPL as published by\n### the Free Software Foundation, version 2\n### or later.\n###\n### This program is distributed in the hope\n### that it will be useful, but WITHOUT ANY\n### WARRANTY; without even the implied\n### warranty of MERCHANTABILITY or FITNESS\n### FOR A PARTICULAR PURPOSE. See the GNU GPL\n### for more details.\n###\n### You should have received a copy of the\n### GNU GPL along with this program.\n### If not, see http://www.gnu.org/licenses/\n###\n### Code: https://github.com/omega8cc/boa\n###\n###----------------------------------------###\n\n\n###----------------------------------------###\n### How To: run it with bash, not with sh ###\n###----------------------------------------###\n###\n### $ wget -qO- http://files.aegir.cc/BOA.sh.txt | bash\n###\n\n###----------------------------------------###\n### DON'T EDIT ANYTHING BELOW THIS LINE ###\n###----------------------------------------###\n\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nexport _tRee=dev\nexport _xSrl=591devT01\nexport _rLsn=\"BOA-5.9.1\"\nexport _bTs=591v02\n\n###\n### Avoid too many questions\n###\nexport DEBIAN_FRONTEND=noninteractive\nexport APT_LISTCHANGES_FRONTEND=none\nif [ -z \"${TERM+x}\" ]; then\n export TERM=vt100\nfi\n\n_NOW=$(date +%y%m%d-%H%M%S)\nexport _NOW=${_NOW//[^0-9-]/}\n_TODAY=$(date +%y%m%d)\nexport _TODAY=${_TODAY//[^0-9]/}\n#\n_barCnf=\"/root/.barracuda.cnf\"\n_crlGet=\"-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab\"\n_wgetGet=\"--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'\"\n_aptAllow=\"--allow-unauthenticated\"\n_aptYesUnth=\"-y ${_aptAllow}\"\n_optBin=\"/opt/local/bin\"\n_usrBin=\"/usr/local/bin\"\n_xpthLog=\"/var/xdrago/log\"\n_pthLog=\"/var/log/boa\"\n_tBn=\"tools/bin\"\n_vBs=\"/var/backups\"\n_boaToolsPid=\"${_pthLog}/updateBOAtools.${_bTs}.ctrl.${_tRee}.${_xSrl}.pid\"\n_INITINS=\"/usr/bin/apt-get ${_aptAllow} -y install\"\n#\nif [ ! -e \"${_pthLog}/.migrated.txt\" ] && [ -d \"${_xpthLog}\" ]; then\n mkdir -p \"${_pthLog}\"\n cp -a ${_xpthLog}/*.pid ${_pthLog}/\n cp -a ${_xpthLog}/.*pid ${_pthLog}/\n cp -a ${_xpthLog}/*.log ${_pthLog}/\n cp -a ${_xpthLog}/*.txt ${_pthLog}/\n cp -a ${_xpthLog}/usage ${_pthLog}/\n cp -a ${_xpthLog}/daily ${_pthLog}/\n cp -a ${_xpthLog}/core ${_pthLog}/\n cp -a ${_xpthLog}/le ${_pthLog}/\n touch \"${_pthLog}/.migrated.txt\"\nfi\n[ ! -d \"${_pthLog}/usage\" ] && mkdir -p \"${_pthLog}/usage\"\n[ ! -d \"${_pthLog}/daily\" ] && mkdir -p \"${_pthLog}/daily\"\n[ ! -d \"${_pthLog}/core\" ] && mkdir -p \"${_pthLog}/core\"\n[ ! -d \"${_pthLog}/le\" ] && mkdir -p \"${_pthLog}/le\"\n#\n_eldirF=\"0001-Print-site_footer-if-defined.patch\"\n_eldirP=\"/var/xdrago/conf/${_eldirF}\"\n#\n_tenCorePatchFname=\"drupal-ten-aegir-core-01.patch\"\n_tenCorePatchPath=\"/data/conf/patches/${_tenCorePatchFname}\"\n#\n_tenConsolePatchFname=\"drupal-ten-aegir-console-02.patch\"\n_tenConsolePatchPath=\"/data/conf/patches/${_tenConsolePatchFname}\"\n#\n_elevenCorePatchFname=\"drupal-eleven-aegir-core-01.patch\"\n_elevenCorePatchPath=\"/data/conf/patches/${_elevenCorePatchFname}\"\n#\n_elevenConsolePatchFname=\"drupal-eleven-aegir-console-02.patch\"\n_elevenConsolePatchPath=\"/data/conf/patches/${_elevenConsolePatchFname}\"\n#\n_elevenValidatorPatchFname=\"drupal-eleven-aegir-validator-03.patch\"\n_elevenValidatorPatchPath=\"/data/conf/patches/${_elevenValidatorPatchFname}\"\n#\n_provLeInc=\"provision_hosting_le.drush.inc\"\n_provLeIncFull=\"/var/xdrago/conf/${_provLeInc}\"\n#\n_hoLeInc=\"hosting_le_vhost.drush.inc\"\n_hoLeIncFull=\"/var/xdrago/conf/${_hoLeInc}\"\n#\n_dehydName=\"dehydrated\"\n_dehydSrcPath=\"/var/xdrago/conf/${_dehydName}\"\n_legacyLeSh=\"/var/xdrago/conf/letsencrypt.sh\"\n\n_DEBUG_MODE=$([ -e \"/root/.debug-barracuda-installer.cnf\" ] && echo \"YES\" || echo \"NO\")\n\n_os_detection_minimal() {\n _APT_UPDATE=\"apt-get update\"\n _OS_CODE=$(lsb_release -ar 2>/dev/null | grep -i codename | cut -s -f2)\n _OS_LIST=\"excalibur daedalus chimaera beowulf buster bullseye bookworm trixie\"\n for e in ${_OS_LIST}; do\n if [ \"${e}\" = \"${_OS_CODE}\" ]; then\n _APT_UPDATE=\"apt-get update --allow-releaseinfo-change\"\n fi\n done\n}\n\n_apt_clean_update() {\n ${_APT_UPDATE} -qq 2>/dev/null\n _CALLER_SCRIPT=\"$(basename \"${BASH_SOURCE[-1]}\")\"\n _CALLER_SCRIPT=\"${_CALLER_SCRIPT//[^a-zA-Z0-9._-]/_}\"\n date +%s > \"/run/_latest_apt_clean_update.${_CALLER_SCRIPT}.pid\"\n}\n\n_if_hosted_sys() {\n _hName=\"$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\n if [ -e \"/root/.host8.cnf\" ] \\\n || [[ \"${_hName}\" =~ \".aegir.cc\"($) ]]; then\n _hostedSys=YES\n else\n _hostedSys=NO\n fi\n}\n\n#\n# Find server city.\n_find_server_city() {\n if [ -e \"/root/.found_correct_city.cnf\" ]; then\n _LOC_CITY=$(cat /root/.found_correct_city.cnf 2>/dev/null | tr -d '\\n')\n else\n if [ -e \"/root/.found_correct_ipv4.cnf\" ]; then\n _LOC_IP=$(cat /root/.found_correct_ipv4.cnf 2>/dev/null | tr -d '\\n')\n _LOC_CITY=$(curl ${_crlGet} ipinfo.io/${_LOC_IP}/city 2>&1)\n _LOC_CITY=$(echo -n ${_LOC_CITY} | tr -d \"\\n\" 2>&1)\n fi\n if [ ! -z \"${_LOC_CITY}\" ]; then\n _LOC_CITY=$(echo \"${_LOC_CITY}\" | tr ' ' '+' 2>&1)\n echo ${_LOC_CITY} > /root/.found_correct_city.cnf\n fi\n fi\n}\n\n#\n# Find correct IP.\n_find_correct_ip() {\n if [ -e \"/root/.found_correct_ipv4.cnf\" ]; then\n _LOC_IP=$(cat /root/.found_correct_ipv4.cnf 2>/dev/null | tr -d '\\n')\n else\n _LOC_IP=$(curl ${_crlGet} https://api.ipify.org | sed 's/[^0-9\\.]//g')\n if [ -z \"${_LOC_IP}\" ]; then\n _LOC_IP=$(curl ${_crlGet} http://ipv4.icanhazip.com | sed 's/[^0-9\\.]//g')\n fi\n if [ ! -z \"${_LOC_IP}\" ]; then\n echo ${_LOC_IP} > /root/.found_correct_ipv4.cnf\n fi\n fi\n if [ -n \"${_LOC_IP}\" ] && grep -qE \"${_LOC_IP}\\s\" /etc/hosts; then\n cp -af /etc/hosts /etc/.was.hosts\n sed -i \"s/^${_LOC_IP}.*//g\" /etc/hosts\n [ -x \"/etc/init.d/unbound\" ] && [ ! -e \"/usr/etc/unbound/unbound.conf.d\" ] && mkdir -p /usr/etc/unbound/unbound.conf.d\n [ -x \"/etc/init.d/unbound\" ] && service unbound restart &> /dev/null\n fi\n}\n\n_fix_dns_settings() {\n [ ! -d \"${_vBs}\" ] && mkdir -p ${_vBs}\n rm -f ${_vBs}/resolv.conf.tmp\n if ! grep -q \"nameserver 127.0.0.1\" /etc/resolv.conf; then\n if [ -x \"/usr/sbin/unbound\" ] && [ -e \"/run/unbound/unbound.pid\" ]; then\n _FORCE_RESOLV_UPDATE=YES\n else\n _FORCE_RESOLV_UPDATE=NO\n fi\n fi\n if ! grep -q \"BOA-DNS-Config\" /etc/resolv.conf || [ \"${_FORCE_RESOLV_UPDATE}\" = \"YES\" ]; then\n echo \"### BOA-DNS-Config ###\" > ${_vBs}/resolv.conf.tmp\n if [ -x \"/usr/sbin/unbound\" ] && [ -e \"/run/unbound/unbound.pid\" ]; then\n echo \"nameserver 127.0.0.1\" >> ${_vBs}/resolv.conf.tmp\n fi\n echo \"nameserver 1.1.1.1\" >> ${_vBs}/resolv.conf.tmp\n echo \"nameserver 8.8.8.8\" >> ${_vBs}/resolv.conf.tmp\n echo \"nameserver 9.9.9.9\" >> ${_vBs}/resolv.conf.tmp\n fi\n if [ -e \"${_vBs}/resolv.conf.tmp\" ]; then\n chattr -i /etc/resolv.conf\n rm -f /etc/resolv.conf\n cp -a ${_vBs}/resolv.conf.tmp /etc/resolv.conf\n chmod 0644 /etc/resolv.conf\n chattr +i /etc/resolv.conf\n cp -a ${_vBs}/resolv.conf.tmp ${_vBs}/resolv.conf.vanilla\n fi\n if [ -x \"/usr/sbin/unbound-control\" ] \\\n && [ -e \"/etc/resolvconf/run/interface/lo.unbound\" ]; then\n unbound-control reload &> /dev/null\n fi\n}\n\n_check_dns_settings() {\n _EHU=NO\n if ! grep -q \"127.0.0.1 localhost\" /etc/hosts; then\n sed -i \"s/^127.0.0.1.*//g\" /etc/hosts\n echo \"\" >> /etc/hosts\n echo \"127.0.0.1 localhost\" >> /etc/hosts\n _EHU=YES\n fi\n if grep -q \"files.aegir.cc\" /etc/hosts; then\n sed -i \"s/.*files.aegir.cc.*//g\" /etc/hosts\n _EHU=YES\n fi\n if grep -q \"github\" /etc/hosts; then\n sed -i \"s/.*github.*//g\" /etc/hosts\n _EHU=YES\n fi\n if [ \"${_EHU}\" = \"YES\" ]; then\n echo >>/etc/hosts\n sed -i \"/^$/d\" /etc/hosts\n fi\n if [ -L \"/etc/resolv.conf\" ]; then\n _fix_dns_settings\n return 1 # Exit the function but continue the script\n fi\n if [ -e \"/root/.use.default.nameservers.cnf\" ]; then\n if [ -e \"/root/.use.local.nameservers.cnf\" ]; then\n rm -f /root/.use.local.nameservers.cnf\n fi\n _USE_DEFAULT_DNS=YES\n if ! grep -q \"BOA-DNS-Config\" /etc/resolv.conf; then\n _fix_dns_settings\n return 1 # Exit the function but continue the script\n fi\n fi\n if [ -e \"/root/.use.local.nameservers.cnf\" ]; then\n _USE_PROVIDER_DNS=YES\n else\n _REMOTE_DNS_TEST=$(host files.aegir.cc 1.1.1.1 -w 10 2>&1)\n if ! grep -q \"BOA-DNS-Config\" /etc/resolv.conf; then\n _fix_dns_settings\n return 1 # Exit the function but continue the script\n fi\n fi\n if [[ \"${_REMOTE_DNS_TEST}\" =~ \"no servers could be reached\" ]] \\\n || [[ \"${_REMOTE_DNS_TEST}\" =~ \"Host files.aegir.cc not found\" ]] \\\n || [ \"${_USE_PROVIDER_DNS}\" = \"YES\" ]; then\n _fix_dns_settings\n fi\n}\n\n_find_fast_mirror_early() {\n _isNetc=\"$(which netcat)\"\n if [ ! -x \"${_isNetc}\" ] || [ -z \"${_isNetc}\" ]; then\n if [ ! -e \"/etc/apt/apt.conf.d/00sandboxoff\" ] \\\n && [ -e \"/etc/apt/apt.conf.d\" ]; then\n echo \"APT::Sandbox::User \\\"root\\\";\" > /etc/apt/apt.conf.d/00sandboxoff\n fi\n _apt_clean_update\n apt-get install netcat-traditional ${_aptYesUnth} &> /dev/null\n fi\n _ffMirr=/opt/local/bin/ffmirror\n if [ -x \"${_ffMirr}\" ]; then\n _ffList=\"/var/backups/boa-mirrors-2025-01.txt\"\n [ -d \"/var/backups\" ] || mkdir -p /var/backups\n if [ ! -e \"${_ffList}\" ]; then\n echo \"eu.files.aegir.cc\" > ${_ffList}\n echo \"us.files.aegir.cc\" >> ${_ffList}\n echo \"ao.files.aegir.cc\" >> ${_ffList}\n fi\n if [ -e \"${_ffList}\" ]; then\n _BROKEN_FFMIRR_TEST=$(grep \"stuff\" ${_ffMirr} 2>&1)\n if [[ \"${_BROKEN_FFMIRR_TEST}\" =~ \"stuff\" ]]; then\n _CHECK_MIRROR=$(bash ${_ffMirr} < ${_ffList} 2>&1)\n _CHECK_MIRROR=$(bash ${_ffMirr} < ${_ffList} 2>&1)\n _USE_MIR=\"${_CHECK_MIRROR}\"\n [[ \"${_USE_MIR}\" =~ \"printf\" ]] && _USE_MIR=\"files.aegir.cc\"\n else\n _USE_MIR=\"files.aegir.cc\"\n fi\n else\n _USE_MIR=\"files.aegir.cc\"\n fi\n else\n _USE_MIR=\"files.aegir.cc\"\n fi\n _urlDev=\"http://${_USE_MIR}/dev\"\n _urlHmr=\"http://${_USE_MIR}/versions/${_tRee}/boa/aegir\"\n}\n\n_extract_archive() {\n if [ ! -z \"$1\" ]; then\n case $1 in\n *.tar.bz2) tar xjf $1 ;;\n *.tar.gz) tar xzf $1 ;;\n *.tar.xz) tar xvf $1 ;;\n *.bz2) bunzip2 $1 ;;\n *.rar) unrar x $1 ;;\n *.gz) gunzip -q $1 ;;\n *.tar) tar xf $1 ;;\n *.tbz2) tar xjf $1 ;;\n *.tgz) tar xzf $1 ;;\n *.zip) unzip -qq $1 ;;\n *.Z) uncompress $1 ;;\n *.7z) 7z x $1 ;;\n *) echo \"'$1' cannot be extracted via >extract<\" ;;\n esac\n rm -f $1\n fi\n}\n\n#\n# Download and extract from dev/contrib mirror.\n_get_dev_contrib() {\n if [ ! -z \"$1\" ]; then\n _max_attempts=10\n _attempt_num=1\n _success=0\n while [ ${_attempt_num} -le ${_max_attempts} ]; do\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && echo \"DNLD: Attempt ${_attempt_num} of ${_max_attempts}: Downloading $1...\"\n if curl ${_crlGet} \"${_urlDev}/${_tRee}/contrib/$1\" -o \"$1\"; then\n _success=1\n break\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && echo \"DNLD: Attempt ${_attempt_num} failed.\"\n _attempt_num=$((_attempt_num+1))\n if [ \"${_attempt_num}\" -le \"${_max_attempts}\" ]; then\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && echo \"DNLD: Retrying in 9 seconds...\"\n sleep 9\n fi\n fi\n done\n if [ \"${_success}\" -eq 1 ]; then\n _extract_archive \"$1\"\n else\n echo \"OOPS: Failed to download ${_urlDev}/${_tRee}/contrib/$1 after ${_max_attempts} attempts\"\n return 1 # Exit the function but continue the script\n fi\n fi\n}\n\n#\n# Download and extract archive from dev/src mirror.\n_get_dev_src() {\n if [ ! -z \"$1\" ]; then\n _max_attempts=10\n _attempt_num=1\n _success=0\n while [ ${_attempt_num} -le ${_max_attempts} ]; do\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && echo \"DNLD: Attempt ${_attempt_num} of ${_max_attempts}: Downloading $1...\"\n if curl ${_crlGet} \"${_urlDev}/src/$1\" -o \"$1\"; then\n _success=1\n break\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && echo \"DNLD: Attempt ${_attempt_num} failed.\"\n _attempt_num=$((_attempt_num+1))\n if [ \"${_attempt_num}\" -le \"${_max_attempts}\" ]; then\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && echo \"DNLD: Retrying in 9 seconds...\"\n sleep 9\n fi\n fi\n done\n if [ \"${_success}\" -eq 1 ]; then\n _extract_archive \"$1\"\n else\n echo \"OOPS: Failed to download ${_urlDev}/src/$1 after ${_max_attempts} attempts\"\n return 1 # Exit the function but continue the script\n fi\n fi\n}\n\n_if_clean_boa_env() {\n if [ ! -x \"/etc/init.d/clean-boa-env\" ]; then\n curl ${_crlGet} \"${_urlHmr}/conf/var/clean-boa-env\" -o /etc/init.d/clean-boa-env\n if [ -e \"/etc/init.d/clean-boa-env\" ]; then\n chmod 700 /etc/init.d/clean-boa-env\n chown root:root /etc/init.d/clean-boa-env\n update-rc.d clean-boa-env defaults &> /dev/null\n fi\n fi\n}\n\n###\n### Function to verify BOA keys\n###\n_verify_boa_keys() {\n if [ -e \"/root/.dev.server.cnf\" ]; then\n echo \"PROC: _verify_boa_keys in BOA.sh.txt\"\n fi\n if [ \"${_tRee}\" = \"pro\" ] || [ \"${_tRee}\" = \"dev\" ]; then\n _if_hosted_sys\n _allw=NO\n _urlEnc=\"http://${_USE_MIR}/enc/2024\"\n _encName=$(echo ${_hName} \\\n | openssl md5 \\\n | awk '{ print $2}' \\\n | tr -d \"\\n\" 2>&1)\n if [[ \"${_hName}\" =~ \".aegir.cc\"($) ]] \\\n || [[ \"${_hName}\" =~ \".o8.io\"($) ]] \\\n || [[ \"${_hName}\" =~ \".boa.io\"($) ]]; then\n _allw=YES\n fi\n mkdir -p /var/opt\n rm -f /var/opt/_encN*\n curl ${_crlGet} \"${_urlEnc}/${_encName}\" -o /var/opt/_encN.${_encName}.tmp\n wait\n echo \"${_hName}.${_encName}\" > /var/opt/_encN_local.${_encName}.tmp\n wait\n if [ -e \"/var/opt/_encN.${_encName}.tmp\" ] && [ -e \"/var/opt/_encN_local.${_encName}.tmp\" ]; then\n _diffTestIf=$(diff -w -B /var/opt/_encN.${_encName}.tmp /var/opt/_encN_local.${_encName}.tmp 2>&1)\n if [ ! -z \"${_diffTestIf}\" ] && [ \"${_allw}\" = \"NO\" ]; then\n echo\n echo \"Your system requires valid license for access to ${_rLsn}-${_tRee}\"\n echo \"Please visit https://omega8.cc/licenses to purchase your own\"\n echo\n if [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"/var/aegir/key/barracuda_key.txt\" ]; then\n mkdir -p /var/aegir/key\n cat /var/opt/_encN_local.${_encName}.tmp > /var/aegir/key/barracuda_key.txt\n fi\n rm -f /var/opt/_encN*\n exit 0\n else\n if [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"/var/aegir/key/barracuda_key.txt\" ]; then\n mkdir -p /var/aegir/key\n cat /var/opt/_encN_local.${_encName}.tmp > /var/aegir/key/barracuda_key.txt\n fi\n fi\n else\n echo\n echo \"Your system requires valid license to use this BOA version (${_tRee})\"\n echo \"Unfortunately it was not possible to verify your system status\"\n echo \"Please contact our support but visit https://omega8.cc/licenses first\"\n echo\n exit 0\n fi\n fi\n}\n\n_locales_check_fix_early() {\n _isLoc=\"$(which locale)\"\n if [ ! -x \"${_isLoc}\" ] || [ -z \"${_isLoc}\" ]; then\n apt-get update -qq &> /dev/null\n ${_INITINS} locales locales-all &> /dev/null\n fi\n _LOC_TEST=$(locale 2>&1)\n if [[ \"${_LOC_TEST}\" =~ LANG=.*UTF-8 ]]; then\n _LOCALE_TEST=OK\n fi\n if [[ \"${_LOC_TEST}\" =~ \"Cannot\" ]]; then\n _LOCALE_TEST=BROKEN\n fi\n if [ \"${_LOCALE_TEST}\" = \"BROKEN\" ]; then\n _LOCALE_GEN_TEST=$(grep -v \"^#\" /etc/locale.gen 2>&1)\n if [[ ! \"${_LOCALE_GEN_TEST}\" =~ \"en_US.UTF-8 UTF-8\" ]]; then\n echo \"en_US.UTF-8 UTF-8\" >> /etc/locale.gen\n fi\n sed -i \"/^$/d\" /etc/locale.gen\n locale-gen &> /dev/null\n locale-gen en_US.UTF-8 &> /dev/null\n # Explicitly enforce all locale settings\n update-locale \\\n LANG=en_US.UTF-8 \\\n LC_CTYPE=en_US.UTF-8 \\\n LC_COLLATE=POSIX \\\n LC_NUMERIC=POSIX \\\n LC_TIME=en_US.UTF-8 \\\n LC_MONETARY=en_US.UTF-8 \\\n LC_MESSAGES=en_US.UTF-8 \\\n LC_PAPER=en_US.UTF-8 \\\n LC_NAME=en_US.UTF-8 \\\n LC_ADDRESS=en_US.UTF-8 \\\n LC_TELEPHONE=en_US.UTF-8 \\\n LC_MEASUREMENT=en_US.UTF-8 \\\n LC_IDENTIFICATION=en_US.UTF-8 \\\n LC_ALL= &> /dev/null\n # Define all locale settings on the fly to prevent unnecessary\n # warnings during installation of packages.\n export LANG=en_US.UTF-8 &> /dev/null\n export LC_CTYPE=en_US.UTF-8 &> /dev/null\n export LC_COLLATE=POSIX &> /dev/null\n export LC_NUMERIC=POSIX &> /dev/null\n export LC_TIME=en_US.UTF-8 &> /dev/null\n export LC_MONETARY=en_US.UTF-8 &> /dev/null\n export LC_MESSAGES=en_US.UTF-8 &> /dev/null\n export LC_PAPER=en_US.UTF-8 &> /dev/null\n export LC_NAME=en_US.UTF-8 &> /dev/null\n export LC_ADDRESS=en_US.UTF-8 &> /dev/null\n export LC_TELEPHONE=en_US.UTF-8 &> /dev/null\n export LC_MEASUREMENT=en_US.UTF-8 &> /dev/null\n export LC_IDENTIFICATION=en_US.UTF-8 &> /dev/null\n export LC_ALL= &> /dev/null\n else\n _LOCALE_GEN_TEST=$(grep -v \"^#\" /etc/locale.gen 2>&1)\n if [[ ! \"${_LOCALE_GEN_TEST}\" =~ \"en_US.UTF-8 UTF-8\" ]]; then\n echo \"en_US.UTF-8 UTF-8\" >> /etc/locale.gen\n fi\n sed -i \"/^$/d\" /etc/locale.gen\n locale-gen &> /dev/null\n locale-gen en_US.UTF-8 &> /dev/null\n # Explicitly enforce locale settings required for consistency\n update-locale \\\n LANG=en_US.UTF-8 \\\n LC_CTYPE=en_US.UTF-8 \\\n LC_COLLATE=POSIX \\\n LC_NUMERIC=POSIX \\\n LC_ALL= &> /dev/null\n # Define locale settings required for consistency also on the fly\n export LC_COLLATE=POSIX &> /dev/null\n export LC_NUMERIC=POSIX &> /dev/null\n export LC_ALL= &> /dev/null\n fi\n _LOCALES_BASHRC_TEST=$(grep LC_COLLATE /root/.bashrc 2>&1)\n if [[ ! \"${_LOCALES_BASHRC_TEST}\" =~ \"LC_COLLATE\" ]]; then\n printf \"\\n\" >> /root/.bashrc\n echo \"export LANG=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_CTYPE=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_COLLATE=POSIX\" >> /root/.bashrc\n echo \"export LC_NUMERIC=POSIX\" >> /root/.bashrc\n echo \"export LC_TIME=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_MONETARY=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_MESSAGES=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_PAPER=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_NAME=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_ADDRESS=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_TELEPHONE=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_MEASUREMENT=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_IDENTIFICATION=en_US.UTF-8\" >> /root/.bashrc\n echo \"export LC_ALL=\" >> /root/.bashrc\n printf \"\\n\" >> /root/.bashrc\n fi\n}\n\n_if_fix_iptables_symlinks() {\n ###\n ### Fix for iptables paths backward compatibility\n ###\n if [ -x \"/sbin/iptables\" ] && [ ! -e \"/usr/sbin/iptables\" ]; then\n ln -sfn /sbin/iptables /usr/sbin/iptables\n fi\n if [ -x \"/usr/sbin/iptables\" ] && [ ! -e \"/sbin/iptables\" ]; then\n ln -sfn /usr/sbin/iptables /sbin/iptables\n fi\n if [ -x \"/sbin/iptables-save\" ] && [ ! -e \"/usr/sbin/iptables-save\" ]; then\n ln -sfn /sbin/iptables-save /usr/sbin/iptables-save\n fi\n if [ -x \"/usr/sbin/iptables-save\" ] && [ ! -e \"/sbin/iptables-save\" ]; then\n ln -sfn /usr/sbin/iptables-save /sbin/iptables-save\n fi\n if [ -x \"/sbin/iptables-restore\" ] && [ ! -e \"/usr/sbin/iptables-restore\" ]; then\n ln -sfn /sbin/iptables-restore /usr/sbin/iptables-restore\n fi\n if [ -x \"/usr/sbin/iptables-restore\" ] && [ ! -e \"/sbin/iptables-restore\" ]; then\n ln -sfn /usr/sbin/iptables-restore /sbin/iptables-restore\n fi\n if [ -x \"/sbin/ip6tables\" ] && [ ! -e \"/usr/sbin/ip6tables\" ]; then\n ln -sfn /sbin/ip6tables /usr/sbin/ip6tables\n fi\n if [ -x \"/usr/sbin/ip6tables\" ] && [ ! -e \"/sbin/ip6tables\" ]; then\n ln -sfn /usr/sbin/ip6tables /sbin/ip6tables\n fi\n if [ -x \"/sbin/ip6tables-save\" ] && [ ! -e \"/usr/sbin/ip6tables-save\" ]; then\n ln -sfn /sbin/ip6tables-save /usr/sbin/ip6tables-save\n fi\n if [ -x \"/usr/sbin/ip6tables-save\" ] && [ ! -e \"/sbin/ip6tables-save\" ]; then\n ln -sfn /usr/sbin/ip6tables-save /sbin/ip6tables-save\n fi\n if [ -x \"/sbin/ip6tables-restore\" ] && [ ! -e \"/usr/sbin/ip6tables-restore\" ]; then\n ln -sfn /sbin/ip6tables-restore /usr/sbin/ip6tables-restore\n fi\n if [ -x \"/usr/sbin/ip6tables-restore\" ] && [ ! -e \"/sbin/ip6tables-restore\" ]; then\n ln -sfn /usr/sbin/ip6tables-restore /sbin/ip6tables-restore\n fi\n ###\n ### Fix for iptables paths backward compatibility\n ###\n}\n\n###\n### Prefer Devuan APT sources\n###\n_prefer_devuan_repositories() {\n # Prefer Devuan; force base-files from Devuan (handles lower version vs Debian).\n mkdir -p /etc/apt/preferences.d\n cat >/etc/apt/preferences.d/99-prefer-devuan <<'EOF'\nPackage: *\nPin: release o=Devuan\nPin-Priority: 700\n\nPackage: base-files\nPin: release o=Devuan\nPin-Priority: 1001\nEOF\n _apt_clean_update\n}\n\n###\n### Display not supported VM or bare metal info\n###\n_not_supported_virt() {\n echo\n echo \"=== OOPS! ===\"\n echo\n echo \"You are running not supported virtualization system:\"\n echo \" $1\"\n echo\n echo \"If you wish to try BOA on this system anyway,\"\n echo \"please create an empty control file:\"\n echo \" /root/.allow.any.virt.cnf\"\n echo\n echo \"Please be aware that it may not work at all,\"\n echo \"or you can experience errors breaking BOA.\"\n echo\n echo \"WARNING! BOA IS NOT DESIGNED TO RUN DIRECTLY ON A BARE METAL.\"\n echo \"WARNING! IT IS VERY DANGEROUS AND THUS EXTREMELY BAD IDEA!\"\n echo \"WARNING! You are free to experiment but don't expect *ANY* support.\"\n echo\n echo \"BOA is known to work well on:\"\n echo\n echo \" * Linux Containers (LXC)\"\n echo \" * Linux KVM guest\"\n echo \" * Microsoft Hyper-V\"\n echo \" * OpenVZ Containers\"\n echo \" * Parallels guest\"\n echo \" * Red Hat KVM guest\"\n echo \" * VirtualBox guest\"\n echo \" * VMware ESXi guest (but excluding vCloud Air)\"\n echo \" * VServer guest\"\n echo \" * Xen guest fully virtualized (HVM)\"\n echo \" * Xen guest\"\n echo \" * Xen paravirtualized guest domain\"\n echo\n echo \"Bye\"\n echo\n exit 1\n}\n\n# --- internal: print message only in debug mode\n_msg() {\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"[virt-what-fix] $*\"\n fi\n}\n\n# --- internal: run virt-what under strace and parse the helper's exec path\n_discover_with_strace() {\n local _path_found=\"\"\n if ! command -v strace >/dev/null 2>&1; then\n _msg \"strace not available, skipping strace-based discovery\"\n echo \"\"\n return 0\n fi\n # Temporarily extend PATH so virt-what can exec the helper for strace to see.\n PATH=\"${PATH}:${_CANDIDATE_PATHS}\" strace -f -qq -e trace=execve -o \"${_TRACE}\" virt-what >/dev/null 2>&1\n\n # mawk-safe parsing: pull the first quoted arg from execve(\"…\") and check suffix\n if [ -s \"${_TRACE}\" ]; then\n _path_found=$(\n awk -v n=\"${_HELPER_NAME}\" '\n /execve\\(\"/ {\n # Find start of execve(\" then extract up to next quote\n i = index($0, \"execve(\\\"\")\n if (i) {\n s = substr($0, i + 8) # after execve(\"\n j = index(s, \"\\\"\")\n if (j) {\n p = substr(s, 1, j - 1) # the path inside quotes\n if (p ~ (\"/\" n \"$\")) { print p; exit }\n }\n }\n }\n ' \"${_TRACE}\"\n )\n fi\n rm -f \"${_TRACE}\"\n\n if [ -n \"${_path_found}\" ] && [ -x \"${_path_found}\" ]; then\n _msg \"strace discovered helper at: ${_path_found}\"\n echo \"${_path_found}\"\n return 0\n fi\n _msg \"strace discovery failed\"\n echo \"\"\n return 0\n}\n\n# --- internal: dpkg-based discovery (Debian/Devuan)\n_discover_with_dpkg() {\n local _p=\"\"\n if command -v dpkg >/dev/null 2>&1; then\n _p=$(dpkg -L virt-what 2>/dev/null | grep -E \"/${_HELPER_NAME}$\" | head -n1)\n if [ -n \"${_p}\" ] && [ -x \"${_p}\" ]; then\n _msg \"dpkg discovered helper at: ${_p}\"\n echo \"${_p}\"\n return 0\n fi\n fi\n echo \"\"\n return 0\n}\n\n# --- internal: filesystem search fallback (bounded)\n_discover_with_find() {\n local _p=\"\"\n # Keep it bounded to /usr to stay fast/noisy-free.\n _p=$(find /usr -maxdepth 4 -type f -name \"${_HELPER_NAME}\" 2>/dev/null | head -n1)\n if [ -n \"${_p}\" ] && [ -x \"${_p}\" ]; then\n _msg \"find discovered helper at: ${_p}\"\n echo \"${_p}\"\n return 0\n fi\n echo \"\"\n return 0\n}\n\n# --- main: ensure symlink\n_ensure_virt_what_helper_symlink() {\n # If the symlink already exists and is working, nothing to do.\n if [ -L \"${_SYMLINK}\" ] && [ -x \"${_SYMLINK}\" ] && [ -e \"$(readlink -f \"${_SYMLINK}\")\" ]; then\n _msg \"Symlink already present and valid: ${_SYMLINK} -> $(readlink -f \"${_SYMLINK}\")\"\n return 0\n fi\n\n local _helper_path=\"\"\n _helper_path=\"$(_discover_with_strace)\"\n if [ -z \"${_helper_path}\" ]; then\n _helper_path=\"$(_discover_with_dpkg)\"\n fi\n if [ -z \"${_helper_path}\" ]; then\n _helper_path=\"$(_discover_with_find)\"\n fi\n\n if [ -z \"${_helper_path}\" ]; then\n echo \"ERROR: Could not locate ${_HELPER_NAME} anywhere under /usr.\" 1>&2\n return 1\n fi\n\n # Safety: if a non-symlink file already exists at the target, back it up once.\n if [ -e \"${_SYMLINK}\" ] && [ ! -L \"${_SYMLINK}\" ]; then\n _msg \"Backing up existing non-symlink at ${_SYMLINK} to ${_SYMLINK}.orig\"\n mv -f \"${_SYMLINK}\" \"${_SYMLINK}.orig\"\n fi\n\n ln -sfn \"${_helper_path}\" \"${_SYMLINK}\"\n if [ -x \"${_SYMLINK}\" ]; then\n _msg \"Symlink created: ${_SYMLINK} -> ${_helper_path}\"\n return 0\n else\n echo \"ERROR: Failed to create working symlink ${_SYMLINK} -> ${_helper_path}\" 1>&2\n return 2\n fi\n}\n\n###\n### Fix VM system detection\n###\n_fix_virt_what() {\n _VIRT_TEST=\"$(which virt-what)\"\n if [ -n \"${_VIRT_TEST}\" ] && [ -x \"${_VIRT_TEST}\" ]; then\n _SHELL_TEST_A=$(grep -I -o \"\\#\\!.*/usr/bin/sh\" ${_VIRT_TEST} 2>&1)\n _SHELL_TEST_B=$(grep -I -o \"\\#\\!.*/bin/sh\" ${_VIRT_TEST} 2>&1)\n if [[ \"${_SHELL_TEST_A}\" =~ \"/usr/bin/sh\" ]]; then\n sed -i \"s/\\/usr\\/bin\\/sh/\\/bin\\/dash/g\" ${_VIRT_TEST}\n fi\n if [[ \"${_SHELL_TEST_B}\" =~ \"/bin/sh\" ]]; then\n sed -i \"s/\\/bin\\/sh/\\/bin\\/dash/g\" ${_VIRT_TEST}\n fi\n _HELPER_NAME=\"virt-what-cpuid-helper\"\n _SYMLINK=\"/usr/sbin/${_HELPER_NAME}\"\n _TRACE=\"/tmp/virtwhat.$$.strace\"\n # Extra dirs we temporarily expose to PATH so virt-what can exec the helper for strace discovery\n _CANDIDATE_PATHS=\"/usr/libexec:/usr/lib/x86_64-linux-gnu:/usr/lib64/virt-what:/usr/lib/virt-what\"\n if [ ! -e \"${_SYMLINK}\" ]; then\n echo \"INFO: virt-what tool requires small update, fixing...\"\n if ! command -v strace &> /dev/null; then\n _apt_clean_update\n apt-get install strace ${_aptYesUnth}\n fi\n _ensure_virt_what_helper_symlink\n fi\n fi\n}\n\n###\n### Fix or install VM system detection\n###\n_fix_or_install_virt_what() {\n _VIRT_TEST=\"$(which virt-what)\"\n if [ -n \"${_VIRT_TEST}\" ] && [ -x \"${_VIRT_TEST}\" ]; then\n _fix_virt_what\n else\n echo \"INFO: installing required virt-what tool ...\"\n if [ ! -e \"/etc/apt/apt.conf.d/00sandboxoff\" ] \\\n && [ -e \"/etc/apt/apt.conf.d\" ]; then\n echo \"APT::Sandbox::User \\\"root\\\";\" > /etc/apt/apt.conf.d/00sandboxoff\n fi\n _apt_clean_update\n apt-get install virt-what ${_aptYesUnth}\n wait\n _fix_virt_what\n fi\n}\n\n_check_virt() {\n _fix_or_install_virt_what\n _VIRT_TOOL=\"$(which virt-what)\"\n if [ -x \"${_VIRT_TOOL}\" ]; then\n _VIRT_TEST=$(virt-what)\n _VIRT_TEST=$(echo -n ${_VIRT_TEST} | fmt -su -w 2500 2>&1)\n if [[ \"${_VIRT_TEST}\" =~ \"program not found\" ]]; then\n echo \"ERROR: virt-what says: ${_VIRT_TEST}\"\n echo \"ERROR: virt-what detection fails for unknown reason\"\n fi\n if [ ! -e \"/root/.allow.any.virt.cnf\" ]; then\n if [ -e \"/proc/self/status\" ]; then\n _VS_GUEST_TEST=$(grep -E \"VxID:[[:space:]]*[0-9]{2,}$\" /proc/self/status 2> /dev/null)\n _VS_HOST_TEST=$(grep -E \"VxID:[[:space:]]*0$\" /proc/self/status 2> /dev/null)\n fi\n if [ ! -z \"${_VS_HOST_TEST}\" ] || [ ! -z \"${_VS_GUEST_TEST}\" ]; then\n if [ -z \"${_VS_HOST_TEST}\" ] && [ ! -z \"${_VS_GUEST_TEST}\" ]; then\n _VIRT_IS=\"Linux VServer guest\"\n else\n if [ ! -z \"${_VS_HOST_TEST}\" ]; then\n _not_supported_virt \"Linux VServer host\"\n else\n _not_supported_virt \"unknown / not a virtual machine\"\n fi\n fi\n else\n if [ -z \"${_VIRT_TEST}\" ] || [ \"${_VIRT_TEST}\" = \"0\" ]; then\n _not_supported_virt \"unknown / not a virtual machine\"\n elif [[ \"${_VIRT_TEST}\" =~ \"xen-dom0\" ]]; then\n _not_supported_virt \"Xen privileged domain\"\n elif [[ \"${_VIRT_TEST}\" =~ \"linux_vserver-host\" ]]; then\n _not_supported_virt \"Linux VServer host\"\n else\n if [[ \"${_VIRT_TEST}\" =~ \"xen xen-hvm\" ]]; then\n _VIRT_TEST=\"xen-hvm\"\n elif [[ \"${_VIRT_TEST}\" =~ \"xen xen-domU\" ]]; then\n _VIRT_TEST=\"xen-domU\"\n elif [[ \"${_VIRT_TEST}\" =~ \"virtualbox kvm\" ]]; then\n _VIRT_TEST=\"virtualbox\"\n elif [[ \"${_VIRT_TEST}\" =~ \"hyperv qemu\" ]]; then\n _VIRT_TEST=\"hyperv\"\n elif [[ \"${_VIRT_TEST}\" =~ \"kvm aws\" ]]; then\n _VIRT_TEST=\"kvm\"\n elif [[ \"${_VIRT_TEST}\" =~ \"redhat kvm\" ]]; then\n _VIRT_TEST=\"redhat-kvm\"\n elif [[ \"${_VIRT_TEST}\" =~ \"openvz lxc\" ]]; then\n _VIRT_TEST=\"openvz\"\n fi\n case \"${_VIRT_TEST}\" in\n hyperv) _VIRT_IS=\"Microsoft Hyper-V\" ;;\n kvm) _VIRT_IS=\"Linux KVM guest\" ;;\n lxc) _VIRT_IS=\"Linux Containers (LXC)\" ;;\n openvz) _VIRT_IS=\"OpenVZ Containers\" ;;\n parallels) _VIRT_IS=\"Parallels guest\" ;;\n redhat-kvm) _VIRT_IS=\"Red Hat KVM guest\" ;;\n virtualbox) _VIRT_IS=\"VirtualBox guest\" ;;\n vmware) _VIRT_IS=\"VMware ESXi guest\" ;;\n xen-domU) _VIRT_IS=\"Xen paravirtualized guest domain\" ;;\n xen-hvm) _VIRT_IS=\"Xen guest fully virtualized (HVM)\" ;;\n xen) _VIRT_IS=\"Xen guest\" ;;\n *) _not_supported_virt \"${_VIRT_TEST}\"\n ;;\n esac\n fi\n fi\n else\n if [ -z \"${_VIRT_TEST}\" ] || [ \"${_VIRT_TEST}\" = \"0\" ]; then\n _VIRT_TEST=\"unknown / not a virtual machine\"\n fi\n fi\n fi\n}\n\n###\n### Make local OpenSSL new/legacy ssl/certs symlinked to system ssl/certs\n###\n_fix_sync_system_ssl_certs() {\n if [ -e \"/etc/ssl/certs/ca-certificates.crt\" ] \\\n && [ ! -e \"/usr/local/ssl3/.old-certs\" ] \\\n && [ -d \"/usr/local/ssl3/certs\" ] \\\n && [ ! -L \"/usr/local/ssl3/certs\" ]; then\n mv -f /usr/local/ssl3/certs /usr/local/ssl3/.old-certs\n ln -sfn /etc/ssl/certs /usr/local/ssl3/certs\n fi\n if [ -e \"/etc/ssl/certs/ca-certificates.crt\" ] \\\n && [ ! -e \"/usr/local/ssl/.old-certs\" ] \\\n && [ -d \"/usr/local/ssl/certs\" ] \\\n && [ ! -L \"/usr/local/ssl/certs\" ]; then\n mv -f /usr/local/ssl/certs /usr/local/ssl/.old-certs\n ln -sfn /etc/ssl/certs /usr/local/ssl/certs\n fi\n}\n\n_update_agents() {\n\n _if_hosted_sys\n if [ \"${_hostedSys}\" = \"YES\" ]; then\n if [ ! -e \"/root/.extended.firewall.exceptions.cnf\" ]; then\n echo host8 > /root/.extended.firewall.exceptions.cnf\n fi\n fi\n\n if [ \"${_VMFAMILY}\" = \"HOSTED\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -d \"/data/u\" ] \\\n && [ -e \"/var/xdrago\" ]; then\n [ ! -e \"/root/.fast.cron.cnf\" ] && echo ON > /root/.fast.cron.cnf\n _PrTestPower=$(grep \"POWER\" /root/.*.octopus.cnf 2>&1)\n _PrTestPhantom=$(grep \"PHANTOM\" /root/.*.octopus.cnf 2>&1)\n _PrTestCluster=$(grep \"CLUSTER\" /root/.*.octopus.cnf 2>&1)\n _PrTestUltra=$(grep \"ULTRA\" /root/.*.octopus.cnf 2>&1)\n _PrTestMonster=$(grep \"MONSTER\" /root/.*.octopus.cnf 2>&1)\n _InTest=$(ls /data/disk/*/static/control/cli.info | wc -l 2>&1)\n _SQL_PSWD=$(cat /root/.my.pass.txt 2>/dev/null | tr -d '\\n')\n if [ \"${_InTest}\" -lt 9 ] \\\n && [[ ! \"${_PrTestPower}\" =~ \"POWER\" ]] \\\n && [[ ! \"${_PrTestPhantom}\" =~ \"PHANTOM\" ]] \\\n && [[ ! \"${_PrTestCluster}\" =~ \"CLUSTER\" ]] \\\n && [[ ! \"${_PrTestUltra}\" =~ \"ULTRA\" ]] \\\n && [[ ! \"${_PrTestMonster}\" =~ \"MONSTER\" ]]; then\n [ ! -e \"/root/.fast.cron.cnf\" ] && echo ${_InTest} > /root/.fast.cron.cnf\n [ -e \"/root/.hr.monitor.cnf\" ] && rm -f /root/.hr.monitor.cnf\n [ -e \"/root/.slow.cron.cnf\" ] && [ ! -e \"/root/.slow.cron.cnf.protected\" ] && rm -f /root/.slow.cron.cnf\n [ -e \"/root/.tg.cnf\" ] && rm -f /root/.tg.cnf\n mysql -u root -e \"SET GLOBAL max_connect_errors = 555;\"\n mysql -u root -e \"SET GLOBAL max_connections = 111;\"\n mysql -u root -e \"SET GLOBAL max_user_connections = 111;\"\n mysql -u root -e \"SET GLOBAL group_concat_max_len = 10000;\"\n fi\n if [ \"${_InTest}\" -ge 9 ] && [ \"${_InTest}\" -le 50 ]; then\n [ ! -e \"/root/.fast.cron.cnf\" ] && echo ${_InTest} > /root/.fast.cron.cnf\n [ -e \"/root/.hr.monitor.cnf\" ] && rm -f /root/.hr.monitor.cnf\n [ -e \"/root/.slow.cron.cnf\" ] && [ ! -e \"/root/.slow.cron.cnf.protected\" ] && rm -f /root/.slow.cron.cnf\n [ -e \"/root/.tg.cnf\" ] && rm -f /root/.tg.cnf\n mysql -u root -e \"SET GLOBAL max_connect_errors = 777;\"\n mysql -u root -e \"SET GLOBAL max_connections = 555;\"\n mysql -u root -e \"SET GLOBAL max_user_connections = 111;\"\n mysql -u root -e \"SET GLOBAL group_concat_max_len = 10000;\"\n fi\n if [ \"${_InTest}\" -gt 50 ]; then\n [ -e \"/root/.fast.cron.cnf\" ] && rm -f /root/.fast.cron.cnf\n [ ! -e \"/root/.tg.cnf\" ] && echo ${_InTest} > /root/.tg.cnf\n [ ! -e \"/root/.hr.monitor.cnf\" ] && echo ${_InTest} > /root/.hr.monitor.cnf\n [ ! -e \"/root/.slow.cron.cnf\" ] && echo ${_InTest} > /root/.slow.cron.cnf\n mysql -u root -e \"SET GLOBAL max_connect_errors = 999;\"\n mysql -u root -e \"SET GLOBAL max_connections = 777;\"\n mysql -u root -e \"SET GLOBAL max_user_connections = 111;\"\n mysql -u root -e \"SET GLOBAL group_concat_max_len = 10000;\"\n fi\n if [[ \"${_PrTestPower}\" =~ \"POWER\" ]]; then\n [ ! -e \"/root/.tg.cnf\" ] && echo ${_InTest} > /root/.tg.cnf\n [ ! -e \"/root/.fast.cron.cnf\" ] && echo ${_InTest} > /root/.fast.cron.cnf\n [ -e \"/root/.hr.monitor.cnf\" ] && rm -f /root/.hr.monitor.cnf\n [ -e \"/root/.slow.cron.cnf\" ] && [ ! -e \"/root/.slow.cron.cnf.protected\" ] && rm -f /root/.slow.cron.cnf\n mysql -u root -e \"SET GLOBAL max_connect_errors = 555;\"\n mysql -u root -e \"SET GLOBAL max_connections = 333;\"\n mysql -u root -e \"SET GLOBAL max_user_connections = 111;\"\n mysql -u root -e \"SET GLOBAL group_concat_max_len = 10000;\"\n fi\n if [[ \"${_PrTestPhantom}\" =~ \"PHANTOM\" ]]; then\n [ ! -e \"/root/.tg.cnf\" ] && echo ${_InTest} > /root/.tg.cnf\n [ ! -e \"/root/.fast.cron.cnf\" ] && echo ${_InTest} > /root/.fast.cron.cnf\n [ -e \"/root/.hr.monitor.cnf\" ] && rm -f /root/.hr.monitor.cnf\n [ -e \"/root/.slow.cron.cnf\" ] && [ ! -e \"/root/.slow.cron.cnf.protected\" ] && rm -f /root/.slow.cron.cnf\n mysql -u root -e \"SET GLOBAL max_connect_errors = 777;\"\n mysql -u root -e \"SET GLOBAL max_connections = 555;\"\n mysql -u root -e \"SET GLOBAL max_user_connections = 333;\"\n mysql -u root -e \"SET GLOBAL group_concat_max_len = 10000;\"\n fi\n if [[ \"${_PrTestCluster}\" =~ \"CLUSTER\" ]]; then\n [ ! -e \"/root/.tg.cnf\" ] && echo ${_InTest} > /root/.tg.cnf\n [ ! -e \"/root/.fast.cron.cnf\" ] && echo ${_InTest} > /root/.fast.cron.cnf\n [ -e \"/root/.hr.monitor.cnf\" ] && rm -f /root/.hr.monitor.cnf\n [ -e \"/root/.slow.cron.cnf\" ] && [ ! -e \"/root/.slow.cron.cnf.protected\" ] && rm -f /root/.slow.cron.cnf\n mysql -u root -e \"SET GLOBAL max_connect_errors = 999;\"\n mysql -u root -e \"SET GLOBAL max_connections = 777;\"\n mysql -u root -e \"SET GLOBAL max_user_connections = 555;\"\n mysql -u root -e \"SET GLOBAL group_concat_max_len = 10000;\"\n fi\n mysql -u root -e \"SET GLOBAL optimizer_switch='derived_merge=off';\"\n mysql -u root -e \"SET GLOBAL sort_buffer_size = 262144;\"\n if [ -e \"/root/.tg.cnf\" ]; then\n if [ ! -e \"/root/.fixed_fpm_workers.cnf\" ]; then\n sed -i \"s/^_PHP_FPM_WORKERS=.*/_PHP_FPM_WORKERS=100/g\" ${_barCnf}\n touch /root/.fixed_fpm_workers.cnf\n fi\n fi\n if [ ! -e \"/root/.high_traffic.cnf\" ]; then\n echo ${_InTest} > /root/.high_traffic.cnf\n echo ${_InTest} > /root/.no.swap.clear.cnf\n fi\n [ -e \"/root/.randomize_duplicity_full_backup_day.cnf\" ] && rm -f /root/.randomize_duplicity_full_backup_day.cnf\n [ -e \"/root/.skip_duplicity_monthly_cleanup.cnf\" ] && rm -f /root/.skip_duplicity_monthly_cleanup.cnf\n [ -e \"/root/.my.batch_innodb.cnf\" ] && rm -f /root/.my.batch_innodb.cnf\n [ -e \"/root/.batch_innodb.cnf\" ] && rm -f /root/.batch_innodb.cnf\n [ -e \"/root/.force.drupalgeddon.cnf\" ] && rm -f /root/.force.drupalgeddon.cnf\n [ -e \"/root/.skip_cleanup.cnf\" ] && rm -f /root/.skip_cleanup.cnf\n [ -e \"/root/.giant_traffic.cnf\" ] && rm -f /root/.giant_traffic.cnf\n [ -e \"/root/.default.cnf\" ] && rm -f /root/.default.cnf\n [ -e \"/root/.debug.cnf\" ] && rm -f /root/.debug.cnf\n if [ -e \"/data/conf/override.global.inc\" ] \\\n && [ ! -e \"/data/conf/.prev6.override.global.inc.off\" ]; then\n mv -f /data/conf/override.global.inc /data/conf/.prev6.override.global.inc.off\n fi\n# if [ ! -e \"/data/conf/override.global.inc\" ]; then\n# echo \" /data/conf/override.global.inc.tmp\n# echo \"\" >> /data/conf/override.global.inc.tmp\n# echo \"\\$use_valkey = TRUE;\" >> /data/conf/override.global.inc.tmp\n# chmod 644 /data/conf/override.global.inc.tmp\n# mv -f /data/conf/override.global.inc.tmp /data/conf/override.global.inc\n# fi\n fi\n\n\n if [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ]; then\n\n _pthCtrl=\"/root/.remote_backups/ctrl\"\n if [ \"${_tRee}\" = \"pro\" ] || [ \"${_tRee}\" = \"dev\" ]; then\n [ ! -e \"${_pthCtrl}\" ] && mkdir -p ${_pthCtrl}\n [ ! -e \"/root/.remote_backups/run\" ] && mkdir -p /root/.remote_backups/run\n else\n rm -rf /root/.remote_backups\n fi\n\n [ ! -e \"/var/xdrago/monitor/check\" ] && mkdir -p /var/xdrago/monitor/check\n [ ! -e \"/var/xdrago/monitor/log\" ] && mkdir -p /var/xdrago/monitor/log\n\n if [ ! -e \"${_pthLog}/.force.f89.${_tRee}.${_xSrl}.ctrl\" ]; then\n rm -f ${_pthLog}/*.ctrl.*.pid\n touch ${_pthLog}/.force.f89.${_tRee}.${_xSrl}.ctrl\n fi\n\n [ ! -e \"/var/xdrago/checksql.pl\" ] && rm -f ${_pthLog}/checksql.pl.ctrl.*.pid\n [ ! -e \"/var/xdrago/clear.sh\" ] && rm -f ${_pthLog}/clear.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/daily.sh\" ] && rm -f ${_pthLog}/daily.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/graceful.sh\" ] && rm -f ${_pthLog}/graceful.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/guest-fire.sh\" ] && rm -f ${_pthLog}/guest-fire.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/guest-water.sh\" ] && rm -f ${_pthLog}/guest-water.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/ip_access.sh\" ] && rm -f ${_pthLog}/ip_access.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/manage_ltd_users.sh\" ] && rm -f ${_pthLog}/manage_ltd_users.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/manage_solr_config.sh\" ] && rm -f ${_pthLog}/manage_solr_config.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/minute.sh\" ] && rm -f ${_pthLog}/minute.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/move_sql.sh\" ] && rm -f ${_pthLog}/move_sql.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/mysql_backup.sh\" ] && rm -f ${_pthLog}/mysql_backup.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/mysql_cleanup.sh\" ] && rm -f ${_pthLog}/mysql_cleanup.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/mysql_cluster_backup.sh\" ] && rm -f ${_pthLog}/mysql_cluster_backup.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/mysql_repair.sh\" ] && rm -f ${_pthLog}/mysql_repair.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/proc_num_ctrl.pl\" ] && rm -f ${_pthLog}/proc_num_ctrl.pl.ctrl.*.pid\n [ ! -e \"/var/xdrago/purge_binlogs.sh\" ] && rm -f ${_pthLog}/purge_binlogs.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/runner.sh\" ] && rm -f ${_pthLog}/runner.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/second.sh\" ] && rm -f ${_pthLog}/second.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/usage.sh\" ] && rm -f ${_pthLog}/usage.sh.ctrl.*.pid\n\n [ ! -e \"/var/xdrago/monitor/check/java.sh\" ] && rm -f ${_pthLog}/java.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/mysql.sh\" ] && rm -f ${_pthLog}/mysql.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/nginx.sh\" ] && rm -f ${_pthLog}/nginx.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/php.sh\" ] && rm -f ${_pthLog}/php.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/valkey.sh\" ] && rm -f ${_pthLog}/valkey.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/redis.sh\" ] && rm -f ${_pthLog}/redis.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/scan_nginx.sh\" ] && rm -f ${_pthLog}/scan_nginx.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/system.sh\" ] && rm -f ${_pthLog}/system.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/unbound.sh\" ] && rm -f ${_pthLog}/unbound.sh.ctrl.*.pid\n\n [ ! -e \"/var/xdrago/monitor/check/escapecheck.sh\" ] && rm -f ${_pthLog}/escapecheck.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/hackcheck.sh\" ] && rm -f ${_pthLog}/hackcheck.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/hackftp.sh\" ] && rm -f ${_pthLog}/hackftp.sh.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/segfault_alert.pl\" ] && rm -f ${_pthLog}/segfault_alert.pl.ctrl.*.pid\n [ ! -e \"/var/xdrago/monitor/check/sqlcheck.pl\" ] && rm -f ${_pthLog}/sqlcheck.pl.ctrl.*.pid\n\n [ -e \"/var/xdrago/proc_num_ctrl.cgi\" ] && rm -f /var/xdrago/proc_num_ctrl.cgi\n [ -e \"/var/xdrago/checksql.cgi\" ] && rm -f /var/xdrago/checksql.cgi\n [ -e \"/var/xdrago/mysql_hourly.sh\" ] && rm -f /var/xdrago/mysql_hourly.sh\n\n [ -e \"/var/xdrago/monitor/check/sqlcheck\" ] && rm -f ${_pthLog}/*.ctrl.*.pid\n [ -e \"/var/xdrago/monitor/check/sqlcheck\" ] && rm -f /var/xdrago/monitor/check/*\n\n [ -e \"/var/xdrago/monitor/hackcheck.archive.log\" ] && rm -f /var/xdrago/monitor/.scan_nginx_arch*\n [ -e \"/var/xdrago/monitor/hackcheck.archive.log\" ] && mv -f /var/xdrago/monitor/*.log /var/xdrago/monitor/log/\n fi\n\n if [ -e \"/root/.remote_backups/schedule/backup_schedule.txt\" ] \\\n && [ -d \"/var/aegir/drush\" ]; then\n if grep -q \"Out of memory: Killed process.*duplicity\" /var/log/iptables.log; then\n if [ ! -e \"/root/.remote_backups/schedule/backup_schedule.txt-off\" ]; then\n cp -a /root/.remote_backups/schedule/backup_schedule.txt /root/.remote_backups/schedule/backup_schedule.txt-off\n echo \"# Backup schedule (service user) OFF\" > /root/.remote_backups/schedule/backup_schedule.txt\n chattr +i /root/.remote_backups/schedule/backup_schedule.txt\n fi\n else\n if [ -e \"/root/.remote_backups/schedule/backup_schedule.txt-off\" ]; then\n chattr -i /root/.remote_backups/schedule/backup_schedule.txt\n rm -f /root/.remote_backups/schedule/backup_schedule.txt\n mv /root/.remote_backups/schedule/backup_schedule.txt-off /root/.remote_backups/schedule/backup_schedule.txt\n fi\n fi\n if [ \"$(pgrep -fc duplicity)\" -gt 0 ] \\\n && [ \"$(pgrep -fc dcysetup)\" -lt 1 ] \\\n && [ \"$(pgrep -fc mybackup)\" -lt 1 ] \\\n && [ \"$(pgrep -fc multiback)\" -lt 1 ]; then\n pkill -9 -f duplicity\n rm -rf /tmp/duplicity*\n rm -rf /root/.cache/duplicity/*/duplicity-*tempdir\n rm -f /root/.cache/duplicity/*/lockfile\n echo \"$(date) Orphaned duplicity processes killed\" >> /var/log/duplicity-cleanup.log\n fi\n fi\n\n if ! grep -q \"OFF\" ${_optBin}/lock.inc; then\n rm -f ${_pthLog}/lock.inc.sh.ctrl.*\n fi\n if [ ! -e \"${_optBin}/lock.inc\" ] \\\n || [ ! -e \"${_pthLog}/lock.inc.sh.ctrl.f98.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc foobar)\n if (( _CNT > 0 )); then\n echo \"The foobar is running!\"\n else\n if [ -e \"${_optBin}/lock.inc\" ]; then\n mv -f ${_optBin}/lock.inc ${_optBin}/lock.inc.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/lock.inc\" -o ${_optBin}/lock.inc\n if [ -e \"${_optBin}/lock.inc\" ]; then\n chmod 700 ${_optBin}/lock.inc\n chown root:root ${_optBin}/lock.inc\n touch ${_pthLog}/lock.inc.sh.ctrl.f98.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/lock.inc.old\" ]; then\n mv -f ${_optBin}/lock.inc.old ${_optBin}/lock.inc\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/vmnetfix\" ] \\\n || [ ! -e \"${_pthLog}/vmnetfix.sh.ctrl.f89.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc vmnetfix)\n if (( _CNT > 0 )); then\n echo \"The vmnetfix is running!\"\n else\n if [ ! -e \"/etc/init.d/networking\" ]; then\n mkdir -p /etc/init.d\n curl ${_crlGet} \"${_urlHmr}/conf/network/networking\" -o /etc/init.d/networking\n chmod 0755 /etc/init.d/networking\n chown root:root /etc/init.d/networking\n update-rc.d networking defaults >/dev/null 2>&1 || true\n fi\n if [ -e \"${_optBin}/vmnetfix\" ]; then\n mv -f ${_optBin}/vmnetfix ${_optBin}/vmnetfix.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/vmnetfix\" -o ${_optBin}/vmnetfix\n if [ -e \"${_optBin}/vmnetfix\" ]; then\n chmod 700 ${_optBin}/vmnetfix\n chown root:root ${_optBin}/vmnetfix\n touch ${_pthLog}/vmnetfix.sh.ctrl.f89.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/vmnetfix.old\" ]; then\n mv -f ${_optBin}/vmnetfix.old ${_optBin}/vmnetfix\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/screenfetch\" ] \\\n || [ ! -e \"${_pthLog}/screenfetch.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc screenfetch)\n if (( _CNT > 0 )); then\n echo \"The screenfetch is running!\"\n else\n if [ -e \"${_optBin}/screenfetch\" ]; then\n mv -f ${_optBin}/screenfetch ${_optBin}/screenfetch.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/screenfetch\" -o ${_optBin}/screenfetch\n if [ -e \"${_optBin}/screenfetch\" ]; then\n chmod 700 ${_optBin}/screenfetch\n chown root:root ${_optBin}/screenfetch\n touch ${_pthLog}/screenfetch.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/screenfetch.old\" ]; then\n mv -f ${_optBin}/screenfetch.old ${_optBin}/screenfetch\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/fixrepo\" ] \\\n || [ ! -e \"${_pthLog}/fixrepo.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc fixrepo)\n if (( _CNT > 0 )); then\n echo \"The fixrepo is running!\"\n else\n if [ -e \"${_optBin}/fixrepo\" ]; then\n mv -f ${_optBin}/fixrepo ${_optBin}/fixrepo.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/fixrepo\" -o ${_optBin}/fixrepo\n if [ -e \"${_optBin}/fixrepo\" ]; then\n chmod 700 ${_optBin}/fixrepo\n chown root:root ${_optBin}/fixrepo\n touch ${_pthLog}/fixrepo.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/fixrepo.old\" ]; then\n mv -f ${_optBin}/fixrepo.old ${_optBin}/fixrepo\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/renameaegirhost\" ] \\\n || [ ! -e \"${_pthLog}/renameaegirhost.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc renameaegirhost)\n if (( _CNT > 0 )); then\n echo \"The renameaegirhost is running!\"\n else\n if [ -e \"${_optBin}/renameaegirhost\" ]; then\n mv -f ${_optBin}/renameaegirhost ${_optBin}/renameaegirhost.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/renameaegirhost\" -o ${_optBin}/renameaegirhost\n if [ -e \"${_optBin}/renameaegirhost\" ]; then\n chmod 700 ${_optBin}/renameaegirhost\n chown root:root ${_optBin}/renameaegirhost\n touch ${_pthLog}/renameaegirhost.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/renameaegirhost.old\" ]; then\n mv -f ${_optBin}/renameaegirhost.old ${_optBin}/renameaegirhost\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/autosymlink\" ] \\\n || [ ! -e \"${_pthLog}/autosymlink.sh.ctrl.f93.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc autosymlink)\n if (( _CNT > 0 )); then\n echo \"The autosymlink is running!\"\n else\n if [ -e \"${_optBin}/autosymlink\" ]; then\n mv -f ${_optBin}/autosymlink ${_optBin}/autosymlink.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/autosymlink\" -o ${_optBin}/autosymlink\n if [ -e \"${_optBin}/autosymlink\" ]; then\n chmod 700 ${_optBin}/autosymlink\n chown root:root ${_optBin}/autosymlink\n touch ${_pthLog}/autosymlink.sh.ctrl.f93.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/autosymlink.old\" ]; then\n mv -f ${_optBin}/autosymlink.old ${_optBin}/autosymlink\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/updatesymlinks\" ] \\\n || [ ! -e \"${_pthLog}/updatesymlinks.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc updatesymlinks)\n if (( _CNT > 0 )); then\n echo \"The updatesymlinks is running!\"\n else\n if [ -e \"${_optBin}/updatesymlinks\" ]; then\n mv -f ${_optBin}/updatesymlinks ${_optBin}/updatesymlinks.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/updatesymlinks\" -o ${_optBin}/updatesymlinks\n if [ -e \"${_optBin}/updatesymlinks\" ]; then\n chmod 700 ${_optBin}/updatesymlinks\n chown root:root ${_optBin}/updatesymlinks\n touch ${_pthLog}/updatesymlinks.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/updatesymlinks.old\" ]; then\n mv -f ${_optBin}/updatesymlinks.old ${_optBin}/updatesymlinks\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/aptcleanup\" ] \\\n || [ ! -e \"${_pthLog}/aptcleanup.sh.ctrl.f97.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc aptcleanup)\n if (( _CNT > 0 )); then\n echo \"The aptcleanup is running!\"\n else\n if [ -e \"${_optBin}/aptcleanup\" ]; then\n mv -f ${_optBin}/aptcleanup ${_optBin}/aptcleanup.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/aptcleanup\" -o ${_optBin}/aptcleanup\n if [ -e \"${_optBin}/aptcleanup\" ]; then\n chmod 700 ${_optBin}/aptcleanup\n chown root:root ${_optBin}/aptcleanup\n touch ${_pthLog}/aptcleanup.sh.ctrl.f97.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/aptcleanup.old\" ]; then\n mv -f ${_optBin}/aptcleanup.old ${_optBin}/aptcleanup\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/loadguard\" ] \\\n || [ ! -e \"${_pthLog}/loadguard.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc xloadguard)\n if (( _CNT > 0 )); then\n echo \"The xloadguard is running!\"\n else\n if [ -e \"${_optBin}/loadguard\" ]; then\n mv -f ${_optBin}/loadguard ${_optBin}/loadguard.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/loadguard\" -o ${_optBin}/loadguard\n if [ -e \"${_optBin}/loadguard\" ]; then\n chmod 700 ${_optBin}/loadguard\n chown root:root ${_optBin}/loadguard\n touch ${_pthLog}/loadguard.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/loadguard.old\" ]; then\n mv -f ${_optBin}/loadguard.old ${_optBin}/loadguard\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/ffmirror\" ] \\\n || [ ! -e \"${_pthLog}/ffmirror.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc xffmirror)\n if (( _CNT > 0 )); then\n echo \"The xffmirror is running!\"\n else\n if [ -e \"${_optBin}/ffmirror\" ]; then\n mv -f ${_optBin}/ffmirror ${_optBin}/ffmirror.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/ffmirror\" -o ${_optBin}/ffmirror\n if [ -e \"${_optBin}/ffmirror\" ]; then\n chmod 700 ${_optBin}/ffmirror\n chown root:root ${_optBin}/ffmirror\n touch ${_pthLog}/ffmirror.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/ffmirror.old\" ]; then\n mv -f ${_optBin}/ffmirror.old ${_optBin}/ffmirror\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/ffdevuan\" ] \\\n || [ ! -e \"${_pthLog}/ffdevuan.sh.ctrl.f95.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc xffdevuan)\n if (( _CNT > 0 )); then\n echo \"The xffdevuan is running!\"\n else\n if [ -e \"${_optBin}/ffdevuan\" ]; then\n mv -f ${_optBin}/ffdevuan ${_optBin}/ffdevuan.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/ffdevuan\" -o ${_optBin}/ffdevuan\n if [ -e \"${_optBin}/ffdevuan\" ]; then\n chmod 700 ${_optBin}/ffdevuan\n chown root:root ${_optBin}/ffdevuan\n touch ${_pthLog}/ffdevuan.sh.ctrl.f95.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/ffdevuan.old\" ]; then\n mv -f ${_optBin}/ffdevuan.old ${_optBin}/ffdevuan\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/webserver\" ] \\\n || [ ! -e \"${_pthLog}/webserver.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc xwebserver)\n if (( _CNT > 0 )); then\n echo \"The xwebserver is running!\"\n else\n if [ -e \"${_optBin}/webserver\" ]; then\n mv -f ${_optBin}/webserver ${_optBin}/webserver.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/webserver\" -o ${_optBin}/webserver\n if [ -e \"${_optBin}/webserver\" ]; then\n chmod 700 ${_optBin}/webserver\n chown root:root ${_optBin}/webserver\n touch ${_pthLog}/webserver.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/webserver.old\" ]; then\n mv -f ${_optBin}/webserver.old ${_optBin}/webserver\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/xboa\" ] \\\n || [ ! -e \"${_pthLog}/xboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc /local/bin/xboa)\n if (( _CNT > 0 )); then\n echo \"The xboa is running!\"\n else\n if [ -e \"${_optBin}/xboa\" ]; then\n mv -f ${_optBin}/xboa ${_optBin}/xboa.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/xboa\" -o ${_optBin}/xboa\n if [ -e \"${_optBin}/xboa\" ]; then\n chmod 700 ${_optBin}/xboa\n chown root:root ${_optBin}/xboa\n touch ${_pthLog}/xboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/xboa.old\" ]; then\n mv -f ${_optBin}/xboa.old ${_optBin}/xboa\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/boa\" ] \\\n || [ ! -e \"${_pthLog}/boa.sh.ctrl.f89.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc /local/bin/boa)\n if (( _CNT > 0 )); then\n echo \"The boa is running!\"\n else\n if [ -e \"${_optBin}/boa\" ]; then\n mv -f ${_optBin}/boa ${_optBin}/boa.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/boa\" -o ${_optBin}/boa\n if [ -e \"${_optBin}/boa\" ]; then\n chmod 700 ${_optBin}/boa\n chown root:root ${_optBin}/boa\n touch ${_pthLog}/boa.sh.ctrl.f89.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/boa.old\" ]; then\n mv -f ${_optBin}/boa.old ${_optBin}/boa\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/barracuda\" ] \\\n || [ ! -e \"${_pthLog}/barracuda.sh.ctrl.f93.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc /local/bin/barracuda)\n if (( _CNT > 0 )); then\n echo \"The barracuda is running!\"\n else\n if [ -e \"${_optBin}/barracuda\" ]; then\n mv -f ${_optBin}/barracuda ${_optBin}/barracuda.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/barracuda\" -o ${_optBin}/barracuda\n if [ -e \"${_optBin}/barracuda\" ]; then\n chmod 700 ${_optBin}/barracuda\n chown root:root ${_optBin}/barracuda\n touch ${_pthLog}/barracuda.sh.ctrl.f93.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/barracuda.old\" ]; then\n mv -f ${_optBin}/barracuda.old ${_optBin}/barracuda\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/octopus\" ] \\\n || [ ! -e \"${_pthLog}/octopus.sh.ctrl.f89.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc /local/bin/octopus)\n if (( _CNT > 0 )); then\n echo \"The octopus is running!\"\n else\n if [ -e \"${_optBin}/octopus\" ]; then\n mv -f ${_optBin}/octopus ${_optBin}/octopus.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/octopus\" -o ${_optBin}/octopus\n if [ -e \"${_optBin}/octopus\" ]; then\n chmod 700 ${_optBin}/octopus\n chown root:root ${_optBin}/octopus\n touch ${_pthLog}/octopus.sh.ctrl.f89.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/octopus.old\" ]; then\n mv -f ${_optBin}/octopus.old ${_optBin}/octopus\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/perftest\" ] \\\n || [ ! -L \"${_usrBin}/perftest\" ] \\\n || [ ! -e \"${_pthLog}/perftest.sh.ctrl.f97.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc /local/bin/perftest)\n if (( _CNT > 0 )); then\n echo \"The perftest is running!\"\n else\n if [ -e \"${_optBin}/perftest\" ]; then\n mv -f ${_optBin}/perftest ${_optBin}/perftest.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/perftest\" -o ${_optBin}/perftest\n if [ -e \"${_optBin}/perftest\" ]; then\n chmod 700 ${_optBin}/perftest\n chown root:root ${_optBin}/perftest\n ln -sf ${_optBin}/perftest ${_usrBin}/perftest\n rm -f ${_pthLog}/perftest.sh.ctrl.*\n touch ${_pthLog}/perftest.sh.ctrl.f97.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/perftest.old\" ]; then\n mv -f ${_optBin}/perftest.old ${_optBin}/perftest\n fi\n fi\n fi\n fi\n\n if [ ! -e \"${_optBin}/aptfast\" ] \\\n || [ ! -e \"${_pthLog}/aptfast.sh.ctrl.f98.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc /local/bin/aptfast)\n if (( _CNT > 0 )); then\n echo \"The aptfast is running!\"\n else\n if [ -e \"${_optBin}/aptfast\" ]; then\n mv -f ${_optBin}/aptfast ${_optBin}/aptfast.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/aptfast\" -o ${_optBin}/aptfast\n if [ -e \"${_optBin}/aptfast\" ]; then\n chmod 700 ${_optBin}/aptfast\n chown root:root ${_optBin}/aptfast\n touch ${_pthLog}/aptfast.sh.ctrl.f98.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/aptfast.old\" ]; then\n mv -f ${_optBin}/aptfast.old ${_optBin}/aptfast\n fi\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/backboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc duplicity)\n if (( _CNT > 0 )); then\n echo \"The duplicity backup is running!\"\n else\n if [ -e \"${_optBin}/backboa\" ]; then\n mv -f ${_optBin}/backboa ${_optBin}/backboa.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/backboa\" -o ${_optBin}/backboa\n if [ -e \"${_optBin}/backboa\" ]; then\n chmod 700 ${_optBin}/backboa\n chown root:root ${_optBin}/backboa\n touch ${_pthLog}/backboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/backboa.old\" ]; then\n mv -f ${_optBin}/backboa.old ${_optBin}/backboa\n fi\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/duobackboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc duplicity)\n if (( _CNT > 0 )); then\n echo \"The duplicity backup is running!\"\n else\n if [ -e \"${_optBin}/duobackboa\" ]; then\n mv -f ${_optBin}/duobackboa ${_optBin}/duobackboa.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/duobackboa\" -o ${_optBin}/duobackboa\n if [ -e \"${_optBin}/duobackboa\" ]; then\n chmod 700 ${_optBin}/duobackboa\n chown root:root ${_optBin}/duobackboa\n touch ${_pthLog}/duobackboa.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/duobackboa.old\" ]; then\n mv -f ${_optBin}/duobackboa.old ${_optBin}/duobackboa\n fi\n fi\n fi\n fi\n\n if [ -e \"/root/.remote_backups/schedule/backup_schedule.txt\" ]; then\n _BROKEN_UPDATE_TEST=$(grep \"Under Construction\" /root/.remote_backups/run/*.sh 2>&1)\n if [ ! -z \"${_BROKEN_UPDATE_TEST}\" ]; then\n rm -f ${_pthCtrl}/*.pid\n fi\n _BROKEN_UPDATE_TEST=$(grep \"404 Not Found\" /root/.remote_backups/run/*.sh 2>&1)\n if [ ! -z \"${_BROKEN_UPDATE_TEST}\" ]; then\n rm -f ${_pthCtrl}/*.pid\n fi\n fi\n\n if [ -e \"/root/.remote_backups/schedule/backup_schedule.txt\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthCtrl}/dcysetup.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc duplicity)\n if (( _CNT > 0 )); then\n echo \"The duplicity backup is running!\"\n else\n if [ -e \"${_optBin}/dcysetup\" ]; then\n mv -f ${_optBin}/dcysetup ${_optBin}/dcysetup.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/dcysetup\" -o ${_optBin}/dcysetup\n if [ -e \"${_optBin}/dcysetup\" ]; then\n chmod 700 ${_optBin}/dcysetup\n chown root:root ${_optBin}/dcysetup\n touch ${_pthCtrl}/dcysetup.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/dcysetup.old\" ]; then\n mv -f ${_optBin}/dcysetup.old ${_optBin}/dcysetup\n fi\n fi\n fi\n fi\n\n if [ -e \"/root/.remote_backups/schedule/backup_schedule.txt\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthCtrl}/multiback.sh.ctrl.f37.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc duplicity)\n if (( _CNT > 0 )); then\n echo \"The duplicity backup is running!\"\n else\n if [ -e \"${_optBin}/multiback\" ]; then\n mv -f ${_optBin}/multiback ${_optBin}/multiback.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/multiback\" -o ${_optBin}/multiback\n if [ -e \"${_optBin}/multiback\" ]; then\n chmod 700 ${_optBin}/multiback\n chown root:root ${_optBin}/multiback\n touch ${_pthCtrl}/multiback.sh.ctrl.f37.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/multiback.old\" ]; then\n mv -f ${_optBin}/multiback.old ${_optBin}/multiback\n fi\n fi\n fi\n fi\n\n if [ -e \"/root/.remote_backups/schedule/backup_schedule.txt\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthCtrl}/mybackup.sh.ctrl.f37.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc duplicity)\n if (( _CNT > 0 )); then\n echo \"The duplicity backup is running!\"\n else\n if [ -e \"${_optBin}/mybackup\" ]; then\n mv -f ${_optBin}/mybackup ${_optBin}/mybackup.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/mybackup\" -o ${_optBin}/mybackup\n if [ -e \"${_optBin}/mybackup\" ]; then\n chmod 755 ${_optBin}/mybackup\n chown root:root ${_optBin}/mybackup\n touch ${_pthCtrl}/mybackup.sh.ctrl.f37.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/mybackup.old\" ]; then\n mv -f ${_optBin}/mybackup.old ${_optBin}/mybackup\n fi\n fi\n fi\n fi\n\n if [ -d \"/root/.remote_backups/run\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthCtrl}/install_dependencies.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\" ]; then\n if [ -e \"/root/.remote_backups/run/install_dependencies.sh\" ]; then\n mv -f /root/.remote_backups/run/install_dependencies.sh /root/.remote_backups/run/install_dependencies.sh.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/backup/run/install_dependencies.sh\" -o /root/.remote_backups/run/install_dependencies.sh\n if [ -e \"/root/.remote_backups/run/install_dependencies.sh\" ]; then\n chmod 700 /root/.remote_backups/run/install_dependencies.sh\n chown root:root /root/.remote_backups/run/install_dependencies.sh\n touch ${_pthCtrl}/install_dependencies.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"/root/.remote_backups/run/install_dependencies.sh.old\" ]; then\n mv -f /root/.remote_backups/run/install_dependencies.sh.old /root/.remote_backups/run/install_dependencies.sh\n fi\n fi\n fi\n\n if [ -d \"/root/.remote_backups/run\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthCtrl}/create_credentials_templates.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\" ]; then\n rm -f /.backboa*\n if [ -e \"/root/.remote_backups/run/create_credentials_templates.sh\" ]; then\n mv -f /root/.remote_backups/run/create_credentials_templates.sh /root/.remote_backups/run/create_credentials_templates.sh.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/backup/run/create_credentials_templates.sh\" -o /root/.remote_backups/run/create_credentials_templates.sh\n if [ -e \"/root/.remote_backups/run/create_credentials_templates.sh\" ]; then\n chmod 700 /root/.remote_backups/run/create_credentials_templates.sh\n chown root:root /root/.remote_backups/run/create_credentials_templates.sh\n touch ${_pthCtrl}/create_credentials_templates.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"/root/.remote_backups/run/create_credentials_templates.sh.old\" ]; then\n mv -f /root/.remote_backups/run/create_credentials_templates.sh.old /root/.remote_backups/run/create_credentials_templates.sh\n fi\n fi\n fi\n\n if [ -d \"/root/.remote_backups/run\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthCtrl}/create_global_paths_config.sh.ctrl.f44.${_tRee}.${_xSrl}.pid\" ]; then\n if [ -e \"/root/.remote_backups/run/create_global_paths_config.sh\" ]; then\n mv -f /root/.remote_backups/run/create_global_paths_config.sh /root/.remote_backups/run/create_global_paths_config.sh.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/backup/run/create_global_paths_config.sh\" -o /root/.remote_backups/run/create_global_paths_config.sh\n if [ -e \"/root/.remote_backups/run/create_global_paths_config.sh\" ]; then\n chmod 700 /root/.remote_backups/run/create_global_paths_config.sh\n chown root:root /root/.remote_backups/run/create_global_paths_config.sh\n touch ${_pthCtrl}/create_global_paths_config.sh.ctrl.f44.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"/root/.remote_backups/run/create_global_paths_config.sh.old\" ]; then\n mv -f /root/.remote_backups/run/create_global_paths_config.sh.old /root/.remote_backups/run/create_global_paths_config.sh\n fi\n fi\n fi\n\n if [ -d \"/root/.remote_backups/run\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthCtrl}/create_user_paths_config.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\" ]; then\n rm -f /.backboa*\n if [ -e \"/root/.remote_backups/run/create_user_paths_config.sh\" ]; then\n mv -f /root/.remote_backups/run/create_user_paths_config.sh /root/.remote_backups/run/create_user_paths_config.sh.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/backup/run/create_user_paths_config.sh\" -o /root/.remote_backups/run/create_user_paths_config.sh\n if [ -e \"/root/.remote_backups/run/create_user_paths_config.sh\" ]; then\n chmod 700 /root/.remote_backups/run/create_user_paths_config.sh\n chown root:root /root/.remote_backups/run/create_user_paths_config.sh\n touch ${_pthCtrl}/create_user_paths_config.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"/root/.remote_backups/run/create_user_paths_config.sh.old\" ]; then\n mv -f /root/.remote_backups/run/create_user_paths_config.sh.old /root/.remote_backups/run/create_user_paths_config.sh\n fi\n fi\n fi\n\n if [ -d \"/root/.remote_backups/run\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthCtrl}/create_cron_entries.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\" ]; then\n if [ -e \"/root/.remote_backups/run/create_cron_entries.sh\" ]; then\n mv -f /root/.remote_backups/run/create_cron_entries.sh /root/.remote_backups/run/create_cron_entries.sh.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/backup/run/create_cron_entries.sh\" -o /root/.remote_backups/run/create_cron_entries.sh\n if [ -e \"/root/.remote_backups/run/create_cron_entries.sh\" ]; then\n chmod 700 /root/.remote_backups/run/create_cron_entries.sh\n chown root:root /root/.remote_backups/run/create_cron_entries.sh\n touch ${_pthCtrl}/create_cron_entries.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"/root/.remote_backups/run/create_cron_entries.sh.old\" ]; then\n mv -f /root/.remote_backups/run/create_cron_entries.sh.old /root/.remote_backups/run/create_cron_entries.sh\n fi\n fi\n fi\n\n if [ -d \"/root/.remote_backups/run\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthCtrl}/create_readme.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\" ]; then\n if [ -e \"/root/.remote_backups/run/create_readme.sh\" ]; then\n mv -f /root/.remote_backups/run/create_readme.sh /root/.remote_backups/run/create_readme.sh.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/backup/run/create_readme.sh\" -o /root/.remote_backups/run/create_readme.sh\n if [ -e \"/root/.remote_backups/run/create_readme.sh\" ]; then\n chmod 700 /root/.remote_backups/run/create_readme.sh\n chown root:root /root/.remote_backups/run/create_readme.sh\n touch ${_pthCtrl}/create_readme.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"/root/.remote_backups/run/create_readme.sh.old\" ]; then\n mv -f /root/.remote_backups/run/create_readme.sh.old /root/.remote_backups/run/create_readme.sh\n fi\n fi\n fi\n\n if [ -d \"/root/.remote_backups/run\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthCtrl}/create_config_readme.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\" ]; then\n if [ -e \"/root/.remote_backups/run/create_config_readme.sh\" ]; then\n mv -f /root/.remote_backups/run/create_config_readme.sh /root/.remote_backups/run/create_config_readme.sh.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/backup/run/create_config_readme.sh\" -o /root/.remote_backups/run/create_config_readme.sh\n if [ -e \"/root/.remote_backups/run/create_config_readme.sh\" ]; then\n chmod 700 /root/.remote_backups/run/create_config_readme.sh\n chown root:root /root/.remote_backups/run/create_config_readme.sh\n touch ${_pthCtrl}/create_config_readme.sh.ctrl.f48.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"/root/.remote_backups/run/create_config_readme.sh.old\" ]; then\n mv -f /root/.remote_backups/run/create_config_readme.sh.old /root/.remote_backups/run/create_config_readme.sh\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/scan_nginx.sh.ctrl.f81.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/scan_nginx.sh /var/xdrago/monitor/check/scan_nginx.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/scan_nginx.sh\" -o /var/xdrago/monitor/check/scan_nginx.sh\n if [ -e \"/var/xdrago/monitor/check/scan_nginx.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/scan_nginx.sh\n chown root:root /var/xdrago/monitor/check/scan_nginx.sh\n touch ${_pthLog}/scan_nginx.sh.ctrl.f81.${_tRee}.${_xSrl}.pid\n if [ ! -e \"/var/xdrago/monitor/log/.scan_nginx_arch.${_xSrl}.pid\" ]; then\n if [ -e \"/var/xdrago/monitor/scan_nginx.archive.log\" ]; then\n mv -f /var/xdrago/monitor/scan_nginx.archive.log /var/xdrago/monitor/log/.scan_nginx_legacy.archive.f81.${_tRee}.${_xSrl}.log\n fi\n if [ -e \"/var/xdrago/monitor/log/scan_nginx.archive.log\" ]; then\n mv -f /var/xdrago/monitor/log/scan_nginx.archive.log /var/xdrago/monitor/log/scan_nginx.archive.f81.${_tRee}.${_xSrl}.log\n fi\n rm -f /var/xdrago/monitor/log/.scan_nginx_arch*.pid\n touch /var/xdrago/monitor/log/.scan_nginx_arch.${_xSrl}.pid\n csf -df\n wait\n [ -e \"/etc/csf/csfpost.d/synproxy.sh\" ] && synproxy_reassert -p \"443 80\" --no-quic -q &> /dev/null\n fi\n if [ ! -e \"/var/xdrago/monitor/log/.hackcheck.arch.${_xSrl}.pid\" ]; then\n if [ -e \"/var/xdrago/monitor/hackcheck.archive.log\" ]; then\n mv -f /var/xdrago/monitor/hackcheck.archive.log /var/xdrago/monitor/log/.scan_nginx_legacy.archive.f81.${_tRee}.${_xSrl}.log\n fi\n if [ -e \"/var/xdrago/monitor/log/hackcheck.archive.log\" ]; then\n mv -f /var/xdrago/monitor/log/hackcheck.archive.log /var/xdrago/monitor/log/hackcheck.archive.f81.${_tRee}.${_xSrl}.log\n fi\n rm -f /var/xdrago/monitor/log/.hackcheck.arch*.pid\n touch /var/xdrago/monitor/log/.hackcheck.arch.${_xSrl}.pid\n csf -df\n wait\n [ -e \"/etc/csf/csfpost.d/synproxy.sh\" ] && synproxy_reassert -p \"443 80\" --no-quic -q &> /dev/null\n fi\n else\n mv -f /var/xdrago/monitor/check/scan_nginx.sh.old /var/xdrago/monitor/check/scan_nginx.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/java.sh.ctrl.f90.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/java.sh /var/xdrago/monitor/check/java.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/java.sh\" -o /var/xdrago/monitor/check/java.sh\n if [ -e \"/var/xdrago/monitor/check/java.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/java.sh\n chown root:root /var/xdrago/monitor/check/java.sh\n touch ${_pthLog}/java.sh.ctrl.f90.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/java.sh.old /var/xdrago/monitor/check/java.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/mysql.sh.ctrl.f82.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/mysql.sh /var/xdrago/monitor/check/mysql.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/mysql.sh\" -o /var/xdrago/monitor/check/mysql.sh\n if [ -e \"/var/xdrago/monitor/check/mysql.sh\" ]; then\n if [ -e \"/root/.debug.cnf\" ] && [ ! -e \"/root/.default.cnf\" ]; then\n _DO_NOTHING=YES\n else\n if [ -e \"/root/.high_load.cnf\" ] \\\n && [ ! -e \"/root/.big_db.cnf\" ] \\\n && [ ! -e \"/root/.tg.cnf\" ]; then\n sed -i \"s/3600/300/g\" /var/xdrago/monitor/check/mysql.sh\n elif [ -e \"/root/.big_db.cnf\" ] || [ -e \"/root/.tg.cnf\" ]; then\n _DO_NOTHING=YES\n else\n sed -i \"s/3600/1800/g\" /var/xdrago/monitor/check/mysql.sh\n fi\n fi\n chmod 700 /var/xdrago/monitor/check/mysql.sh\n chown root:root /var/xdrago/monitor/check/mysql.sh\n touch ${_pthLog}/mysql.sh.ctrl.f82.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/mysql.sh.old /var/xdrago/monitor/check/mysql.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/nginx.sh.ctrl.f92.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/nginx.sh /var/xdrago/monitor/check/nginx.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/nginx.sh\" -o /var/xdrago/monitor/check/nginx.sh\n if [ -e \"/var/xdrago/monitor/check/nginx.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/nginx.sh\n chown root:root /var/xdrago/monitor/check/nginx.sh\n touch ${_pthLog}/nginx.sh.ctrl.f92.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/nginx.sh.old /var/xdrago/monitor/check/nginx.sh\n fi\n fi\n\n if [ ! -e \"/var/xdrago/monitor/check/nginx_guard.sh\" ]; then\n rm -f ${_pthLog}/nginx_guard.sh.ctrl.*\n fi\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/nginx_guard.sh.ctrl.f98.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/nginx_guard.sh /var/xdrago/monitor/check/nginx_guard.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/nginx_guard.sh\" -o /var/xdrago/monitor/check/nginx_guard.sh\n if [ -e \"/var/xdrago/monitor/check/nginx_guard.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/nginx_guard.sh\n chown root:root /var/xdrago/monitor/check/nginx_guard.sh\n touch ${_pthLog}/nginx_guard.sh.ctrl.f98.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/nginx_guard.sh.old /var/xdrago/monitor/check/nginx_guard.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/php.sh.ctrl.f85.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/php.sh /var/xdrago/monitor/check/php.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/php.sh\" -o /var/xdrago/monitor/check/php.sh\n if [ -e \"/var/xdrago/monitor/check/php.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/php.sh\n chown root:root /var/xdrago/monitor/check/php.sh\n touch ${_pthLog}/php.sh.ctrl.f85.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/php.sh.old /var/xdrago/monitor/check/php.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/valkey.sh.ctrl.f87.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/valkey.sh /var/xdrago/monitor/check/valkey.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/valkey.sh\" -o /var/xdrago/monitor/check/valkey.sh\n if [ -e \"/var/xdrago/monitor/check/valkey.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/valkey.sh\n chown root:root /var/xdrago/monitor/check/valkey.sh\n touch ${_pthLog}/valkey.sh.ctrl.f87.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/valkey.sh.old /var/xdrago/monitor/check/valkey.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/redis.sh.ctrl.f90.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/redis.sh /var/xdrago/monitor/check/redis.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/redis.sh\" -o /var/xdrago/monitor/check/redis.sh\n if [ -e \"/var/xdrago/monitor/check/redis.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/redis.sh\n chown root:root /var/xdrago/monitor/check/redis.sh\n touch ${_pthLog}/redis.sh.ctrl.f90.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/redis.sh.old /var/xdrago/monitor/check/redis.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/system.sh.ctrl.f83.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/system.sh /var/xdrago/monitor/check/system.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/system.sh\" -o /var/xdrago/monitor/check/system.sh\n if [ -e \"/var/xdrago/monitor/check/system.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/system.sh\n chown root:root /var/xdrago/monitor/check/system.sh\n touch ${_pthLog}/system.sh.ctrl.f83.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/system.sh.old /var/xdrago/monitor/check/system.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/unbound.sh.ctrl.f86.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/unbound.sh /var/xdrago/monitor/check/unbound.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/unbound.sh\" -o /var/xdrago/monitor/check/unbound.sh\n if [ -e \"/var/xdrago/monitor/check/unbound.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/unbound.sh\n chown root:root /var/xdrago/monitor/check/unbound.sh\n touch ${_pthLog}/unbound.sh.ctrl.f86.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/unbound.sh.old /var/xdrago/monitor/check/unbound.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/escapecheck.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/escapecheck.sh /var/xdrago/monitor/check/escapecheck.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/escapecheck.sh\" -o /var/xdrago/monitor/check/escapecheck.sh\n if [ -e \"/var/xdrago/monitor/check/escapecheck.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/escapecheck.sh\n chown root:root /var/xdrago/monitor/check/escapecheck.sh\n touch ${_pthLog}/escapecheck.sh.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/escapecheck.sh.old /var/xdrago/monitor/check/escapecheck.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/hackcheck.sh.ctrl.f95.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/hackcheck.sh /var/xdrago/monitor/check/hackcheck.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/hackcheck.sh\" -o /var/xdrago/monitor/check/hackcheck.sh\n if [ -e \"/var/xdrago/monitor/check/hackcheck.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/hackcheck.sh\n chown root:root /var/xdrago/monitor/check/hackcheck.sh\n touch ${_pthLog}/hackcheck.sh.ctrl.f95.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/hackcheck.sh.old /var/xdrago/monitor/check/hackcheck.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/hackftp.sh.ctrl.f98.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/hackftp.sh /var/xdrago/monitor/check/hackftp.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/hackftp.sh\" -o /var/xdrago/monitor/check/hackftp.sh\n if [ -e \"/var/xdrago/monitor/check/hackftp.sh\" ]; then\n chmod 700 /var/xdrago/monitor/check/hackftp.sh\n chown root:root /var/xdrago/monitor/check/hackftp.sh\n touch ${_pthLog}/hackftp.sh.ctrl.f98.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/hackftp.sh.old /var/xdrago/monitor/check/hackftp.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/segfault_alert.pl.ctrl.f94.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/segfault_alert.pl /var/xdrago/monitor/check/segfault_alert.pl.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/segfault_alert.pl\" -o /var/xdrago/monitor/check/segfault_alert.pl\n if [ -e \"/var/xdrago/monitor/check/segfault_alert.pl\" ]; then\n chmod 700 /var/xdrago/monitor/check/segfault_alert.pl\n chown root:root /var/xdrago/monitor/check/segfault_alert.pl\n touch ${_pthLog}/segfault_alert.pl.ctrl.f94.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/segfault_alert.pl.old /var/xdrago/monitor/check/segfault_alert.pl\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/sqlcheck.pl.ctrl.f94.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/monitor/check/sqlcheck.pl /var/xdrago/monitor/check/sqlcheck.pl.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/monitor/check/sqlcheck.pl\" -o /var/xdrago/monitor/check/sqlcheck.pl\n if [ -e \"/var/xdrago/monitor/check/sqlcheck.pl\" ]; then\n chmod 700 /var/xdrago/monitor/check/sqlcheck.pl\n chown root:root /var/xdrago/monitor/check/sqlcheck.pl\n touch ${_pthLog}/sqlcheck.pl.ctrl.f94.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/monitor/check/sqlcheck.pl.old /var/xdrago/monitor/check/sqlcheck.pl\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ ! -e \"${_pthLog}/cv-phar-symlink.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n if [ -x \"/usr/local/bin/cv.phar\" ] \\\n && [ -L \"/usr/bin/cv\" ]; then\n _CV_SYMLINK=$(readlink -n /usr/bin/cv 2>&1)\n _CV_SYMLINK=$(echo -n ${_CV_SYMLINK} | tr -d \"\\n\" 2>&1)\n if [ \"${_CV_SYMLINK}\" != \"/usr/local/bin/cv.phar\" ]; then\n rm -f /usr/bin/cv\n ln -sfn /usr/local/bin/cv.phar /usr/bin/cv\n touch ${_pthLog}/cv-phar-symlink.ctrl.${_tRee}.${_xSrl}.pid\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ ! -e \"${_pthLog}/drush8-classic-symlink.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n if [ -x \"/opt/tools/drush/8/drush/drush.php\" ] \\\n && [ -L \"/usr/bin/drush8\" ]; then\n _DRUSH_SYMLINK=$(readlink -n /usr/bin/drush8 2>&1)\n _DRUSH_SYMLINK=$(echo -n ${_DRUSH_SYMLINK} | tr -d \"\\n\" 2>&1)\n if [ \"${_DRUSH_SYMLINK}\" != \"/opt/tools/drush/8/drush/drush.php\" ]; then\n rm -f /usr/bin/drush8\n rm -f /usr/bin/drush\n ln -sfn /opt/tools/drush/8/drush/drush.php /usr/bin/drush8\n ln -sfn /opt/tools/drush/8/drush/drush.php /usr/bin/drush\n touch ${_pthLog}/drush8-classic-symlink.ctrl.${_tRee}.${_xSrl}.pid\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/clean-boa-env.ctrl.f97.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /etc/init.d/clean-boa-env /var/xdrago/clean-boa-env.old\n curl ${_crlGet} \"${_urlHmr}/conf/var/clean-boa-env\" -o /etc/init.d/clean-boa-env\n if [ -e \"/etc/init.d/clean-boa-env\" ]; then\n chmod 700 /etc/init.d/clean-boa-env\n chown root:root /etc/init.d/clean-boa-env\n touch ${_pthLog}/clean-boa-env.ctrl.f97.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/clean-boa-env.old /etc/init.d/clean-boa-env\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/mysql_backup.sh.ctrl.f88.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc mysql_backup.sh)\n if (( _CNT > 0 )); then\n echo \"The mysql_backup.sh is running!\"\n else\n mv -f /var/xdrago/mysql_backup.sh /var/xdrago/mysql_backup.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/mysql_backup.sh\" -o /var/xdrago/mysql_backup.sh\n if [ -e \"/var/xdrago/mysql_backup.sh\" ]; then\n chmod 700 /var/xdrago/mysql_backup.sh\n chown root:root /var/xdrago/mysql_backup.sh\n touch ${_pthLog}/mysql_backup.sh.ctrl.f88.${_xSrl}.pid\n else\n mv -f /var/xdrago/mysql_backup.sh.old /var/xdrago/mysql_backup.sh\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/unbound-helper.ctrl.f95.${_xSrl}.pid\" ]; then\n mv -f /usr/libexec/unbound-helper /usr/libexec/unbound-helper.old\n curl ${_crlGet} \"${_urlHmr}/conf/dns/unbound-helper\" -o /usr/libexec/unbound-helper\n if [ -e \"/usr/libexec/unbound-helper\" ]; then\n chmod 755 /usr/libexec/unbound-helper\n chown root:root /usr/libexec/unbound-helper\n touch ${_pthLog}/unbound-helper.ctrl.f95.${_xSrl}.pid\n else\n mv -f /usr/libexec/unbound-helper.old /usr/libexec/unbound-helper\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/mysql_cleanup.sh.ctrl.f92.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/mysql_cleanup.sh /var/xdrago/mysql_cleanup.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/mysql_cleanup.sh\" -o /var/xdrago/mysql_cleanup.sh\n if [ -e \"/var/xdrago/mysql_cleanup.sh\" ]; then\n chmod 700 /var/xdrago/mysql_cleanup.sh\n chown root:root /var/xdrago/mysql_cleanup.sh\n touch ${_pthLog}/mysql_cleanup.sh.ctrl.f92.${_xSrl}.pid\n else\n mv -f /var/xdrago/mysql_cleanup.sh.old /var/xdrago/mysql_cleanup.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/mysql_cluster_backup.sh.ctrl.f91.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc mysql_cluster_backup.sh)\n if (( _CNT > 0 )); then\n echo \"The mysql_cluster_backup.sh is running!\"\n else\n mv -f /var/xdrago/mysql_cluster_backup.sh /var/xdrago/mysql_cluster_backup.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/mysql_cluster_backup.sh\" -o /var/xdrago/mysql_cluster_backup.sh\n if [ -e \"/var/xdrago/mysql_cluster_backup.sh\" ]; then\n chmod 700 /var/xdrago/mysql_cluster_backup.sh\n chown root:root /var/xdrago/mysql_cluster_backup.sh\n touch ${_pthLog}/mysql_cluster_backup.sh.ctrl.f91.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/mysql_cluster_backup.sh.old /var/xdrago/mysql_cluster_backup.sh\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/runner.sh.ctrl.f86.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/runner.sh /var/xdrago/runner.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/runner.sh\" -o /var/xdrago/runner.sh\n if [ -e \"/var/xdrago/runner.sh\" ]; then\n chmod 700 /var/xdrago/runner.sh\n chown root:root /var/xdrago/runner.sh\n touch ${_pthLog}/runner.sh.ctrl.f86.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/runner.sh.old /var/xdrago/runner.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/minute.sh.ctrl.f91.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/minute.sh /var/xdrago/minute.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/minute.sh\" -o /var/xdrago/minute.sh\n if [ -e \"/var/xdrago/minute.sh\" ]; then\n chmod 700 /var/xdrago/minute.sh\n chown root:root /var/xdrago/minute.sh\n touch ${_pthLog}/minute.sh.ctrl.f91.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/minute.sh.old /var/xdrago/minute.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/second.sh.ctrl.f88.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/second.sh /var/xdrago/second.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/second.sh\" -o /var/xdrago/second.sh\n if [ -e \"/var/xdrago/second.sh\" ]; then\n chmod 700 /var/xdrago/second.sh\n chown root:root /var/xdrago/second.sh\n touch ${_pthLog}/second.sh.ctrl.f88.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/second.sh.old /var/xdrago/second.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/ip_access.sh.ctrl.f93.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/ip_access.sh /var/xdrago/ip_access.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/ip_access.sh\" -o /var/xdrago/ip_access.sh\n if [ -e \"/var/xdrago/ip_access.sh\" ]; then\n chmod 700 /var/xdrago/ip_access.sh\n chown root:root /var/xdrago/ip_access.sh\n touch ${_pthLog}/ip_access.sh.ctrl.f93.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/ip_access.sh.old /var/xdrago/ip_access.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/move_sql.sh.ctrl.f90.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/move_sql.sh /var/xdrago/move_sql.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/move_sql.sh\" -o /var/xdrago/move_sql.sh\n if [ -e \"/var/xdrago/move_sql.sh\" ]; then\n chmod 700 /var/xdrago/move_sql.sh\n chown root:root /var/xdrago/move_sql.sh\n touch ${_pthLog}/move_sql.sh.ctrl.f90.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/move_sql.sh.old /var/xdrago/move_sql.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/mysql_repair.sh.ctrl.f95.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/mysql_repair.sh /var/xdrago/mysql_repair.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/mysql_repair.sh\" -o /var/xdrago/mysql_repair.sh\n if [ -e \"/var/xdrago/mysql_repair.sh\" ]; then\n chmod 700 /var/xdrago/mysql_repair.sh\n chown root:root /var/xdrago/mysql_repair.sh\n touch ${_pthLog}/mysql_repair.sh.ctrl.f95.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/mysql_repair.sh.old /var/xdrago/mysql_repair.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/purge_binlogs.sh.ctrl.f93.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/purge_binlogs.sh /var/xdrago/purge_binlogs.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/purge_binlogs.sh\" -o /var/xdrago/purge_binlogs.sh\n if [ -e \"/var/xdrago/purge_binlogs.sh\" ]; then\n chmod 700 /var/xdrago/purge_binlogs.sh\n chown root:root /var/xdrago/purge_binlogs.sh\n touch ${_pthLog}/purge_binlogs.sh.ctrl.f93.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/purge_binlogs.sh.old /var/xdrago/purge_binlogs.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/checksql.pl.ctrl.f95.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/checksql.pl /var/xdrago/checksql.pl.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/checksql.pl\" -o /var/xdrago/checksql.pl\n if [ -e \"/var/xdrago/checksql.pl\" ]; then\n chmod 700 /var/xdrago/checksql.pl\n chown root:root /var/xdrago/checksql.pl\n touch ${_pthLog}/checksql.pl.ctrl.f95.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/checksql.pl.old /var/xdrago/checksql.pl\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/clear.sh.ctrl.f85.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/clear.sh /var/xdrago/clear.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/clear.sh\" -o /var/xdrago/clear.sh\n if [ -e \"/var/xdrago/clear.sh\" ]; then\n chmod 700 /var/xdrago/clear.sh\n chown root:root /var/xdrago/clear.sh\n touch ${_pthLog}/clear.sh.ctrl.f85.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/clear.sh.old /var/xdrago/clear.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/autoupboa.ctrl.f76.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc autoupboa)\n if (( _CNT > 0 )); then\n echo \"The autoupboa is running!\"\n else\n if [ -e \"${_optBin}/autoupboa\" ]; then\n mv -f ${_optBin}/autoupboa ${_optBin}/autoupboa.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/autoupboa\" -o ${_optBin}/autoupboa\n if [ -e \"${_optBin}/autoupboa\" ]; then\n chmod 700 ${_optBin}/autoupboa\n chown root:root ${_optBin}/autoupboa\n touch ${_pthLog}/autoupboa.ctrl.f76.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/autoupboa.old\" ]; then\n mv -f ${_optBin}/autoupboa.old ${_optBin}/autoupboa\n fi\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/fixmounts.ctrl.f98.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc fixmounts)\n if (( _CNT > 0 )); then\n echo \"The fixmounts is running!\"\n else\n if [ -e \"${_optBin}/fixmounts\" ]; then\n mv -f ${_optBin}/fixmounts ${_optBin}/fixmounts.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/fixmounts\" -o ${_optBin}/fixmounts\n if [ -e \"${_optBin}/fixmounts\" ]; then\n chmod 700 ${_optBin}/fixmounts\n chown root:root ${_optBin}/fixmounts\n touch ${_pthLog}/fixmounts.ctrl.f98.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/fixmounts.old\" ]; then\n mv -f ${_optBin}/fixmounts.old ${_optBin}/fixmounts\n fi\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/daily.sh.ctrl.f73.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/daily.sh /var/xdrago/daily.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/daily.sh\" -o /var/xdrago/daily.sh\n if [ -e \"/var/xdrago/daily.sh\" ]; then\n chmod 700 /var/xdrago/daily.sh\n chown root:root /var/xdrago/daily.sh\n touch ${_pthLog}/daily.sh.ctrl.f73.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/daily.sh.old /var/xdrago/daily.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/graceful.sh.ctrl.f86.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/graceful.sh /var/xdrago/graceful.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/graceful.sh\" -o /var/xdrago/graceful.sh\n if [ -e \"/var/xdrago/graceful.sh\" ]; then\n chmod 700 /var/xdrago/graceful.sh\n chown root:root /var/xdrago/graceful.sh\n touch ${_pthLog}/graceful.sh.ctrl.f86.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/graceful.sh.old /var/xdrago/graceful.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/usage.sh.ctrl.f80.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/usage.sh /var/xdrago/usage.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/usage.sh\" -o /var/xdrago/usage.sh\n if [ -e \"/var/xdrago/usage.sh\" ]; then\n chmod 700 /var/xdrago/usage.sh\n chown root:root /var/xdrago/usage.sh\n touch ${_pthLog}/usage.sh.ctrl.f80.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/usage.sh.old /var/xdrago/usage.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/manage_ltd_users.sh.ctrl.f67.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/manage_ltd_users.sh /var/xdrago/manage_ltd_users.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/manage_ltd_users.sh\" \\\n -o /var/xdrago/manage_ltd_users.sh\n if [ -e \"/var/xdrago/manage_ltd_users.sh\" ]; then\n chmod 700 /var/xdrago/manage_ltd_users.sh\n chown root:root /var/xdrago/manage_ltd_users.sh\n touch ${_pthLog}/manage_ltd_users.sh.ctrl.f67.${_tRee}.${_xSrl}.pid\n [ -e \"/run/manage_ltd_users.pid\" ] && rm -f /run/manage_ltd_users.pid\n [ -d \"/var/backups/ltd/log\" ] && rm -rf /var/backups/ltd/log\n mkdir -p /var/backups/ltd/{conf,log,old}\n else\n mv -f /var/xdrago/manage_ltd_users.sh.old /var/xdrago/manage_ltd_users.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/manage_solr_config.sh.ctrl.f85.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/manage_solr_config.sh /var/xdrago/manage_solr_config.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/manage_solr_config.sh\" \\\n -o /var/xdrago/manage_solr_config.sh\n if [ -e \"/var/xdrago/manage_solr_config.sh\" ]; then\n chmod 700 /var/xdrago/manage_solr_config.sh\n chown root:root /var/xdrago/manage_solr_config.sh\n touch ${_pthLog}/manage_solr_config.sh.ctrl.f85.${_tRee}.${_xSrl}.pid\n rm -f /run/manage_solr_config.pid\n else\n mv -f /var/xdrago/manage_solr_config.sh.old /var/xdrago/manage_solr_config.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/proc_num_ctrl.pl.ctrl.f83.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/proc_num_ctrl.pl /var/xdrago/proc_num_ctrl.pl.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/proc_num_ctrl.pl\" \\\n -o /var/xdrago/proc_num_ctrl.pl\n if [ -e \"/var/xdrago/proc_num_ctrl.pl\" ]; then\n chmod 700 /var/xdrago/proc_num_ctrl.pl\n chown root:root /var/xdrago/proc_num_ctrl.pl\n touch ${_pthLog}/proc_num_ctrl.pl.ctrl.f83.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/proc_num_ctrl.pl.old /var/xdrago/proc_num_ctrl.pl\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/fast_shutdown.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n sed -i \"s/.*opcache.fast_shutdown.*//g\" /opt/etc/fpm/fpm-pool-commo*.conf\n _PHP_V=\"85 84 83 82 81 80 74 73 72 71 70 56\"\n for e in ${_PHP_V}; do\n if [ -e \"/etc/init.d/php${e}-fpm\" ] && [ -e \"/opt/php${e}/bin/php\" ]; then\n service \"php${e}-fpm\" reload &> /dev/null\n fi\n done\n _PHP_V=\"55 54 53\"\n for e in ${_PHP_V}; do\n if [ -e \"/etc/init.d/php${e}-fpm\" ] && [ -e \"/opt/php${e}/bin/php\" ]; then\n service \"php${e}-fpm\" force-quit &> /dev/null\n fi\n done\n touch ${_pthLog}/fast_shutdown.ctrl.${_tRee}.${_xSrl}.pid\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -x \"/usr/sbin/csf\" ] \\\n && [ -e \"/etc/csf/csf.deny\" ] \\\n && [ ! -e \"${_pthLog}/guest-fire.sh.ctrl.f92.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/guest-fire.sh /var/xdrago/guest-fire.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/guest-fire.sh\" \\\n -o /var/xdrago/guest-fire.sh\n if [ -e \"/var/xdrago/guest-fire.sh\" ]; then\n chmod 700 /var/xdrago/guest-fire.sh\n chown root:root /var/xdrago/guest-fire.sh\n touch ${_pthLog}/guest-fire.sh.ctrl.f92.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/guest-fire.sh.old /var/xdrago/guest-fire.sh\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -x \"/usr/sbin/csf\" ] \\\n && [ -e \"/etc/csf/csf.deny\" ] \\\n && [ ! -e \"${_pthLog}/guest-water.sh.ctrl.f89.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/guest-water.sh /var/xdrago/guest-water.sh.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/guest-water.sh\" \\\n -o /var/xdrago/guest-water.sh\n if [ -e \"/var/xdrago/guest-water.sh\" ]; then\n chmod 700 /var/xdrago/guest-water.sh\n chown root:root /var/xdrago/guest-water.sh\n touch ${_pthLog}/guest-water.sh.ctrl.f89.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/guest-water.sh.old /var/xdrago/guest-water.sh\n fi\n fi\n\n if ! grep -q \"whoami\" /var/xdrago/conf/lshell.conf; then\n rm -f ${_pthLog}/lshell.ctrl.*\n fi\n if [ -x \"/opt/tools/drush/8/drush/drush.php\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/lshell.ctrl.f91.${_tRee}.${_xSrl}.pid\" ]; then\n if [ -z \"${_CUSTOM_CONFIG_LSHELL}\" ] \\\n || [ \"${_CUSTOM_CONFIG_LSHELL}\" = \"NO\" ]; then\n mv -f /var/xdrago/conf/lshell.conf /var/xdrago/conf/lshell.conf.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/conf/lshell.conf\" \\\n -o /var/xdrago/conf/lshell.conf\n if [ -e \"/var/xdrago/conf/lshell.conf\" ]; then\n chmod 644 /var/xdrago/conf/lshell.conf\n chown root:root /var/xdrago/conf/lshell.conf\n touch ${_pthLog}/lshell.ctrl.f91.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/conf/lshell.conf.old /var/xdrago/conf/lshell.conf\n fi\n fi\n fi\n\n if [ -x \"/opt/tools/drush/8/drush/drush.php\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ]; then\n _BROKEN_UPDATE_TEST=$(grep \"Under Construction\" /var/xdrago/conf/fpm-pool* 2>&1)\n if [ ! -z \"${_BROKEN_UPDATE_TEST}\" ]; then\n rm -f /var/xdrago/conf/fpm-pool*\n rm ${_pthLog}/multi.ctrl.*\n rm ${_pthLog}/legacy.ctrl.*\n rm ${_pthLog}/modern.ctrl.*\n rm ${_pthLog}/single.ctrl.*\n rm ${_pthLog}/common.ctrl.*\n fi\n _BROKEN_UPDATE_TEST=$(grep \"404 Not Found\" /var/xdrago/conf/fpm-pool* 2>&1)\n if [ ! -z \"${_BROKEN_UPDATE_TEST}\" ]; then\n rm -f /var/xdrago/conf/fpm-pool*\n rm ${_pthLog}/multi.ctrl.*\n rm ${_pthLog}/legacy.ctrl.*\n rm ${_pthLog}/modern.ctrl.*\n rm ${_pthLog}/single.ctrl.*\n rm ${_pthLog}/common.ctrl.*\n fi\n _BROKEN_UPDATE_TEST=$(grep \"max_execution_time\" /var/xdrago/conf/fpm-pool* 2>&1)\n if [ -z \"${_BROKEN_UPDATE_TEST}\" ]; then\n rm -f /var/xdrago/conf/fpm-pool*\n rm ${_pthLog}/multi.ctrl.*\n rm ${_pthLog}/legacy.ctrl.*\n rm ${_pthLog}/modern.ctrl.*\n rm ${_pthLog}/single.ctrl.*\n rm ${_pthLog}/common.ctrl.*\n fi\n _BROKEN_UPDATE_TEST=$(grep \"max_accelerated_files\" /var/xdrago/conf/fpm-pool* 2>&1)\n if [ ! -z \"${_BROKEN_UPDATE_TEST}\" ]; then\n rm -f /var/xdrago/conf/fpm-pool*\n rm ${_pthLog}/multi.ctrl.*\n rm ${_pthLog}/legacy.ctrl.*\n rm ${_pthLog}/modern.ctrl.*\n rm ${_pthLog}/single.ctrl.*\n rm ${_pthLog}/common.ctrl.*\n fi\n fi\n\n if [ -x \"/opt/tools/drush/8/drush/drush.php\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/common.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/conf/fpm-pool-common.conf /var/xdrago/conf/fpm-pool-common.conf.old\n curl ${_crlGet} \"${_urlHmr}/conf/php/fpm-pool-common.conf\" \\\n -o /var/xdrago/conf/fpm-pool-common.conf\n if [ -e \"/var/xdrago/conf/fpm-pool-common.conf\" ]; then\n sed -i \"s/127.0.0.1/127.0.0.1,${_LOC_IP}/g\" /var/xdrago/conf/fpm-pool-common.conf\n chmod 644 /var/xdrago/conf/fpm-pool-common.conf\n chown root:root /var/xdrago/conf/fpm-pool-common.conf\n touch ${_pthLog}/common.ctrl.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/conf/fpm-pool-common.conf.old /var/xdrago/conf/fpm-pool-common.conf\n fi\n fi\n\n if [ -x \"/opt/tools/drush/8/drush/drush.php\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/legacy.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/conf/fpm-pool-common-legacy.conf /var/xdrago/conf/fpm-pool-common-legacy.conf.old\n curl ${_crlGet} \"${_urlHmr}/conf/php/fpm-pool-common-legacy.conf\" \\\n -o /var/xdrago/conf/fpm-pool-common-legacy.conf\n if [ -e \"/var/xdrago/conf/fpm-pool-common-legacy.conf\" ]; then\n sed -i \"s/127.0.0.1/127.0.0.1,${_LOC_IP}/g\" /var/xdrago/conf/fpm-pool-common-legacy.conf\n chmod 644 /var/xdrago/conf/fpm-pool-common-legacy.conf\n chown root:root /var/xdrago/conf/fpm-pool-common-legacy.conf\n touch ${_pthLog}/legacy.ctrl.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/conf/fpm-pool-common-legacy.conf.old /var/xdrago/conf/fpm-pool-common-legacy.conf\n fi\n fi\n\n if [ -x \"/opt/tools/drush/8/drush/drush.php\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/modern.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/conf/fpm-pool-common-modern.conf /var/xdrago/conf/fpm-pool-common-modern.conf.old\n curl ${_crlGet} \"${_urlHmr}/conf/php/fpm-pool-common-modern.conf\" \\\n -o /var/xdrago/conf/fpm-pool-common-modern.conf\n if [ -e \"/var/xdrago/conf/fpm-pool-common-modern.conf\" ]; then\n sed -i \"s/127.0.0.1/127.0.0.1,${_LOC_IP}/g\" /var/xdrago/conf/fpm-pool-common-modern.conf\n chmod 644 /var/xdrago/conf/fpm-pool-common-modern.conf\n chown root:root /var/xdrago/conf/fpm-pool-common-modern.conf\n touch ${_pthLog}/modern.ctrl.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/conf/fpm-pool-common-modern.conf.old /var/xdrago/conf/fpm-pool-common-modern.conf\n fi\n fi\n\n if [ -x \"/opt/tools/drush/8/drush/drush.php\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/multi.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/conf/fpm-pool-foo-multi.conf /var/xdrago/conf/fpm-pool-foo-multi.conf.old\n curl ${_crlGet} \"${_urlHmr}/conf/php/fpm-pool-foo-multi.conf\" \\\n -o /var/xdrago/conf/fpm-pool-foo-multi.conf\n if [ -e \"/var/xdrago/conf/fpm-pool-foo-multi.conf\" ]; then\n chmod 644 /var/xdrago/conf/fpm-pool-foo-multi.conf\n chown root:root /var/xdrago/conf/fpm-pool-foo-multi.conf\n touch ${_pthLog}/multi.ctrl.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/conf/fpm-pool-foo-multi.conf.old /var/xdrago/conf/fpm-pool-foo-multi.conf\n fi\n fi\n\n if [ -e \"/opt/tools/drush\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/single.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/conf/fpm-pool-foo.conf /var/xdrago/conf/fpm-pool-foo.conf.old\n curl ${_crlGet} \"${_urlHmr}/conf/php/fpm-pool-foo.conf\" \\\n -o /var/xdrago/conf/fpm-pool-foo.conf\n if [ -e \"/var/xdrago/conf/fpm-pool-foo.conf\" ]; then\n chmod 644 /var/xdrago/conf/fpm-pool-foo.conf\n chown root:root /var/xdrago/conf/fpm-pool-foo.conf\n touch ${_pthLog}/single.ctrl.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/conf/fpm-pool-foo.conf.old /var/xdrago/conf/fpm-pool-foo.conf\n fi\n fi\n\n if [ -e \"/etc/ImageMagick-6/policy.xml\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ ! -e \"${_pthLog}/policymap-hf-06.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n _isCurlBin=\"$(which curl)\"\n chmod 755 ${_isCurlBin} &> /dev/null\n chgrp root ${_isCurlBin} &> /dev/null\n cp -af /etc/ImageMagick-6/policy.xml /var/xdrago/conf/etc-ImageMagick-6-policy.xml.hf-06.old\n rm -f /var/xdrago/conf/etc-ImageMagick-6-policy.xml\n curl ${_crlGet} \"${_urlHmr}/conf/etc/etc-ImageMagick-6-policy.xml\" \\\n -o /var/xdrago/conf/etc-ImageMagick-6-policy.xml\n if [ -e \"/var/xdrago/conf/etc-ImageMagick-6-policy.xml\" ]; then\n cp -af /var/xdrago/conf/etc-ImageMagick-6-policy.xml /etc/ImageMagick-6/policy.xml\n chmod 644 /etc/ImageMagick-6/policy.xml\n chown root:root /etc/ImageMagick-6/policy.xml\n touch ${_pthLog}/policymap-hf-06.ctrl.${_tRee}.${_xSrl}.pid\n _PHP_V=\"85 84 83 82 81 80 74 73 72 71 70 56\"\n for e in ${_PHP_V}; do\n if [ -e \"/etc/init.d/php${e}-fpm\" ]; then\n service \"php${e}-fpm\" reload &> /dev/null\n fi\n done\n else\n if [ -e \"/var/xdrago/conf/etc-ImageMagick-6-policy.xml.hf-06.old\" ]; then\n cp -af /var/xdrago/conf/etc-ImageMagick-6-policy.xml.hf-06.old /etc/ImageMagick-6/policy.xml\n fi\n fi\n fi\n\n if [ -e \"/opt/tools/drush\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -d \"/data/u\" ] \\\n && [ ! -e \"${_pthLog}/dispatch.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n sed -i \"s/.*cache.*//g; s/.*cc drush.*//g; s/ *$//g; /^$/d\" /data/disk/*/aegir.sh\n touch ${_pthLog}/dispatch.ctrl.${_tRee}.${_xSrl}.pid\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/xdrago/conf/control-readme.txt\" ] \\\n && [ ! -e \"${_pthLog}/control-readme.txt.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /var/xdrago/conf/control-readme.txt /var/xdrago/conf/control-readme.txt.old\n curl ${_crlGet} \"${_urlHmr}/tools/system/conf/control-readme.txt\" -o /var/xdrago/conf/control-readme.txt\n if [ -e \"/var/xdrago/conf/control-readme.txt\" ]; then\n chmod 644 /var/xdrago/conf/control-readme.txt\n chown root:root /var/xdrago/conf/control-readme.txt\n touch ${_pthLog}/control-readme.txt.ctrl.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/conf/control-readme.txt.old /var/xdrago/conf/control-readme.txt\n fi\n fi\n\n if [ -d \"/data/u\" ] \\\n && [ ! -e \"${_pthLog}/hosting.cron.queue.ctrl.f96.${_tRee}.${_xSrl}.pid\" ]; then\n _hQueueF=\"hosting_cron.module\"\n _hQueueP=\"/var/xdrago/conf/${_hQueueF}\"\n [ -e \"${_hQueueP}\" ] && _isPatchedTpl=$(grep \"url_own\" \"${_hQueueP}\")\n if [ ! -e \"${_hQueueP}\" ] || [[ ! \"${_isPatchedTpl}\" =~ \"url_own\" ]]; then\n curl ${_crlGet} \"${_urlHmr}/patches/${_hQueueF}\" -o ${_hQueueP}\n fi\n for _pthSysUsr in `find /data/disk/ -maxdepth 1 -mindepth 1 | sort`; do\n _tUsr=\n _tUsr=$(echo ${_pthSysUsr} | cut -d'/' -f4 | awk '{ print $1}' 2>&1)\n if [ -n \"${_tUsr}\" ] && [ \"${_tUsr}\" != \"arch\" ]; then\n if [ -e \"${_pthSysUsr}/log/hosting_cron_use_backend.txt\" ]; then\n rm -f ${_pthSysUsr}/log/hosting_cron_use_backend.txt\n fi\n _hmPlr=$(cat ${_pthSysUsr}/.drush/hostmaster.alias.drushrc.php \\\n | grep \"root'\" \\\n | cut -d: -f2 \\\n | awk '{ print $3}' \\\n | sed \"s/[\\,']//g\" 2>&1)\n _hmDir=\"${_hmPlr}/profiles/hostmaster/modules/aegir/hosting\"\n _hmQmd=\"${_hmDir}/cron/hosting_cron.module\"\n if [ -e \"${_hmDir}/cron/hosting_cron.module.orig\" ]; then\n rm -f ${_hmDir}/cron/hosting_cron.module.orig\n fi\n if [ -e \"${_hmDir}/cron/hosting_cron.module.rej\" ]; then\n rm -f ${_hmDir}/cron/hosting_cron.module.rej\n fi\n if [ -e \"${_hmQmd}\" ] && [ -e \"${_hQueueP}\" ]; then\n _isPatched=$(grep \"url_own\" \"${_hmQmd}\")\n if [[ ! \"${_isPatched}\" =~ \"url_own\" ]]; then\n cp -a ${_hQueueP} ${_hmDir}/cron/\n if [ -e \"${_hmDir}/cron/${_hQueueF}\" ]; then\n sed -i \"s/127.0.0.1/${_LOC_IP}/g\" \"${_hmDir}/cron/${_hQueueF}\"\n fi\n fi\n fi\n fi\n done\n touch ${_pthLog}/hosting.cron.queue.ctrl.f96.${_tRee}.${_xSrl}.pid\n fi\n\n if [ -d \"/data/u\" ] \\\n && [ ! -e \"${_pthLog}/hosting.cron.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n for _pthSysUsr in `find /data/disk/ -maxdepth 1 -mindepth 1 | sort`; do\n _tUsr=\n _tUsr=$(echo ${_pthSysUsr} | cut -d'/' -f4 | awk '{ print $1}' 2>&1)\n if [ -n \"${_tUsr}\" ] && [ \"${_tUsr}\" != \"arch\" ]; then\n if [ -e \"${_pthSysUsr}/log/hosting_cron_use_backend.txt\" ]; then\n rm -f ${_pthSysUsr}/log/hosting_cron_use_backend.txt\n fi\n fi\n done\n touch ${_pthLog}/hosting.cron.ctrl.f99.${_tRee}.${_xSrl}.pid\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/data/u\" ] \\\n && [ -e \"/usr/sbin/csf\" ] \\\n && [ ! -e \"${_pthLog}/fpm-cli.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n _usrGroup=users\n [ -d \"/var/backups/off-run/\" ] && cp -a /var/backups/off-run/run* /var/xdrago/ &> /dev/null\n for _pthSysUsr in `find /data/disk/ -maxdepth 1 -mindepth 1 | sort`; do\n _tUsr=\n _tUsr=$(echo ${_pthSysUsr} | cut -d'/' -f4 | awk '{ print $1}' 2>&1)\n if [ \"${_tUsr}\" != \"arch\" ]; then\n if [ ! -e \"${_pthSysUsr}/static/control/MyQuick.info\" ] \\\n && [ ! -e \"${_pthSysUsr}/static/control/MyClassic.info\" ]; then\n echo ON > ${_pthSysUsr}/static/control/MyQuick.info\n fi\n if [ ! -e \"${_pthSysUsr}/static/control/.disFastTrack.pid\" ]; then\n rm -f ${_pthSysUsr}/static/control/FastTrack.info\n touch ${_pthSysUsr}/static/control/.disFastTrack.pid\n fi\n if [ ! -e \"${_pthSysUsr}/static/control/FastTrack.info\" ] \\\n && [ ! -e \"${_pthSysUsr}/static/control/ClassicTrack.info\" ]; then\n echo ON > ${_pthSysUsr}/static/control/ClassicTrack.info\n fi\n if [ -e \"${_pthSysUsr}/static/control/fpm.info\" ] \\\n && [ ! -e \"${_pthSysUsr}/static/control/cli.info\" ]; then\n cp ${_pthSysUsr}/static/control/fpm.info ${_pthSysUsr}/static/control/cli.info\n fi\n if [ -e \"${_pthSysUsr}/log/CANCELLED\" ] \\\n || [ -e \"${_pthSysUsr}/log/proxied.pid\" ] \\\n || [ ! -e \"${_pthSysUsr}/static/control/cli.info\" ]; then\n if [ -e \"/var/xdrago/run-${_tUsr}\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ]; then\n [ -d \"/var/backups/off-run\" ] || mkdir -p /var/backups/off-run\n mv -f /var/xdrago/run-${_tUsr} /var/backups/off-run/\n fi\n else\n _dscUsr=\"/data/disk/${_tUsr}\"\n _ngxCnf=\"${_dscUsr}/config/includes/nginx_vhost_common.conf\"\n _NGINX_CNF_TEST=$(grep \"foobaroff\" ${_ngxCnf} 2>&1)\n if [[ \"${_NGINX_CNF_TEST}\" =~ \"foobaroff\" ]]; then\n _DO_NOTHING=YES\n else\n sed -i \"s/args.*q=/args ~* \\\"foobaroff=/g\" ${_ngxCnf}\n fi\n for _version in 84 85 83 82 81 74 56; do\n if [ -x \"/opt/php${_version}/bin/php\" ]; then\n if [ \"${_version}\" = \"74\" ]; then\n _useCli=\"7.4\"\n _useFpm=\"7.4\"\n elif [ \"${_version}\" = \"56\" ]; then\n _useCli=\"5.6\"\n _useFpm=\"5.6\"\n else\n _useCli=\"8.${_version:1}\"\n _useFpm=\"8.${_version:1}\"\n fi\n break\n fi\n done\n if [ ! -e \"${_dscUsr}/static/control/fpm.info\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ]; then\n if [ -n \"${_useFpm}\" ]; then\n echo ${_useFpm} > ${_dscUsr}/static/control/fpm.info\n chown ${_tUsr}.ftp:${_usrGroup} ${_dscUsr}/static/control/fpm.info\n chmod 0644 ${_dscUsr}/static/control/fpm.info\n fi\n fi\n if [ ! -e \"${_dscUsr}/static/control/cli.info\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ]; then\n if [ -e \"${_dscUsr}/static/control/fpm.info\" ]; then\n cp -af ${_dscUsr}/static/control/fpm.info ${_dscUsr}/static/control/cli.info\n else\n if [ -n \"${_useCli}\" ]; then\n echo ${_useCli} > ${_dscUsr}/static/control/cli.info\n chown ${_tUsr}.ftp:${_usrGroup} ${_dscUsr}/static/control/cli.info\n chmod 0644 ${_dscUsr}/static/control/cli.info\n fi\n fi\n fi\n if [ ! -e \"${_dscUsr}/static/control/.ctrl.${_tRee}.${_xSrl}.pid\" ] \\\n && [ -e \"/home/${_tUsr}.ftp/clients\" ]; then\n mkdir -p ${_dscUsr}/static/control\n chmod 755 ${_dscUsr}/static/control\n if [ -e \"/var/xdrago/conf/control-readme.txt\" ]; then\n cp -af /var/xdrago/conf/control-readme.txt \\\n ${_dscUsr}/static/control/README.txt &> /dev/null\n chmod 0644 ${_dscUsr}/static/control/README.txt\n fi\n chown -R ${_tUsr}.ftp:${_usrGroup} ${_dscUsr}/static/control\n rm -f ${_dscUsr}/static/control/.ctrl.*\n echo OK > ${_dscUsr}/static/control/.ctrl.${_tRee}.${_xSrl}.pid\n fi\n fi\n fi\n done\n touch ${_pthLog}/fpm-cli.ctrl.${_tRee}.${_xSrl}.pid\n fi\n\n # Create the destination directory if it doesn't exist\n [ -d \"/var/backups/off-run\" ] || mkdir -p /var/backups/off-run\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/data/u\" ] \\\n && [ -e \"/usr/sbin/csf\" ]; then\n # Loop through all files matching the pattern /var/xdrago/run-USER\n for _file in /var/xdrago/run-*; do\n # Skip iteration if no files match the pattern\n [ -e \"${_file}\" ] || continue\n\n # Extract the _USER from the filename\n _USER=${_file#/var/xdrago/run-}\n\n # Define the paths to check\n _USER_DIR=\"/data/disk/${_USER}\"\n _CANCELLED_FILE=\"${_USER_DIR}/log/CANCELLED\"\n _PROXIED_PID_FILE=\"${_USER_DIR}/log/proxied.pid\"\n _CLI_INFO_FILE=\"${_USER_DIR}/static/control/cli.info\"\n\n # Check the conditions\n if [ ! -d \"${_USER_DIR}\" ] || \\\n [ -f \"${_CANCELLED_FILE}\" ] || \\\n [ -f \"${_PROXIED_PID_FILE}\" ] || \\\n [ ! -f \"${_CLI_INFO_FILE}\" ]; then\n # Move the file if any condition is met\n mv -f \"${_file}\" /var/backups/off-run/\n fi\n\n if grep -q \"renice 0\" \"${_file}\"; then\n sed -i \"s/renice 0/renice 9/g\" \"${_file}\"\n fi\n done\n fi\n\n if [ -x \"/opt/tools/drush/8/drush/drush.php\" ] \\\n && [ -e \"${_provLeIncFull}\" ] \\\n && [ -e \"${_hoLeIncFull}\" ] \\\n && [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -d \"/data/u\" ] \\\n && [ ! -e \"${_pthLog}/le_renewal_days_69.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n _leBasePath=\"profiles/hostmaster/modules/aegir/hosting_le\"\n _lePath=\"${_leBasePath}/drush/${_provLeInc}\"\n _leVhPath=\"${_leBasePath}/hosting_le_vhost/drush/${_hoLeInc}\"\n for _pthSysUsr in `find /data/disk/ -maxdepth 1 -mindepth 1 | sort`; do\n if [ -e \"${_pthSysUsr}/config/server_master/nginx/vhost.d\" ] \\\n && [ -e \"${_pthSysUsr}/static/control/cli.info\" ] \\\n && [ ! -e \"${_pthSysUsr}/log/proxied.pid\" ] \\\n && [ ! -e \"${_pthSysUsr}/log/CANCELLED\" ]; then\n _tUsr=\n _validReg=\n _validIPr=\n _tUsr=$(echo ${_pthSysUsr} | cut -d'/' -f4 | awk '{ print $1}' 2>&1)\n _dscUsr=\"/data/disk/${_tUsr}\"\n _hmPf=$(cat ${_dscUsr}/.drush/hostmaster.alias.drushrc.php \\\n | grep \"root'\" \\\n | cut -d: -f2 \\\n | awk '{ print $3}' \\\n | sed \"s/[\\,']//g\" 2>&1)\n _locFile=\"${_hmPf}/${_lePath}\"\n if [ -e \"${_locFile}\" ] && [ -e \"${_provLeIncFull}\" ]; then\n cp -af ${_provLeIncFull} ${_locFile}\n chown ${_tUsr}:users ${_locFile}\n chmod 0644 ${_locFile}\n fi\n _locVhFile=\"${_hmPf}/${_leVhPath}\"\n if [ -e \"${_locVhFile}\" ] && [ -e \"${_hoLeIncFull}\" ]; then\n cp -af ${_hoLeIncFull} ${_locVhFile}\n chown ${_tUsr}:users ${_locVhFile}\n chmod 0644 ${_locVhFile}\n fi\n _leRoot=\"${_dscUsr}/tools/le\"\n _exeLe=\"${_leRoot}/dehydrated\"\n _dehydFull=\"${_leRoot}/${_dehydName}\"\n _legacyLeShFile=\"${_leRoot}/letsencrypt.sh\"\n _lockLeFile=\"${_leRoot}/lock\"\n _configIni=\"${_leRoot}/config\"\n _acctsDir=\"${_leRoot}/accounts\"\n _acctsDemoDir=\"${_leRoot}/accounts-demo\"\n _demoPid=\"${_leRoot}/.ctrl/ssl-demo-mode.pid\"\n _normalRegPid=\"${_leRoot}/.ctrl/normal-re6-register.pid\"\n _forcedRegPid=\"${_leRoot}/.ctrl/forced-re6-register.pid\"\n _onDemandRegPid=\"${_leRoot}/.ctrl/onDemand-register.pid\"\n _validIdn=$(grep \"letsencrypt\" ${_acctsDir}/*/account_id.json 2>&1)\n _validReg=$(grep \"valid\" ${_acctsDir}/*/registration_info.json 2>&1)\n _validIPr=$(grep \"${_LOC_IP}\" ${_acctsDir}/*/registration_info.json 2>&1)\n _HOUR=$(date +%H 2>&1)\n _HOUR=${_HOUR//[^0-9-]/}\n if [ -e \"${_dehydSrcPath}\" ]; then\n cp -af ${_dehydSrcPath} ${_dehydFull}\n chown ${_tUsr}:users ${_dehydFull}\n chmod 0700 ${_dehydFull}\n fi\n if [ -e \"${_dehydFull}\" ] \\\n && [ ! -e \"${_normalRegPid}\" ]; then\n if [ \"${_HOUR}\" = \"5\" ] \\\n || [ \"${_HOUR}\" = \"17\" ] \\\n || [ -e \"${_onDemandRegPid}\" ]; then\n su -s /bin/bash - ${_tUsr} -c \"bash ${_exeLe} --register --accept-terms\"\n wait\n touch ${_normalRegPid}\n fi\n fi\n if [ -e \"${_lockLeFile}\" ]; then\n rm -f ${_lockLeFile}\n sleep 1\n fi\n if [ -e \"${_demoPid}\" ]; then\n rm -f ${_demoPid}\n fi\n if [ \"${_HOUR}\" = \"11\" ] \\\n || [ \"${_HOUR}\" = \"23\" ] \\\n || [ -e \"${_onDemandRegPid}\" ]; then\n if [ -e \"${_legacyLeShFile}\" ] \\\n || [ -e \"${_acctsDemoDir}\" ] \\\n || [[ ! \"${_validIdn}\" =~ \"letsencrypt\" ]] \\\n || [[ ! \"${_validReg}\" =~ \"valid\" ]] \\\n || [[ ! \"${_validIPr}\" =~ \"${_LOC_IP}\" ]] \\\n || [ ! -e \"${_forcedRegPid}\" ]; then\n rm -f ${_legacyLeShFile}\n rm -rf ${_acctsDemoDir}\n rm -rf ${_acctsDir}\n rm -f ${_leRoot}/.ctrl/.forced*\n rm -f ${_leRoot}/.ctrl/.normal*\n rm -f ${_leRoot}/.ctrl/forced*\n rm -f ${_leRoot}/.ctrl/normal*\n if [ -e \"${_exeLe}\" ]; then\n su -s /bin/bash - ${_tUsr} -c \"bash ${_exeLe} --register --accept-terms\"\n wait\n touch ${_forcedRegPid}\n touch ${_normalRegPid}\n fi\n fi\n fi\n fi\n done\n touch ${_pthLog}/le_renewal_days_69.ctrl.${_tRee}.${_xSrl}.pid\n fi\n\n if ! grep -q \"defunct\" /opt/local/bin/websh; then\n rm -f ${_pthLog}/websh.ctrl.*\n fi\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_pthLog}/websh.ctrl.f72.${_tRee}.${_xSrl}.pid\" ]; then\n mv -f /opt/local/bin/websh /var/xdrago/websh.sh.old\n curl ${_crlGet} \"${_urlHmr}/helpers/websh.sh.txt\" -o /opt/local/bin/websh\n if [ -e \"/opt/local/bin/websh\" ] \\\n && grep -i '_forward_to_dash' /opt/local/bin/websh &> /dev/null; then\n chmod 755 /opt/local/bin/websh\n chown root:root /opt/local/bin/websh\n [ -x \"/bin/websh\" ] && [ ! -L \"/bin/websh\" ] && ln -sfn /opt/local/bin/websh /bin/websh\n touch ${_pthLog}/websh.ctrl.f72.${_tRee}.${_xSrl}.pid\n else\n mv -f /var/xdrago/websh.sh.old /opt/local/bin/websh\n fi\n _WEB_SH=\"$(readlink -n /bin/sh)\"\n if [ -x \"/opt/local/bin/websh\" ] \\\n && grep -i '_forward_to_dash' /opt/local/bin/websh &> /dev/null; then\n if [ \"${_WEB_SH}\" != \"/opt/local/bin/websh\" ]; then\n ln -sfn /opt/local/bin/websh /bin/sh\n if [ -e \"/usr/bin/sh\" ]; then\n ln -sfn /opt/local/bin/websh /usr/bin/sh\n fi\n [ -x \"/bin/websh\" ] && [ ! -L \"/bin/websh\" ] && ln -sfn /opt/local/bin/websh /bin/websh\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -x \"/etc/cron.hourly/systemtime\" ] \\\n && [ ! -e \"${_pthLog}/systemtime.ctrl.f95.${_tRee}.${_xSrl}.pid\" ]; then\n curl ${_crlGet} \"${_urlHmr}/helpers/systemtime\" -o /etc/cron.hourly/systemtime\n if [ -e \"/etc/cron.hourly/systemtime\" ]; then\n chmod 755 /etc/cron.hourly/systemtime\n chown root:root /etc/cron.hourly/systemtime\n service cron restart\n touch ${_pthLog}/systemtime.ctrl.f95.${_tRee}.${_xSrl}.pid\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/synproxy.ctrl.f93.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc synproxy_rollback)\n if (( _CNT > 0 )); then\n echo \"The synproxy_rollback is running!\"\n else\n if [ -e \"${_optBin}/synproxy\" ]; then\n mv -f ${_optBin}/synproxy ${_optBin}/synproxy.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/synproxy\" -o ${_optBin}/synproxy\n if [ -e \"${_optBin}/synproxy\" ]; then\n chmod 700 ${_optBin}/synproxy\n chown root:root ${_optBin}/synproxy\n touch ${_pthLog}/synproxy.ctrl.f93.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/synproxy.old\" ]; then\n mv -f ${_optBin}/synproxy.old ${_optBin}/synproxy\n fi\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/synproxy_rollback.ctrl.f94.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc synproxy_rollback)\n if (( _CNT > 0 )); then\n echo \"The synproxy_rollback is running!\"\n else\n if [ -e \"${_optBin}/synproxy_rollback\" ]; then\n mv -f ${_optBin}/synproxy_rollback ${_optBin}/synproxy_rollback.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/synproxy_rollback\" -o ${_optBin}/synproxy_rollback\n if [ -e \"${_optBin}/synproxy_rollback\" ]; then\n chmod 700 ${_optBin}/synproxy_rollback\n chown root:root ${_optBin}/synproxy_rollback\n touch ${_pthLog}/synproxy_rollback.ctrl.f94.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/synproxy_rollback.old\" ]; then\n mv -f ${_optBin}/synproxy_rollback.old ${_optBin}/synproxy_rollback\n fi\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/synproxy_reassert.ctrl.f88.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc synproxy_rollback)\n if (( _CNT > 0 )); then\n echo \"The synproxy_rollback is running!\"\n else\n if [ -e \"${_optBin}/synproxy_reassert\" ]; then\n mv -f ${_optBin}/synproxy_reassert ${_optBin}/synproxy_reassert.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/synproxy_reassert\" -o ${_optBin}/synproxy_reassert\n if [ -e \"${_optBin}/synproxy_reassert\" ]; then\n chmod 700 ${_optBin}/synproxy_reassert\n chown root:root ${_optBin}/synproxy_reassert\n touch ${_pthLog}/synproxy_reassert.ctrl.f88.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/synproxy_reassert.old\" ]; then\n mv -f ${_optBin}/synproxy_reassert.old ${_optBin}/synproxy_reassert\n fi\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/synproxy_hook_fix.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc synproxy_rollback)\n if (( _CNT > 0 )); then\n echo \"The synproxy_rollback is running!\"\n else\n if [ -e \"${_optBin}/synproxy_hook_fix\" ]; then\n mv -f ${_optBin}/synproxy_hook_fix ${_optBin}/synproxy_hook_fix.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/synproxy_hook_fix\" -o ${_optBin}/synproxy_hook_fix\n if [ -e \"${_optBin}/synproxy_hook_fix\" ]; then\n chmod 700 ${_optBin}/synproxy_hook_fix\n chown root:root ${_optBin}/synproxy_hook_fix\n touch ${_pthLog}/synproxy_hook_fix.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/synproxy_hook_fix.old\" ]; then\n mv -f ${_optBin}/synproxy_hook_fix.old ${_optBin}/synproxy_hook_fix\n fi\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/synproxy_snapshot.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc synproxy_rollback)\n if (( _CNT > 0 )); then\n echo \"The synproxy_rollback is running!\"\n else\n if [ -e \"${_optBin}/synproxy_snapshot\" ]; then\n mv -f ${_optBin}/synproxy_snapshot ${_optBin}/synproxy_snapshot.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/synproxy_snapshot\" -o ${_optBin}/synproxy_snapshot\n if [ -e \"${_optBin}/synproxy_snapshot\" ]; then\n chmod 700 ${_optBin}/synproxy_snapshot\n chown root:root ${_optBin}/synproxy_snapshot\n touch ${_pthLog}/synproxy_snapshot.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/synproxy_snapshot.old\" ]; then\n mv -f ${_optBin}/synproxy_snapshot.old ${_optBin}/synproxy_snapshot\n fi\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/synproxy_status.ctrl.f99.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc synproxy_rollback)\n if (( _CNT > 0 )); then\n echo \"The synproxy_rollback is running!\"\n else\n if [ -e \"${_optBin}/synproxy_status\" ]; then\n mv -f ${_optBin}/synproxy_status ${_optBin}/synproxy_status.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/synproxy_status\" -o ${_optBin}/synproxy_status\n if [ -e \"${_optBin}/synproxy_status\" ]; then\n chmod 700 ${_optBin}/synproxy_status\n chown root:root ${_optBin}/synproxy_status\n touch ${_pthLog}/synproxy_status.ctrl.f99.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/synproxy_status.old\" ]; then\n mv -f ${_optBin}/synproxy_status.old ${_optBin}/synproxy_status\n fi\n fi\n fi\n fi\n\n if [ -e \"/var/xdrago/monitor/check\" ] \\\n && [ -d \"/var/aegir/drush\" ] \\\n && [ ! -e \"${_pthLog}/synproxy_monitor.ctrl.f98.${_tRee}.${_xSrl}.pid\" ]; then\n _CNT=$(pgrep -fc synproxy_rollback)\n if (( _CNT > 0 )); then\n echo \"The synproxy_rollback is running!\"\n else\n if [ -e \"${_optBin}/synproxy_monitor\" ]; then\n mv -f ${_optBin}/synproxy_monitor ${_optBin}/synproxy_monitor.old\n fi\n curl ${_crlGet} \"${_urlHmr}/tools/bin/synproxy_monitor\" -o ${_optBin}/synproxy_monitor\n if [ -e \"${_optBin}/synproxy_monitor\" ]; then\n chmod 700 ${_optBin}/synproxy_monitor\n chown root:root ${_optBin}/synproxy_monitor\n touch ${_pthLog}/synproxy_monitor.ctrl.f98.${_tRee}.${_xSrl}.pid\n else\n if [ -e \"${_optBin}/synproxy_monitor.old\" ]; then\n mv -f ${_optBin}/synproxy_monitor.old ${_optBin}/synproxy_monitor\n fi\n fi\n fi\n fi\n\n _Dir=\"/data/all/000/modules\"\n _REDIS_E_VERSION=8.x-1.11.2\n if [ -e \"/var/xdrago/manage_solr_config.sh\" ]; then\n if [ ! -e \"${_Dir}/redis_ten_eleven/ver-${_REDIS_E_VERSION}.${_xSrl}.info\" ]; then\n mkdir -p ${_Dir}\n cd ${_Dir}\n rm -rf ${_Dir}/redis_ten_eleven\n _get_dev_contrib \"redis_ten_eleven-${_REDIS_E_VERSION}.tar.gz\"\n echo update > ${_Dir}/redis_ten_eleven/ver-${_REDIS_E_VERSION}.${_xSrl}.info\n find ${_Dir} -type d -exec chmod 0755 {} \\; &> /dev/null\n find ${_Dir} -type f -exec chmod 0644 {} \\; &> /dev/null\n touch ${_pthLog}/redis_ten_eleven.ctrl.${_xSrl}.log\n fi\n fi\n\n _Dir=\"/data/all/000/modules\"\n _REDIS_T_VERSION=8.x-1.8.2\n if [ -e \"/var/xdrago/manage_solr_config.sh\" ]; then\n if [ ! -e \"${_Dir}/redis_nine_ten/ver-${_REDIS_T_VERSION}.${_xSrl}.info\" ]; then\n mkdir -p ${_Dir}\n cd ${_Dir}\n rm -rf ${_Dir}/redis_nine_ten\n _get_dev_contrib \"redis_nine_ten-${_REDIS_T_VERSION}.tar.gz\"\n echo update > ${_Dir}/redis_nine_ten/ver-${_REDIS_T_VERSION}.${_xSrl}.info\n find ${_Dir} -type d -exec chmod 0755 {} \\; &> /dev/null\n find ${_Dir} -type f -exec chmod 0644 {} \\; &> /dev/null\n touch ${_pthLog}/redis_nine_ten.ctrl.${_xSrl}.log\n fi\n fi\n\n _Dir=\"/data/all/000/modules\"\n _REDIS_C_VERSION=com-19-04-2021\n if [ -e \"/var/xdrago/manage_solr_config.sh\" ]; then\n if [ ! -e \"${_Dir}/redis_compr/ver-${_REDIS_C_VERSION}.${_xSrl}.info\" ]; then\n mkdir -p ${_Dir}\n cd ${_Dir}\n rm -rf ${_Dir}/redis_compr\n _get_dev_contrib \"redis_compr-${_REDIS_C_VERSION}.tar.gz\"\n echo update > ${_Dir}/redis_compr/ver-${_REDIS_C_VERSION}.${_xSrl}.info\n find ${_Dir} -type d -exec chmod 0755 {} \\; &> /dev/null\n find ${_Dir} -type f -exec chmod 0644 {} \\; &> /dev/null\n touch ${_pthLog}/redis_compr.ctrl.${_xSrl}.log\n fi\n fi\n\n _Dir=\"/data/all/000/modules\"\n _REDIS_L_VERSION=7.x-3.19.1\n if [ -e \"/var/xdrago/manage_solr_config.sh\" ]; then\n if [ ! -e \"${_Dir}/redis_edge/ver-${_REDIS_L_VERSION}.${_xSrl}.info\" ]; then\n mkdir -p ${_Dir}\n cd ${_Dir}\n rm -rf ${_Dir}/redis_edge\n _get_dev_contrib \"redis_edge-${_REDIS_L_VERSION}.tar.gz\"\n echo update > ${_Dir}/redis_edge/ver-${_REDIS_L_VERSION}.${_xSrl}.info\n find ${_Dir} -type d -exec chmod 0755 {} \\; &> /dev/null\n find ${_Dir} -type f -exec chmod 0644 {} \\; &> /dev/null\n touch ${_pthLog}/redis_edge.ctrl.${_xSrl}.log\n fi\n fi\n\n _Dir=\"/data/all/000/modules\"\n _REDIS_N_VERSION=com-19-04-2021\n if [ -e \"/var/xdrago/manage_solr_config.sh\" ]; then\n if [ ! -e \"${_Dir}/redis_eight/ver-${_REDIS_N_VERSION}.${_xSrl}.info\" ]; then\n mkdir -p ${_Dir}\n cd ${_Dir}\n rm -rf ${_Dir}/redis_eight\n _get_dev_contrib \"redis_eight-${_REDIS_N_VERSION}.tar.gz\"\n echo update > ${_Dir}/redis_eight/ver-${_REDIS_N_VERSION}.${_xSrl}.info\n find ${_Dir} -type d -exec chmod 0755 {} \\; &> /dev/null\n find ${_Dir} -type f -exec chmod 0644 {} \\; &> /dev/null\n touch ${_pthLog}/redis_eight.ctrl.${_xSrl}.log\n fi\n fi\n}\n\n_fix_core_dgd() {\n # sed -i \"s/^_PERMISSIONS_FIX=.*/_PERMISSIONS_FIX=YES/g\" ${_barCnf}\n\n _saCoreS=\"${_saCoreN}-D7\"\n _saIncDb=\"includes/database/database.inc\"\n _saPatch=\"/var/xdrago/conf/${_saCoreS}.patch\"\n\n _saQCoreN=\"${_saCoreN}\"\n _saQCoreS=\"${_saQCoreN}-D8\"\n _saQIncDb=\"core/includes/database.inc\"\n _saQPatch=\"/var/xdrago/conf/${_saQCoreS}.patch\"\n\n _saXCoreN=\"${_saCoreN}\"\n _saXCoreS=\"${_saXCoreN}-D6\"\n _saXIncDb=\"includes/database.inc\"\n _saXPatch=\"/var/xdrago/conf/${_saXCoreS}.patch\"\n\n _saBCoreP=\"${_saCoreN}-provision\"\n _saBPatch=\"/var/xdrago/conf/${_saBCoreP}.patch\"\n\n # SA-CORE D8 patch\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_saQPatch}\" ]; then\n mkdir -p /var/xdrago/conf\n curl ${_crlGet} \"${_urlHmr}/patches/8-core/${_saQCoreS}.patch\" -o ${_saQPatch}\n fi\n\n # SA-CORE D7 patch\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_saPatch}\" ]; then\n mkdir -p /var/xdrago/conf\n curl ${_crlGet} \"${_urlHmr}/patches/7-core/${_saCoreS}.patch\" -o ${_saPatch}\n fi\n\n # SA-CORE D6 patch\n # if [ -e \"/var/xdrago\" ] \\\n # && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n\t# && [ ! -e \"${_saXPatch}\" ]; then\n\t# mkdir -p /var/xdrago/conf\n\t# curl ${_crlGet} \"${_urlHmr}/patches/6-core/${_saXCoreS}.patch\" -o ${_saXPatch}\n # fi\n\n # SA-CORE for Octopus hostmaster platforms\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -d \"/data/u\" ] \\\n && [ -e \"${_saPatch}\" ]; then\n if [ -d \"/data/all\" ] \\\n && [ ! -e \"${_pthLog}/hostmaster-octopus-${_saCoreN}-fixed-d7.log\" ]; then\n for _File in `find /data/disk/*/aegir/distro/*/${_saIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] && [ ! -e \"${_Core}/core\" ]; then\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n fi\n done\n touch ${_pthLog}/hostmaster-octopus-${_saCoreN}-fixed-d7.log\n fi\n cd\n fi\n\n # SA-CORE for Barracuda hostmaster platforms\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -e \"${_saPatch}\" ]; then\n if [ -d \"/data/all\" ] \\\n && [ ! -e \"${_pthLog}/hostmaster-barracuda-${_saCoreN}-fixed-d7.log\" ]; then\n for _File in `find /var/aegir/host_master/*/${_saIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] && [ ! -e \"${_Core}/core\" ]; then\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n fi\n done\n\n for _File in `find /var/aegir/hostmaster*/${_saIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] && [ ! -e \"${_Core}/core\" ]; then\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n fi\n done\n\n touch ${_pthLog}/hostmaster-barracuda-${_saCoreN}-fixed-d7.log\n fi\n cd\n fi\n\n # SA-CORE for built-in D7 platforms\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -e \"${_saPatch}\" ] \\\n && [ ! -e \"${_pthLog}/${_saCoreN}-fixed-d7.log\" ]; then\n if [ -d \"/data/all/000/core\" ]; then\n for _Core in `find /data/all/000/core/drupal-7* \\\n -maxdepth 0 -mindepth 0 | sort`; do\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n done\n elif [ -d \"/data/disk/all/000/core\" ]; then\n for _Core in `find /data/disk/all/000/core/drupal-7* \\\n -maxdepth 0 -mindepth 0 | sort`; do\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n done\n fi\n touch ${_pthLog}/${_saCoreN}-fixed-d7.log\n cd\n fi\n\n # SA-CORE for ancient D7 platforms\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -e \"${_saPatch}\" ]; then\n if [ -d \"/data/all\" ] \\\n && [ ! -e \"${_pthLog}/legacy-${_saCoreN}-fixed-d7.log\" ]; then\n for _File in `find /data/all/*/*/${_saIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] && [ ! -e \"${_Core}/core\" ]; then\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n fi\n done\n touch ${_pthLog}/legacy-${_saCoreN}-fixed-d7.log\n elif [ -d \"/data/disk/all\" ] \\\n && [ ! -e \"${_pthLog}/legacy-${_saCoreN}-fixed-d7eee.log\" ]; then\n for _File in `find /data/disk/all/*/*/${_saIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] && [ ! -e \"${_Core}/core\" ]; then\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n fi\n done\n touch ${_pthLog}/legacy-${_saCoreN}-fixed-d7eee.log\n fi\n cd\n fi\n\n # SA-CORE for custom D7 platforms\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -e \"${_saPatch}\" ]; then\n if [ -d \"/data/u\" ] \\\n && [ ! -e \"${_pthLog}/batch-custom-${_saCoreN}-fixed-d7.log\" ]; then\n for _File in `find /data/disk/*/static/*/${_saIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ ! -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saCoreS}-fix.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saCoreS}-fix.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/${_saIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ ! -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saCoreS}-fix.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saCoreS}-fix.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/*/${_saIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ ! -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saCoreS}-fix.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saCoreS}-fix.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/*/*/${_saIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ ! -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saCoreS}-fix.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saCoreS}-fix.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/*/*/*/${_saIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ ! -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saCoreS}-fix.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saCoreS}-fix.info\n fi\n done\n fi\n cd\n touch ${_pthLog}/batch-custom-${_saCoreN}-fixed-d7.log\n fi\n\n # SA-CORE for D8 platforms in ~/static\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -e \"${_saQPatch}\" ]; then\n if [ -d \"/data/u\" ] \\\n && [ ! -e \"${_pthLog}/batch-custom-${_saQCoreN}-fixed-d8.log\" ]; then\n for _File in `find /data/disk/*/static/*/${_saQIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/core.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saQCoreS}-fix.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saQPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saQCoreS}-fix.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/${_saQIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/core.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saQCoreS}-fix.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saQPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saQCoreS}-fix.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/*/${_saQIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/core.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saQCoreS}-fix.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saQPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saQCoreS}-fix.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/*/*/${_saQIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/core.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saQCoreS}-fix.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saQPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saQCoreS}-fix.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/*/*/*/${_saQIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/core.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saQCoreS}-fix.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saQPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saQCoreS}-fix.info\n fi\n done\n fi\n cd\n touch ${_pthLog}/batch-custom-${_saQCoreN}-fixed-d8.log\n fi\n\n # SA-CORE for built-in D6 platforms\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -e \"${_saXPatch}\" ] \\\n && [ ! -e \"${_pthLog}/${_saXCoreN}-finally-fixed-d6.log\" ]; then\n if [ -d \"/data/all/000/core\" ]; then\n for _Core in `find /data/all/000/core/pressflow-6* \\\n -maxdepth 0 -mindepth 0 | sort`; do\n cd ${_Core}\n patch -p1 < ${_saXPatch} &> /dev/null\n done\n elif [ -d \"/data/disk/all/000/core\" ]; then\n for _Core in `find /data/disk/all/000/core/pressflow-6* \\\n -maxdepth 0 -mindepth 0 | sort`; do\n cd ${_Core}\n patch -p1 < ${_saXPatch} &> /dev/null\n done\n fi\n touch ${_pthLog}/${_saXCoreN}-finally-fixed-d6.log\n cd\n fi\n\n # SA-CORE for ancient D6 platforms\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -e \"${_saXPatch}\" ]; then\n if [ -d \"/data/all\" ] \\\n && [ ! -e \"${_pthLog}/legacy-${_saXCoreN}-finally-fixed-d6.log\" ]; then\n for _File in `find /data/all/*/*/${_saXIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] && [ ! -e \"${_Core}/core\" ]; then\n cd ${_Core}\n patch -p1 < ${_saXPatch} &> /dev/null\n fi\n done\n touch ${_pthLog}/legacy-${_saXCoreN}-finally-fixed-d6.log\n elif [ -d \"/data/disk/all\" ] \\\n && [ ! -e \"${_pthLog}/legacy-${_saXCoreN}-finally-fixed-d6eee.log\" ]; then\n for _File in `find /data/disk/all/*/*/${_saXIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] && [ ! -e \"${_Core}/core\" ]; then\n cd ${_Core}\n patch -p1 < ${_saXPatch} &> /dev/null\n fi\n done\n touch ${_pthLog}/legacy-${_saXCoreN}-finally-fixed-d6eee.log\n fi\n cd\n fi\n\n # SA-CORE for custom D6 platforms\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ -e \"${_saXPatch}\" ]; then\n if [ -d \"/data/u\" ] \\\n && [ ! -e \"${_pthLog}/batch-custom-${_saXCoreN}-finally-fixed-d6.log\" ]; then\n for _File in `find /data/disk/*/static/*/${_saXIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ ! -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saXCoreS}-fix-finally.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saXPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saXCoreS}-fix-finally.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/${_saXIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ ! -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saXCoreS}-fix-finally.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saXPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saXCoreS}-fix-finally.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/*/${_saXIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ ! -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saXCoreS}-fix-finally.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saXPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saXCoreS}-fix-finally.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/*/*/${_saXIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ ! -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saXCoreS}-fix-finally.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saXPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saXCoreS}-fix-finally.info\n fi\n done\n for _File in `find /data/disk/*/static/*/*/*/*/*/${_saXIncDb} \\\n -maxdepth 0 -mindepth 0 | sort`; do\n _Core=$(echo ${_File} \\\n | sed 's/\\/includes.*//g' \\\n | awk '{print $1}' 2> /dev/null)\n if [ -d \"${_Core}\" ] \\\n && [ ! -e \"${_Core}/core\" ] \\\n && [ ! -e \"${_Core}/profiles/${_saXCoreS}-fix-finally.info\" ]; then\n cd ${_Core}\n patch -p1 < ${_saXPatch} &> /dev/null\n echo fixed > ${_Core}/profiles/${_saXCoreS}-fix-finally.info\n fi\n done\n fi\n cd\n touch ${_pthLog}/batch-custom-${_saXCoreN}-finally-fixed-d6.log\n fi\n}\n\n_fix_ping_perms() {\n if [ -e \"/bin/ping\" ]; then\n _PING_TEST=$(ls -la /bin/ping | grep rwsr-xr-x 2>&1)\n if [ -z \"${_PING_TEST}\" ]; then\n chown root:root /bin/ping\n chmod 4755 /bin/ping\n fi\n fi\n}\n\n_fix_fpm_process_max() {\n if [ ! -e \"${_pthLog}/process.max.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n sed -i \"s/process.max =.*/process.max = 0/g\" /opt/php*/etc/php*-fpm.conf\n touch ${_pthLog}/process.max.ctrl.${_tRee}.${_xSrl}.pid\n fi\n}\n\n_fix_node_in_lshell_access() {\n if [ ! -e \"${_pthLog}/node.lshell-fix-npx.ctrl.${_tRee}.${_xSrl}.pid\" ] \\\n && [ -e \"/etc/lshell.conf\" ]; then\n _PrTestPhantom=$(grep \"PHANTOM\" /root/.*.octopus.cnf 2>&1)\n _PrTestCluster=$(grep \"CLUSTER\" /root/.*.octopus.cnf 2>&1)\n _PrTestUltra=$(grep \"ULTRA\" /root/.*.octopus.cnf 2>&1)\n _PrTestMonster=$(grep \"MONSTER\" /root/.*.octopus.cnf 2>&1)\n if [[ \"${_PrTestPhantom}\" =~ \"PHANTOM\" ]] \\\n || [[ \"${_PrTestCluster}\" =~ \"CLUSTER\" ]] \\\n || [[ \"${_PrTestUltra}\" =~ \"ULTRA\" ]] \\\n || [[ \"${_PrTestMonster}\" =~ \"MONSTER\" ]] \\\n || [ -e \"/root/.allow.node.lshell.cnf\" ]; then\n _ALLOW_NODE=YES\n else\n _ALLOW_NODE=NO\n sed -i \\\n -e \"s/, 'node', 'npm', 'npx',/,/gi\" \\\n -e \"s/, 'scp',/,/gi\" \\\n /etc/lshell.conf /var/xdrago/conf/lshell.conf\n fi\n touch ${_pthLog}/node.lshell-fix-npx.ctrl.${_tRee}.${_xSrl}.pid\n fi\n}\n\n_fix_php_in_lshell_access() {\n if [ ! -e \"${_pthLog}/php.lshell-fix-php.ctrl.${_tRee}.${_xSrl}.pid\" ] \\\n && [ -e \"/etc/lshell.conf\" ]; then\n _PrTestPhantom=$(grep \"PHANTOM\" /root/.*.octopus.cnf 2>&1)\n _PrTestCluster=$(grep \"CLUSTER\" /root/.*.octopus.cnf 2>&1)\n _PrTestUltra=$(grep \"ULTRA\" /root/.*.octopus.cnf 2>&1)\n _PrTestMonster=$(grep \"MONSTER\" /root/.*.octopus.cnf 2>&1)\n if [[ \"${_PrTestPhantom}\" =~ \"PHANTOM\" ]] \\\n || [[ \"${_PrTestCluster}\" =~ \"CLUSTER\" ]] \\\n || [[ \"${_PrTestUltra}\" =~ \"ULTRA\" ]] \\\n || [[ \"${_PrTestMonster}\" =~ \"MONSTER\" ]] \\\n || [ -e \"/root/.allow.php.lshell.cnf\" ]; then\n _ALLOW_PHP=YES\n else\n _ALLOW_PHP=NO\n sed -i \\\n -e \"s/, 'php.*':.*php',/,/gi\" \\\n -e \"s/, '\\/opt\\/php.*',/,/gi\" \\\n /etc/lshell.conf /var/xdrago/conf/lshell.conf\n fi\n touch ${_pthLog}/php.lshell-fix-php.ctrl.${_tRee}.${_xSrl}.pid\n fi\n}\n\n_if_fix_lshell() {\n if [ ! -e \"/usr/local/etc/lshell.conf\" ] \\\n && [ ! -L \"/usr/local/etc/lshell.conf\" ] \\\n && [ -e \"/etc/lshell.conf\" ]; then\n [ ! -d \"/usr/local/etc\" ] && mkdir -p /usr/local/etc\n ln -sfn /etc/lshell.conf /usr/local/etc/lshell.conf\n fi\n _LSHELL_VRN=0.10\n _PATH_LSHELL=\"${_usrBin}/lshell\"\n _LSHELL_CHK_VRN=0.10\n _LSHELL_FORCE_REINSTALL=NO\n _isLshell=\"$(which lshell)\"\n _LSHELL_ITD=$(${_isLshell} --version 2>&1 \\\n | tr -d \"\\n\" \\\n | cut -d\"-\" -f2 \\\n | awk '{ print $1}' 2>&1)\n if [ -z \"${_isLshell}\" ] \\\n || [ -z \"${_PATH_LSHELL}\" ] \\\n || [ \"${_LSHELL_ITD}\" != \"${_LSHELL_CHK_VRN}\" ] \\\n || [[ \"${_LSHELL_ITD}\" =~ \"Traceback\" ]] \\\n || [[ \"${_LSHELL_ITD}\" =~ \"bad interpreter\" ]] \\\n || [[ \"${_LSHELL_ITD}\" =~ \"ImportError\" ]]; then\n _LSHELL_FORCE_REINSTALL=YES\n fi\n if [ \"${_LSHELL_FORCE_REINSTALL}\" = \"YES\" ]; then\n [ -f \"/etc/lshell.conf\" ] && cp -af /etc/lshell.conf /etc/lshell.conf-bak-${_LSHELL_VRN}\n _apt_clean_update\n apt-get install python3-pip ${_aptYesUnth}\n if [ -x \"/usr/bin/pip3\" ]; then\n _usePip=/usr/bin/pip3\n elif [ -x \"/usr/local/bin/pip3\" ]; then\n _usePip=/usr/local/bin/pip3\n fi\n _PIP_TEST=$(${_usePip} --version 2>&1)\n if [[ \"${_PIP_TEST}\" =~ \"python 3.11\" ]] \\\n || [[ \"${_PIP_TEST}\" =~ \"python 3.12\" ]] \\\n || [[ \"${_PIP_TEST}\" =~ \"python 3.13\" ]]; then\n ${_usePip} install --upgrade pip --root-user-action ignore\n else\n ${_usePip} install --upgrade pip\n fi\n cd /var/opt\n rm -rf lshell*\n _get_dev_src \"lshell-${_LSHELL_VRN}.tar.gz\"\n for _Files in `find /var/opt/lshell-${_LSHELL_VRN} -type f`; do\n sed -i \"s/kicked/logged/g\" ${_Files} &> /dev/null\n wait\n sed -i \"s/Kicked/Logged/g\" ${_Files} &> /dev/null\n wait\n done\n rm -rf /usr/local/lib/python*/site-packages/lshell*\n rm -rf /usr/local/lib/python*/dist-packages/lshell*\n cd /var/opt/lshell-${_LSHELL_VRN}\n _PIP_TEST=$(${_usePip} --version 2>&1)\n if [[ \"${_PIP_TEST}\" =~ \"python 3.11\" ]] \\\n || [[ \"${_PIP_TEST}\" =~ \"python 3.12\" ]] \\\n || [[ \"${_PIP_TEST}\" =~ \"python 3.13\" ]]; then\n ${_usePip} install . --break-system-packages --root-user-action ignore\n else\n ${_usePip} install .\n fi\n [ -f \"/etc/lshell.conf-bak-${_LSHELL_VRN}\" ] && cp -af /etc/lshell.conf-bak-${_LSHELL_VRN} /etc/lshell.conf\n rm -f /etc/logrotate.d/lshell\n addgroup --system lshellg &> /dev/null\n addgroup --system ltd-shell-more &> /dev/null\n mkdir -p /var/log/lsh\n chown :lshellg /var/log/lsh\n chmod 770 /var/log/lsh &> /dev/null\n # Kill all non-root logged-in users\n who | awk '$1 !~ /^root$/ { cmd = \"pkill -KILL -u \" $1; system(cmd) }'\n touch ${_pthLog}/lshell-fix-build-${_LSHELL_VRN}.log\n fi\n if [ -e \"${_usrBin}/lshell\" ]; then\n chown root:users ${_usrBin}/lshell\n chmod 750 ${_usrBin}/lshell\n if [ ! -L \"/usr/bin/lshell\" ]; then\n ln -sfn ${_usrBin}/lshell /usr/bin/lshell &> /dev/null\n fi\n fi\n}\n\n_fix_start_stop_ports_solr() {\n if [ -x \"/etc/init.d/solr9\" ] && [ -e \"/etc/default/solr9.in.sh\" ]; then\n _SOLR9_STOP_TEST=$(grep \"STOP\\.PORT=19099\" /etc/default/solr9.in.sh 2>&1)\n _SOLR9_WAIT_TEST=$(grep \"SOLR_START_WAIT=\" /etc/default/solr9.in.sh 2>&1)\n if [ ! -e \"/var/log/boa/solr9.in.004.fixed.pid\" ] \\\n || [[ ! \"${_SOLR9_STOP_TEST}\" =~ \"19099\" ]] \\\n || [[ ! \"${_SOLR9_WAIT_TEST}\" =~ \"10\" ]]; then\n sed -i \"s/^SOLR_STOP_PORT.*//g\" /etc/default/solr9.in.sh\n sed -i \"s/^SOLR_STOP_KEY.*//g\" /etc/default/solr9.in.sh\n sed -i \"s/.*mycustomkey9.*//g\" /etc/default/solr9.in.sh\n sed -i \"s/.*_WAIT.*//g\" /etc/default/solr9.in.sh\n echo \"SOLR_OPTS=\\\"\\$SOLR_OPTS -DSTOP.PORT=19099 -DSTOP.KEY=mycustomkey9\\\"\" >> /etc/default/solr9.in.sh\n echo \"SOLR_START_WAIT=\\\"10\\\"\" >> /etc/default/solr9.in.sh\n echo \"SOLR_STOP_WAIT=\\\"10\\\"\" >> /etc/default/solr9.in.sh\n echo \"SOLR_WAIT_FOR_ZK=\\\"10\\\"\" >> /etc/default/solr9.in.sh\n sed -i \"/^$/d\" /etc/default/solr9.in.sh\n echo \"_restartSolr9 at $(date)\" >> ${_pthLog}/_fix_start_stop_ports_solr.log\n touch /var/log/boa/solr9.in.004.fixed.pid\n service solr9 restart\n fi\n fi\n if [ -x \"/etc/init.d/solr7\" ] && [ -e \"/etc/default/solr7.in.sh\" ]; then\n _SOLR7_STOP_TEST=$(grep \"STOP\\.PORT=17077\" /etc/default/solr7.in.sh 2>&1)\n _SOLR7_WAIT_TEST=$(grep \"SOLR_START_WAIT=\" /etc/default/solr7.in.sh 2>&1)\n if [ ! -e \"/var/log/boa/solr7.in.004.fixed.pid\" ] \\\n || [[ ! \"${_SOLR7_STOP_TEST}\" =~ \"17077\" ]] \\\n || [[ ! \"${_SOLR7_WAIT_TEST}\" =~ \"10\" ]]; then\n sed -i \"s/^SOLR_STOP_PORT.*//g\" /etc/default/solr7.in.sh\n sed -i \"s/^SOLR_STOP_KEY.*//g\" /etc/default/solr7.in.sh\n sed -i \"s/.*mycustomkey7.*//g\" /etc/default/solr7.in.sh\n sed -i \"s/.*_WAIT.*//g\" /etc/default/solr7.in.sh\n echo \"SOLR_OPTS=\\\"\\$SOLR_OPTS -DSTOP.PORT=17077 -DSTOP.KEY=mycustomkey7\\\"\" >> /etc/default/solr7.in.sh\n echo \"SOLR_START_WAIT=\\\"10\\\"\" >> /etc/default/solr7.in.sh\n echo \"SOLR_STOP_WAIT=\\\"10\\\"\" >> /etc/default/solr7.in.sh\n echo \"SOLR_WAIT_FOR_ZK=\\\"10\\\"\" >> /etc/default/solr7.in.sh\n sed -i \"/^$/d\" /etc/default/solr7.in.sh\n echo \"_restartSolr7 at $(date)\" >> ${_pthLog}/_fix_start_stop_ports_solr.log\n touch /var/log/boa/solr7.in.004.fixed.pid\n service solr7 restart\n fi\n fi\n if [ -x \"/etc/init.d/jetty9\" ]; then\n _restartSolr4=FALSE\n _ctrl_jetty_nr=$(ls -la /tmp/jetty-0.0.0.0-8099-solr.war* | wc -l 2>&1)\n if [[ ! \"${_ctrl_jetty_nr}\" =~ \"No such file\" ]] && [ \"${_ctrl_jetty_nr}\" -gt 8 ]; then\n _restartSolr4=TRUE\n fi\n if [ \"${_restartSolr4}\" = \"TRUE\" ]; then\n if [ ! -x \"/etc/init.d/jenkins\" ] && [ ! -e \"/var/lib/jenkins\" ]; then\n find /tmp -mindepth 1 -user jetty9 -exec rm -rf {} + 2>/dev/null\n pkill -9 -f jetty9\n echo \"_restartSolr4 at $(date)\" >> ${_pthLog}/_fix_start_stop_ports_solr.log\n fi\n fi\n fi\n}\n\n_fix_log4j_solr7() {\n _LOG4J_VRN=2.17.1\n _DO_SOLR_RESTART=\n if [ -x \"/etc/init.d/solr7\" ] && [ -e \"/etc/default/solr7.in.sh\" ]; then\n if [ -e \"/opt/solr-7.7.3\" ] \\\n && [ ! -e \"/opt/solr-7.7.3/server/lib/ext/log4j-core-${_LOG4J_VRN}.jar\" ]; then\n cd /var/opt\n rm -rf apache-log4j*\n _get_dev_src \"apache-log4j-${_LOG4J_VRN}-bin.tar.gz\"\n if [ -e \"/var/opt/apache-log4j-${_LOG4J_VRN}-bin/log4j-core-${_LOG4J_VRN}.jar\" ]; then\n cd /var/opt/apache-log4j-${_LOG4J_VRN}-bin\n [ -d \"/var/backups/log4j/solr-7.7.3\" ] || mkdir -p /var/backups/log4j/solr-7.7.3\n mv -f /opt/solr-7.7.3/server/lib/ext/log4j* /var/backups/log4j/solr-7.7.3/\n rm -f /opt/solr-7.7.3/contrib/prometheus-exporter/lib/log4j*\n cp -af log4j-1.2-api-${_LOG4J_VRN}.jar /opt/solr-7.7.3/server/lib/ext/\n cp -af log4j-core-${_LOG4J_VRN}.jar /opt/solr-7.7.3/server/lib/ext/\n cp -af log4j-core-${_LOG4J_VRN}.jar /opt/solr-7.7.3/contrib/prometheus-exporter/lib/\n cp -af log4j-slf4j-impl-${_LOG4J_VRN}.jar /opt/solr-7.7.3/server/lib/ext/\n cp -af log4j-slf4j-impl-${_LOG4J_VRN}.jar /opt/solr-7.7.3/contrib/prometheus-exporter/lib/\n cp -af log4j-api-${_LOG4J_VRN}.jar /opt/solr-7.7.3/server/lib/ext/\n cp -af log4j-api-${_LOG4J_VRN}.jar /opt/solr-7.7.3/contrib/prometheus-exporter/lib/\n chown root:root /opt/solr-7.7.3/server/lib/ext/log4j*\n chown root:root /opt/solr-7.7.3/contrib/prometheus-exporter/lib/log4j*\n _DO_SOLR_RESTART=YES\n fi\n fi\n if [ -e \"/opt/solr-7.6.0\" ] \\\n && [ ! -e \"/opt/solr-7.6.0/server/lib/ext/log4j-core-${_LOG4J_VRN}.jar\" ]; then\n cd /var/opt\n rm -rf apache-log4j*\n _get_dev_src \"apache-log4j-${_LOG4J_VRN}-bin.tar.gz\"\n if [ -e \"/var/opt/apache-log4j-${_LOG4J_VRN}-bin/log4j-core-${_LOG4J_VRN}.jar\" ]; then\n cd /var/opt/apache-log4j-${_LOG4J_VRN}-bin\n [ -d \"/var/backups/log4j/solr-7.6.0\" ] || mkdir -p /var/backups/log4j/solr-7.6.0\n mv -f /opt/solr-7.6.0/server/lib/ext/log4j* /var/backups/log4j/solr-7.6.0/\n rm -f /opt/solr-7.6.0/contrib/prometheus-exporter/lib/log4j*\n cp -af log4j-1.2-api-${_LOG4J_VRN}.jar /opt/solr-7.6.0/server/lib/ext/\n cp -af log4j-core-${_LOG4J_VRN}.jar /opt/solr-7.6.0/server/lib/ext/\n cp -af log4j-core-${_LOG4J_VRN}.jar /opt/solr-7.6.0/contrib/prometheus-exporter/lib/\n cp -af log4j-slf4j-impl-${_LOG4J_VRN}.jar /opt/solr-7.6.0/server/lib/ext/\n cp -af log4j-slf4j-impl-${_LOG4J_VRN}.jar /opt/solr-7.6.0/contrib/prometheus-exporter/lib/\n cp -af log4j-api-${_LOG4J_VRN}.jar /opt/solr-7.6.0/server/lib/ext/\n cp -af log4j-api-${_LOG4J_VRN}.jar /opt/solr-7.6.0/contrib/prometheus-exporter/lib/\n chown root:root /opt/solr-7.6.0/server/lib/ext/log4j*\n chown root:root /opt/solr-7.6.0/contrib/prometheus-exporter/lib/log4j*\n _DO_SOLR_RESTART=YES\n fi\n fi\n _RESULT_LOG4J=$(grep \"LOG4J_FORMAT_MSG_NO_LOOKUPS=true\" /etc/default/solr7.in.sh 2>&1)\n if [[ ! \"${_RESULT_LOG4J}\" =~ \"LOG4J\" ]]; then\n echo \"LOG4J_FORMAT_MSG_NO_LOOKUPS=true\" >> /etc/default/solr7.in.sh\n fi\n if [[ ! \"${_RESULT_LOG4J}\" =~ \"LOG4J\" ]] || [ ! -z \"${_DO_SOLR_RESTART}\" ]; then\n #pkill -9 -f solr7\n service solr7 restart &> /dev/null\n fi\n fi\n}\n\n_fix_authorized_keys() {\n if [ ! -e \"${_pthLog}/_fix_authorized_keys.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n chmod 0600 /home/*/.ssh/authorized_keys &> /dev/null\n chmod 0700 /home/*/.ssh &> /dev/null\n touch ${_pthLog}/_fix_authorized_keys.ctrl.${_tRee}.${_xSrl}.pid\n fi\n}\n\n_fix_aio() {\n _AIO_FIX=$(grep \"fs.aio-max-nr\" /etc/sysctl.conf 2>&1)\n if [ -z \"${_AIO_FIX}\" ]; then\n echo \"fs.aio-max-nr = 1048576\" >> /etc/sysctl.conf\n fi\n}\n\n_fix_console_print() {\n _PRK_FIX=$(grep \"kernel.printk\" /etc/sysctl.conf 2>&1)\n if [ -z \"${_PRK_FIX}\" ]; then\n echo \"kernel.printk = 4 1 1 7\" >> /etc/sysctl.conf\n fi\n}\n\n_fix_java_symlinks() {\n if [ \"${_OS_CODE}\" = \"jessie\" ] && [ -x \"/usr/lib/jvm/java-7-openjdk/jre/bin/java\" ]; then\n if [ ! -e \"/usr/bin/java\" ] || [ ! -e \"/etc/alternatives/java\" ]; then\n ln -sfn /usr/lib/jvm/java-7-openjdk/jre/bin/java /etc/alternatives/java\n ln -sfn /etc/alternatives/java /usr/bin/java\n echo fixed java symlinks for ${_OS_CODE}\n fi\n fi\n if [ \"${_OS_CODE}\" = \"stretch\" ] && [ -x \"/usr/lib/jvm/java-8-openjdk/jre/bin/java\" ]; then\n if [ ! -e \"/usr/bin/java\" ] || [ ! -e \"/etc/alternatives/java\" ]; then\n ln -sfn /usr/lib/jvm/java-8-openjdk/jre/bin/java /etc/alternatives/java\n ln -sfn /etc/alternatives/java /usr/bin/java\n echo fixed java symlinks for ${_OS_CODE}\n fi\n fi\n if [ \"${_OS_CODE}\" = \"excalibur\" ] \\\n || [ \"${_OS_CODE}\" = \"daedalus\" ] \\\n || [ \"${_OS_CODE}\" = \"chimaera\" ]; then\n if [ ! -e \"/usr/lib/jvm/java-21-openjdk\" ] \\\n && [ -d \"/usr/lib/jvm/java-21-openjdk-amd64\" ]; then\n ln -sfn /usr/lib/jvm/java-21-openjdk-amd64 /usr/lib/jvm/java-21-openjdk\n fi\n if [ ! -e \"/usr/bin/java21\" ] \\\n && [ -e \"/usr/lib/jvm/java-21-openjdk-amd64/bin/java\" ]; then\n ln -sfn /usr/lib/jvm/java-21-openjdk-amd64/bin/java /usr/bin/java21\n fi\n if [ ! -e \"/usr/lib/jvm/java-17-openjdk\" ] \\\n && [ -d \"/usr/lib/jvm/java-17-openjdk-amd64\" ]; then\n ln -sfn /usr/lib/jvm/java-17-openjdk-amd64 /usr/lib/jvm/java-17-openjdk\n fi\n if [ ! -e \"/usr/bin/java17\" ] \\\n && [ -e \"/usr/lib/jvm/java-17-openjdk-amd64/bin/java\" ]; then\n ln -sfn /usr/lib/jvm/java-17-openjdk-amd64/bin/java /usr/bin/java17\n fi\n if [ ! -e \"/usr/lib/jvm/java-11-openjdk\" ] \\\n && [ -d \"/usr/lib/jvm/java-11-openjdk-amd64\" ]; then\n ln -sfn /usr/lib/jvm/java-11-openjdk-amd64 /usr/lib/jvm/java-11-openjdk\n fi\n if [ ! -e \"/usr/bin/java11\" ] \\\n && [ -e \"/usr/lib/jvm/java-11-openjdk-amd64/bin/java\" ]; then\n ln -sfn /usr/lib/jvm/java-11-openjdk-amd64/bin/java /usr/bin/java11\n fi\n if [ -x \"/etc/init.d/jenkins\" ] && [ -e \"/var/lib/jenkins\" ]; then\n _LOOK_LIKE_JENKINS=TRUE\n elif [ -e \"/root/.look.like.jenkins.cnf\" ]; then\n _LOOK_LIKE_JENKINS=TRUE\n else\n _LOOK_LIKE_JENKINS=FALSE\n fi\n if [ \"${_LOOK_LIKE_JENKINS}\" = \"TRUE\" ] \\\n || [ \"${_OS_CODE}\" = \"daedalus\" ] \\\n || [ \"${_OS_CODE}\" = \"excalibur\" ]; then\n if [ -x \"/usr/lib/jvm/java-17-openjdk/bin/java\" ] \\\n && [ ! -e \"/var/log/boa/.fixed-java17-symlinks.log\" ]; then\n if [ -e \"/usr/lib/jvm/java-17-openjdk-amd64\" ]; then\n rm -f /usr/lib/jvm/default-java\n ln -sfn /usr/lib/jvm/java-17-openjdk-amd64 /usr/lib/jvm/default-java\n fi\n ln -sfn /usr/lib/jvm/java-17-openjdk/bin/java /etc/alternatives/java\n ln -sfn /etc/alternatives/java /usr/bin/java\n touch /var/log/boa/.fixed-java17-symlinks.log\n echo \"Fixed Java 17 symlinks for ${_OS_CODE}\"\n fi\n if [ -x \"/usr/lib/jvm/java-21-openjdk/bin/java\" ] \\\n && [ ! -e \"/var/log/boa/.fixed-java21-symlinks.log\" ]; then\n if [ -e \"/usr/lib/jvm/java-21-openjdk-amd64\" ]; then\n rm -f /usr/lib/jvm/default-java\n ln -sfn /usr/lib/jvm/java-21-openjdk-amd64 /usr/lib/jvm/default-java\n fi\n ln -sfn /usr/lib/jvm/java-21-openjdk/bin/java /etc/alternatives/java\n ln -sfn /etc/alternatives/java /usr/bin/java\n touch /var/log/boa/.fixed-java21-symlinks.log\n echo \"Fixed Java 21 symlinks for ${_OS_CODE}\"\n fi\n else\n if [ -x \"/usr/lib/jvm/java-11-openjdk/bin/java\" ]; then\n if [ -e \"/usr/lib/jvm/java-11-openjdk-amd64\" ]; then\n rm -f /usr/lib/jvm/default-java\n ln -sfn /usr/lib/jvm/java-11-openjdk-amd64 /usr/lib/jvm/default-java\n fi\n if [ ! -e \"/usr/bin/java\" ] || [ ! -e \"/etc/alternatives/java\" ]; then\n ln -sfn /usr/lib/jvm/java-11-openjdk/bin/java /etc/alternatives/java\n ln -sfn /etc/alternatives/java /usr/bin/java\n echo \"Fixed Java 11 symlinks for ${_OS_CODE}\"\n fi\n fi\n fi\n else\n if [ -x \"/usr/lib/jvm/java-11-openjdk/bin/java\" ]; then\n if [ ! -e \"/usr/bin/java\" ] || [ ! -e \"/etc/alternatives/java\" ]; then\n ln -sfn /usr/lib/jvm/java-11-openjdk/bin/java /etc/alternatives/java\n ln -sfn /etc/alternatives/java /usr/bin/java\n echo \"Fixed Java 11 symlinks for ${_OS_CODE}\"\n fi\n fi\n fi\n}\n\n_fix_composer_version() {\n _COMPOSER_VRN=2.8.2\n if [ -x \"/usr/local/bin/composer\" ]; then\n _COMPOSER_IS=$(composer --no-interaction --version 2>&1 \\\n | tr -d \"\\n\" \\\n | cut -d\" \" -f35 \\\n | awk '{ print $1}' 2>&1)\n if [ \"${_COMPOSER_IS}\" != \"${_COMPOSER_VRN}\" ]; then\n composer self-update ${_COMPOSER_VRN} &> /dev/null\n fi\n fi\n}\n\n_fix_sftp_server() {\n if [ -e \"/etc/ssh/sshd_config\" ]; then\n _SFTP_UMASK_TEST=$(grep \"sftp-server -u 0002\" /etc/ssh/sshd_config 2>&1)\n if [[ ! \"${_SFTP_UMASK_TEST}\" =~ \"sftp-server -u 0002\" ]]; then\n sed -i \"s/^Subsystem.*//g\" /etc/ssh/sshd_config\n echo \"Subsystem sftp /usr/lib/openssh/sftp-server -u 0002\" >> /etc/ssh/sshd_config\n sed -i \"/^$/d\" /etc/ssh/sshd_config\n service ssh restart 2> /dev/null\n fi\n fi\n}\n\n_fix_wkhtml_perms() {\n\n _WKHTML_ARRAY=\"/usr/local/bin/wkhtmltopdf \\\n /usr/bin/wkhtmltopdf \\\n /usr/bin/wkhtmltopdf-0.12.4 \\\n /usr/local/bin/wkhtmltoimage \\\n /usr/bin/wkhtmltoimage \\\n /usr/bin/wkhtmltoimage-0.12.4\"\n\n for _WKHTML_ITEM in ${_WKHTML_ARRAY}; do\n if [ -x \"${_WKHTML_ITEM}\" ]; then\n _PERM_TEST=$(ls -la ${_WKHTML_ITEM} | grep rwxr-xr-x 2>&1)\n if [ -z \"${_PERM_TEST}\" ]; then\n chgrp root ${_WKHTML_ITEM} &> /dev/null\n chmod 755 ${_WKHTML_ITEM} &> /dev/null\n fi\n fi\n done\n}\n\n_fix_wkhtml() {\n if [ -x \"/usr/local/bin/wkhtmltopdf\" ] \\\n && [ -L \"/usr/bin/wkhtmltopdf\" ]; then\n rm -f /usr/bin/wkhtmltopdf\n cp -af /usr/local/bin/wkhtmltopdf /usr/bin/wkhtmltopdf\n chgrp root /usr/bin/wkhtmltopdf &> /dev/null\n chmod 755 /usr/bin/wkhtmltopdf &> /dev/null\n fi\n if [ -x \"/usr/local/bin/wkhtmltoimage\" ] \\\n && [ -L \"/usr/bin/wkhtmltoimage\" ]; then\n rm -f /usr/bin/wkhtmltoimage\n cp -af /usr/local/bin/wkhtmltoimage /usr/bin/wkhtmltoimage\n chgrp root /usr/bin/wkhtmltoimage &> /dev/null\n chmod 755 /usr/bin/wkhtmltoimage &> /dev/null\n fi\n if [ -x \"/usr/local/bin/wkhtmltopdf\" ] \\\n && [ ! -e \"/usr/bin/wkhtmltopdf\" ]; then\n cp -af /usr/local/bin/wkhtmltopdf /usr/bin/wkhtmltopdf\n chgrp root /usr/bin/wkhtmltopdf &> /dev/null\n chmod 755 /usr/bin/wkhtmltopdf &> /dev/null\n fi\n if [ -x \"/usr/local/bin/wkhtmltoimage\" ] \\\n && [ ! -e \"/usr/bin/wkhtmltoimage\" ]; then\n cp -af /usr/local/bin/wkhtmltoimage /usr/bin/wkhtmltoimage\n chgrp root /usr/bin/wkhtmltoimage &> /dev/null\n chmod 755 /usr/bin/wkhtmltoimage &> /dev/null\n fi\n if [ ! -x \"/usr/local/bin/wkhtmltopdf\" ] \\\n && [ -x \"/usr/bin/wkhtmltopdf\" ]; then\n rm -f /usr/local/bin/wkhtmltopdf\n cp -af /usr/bin/wkhtmltopdf /usr/local/bin/wkhtmltopdf\n chgrp root /usr/local/bin/wkhtmltopdf &> /dev/null\n chmod 755 /usr/local/bin/wkhtmltopdf &> /dev/null\n fi\n if [ ! -x \"/usr/local/bin/wkhtmltoimage\" ] \\\n && [ -x \"/usr/bin/wkhtmltoimage\" ]; then\n rm -f /usr/local/bin/wkhtmltoimage\n cp -af /usr/bin/wkhtmltoimage /usr/local/bin/wkhtmltoimage\n chgrp root /usr/local/bin/wkhtmltoimage &> /dev/null\n chmod 755 /usr/local/bin/wkhtmltoimage &> /dev/null\n fi\n}\n\n_fix_eldir() {\n if [ -e \"/var/xdrago\" ] \\\n && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"${_eldirP}\" ]; then\n mkdir -p /var/xdrago/conf\n curl ${_crlGet} \"${_urlHmr}/patches/${_eldirF}\" -o ${_eldirP}\n fi\n}\n\n_if_drupal_patches_update() {\n if [ -e \"/var/xdrago\" ]; then\n _BROKEN_UPDATE_TEST_A=$(grep \"Under Construction\" /data/conf/patches/* 2>&1)\n _BROKEN_UPDATE_TEST_B=$(grep \"404 Not Found\" /data/conf/patches/* 2>&1)\n if [ ! -z \"${_BROKEN_UPDATE_TEST_A}\" ] \\\n || [ ! -z \"${_BROKEN_UPDATE_TEST_B}\" ] \\\n || [ ! -e \"/data/conf/patches/ctrl.f96.${_tRee}.${_xSrl}.pid\" ]; then\n mkdir -p /data/conf/patches\n rm -f /data/conf/patches/*\n touch /data/conf/patches/ctrl.f96.${_tRee}.${_xSrl}.pid\n fi\n fi\n}\n\n_fix_drupal_core_ten() {\n if [ -e \"/var/xdrago\" ]; then\n if [ ! -e \"${_tenCorePatchPath}\" ]; then\n mkdir -p /data/conf/patches\n curl ${_crlGet} \"${_urlHmr}/patches/${_tenCorePatchFname}\" -o ${_tenCorePatchPath}\n fi\n if [ ! -e \"${_tenConsolePatchPath}\" ]; then\n mkdir -p /data/conf/patches\n curl ${_crlGet} \"${_urlHmr}/patches/${_tenConsolePatchFname}\" -o ${_tenConsolePatchPath}\n fi\n fi\n}\n\n_fix_drupal_core_eleven() {\n if [ -e \"/var/xdrago\" ]; then\n if [ ! -e \"${_elevenCorePatchPath}\" ]; then\n mkdir -p /data/conf/patches\n curl ${_crlGet} \"${_urlHmr}/patches/${_elevenCorePatchFname}\" -o ${_elevenCorePatchPath}\n fi\n if [ ! -e \"${_elevenConsolePatchPath}\" ]; then\n mkdir -p /data/conf/patches\n curl ${_crlGet} \"${_urlHmr}/patches/${_elevenConsolePatchFname}\" -o ${_elevenConsolePatchPath}\n fi\n if [ ! -e \"${_elevenValidatorPatchPath}\" ]; then\n mkdir -p /data/conf/patches\n curl ${_crlGet} \"${_urlHmr}/patches/${_elevenValidatorPatchFname}\" -o ${_elevenValidatorPatchPath}\n fi\n fi\n}\n\n_fix_pure_ftpd() {\n if [ -e \"/usr/local/etc/pure-ftpd.conf\" ]; then\n _PAM_AUTH=$(grep \"^PAMAuthentication\" /usr/local/etc/pure-ftpd.conf 2>&1)\n if [ ! -z \"${_PAM_AUTH}\" ]; then\n sed -i \"s/^PAMAuthentication/# PAMAuthentication/g\" /usr/local/etc/pure-ftpd.conf\n killall -9 pure-ftpd &> /dev/null\n fi\n fi\n}\n\n_fix_hosting_le() {\n if [ -d \"/var/xdrago/conf\" ]; then\n if [ ! -e \"${_hoLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid\" ] \\\n || [ ! -e \"${_pthLog}/dehydrated-up01.ctrl.${_tRee}.${_xSrl}.pid\" ] \\\n || [ -e \"/var/xdrago/${_provLeInc}\" ] \\\n || [ -e \"/var/xdrago/${_hoLeInc}\" ] \\\n || [ -e \"/var/xdrago/${_dehydName}\" ] \\\n || [ -e \"/root/${_provLeInc}\" ] \\\n || [ -e \"/root/hosting_le_vhost.drush.inc.ctrl.${_tRee}.${_xSrl}.pid\" ] \\\n || [ -e \"/root/${_hoLeInc}\" ] \\\n || [ -e \"${_legacyLeSh}\" ] \\\n || [ ! -e \"${_dehydSrcPath}\" ] \\\n || [ ! -e \"${_provLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n mkdir -p /var/xdrago/conf\n rm -f /var/xdrago/*.drush.inc*\n rm -f /root/*.drush.inc*\n rm -f ${_legacyLeSh}\n rm -f ${_dehydSrcPath}.ctrl.${_tRee}.${_xSrl}.pid\n rm -f ${_hoLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid\n rm -f ${_provLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid\n curl ${_crlGet} \"${_urlHmr}/helpers/${_dehydName}\" -o ${_dehydSrcPath}.ctrl.${_tRee}.${_xSrl}.pid\n cp -af ${_dehydSrcPath}.ctrl.${_tRee}.${_xSrl}.pid ${_dehydSrcPath}\n curl ${_crlGet} \"${_urlHmr}/patches/${_hoLeInc}\" -o ${_hoLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid\n cp -af ${_hoLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid ${_hoLeIncFull}\n curl ${_crlGet} \"${_urlHmr}/patches/${_provLeInc}\" -o ${_provLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid\n if [ -e \"${_provLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n cp -af ${_provLeIncFull}.ctrl.${_tRee}.${_xSrl}.pid ${_provLeIncFull}\n [ -e \"${_provLeIncFull}\" ] && touch ${_pthLog}/dehydrated-up01.ctrl.${_tRee}.${_xSrl}.pid\n fi\n fi\n fi\n}\n\n_fix_newrelic() {\n _PHP_EXT_DIR_84=\"/opt/php84/lib/php/extensions/no-debug-non-zts-20240924\"\n _NR_SO=\"/usr/lib/newrelic-php5/agent/x64/newrelic-20240924.so\"\n if [ -e \"${_PHP_EXT_DIR_84}\" ] \\\n && [ -e \"${_NR_SO}\" ] \\\n && [ ! -e \"${_PHP_EXT_DIR_84}/newrelic.so\" ]; then\n ln -sfn ${_NR_SO} ${_PHP_EXT_DIR_84}/newrelic.so\n service php84-fpm reload\n fi\n\n _PHP_EXT_DIR_74=\"/opt/php74/lib/php/extensions/no-debug-non-zts-20190902\"\n _NR_SO=\"/usr/lib/newrelic-php5/agent/x64/newrelic-20190902.so\"\n if [ -e \"${_PHP_EXT_DIR_74}\" ] \\\n && [ -e \"${_NR_SO}\" ] \\\n && [ ! -e \"${_PHP_EXT_DIR_74}/newrelic.so\" ]; then\n ln -sfn ${_NR_SO} ${_PHP_EXT_DIR_74}/newrelic.so\n service php74-fpm reload\n fi\n\n _PHP_EXT_DIR_71=\"/opt/php71/lib/php/extensions/no-debug-non-zts-20160303\"\n _NR_SO=\"/usr/lib/newrelic-php5/agent/x64/newrelic-20160303.so\"\n if [ -e \"${_PHP_EXT_DIR_71}\" ] \\\n && [ ! -e \"${_NR_SO}\" ] \\\n && [ -L \"${_PHP_EXT_DIR_71}/newrelic.so\" ]; then\n rm -f ${_PHP_EXT_DIR_71}/newrelic.so\n service php71-fpm reload\n fi\n\n _PHP_EXT_DIR_70=\"/opt/php70/lib/php/extensions/no-debug-non-zts-20151012\"\n _NR_SO=\"/usr/lib/newrelic-php5/agent/x64/newrelic-20151012.so\"\n if [ -e \"${_PHP_EXT_DIR_70}\" ] \\\n && [ ! -e \"${_NR_SO}\" ] \\\n && [ -L \"${_PHP_EXT_DIR_70}/newrelic.so\" ]; then\n rm -f ${_PHP_EXT_DIR_70}/newrelic.so\n service php70-fpm reload\n fi\n\n _PHP_EXT_DIR_56=\"/opt/php56/lib/php/extensions/no-debug-non-zts-20131226\"\n _NR_SO=\"/usr/lib/newrelic-php5/agent/x64/newrelic-20131226.so\"\n if [ -e \"${_PHP_EXT_DIR_56}\" ] \\\n && [ ! -e \"${_NR_SO}\" ] \\\n && [ -L \"${_PHP_EXT_DIR_56}/newrelic.so\" ]; then\n rm -f ${_PHP_EXT_DIR_56}/newrelic.so\n service php56-fpm reload\n fi\n}\n\n_fix_leftovers() {\n if [ -e \"/data/disk/arch/static/control\" ]; then\n rm -rf /data/disk/arch/static\n fi\n}\n\n_force_rebuild() {\n if [ ! -e \"${_pthLog}/forced.rebuild.glibc.txt\" ]; then\n echo \"_GIT_FORCE_REINSTALL=YES\" >> ${_barCnf}\n echo \"_NGX_FORCE_REINSTALL=YES\" >> ${_barCnf}\n echo \"_PHP_FORCE_REINSTALL=YES\" >> ${_barCnf}\n echo \"_SSH_FORCE_REINSTALL=YES\" >> ${_barCnf}\n echo \"_SSL_FORCE_REINSTALL=YES\" >> ${_barCnf}\n rm -f ${_pthLog}/pure-ftpd-build*\n rm -f ${_pthLog}/mss-build*\n rm -f ${_pthLog}/lshell-build*\n rm -f ${_pthLog}/redis-*\n rm -f ${_pthLog}/valkey-*\n touch ${_pthLog}/forced.rebuild.glibc.txt\n fi\n}\n\n#\n# Detect, remove, and report broken symlinks\n_check_and_remove_broken_symlinks() {\n local _dir=$1\n\n # Find broken symlinks in the directory\n _broken_symlinks=$(find \"${_dir}\" -maxdepth 1 -type l ! -exec test -e {} \\; -print)\n\n if [ -n \"${_broken_symlinks}\" ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"CLNP: Removing the following broken symlinks from ${_dir}:\"\n echo \"CLNP: ${_broken_symlinks}\"\n fi\n\n for _symlink in ${_broken_symlinks}; do\n rm \"${_symlink}\"\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"CLNP: Removed broken symlink: ${_symlink}\"\n fi\n done\n\n # Set the _ifAnySymlinksCleaned variable to true since we removed broken symlinks\n _ifAnySymlinksCleaned=YES\n else\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"CLNP: No broken symlinks found in ${_dir}\"\n fi\n fi\n}\n\n#\n# Check and move disallowed versions\n_check_and_move() {\n local _dir=$1\n\n # Determine the name of the backup subdirectory based on the source directory\n local _backup_dir=\"${_backLegBase}$(echo \"${_dir}\" | tr '/' '_')\"\n\n # Find any libcurl.so files in the directory, excluding the allowed version and those without a complete version number\n _found_versions=$(find \"${_dir}\" -maxdepth 1 -type f -name \"libcurl.so.*\" ! -name \"${_allowedFile}\" | grep -E \"libcurl\\.so\\.[0-9]+\\.[0-9]+\\.[0-9]+$\")\n\n if [ -n \"${_found_versions}\" ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"CLNP: Moving the following disallowed versions from ${_dir} to ${_backup_dir}:\"\n echo \"CLNP: ${_found_versions}\"\n fi\n\n # Create the backup directory if it doesn't exist\n mkdir -p \"${_backup_dir}\"\n\n # Move each found version to the backup directory\n for _file in ${_found_versions}; do\n mv -f \"${_file}\" \"${_backup_dir}/\"\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"CLNP: Moved ${_file} to ${_backup_dir}/\"\n fi\n done\n\n # Set the _ifAnyFilesCleaned variable to true since we moved files\n _ifAnyFilesCleaned=YES\n else\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"CLNP: Only the allowed version (${_allowedFile}) is present in ${_dir}\"\n fi\n fi\n}\n\n_if_reinstall_curl() {\n _CURL_VRN=8.20.0\n _CURL_INSTALL_REQUIRED=NO\n if ! command -v lsb_release &> /dev/null; then\n apt-get update -qq &> /dev/null\n apt-get install lsb-release ${_aptYesUnth} -qq &> /dev/null\n fi\n _OS_CODE=$(lsb_release -ar 2>/dev/null | grep -i codename | cut -s -f2)\n [ \"${_OS_CODE}\" = \"wheezy\" ] && _CURL_VRN=7.50.1\n [ \"${_OS_CODE}\" = \"jessie\" ] && _CURL_VRN=7.71.1\n [ \"${_OS_CODE}\" = \"stretch\" ] && _CURL_VRN=8.2.1\n\n if [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ \"${_OS_CODE}\" != \"jessie\" ] \\\n && [ \"${_OS_CODE}\" != \"stretch\" ]; then\n\n # Target version\n _allowedFile=\"libcurl.so.4.8.0\"\n\n # Directories to check\n _dirsToClean=(\"/usr/lib\" \"/usr/local/lib\" \"/usr/lib/x86_64-linux-gnu\")\n\n # Backup base directory\n _backLegBase=\"/var/backups/legacy-libcurl-boa-${_NOW}\"\n\n # Variable to track if any files were moved\n _ifAnyFilesCleaned=NO\n\n # Variable to track if any broken symlinks were found and removed\n _ifAnySymlinksCleaned=NO\n\n # Iterate over the directories and apply the _check_and_move function\n for _dir in \"${_dirsToClean[@]}\"; do\n _check_and_move \"${_dir}\"\n done\n\n # Iterate over the directories and apply the _check_and_remove_broken_symlinks function\n for _dir in \"${_dirsToClean[@]}\"; do\n _check_and_remove_broken_symlinks \"${_dir}\"\n done\n\n # Export the _ifAnyFilesCleaned variable for later use\n export _ifAnyFilesCleaned\n\n # Export the _ifAnySymlinksCleaned variable for later use\n export _ifAnySymlinksCleaned\n\n fi\n\n if [ \"${_ifAnySymlinksCleaned}\" = \"YES\" ] \\\n || [ \"${_ifAnyFilesCleaned}\" = \"YES\" ]; then\n ldconfig 2> /dev/null\n _CURL_INSTALL_REQUIRED=YES\n _bkLibcurlPre=\"/var/backups/legacy-libcurl-pre-${_CURL_VRN}-${_NOW}\"\n mkdir -p ${_bkLibcurlPre}\n mv -f /usr/lib/x86_64-linux-gnu/libcurl.so* ${_bkLibcurlPre}/ &> /dev/null\n mv -f /usr/lib/x86_64-linux-gnu/libcurl.la ${_bkLibcurlPre}/ &> /dev/null\n mv -f /usr/lib/x86_64-linux-gnu/libcurl.a ${_bkLibcurlPre}/ &> /dev/null\n fi\n\n _isCurl=$(curl --version 2>&1)\n if [[ ! \"${_isCurl}\" =~ \"OpenSSL\" ]] \\\n || [[ \"${_isCurl}\" =~ \"libcurl.so.4\" ]] \\\n || [ -z \"${_isCurl}\" ] \\\n || [ \"${_ifAnySymlinksCleaned}\" = \"YES\" ] \\\n || [ \"${_ifAnyFilesCleaned}\" = \"YES\" ] \\\n || [ \"${_CURL_INSTALL_REQUIRED}\" = \"YES\" ]; then\n if [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ]; then\n echo \"OOPS: cURL is broken! Re-installing..\"\n fi\n if [ ! -e \"/etc/apt/apt.conf.d/00sandboxoff\" ] \\\n && [ -e \"/etc/apt/apt.conf.d\" ]; then\n echo \"APT::Sandbox::User \\\"root\\\";\" > /etc/apt/apt.conf.d/00sandboxoff\n fi\n echo \"curl install\" | dpkg --set-selections 2> /dev/null\n _apt_clean_update\n # Check for libssl1.0-dev and remove conditionally\n if dpkg-query -W -f='${Status}' libssl1.0-dev 2>/dev/null | grep -q \"install ok installed\"; then\n apt-get remove libssl1.0-dev -y --purge --auto-remove -qq 2>/dev/null\n fi\n apt-get autoremove -y 2> /dev/null\n apt-get install libssl-dev ${_aptYesUnth} -qq 2> /dev/null\n apt-get build-dep curl ${_aptYesUnth} 2> /dev/null\n if [ ! -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ]; then\n apt-get install curl --reinstall ${_aptYesUnth} -qq 2> /dev/null\n fi\n if [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ]; then\n echo \"INFO: Installing curl from sources...\"\n mkdir -p /var/opt\n rm -rf /var/opt/curl*\n cd /var/opt\n wget ${_wgetGet} http://files.aegir.cc/dev/src/curl-${_CURL_VRN}.tar.gz &> /dev/null\n tar -xzf curl-${_CURL_VRN}.tar.gz &> /dev/null\n if [ -e \"/root/.install.modern.openssl.cnf\" ] \\\n && [ -x \"/usr/local/ssl3/bin/openssl\" ]; then\n _SSL_BINARY=/usr/local/ssl3/bin/openssl\n else\n _SSL_BINARY=/usr/local/ssl/bin/openssl\n fi\n if [ -e \"/usr/local/ssl3/lib64/libssl.so.3\" ]; then\n _SSL_PATH=\"/usr/local/ssl3\"\n _SSL_LIB_PATH=\"${_SSL_PATH}/lib64\"\n else\n _SSL_PATH=\"/usr/local/ssl\"\n _SSL_LIB_PATH=\"${_SSL_PATH}/lib\"\n fi\n _PKG_CONFIG_PATH=\"${_SSL_LIB_PATH}/pkgconfig\"\n\n if [ -e \"${_PKG_CONFIG_PATH}\" ] \\\n && [ -e \"/var/opt/curl-${_CURL_VRN}\" ]; then\n cd /var/opt/curl-${_CURL_VRN}\n LIBS=\"-ldl -lpthread\" PKG_CONFIG_PATH=\"${_PKG_CONFIG_PATH}\" ./configure \\\n --with-openssl \\\n --with-zlib=/usr \\\n --prefix=/usr/local &> /dev/null\n make -j $(nproc) --quiet &> /dev/null\n make --quiet install &> /dev/null\n ldconfig 2> /dev/null\n fi\n fi\n if [ -x \"/usr/local/bin/curl\" ] && [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ]; then\n _CURL_ITD=$(/usr/local/bin/curl --version 2>&1 \\\n | tr -d \"\\n\" \\\n | cut -d\" \" -f2 \\\n | awk '{ print $1}' 2>&1)\n if [[ ! \"${_CURL_ITD}\" =~ OpenSSL ]]; then\n echo \"ERRR: /usr/local/bin/curl is broken\"\n echo \"ERRR: Please install cURL and debug manually\"\n else\n echo \"GOOD: /usr/local/bin/curl works\"\n echo \"curl hold\" | dpkg --set-selections &> /dev/null\n if [ -x \"/usr/local/bin/curl\" ]; then\n if [ -x \"/usr/bin/curl\" ] && [ ! -L \"/usr/bin/curl\" ]; then\n mv -f /usr/bin/curl /usr/bin/old-curl-$(date +%y%m%d-%H%M%S)\n fi\n ln -sfn /usr/local/bin/curl /usr/bin/curl\n fi\n if [ ! -e \"${_SSL_PATH}/certs/ca-certificates.crt\" ]; then\n cp -af /etc/ssl/certs/* ${_SSL_PATH}/certs/ &> /dev/null\n fi\n if [ -e \"/usr/local/lib/libcurl.so.4.8.0\" ]; then\n ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/libcurl.so\n ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/libcurl.so.4\n ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/libcurl.so.4.8.0\n ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/x86_64-linux-gnu/libcurl.so\n ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/x86_64-linux-gnu/libcurl.so.4\n ln -sfn /usr/local/lib/libcurl.so.4.8.0 /usr/lib/x86_64-linux-gnu/libcurl.so.4.8.0\n fi\n if [ -e \"/usr/local/lib/libcurl.a\" ]; then\n ln -sfn /usr/local/lib/libcurl.a /usr/lib/x86_64-linux-gnu/libcurl.a\n ln -sfn /usr/local/lib/libcurl.a /usr/lib/libcurl.a\n fi\n if [ -e \"/usr/local/lib/libcurl.la\" ]; then\n ln -sfn /usr/local/lib/libcurl.la /usr/lib/x86_64-linux-gnu/libcurl.la\n ln -sfn /usr/local/lib/libcurl.la /usr/lib/libcurl.la\n fi\n ldconfig 2> /dev/null\n if [ -e \"/usr/local/include/curl/curl.h\" ] \\\n && [ -e \"/usr/local/include/curl/easy.h\" ] \\\n && [ -d \"/usr/include/x86_64-linux-gnu/curl\" ] \\\n && [ ! -L \"/usr/include/x86_64-linux-gnu/curl\" ]; then\n _apt_clean_update\n if dpkg-query -W -f='${Status}' libcurl4-openssl-dev 2>/dev/null | grep -q \"install ok installed\"; then\n apt-get remove libcurl4-openssl-dev -y --purge --auto-remove -qq 2> /dev/null\n fi\n ln -sfn /usr/local/include/curl /usr/include/x86_64-linux-gnu/curl\n ldconfig 2> /dev/null\n fi\n fi\n fi\n fi\n}\n\n_if_boa_key_tools_update_allowed() {\n if [ -e \"/root/.run-to-excalibur.cnf\" ] \\\n || [ -e \"/root/.run-to-daedalus.cnf\" ] \\\n || [ -e \"/root/.run-to-chimaera.cnf\" ] \\\n || [ -e \"/root/.run-to-beowulf.cnf\" ]; then\n _BOA_KEY_TOOLS_UPDATE_ALLOWED=NO\n else\n _BOA_KEY_TOOLS_UPDATE_ALLOWED=YES\n fi\n}\n\n_update_boa_tools() {\n mkdir -p ${_usrBin}\n if [ -e \"${_pthLog}\" ] && [ ! -e \"${_pthLog}/updateFx30.ctrl.${_tRee}.${_xSrl}.pid\" ]; then\n _fxPp=\"fix-drupal-platform-permissions.sh\"\n _fxSp=\"fix-drupal-site-permissions.sh\"\n _fxPo=\"fix-drupal-platform-ownership.sh\"\n _fxSo=\"fix-drupal-site-ownership.sh\"\n _fxLo=\"lock-local-drush-permissions.sh\"\n curl ${_crlGet} \"${_urlHmr}/${_tBn}/${_fxPp}\" -o ${_usrBin}/${_fxPp}\n curl ${_crlGet} \"${_urlHmr}/${_tBn}/${_fxSp}\" -o ${_usrBin}/${_fxSp}\n curl ${_crlGet} \"${_urlHmr}/${_tBn}/${_fxPo}\" -o ${_usrBin}/${_fxPo}\n curl ${_crlGet} \"${_urlHmr}/${_tBn}/${_fxSo}\" -o ${_usrBin}/${_fxSo}\n curl ${_crlGet} \"${_urlHmr}/${_tBn}/${_fxLo}\" -o ${_usrBin}/${_fxLo}\n chmod 700 ${_usrBin}/${_fxPp}\n chmod 700 ${_usrBin}/${_fxSp}\n chmod 700 ${_usrBin}/${_fxPo}\n chmod 700 ${_usrBin}/${_fxSo}\n chmod 700 ${_usrBin}/${_fxLo}\n touch ${_pthLog}/updateFx30.ctrl.${_tRee}.${_xSrl}.pid\n fi\n mkdir -p ${_optBin}\n _boaBins=\"aptcleanup \\\n aptfast \\\n autobeowulf \\\n autochimaera \\\n autodaedalus \\\n autoexcalibur \\\n autoinit \\\n automini \\\n autosymlink \\\n autoupboa \\\n backboa \\\n backchain \\\n barracuda \\\n boa \\\n codebasecheck \\\n copydbackup \\\n dcysetup \\\n dhcpfix \\\n duobackboa \\\n fancynow \\\n ffdevuan \\\n ffmirror \\\n fixmounts \\\n fixrepo \\\n killer \\\n loadguard \\\n lock.inc \\\n memorytuner \\\n mergecsf \\\n multiback \\\n mybackup \\\n mycnfup \\\n mysqltuner5 \\\n mysqltuner8 \\\n octopus \\\n perftest \\\n randpass \\\n renameaegirhost \\\n screenfetch \\\n setprio \\\n smtpgapps \\\n sqlclean \\\n sqlmagic \\\n syncpass \\\n synproxy \\\n synproxy_hook_fix \\\n synproxy_monitor \\\n synproxy_reassert \\\n synproxy_rollback \\\n synproxy_snapshot \\\n synproxy_status \\\n thinkdifferent \\\n updatesymlinks \\\n verifyvhostsdns \\\n vhostcheck \\\n vmnetfix \\\n weblogx \\\n webserver \\\n websh \\\n xboa \\\n xcopy\"\n for _cbn in ${_boaBins}; do\n if [ -e \"${_optBin}/${_cbn}\" ]; then\n _CNT=$(pgrep -fc /local/bin/${_cbn})\n if (( _CNT > 0 )); then\n echo \"The ${_cbn} is running!\"\n else\n _CNT=$(pgrep -fc /var/xdrago/daily.sh)\n if [ \"${_cbn}\" = \"weblogx\" ] && (( _CNT > 0 )); then\n echo \"The ${_cbn} and daily.sh is running!\"\n else\n rm -f ${_optBin}/${_cbn}.new\n if [ \"${_cbn}\" = \"mysqltuner5\" ] || [ \"${_cbn}\" = \"mysqltuner8\" ]; then\n curl ${_crlGet} \"${_urlHmr}/helpers/${_cbn}\" -o ${_optBin}/${_cbn}.new\n else\n curl ${_crlGet} \"${_urlHmr}/${_tBn}/${_cbn}\" -o ${_optBin}/${_cbn}.new\n fi\n mv -f ${_optBin}/${_cbn} ${_optBin}/${_cbn}.prev\n mv -f ${_optBin}/${_cbn}.new ${_optBin}/${_cbn}\n if [ -e \"${_optBin}/${_cbn}\" ]; then\n chmod 755 ${_optBin}/${_cbn}\n rm -f ${_optBin}/${_cbn}.prev\n else\n mv -f ${_optBin}/${_cbn}.prev ${_optBin}/${_cbn}\n fi\n fi\n fi\n else\n if [ \"${_cbn}\" = \"mysqltuner5\" ] || [ \"${_cbn}\" = \"mysqltuner8\" ]; then\n curl ${_crlGet} \"${_urlHmr}/helpers/${_cbn}\" -o ${_optBin}/${_cbn}\n else\n curl ${_crlGet} \"${_urlHmr}/${_tBn}/${_cbn}\" -o ${_optBin}/${_cbn}\n fi\n fi\n done\n\n if [ -e \"${_optBin}/fixmounts\" ] && [ ! -e \"${_usrBin}/fixmounts\" ]; then\n rm -f ${_usrBin}/{aptcleanup*,autoinit*,automini*,backchain*,barracuda*,boa*,dhcpfix*,ffdevuan*,ffmirror*,fixmounts*}\n rm -f ${_usrBin}/{aptfast*,killer*,loadguard*,perftest*,octopus*,screenfetch*,vmnetfix*,webserver*,websh*}\n ln -sfn ${_optBin}/aptcleanup ${_usrBin}/aptcleanup\n ln -sfn ${_optBin}/autoinit ${_usrBin}/autoinit\n ln -sfn ${_optBin}/automini ${_usrBin}/automini\n ln -sfn ${_optBin}/backchain ${_usrBin}/backchain\n ln -sfn ${_optBin}/barracuda ${_usrBin}/barracuda\n ln -sfn ${_optBin}/boa ${_usrBin}/boa\n ln -sfn ${_optBin}/dhcpfix ${_usrBin}/dhcpfix\n ln -sfn ${_optBin}/ffdevuan ${_usrBin}/ffdevuan\n ln -sfn ${_optBin}/ffmirror ${_usrBin}/ffmirror\n ln -sfn ${_optBin}/fixmounts ${_usrBin}/fixmounts\n ln -sfn ${_optBin}/killer ${_usrBin}/killer\n ln -sfn ${_optBin}/loadguard ${_usrBin}/loadguard\n ln -sfn ${_optBin}/octopus ${_usrBin}/octopus\n ln -sfn ${_optBin}/perftest ${_usrBin}/perftest\n ln -sfn ${_optBin}/screenfetch ${_usrBin}/screenfetch\n ln -sfn ${_optBin}/vmnetfix ${_usrBin}/vmnetfix\n ln -sfn ${_optBin}/webserver ${_usrBin}/webserver\n ln -sfn ${_optBin}/websh ${_usrBin}/websh\n fi\n\n if [ -e \"/data/u\" ]; then\n if [ ! -e \"${_usrBin}/dcysetup\" ] && [ -e \"${_optBin}/dcysetup\" ]; then\n ln -sfn ${_optBin}/dcysetup ${_usrBin}/dcysetup\n fi\n if [ ! -e \"${_usrBin}/multiback\" ] && [ -e \"${_optBin}/multiback\" ]; then\n ln -sfn ${_optBin}/multiback ${_usrBin}/multiback\n fi\n if [ ! -e \"${_usrBin}/mybackup\" ] && [ -e \"${_optBin}/mybackup\" ]; then\n ln -sfn ${_optBin}/mybackup ${_usrBin}/mybackup\n fi\n fi\n\n echo \"=== BOA executables permissions setup ===\"\n echo \"Last updated: $(date)\"\n echo \"Groups are organized by function.\"\n\n # _AUTO (700): automatic install/upgrade helpers\n chmod 700 ${_optBin}/{autobeowulf,autochimaera,autodaedalus,autoexcalibur,autoinit,automini,autoupboa}\n\n # _BACKUP (700): backup helpers\n chmod 700 ${_optBin}/{backboa,copydbackup,dcysetup,duobackboa,multiback}\n\n # _CORE (700): core BOA tools\n chmod 700 ${_optBin}/{barracuda,boa,ffdevuan,ffmirror,killer,octopus,webserver}\n chmod 700 ${_optBin}/{loadguard,lock.inc,renameaegirhost,syncpass,weblogx,xboa,xcopy}\n\n # _DB (700): performance and DB tuners\n chmod 700 ${_optBin}/{memorytuner,mycnfup,mysqltuner5,mysqltuner8,perftest}\n\n # _MAIL (700): mail + priority tools\n chmod 700 ${_optBin}/{setprio,smtpgapps}\n\n # _NET (700): network protection\n chmod 700 ${_optBin}/synproxy*\n\n # _SYS (700): system utilities\n chmod 700 ${_optBin}/{aptfast,codebasecheck,dhcpfix,fancynow,fixmounts,fixrepo,mergecsf,screenfetch,vmnetfix}\n\n # _SYS (700): cleanup tools\n chmod 700 ${_optBin}/{aptcleanup,autosymlink,sqlclean,updatesymlinks,verifyvhostsdns,vhostcheck}\n\n # _MISC (755): misc user-space utilities\n chmod 755 ${_optBin}/{backchain,mybackup,randpass,sqlmagic,thinkdifferent,websh}\n\n echo \"Permissions applied successfully\"\n echo \"=== End of BOA executables permissions setup ===\"\n\n}\n\n# Ensure /usr/sbin/ipset and /sbin/ipset both resolve to the actual ipset binary.\n_ensure_ipset_symlinks() {\n _IPSET_REAL=\"$(command -v ipset 2>/dev/null || true)\"\n if [ -z \"${_IPSET_REAL}\" ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"ipset not installed; skipping symlink fixes\"\n fi\n return 0\n fi\n\n # Resolve through any intermediate symlinks.\n if [ -L \"${_IPSET_REAL}\" ]; then\n _IPSET_REAL=\"$(readlink -f \"${_IPSET_REAL}\")\"\n fi\n\n for _CAND in /usr/sbin/ipset /sbin/ipset; do\n _PARENT=\"$(dirname \"${_CAND}\")\"\n [ -d \"${_PARENT}\" ] || mkdir -p \"${_PARENT}\"\n\n # If the candidate *is* the real file, nothing to do.\n if [ \"${_CAND}\" = \"${_IPSET_REAL}\" ]; then\n continue\n fi\n\n # If it exists, check whether it already resolves to the right target.\n if [ -e \"${_CAND}\" ] || [ -L \"${_CAND}\" ]; then\n _TARGET=\"$(readlink -f \"${_CAND}\" 2>/dev/null || true)\"\n if [ \"${_TARGET}\" = \"${_IPSET_REAL}\" ]; then\n continue\n fi\n fi\n\n ln -sfn \"${_IPSET_REAL}\" \"${_CAND}\"\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"Linked ${_CAND} -> ${_IPSET_REAL}\"\n fi\n done\n}\n\n_if_update_boa_key_tools_only() {\n\n _check_dns_settings\n _if_reinstall_curl\n\n _CURL_TEST=$(curl -L -k -s \\\n --max-redirs 10 \\\n --retry 3 \\\n --retry-delay 10 \\\n -I \"http://${_USE_MIR}\" 2> /dev/null)\n if [[ ! \"${_CURL_TEST}\" =~ \"200 OK\" ]]; then\n if [[ \"${_CURL_TEST}\" =~ \"unknown option was passed in to libcurl\" ]]; then\n echo \"ERROR: cURL libs are out of sync! Re-installing..\"\n _if_reinstall_curl\n fi\n echo \"ERROR: ${_USE_MIR} is not available, please try later\"\n exit 1\n else\n _urlHmr=\"http://${_USE_MIR}/versions/${_tRee}/boa/aegir\"\n fi\n _LSB_TEST=\"$(which lsb_release)\"\n if [ ! -x \"${_LSB_TEST}\" ]; then\n if [ ! -e \"/etc/apt/apt.conf.d/00sandboxoff\" ] \\\n && [ -e \"/etc/apt/apt.conf.d\" ]; then\n echo \"APT::Sandbox::User \\\"root\\\";\" > /etc/apt/apt.conf.d/00sandboxoff\n fi\n _apt_clean_update\n apt-get install lsb-release ${_aptYesUnth} &> /dev/null\n fi\n _IPSET_TEST=\"$(which ipset)\"\n if [ ! -x \"${_IPSET_TEST}\" ]; then\n if [ ! -e \"/etc/apt/apt.conf.d/00sandboxoff\" ] \\\n && [ -e \"/etc/apt/apt.conf.d\" ]; then\n echo \"APT::Sandbox::User \\\"root\\\";\" > /etc/apt/apt.conf.d/00sandboxoff\n fi\n _apt_clean_update\n if [ -L \"/sbin/ipset\" ]; then\n rm -f /sbin/ipset\n fi\n if [ -L \"/usr/sbin/ipset\" ]; then\n rm -f /usr/sbin/ipset\n fi\n apt-get install ipset ${_aptYesUnth} &> /dev/null\n fi\n\n _ensure_ipset_symlinks\n\n if [ -x \"/usr/sbin/csf\" ] \\\n && [ -e \"/etc/csf/csf.deny\" ] \\\n && [ ! -x \"/etc/csf/csfpost.sh\" ]; then\n echo \"\" > /etc/csf/csfpost.sh\n echo \"iptables -t raw -A PREROUTING -p tcp --dport 21 -j CT --helper ftp\" >> /etc/csf/csfpost.sh\n echo \"iptables -t raw -A OUTPUT -p tcp --dport 21 -j CT --helper ftp\" >> /etc/csf/csfpost.sh\n chmod 700 /etc/csf/csfpost.sh\n _CSF_TEST=\"$(which csf)\"\n if [ -x \"${_CSF_TEST}\" ]; then\n service clean-boa-env start &> /dev/null\n _if_fix_iptables_symlinks\n ### csf -uf\n ### wait\n _NFTABLES_TEST=$(iptables -V)\n if [[ \"${_NFTABLES_TEST}\" =~ \"nf_tables\" ]]; then\n if [ -e \"/usr/sbin/iptables-legacy\" ]; then\n update-alternatives --set iptables /usr/sbin/iptables-legacy &> /dev/null\n fi\n if [ -e \"/usr/sbin/ip6tables-legacy\" ]; then\n update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy &> /dev/null\n fi\n if [ -e \"/usr/sbin/arptables-legacy\" ]; then\n update-alternatives --set arptables /usr/sbin/arptables-legacy &> /dev/null\n fi\n if [ -e \"/usr/sbin/ebtables-legacy\" ]; then\n update-alternatives --set ebtables /usr/sbin/ebtables-legacy &> /dev/null\n fi\n fi\n sed -i \"s/.*DHCP.*//g\" /etc/csf/csf.allow\n wait\n sed -i \"/^$/d\" /etc/csf/csf.allow\n if [ -e \"/var/log/daemon.log\" ]; then\n _DHCP_LOG=\"/var/log/daemon.log\"\n else\n _DHCP_LOG=\"/var/log/syslog\"\n fi\n grep DHCPREQUEST \"${_DHCP_LOG}\" | awk '{print $12}' | sort -u | while read -r _IP; do\n if [[ ${_IP} =~ ^([0-9]{1,3}\\.){3}[0-9]{1,3}$ ]]; then\n IFS='.' read -r oct1 oct2 oct3 oct4 <<< \"${_IP}\"\n if (( oct1 <= 255 && oct2 <= 255 && oct3 <= 255 && oct4 <= 255 )); then\n echo \"udp|out|d=67|d=${_IP} # Local DHCP out\" >> /etc/csf/csf.allow\n fi\n fi\n done\n if [ -e \"/etc/csf/csfpost.d/synproxy.sh\" ]; then\n csf -ra &> /dev/null\n synproxy_reassert -p \"443 80\" --no-quic -q &> /dev/null\n else\n csf -r &> /dev/null\n fi\n ### Linux kernel TCP SACK CVEs mitigation\n ### CVE-2019-11477 SACK Panic\n ### CVE-2019-11478 SACK Slowness\n ### CVE-2019-11479 Excess Resource Consumption Due to Low MSS Values\n if [ -x \"/usr/sbin/csf\" ] && [ -e \"/etc/csf/csf.deny\" ]; then\n _SACK_TEST=$(ip6tables --list | grep tcpmss)\n if [[ ! \"${_SACK_TEST}\" =~ \"tcpmss\" ]]; then\n sysctl net.ipv4.tcp_mtu_probing=0 &> /dev/null\n iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null\n ip6tables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null\n [ -e \"/etc/csf/csfpost.d/synproxy.sh\" ] && synproxy_reassert -p \"443 80\" --no-quic -q &> /dev/null\n fi\n fi\n fi\n fi\n if [ -x \"/usr/sbin/csf\" ] && [ -e \"/etc/csf/csf.conf\" ]; then\n _CC_SRC_TEST=$(grep 'CC_SRC\\ =' /etc/csf/csf.conf 2>&1)\n ### echo _CC_SRC_TEST 1 is \"${_CC_SRC_TEST}\"\n if [[ ! ${_CC_SRC_TEST} =~ CC_SRC\\ =\\ \\\"2\\\" ]]; then\n echo _CC_SRC_TEST 2 is \"${_CC_SRC_TEST}\"\n service clean-boa-env start &> /dev/null\n _if_fix_iptables_symlinks\n ### csf -uf\n ### wait\n _NFTABLES_TEST=$(iptables -V)\n if [[ \"${_NFTABLES_TEST}\" =~ \"nf_tables\" ]]; then\n if [ -e \"/usr/sbin/iptables-legacy\" ]; then\n update-alternatives --set iptables /usr/sbin/iptables-legacy &> /dev/null\n fi\n if [ -e \"/usr/sbin/ip6tables-legacy\" ]; then\n update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy &> /dev/null\n fi\n if [ -e \"/usr/sbin/arptables-legacy\" ]; then\n update-alternatives --set arptables /usr/sbin/arptables-legacy &> /dev/null\n fi\n if [ -e \"/usr/sbin/ebtables-legacy\" ]; then\n update-alternatives --set ebtables /usr/sbin/ebtables-legacy &> /dev/null\n fi\n fi\n sed -i \"s/^CC_SRC .*/CC_SRC = \\\"2\\\"/g\" /etc/csf/csf.conf\n wait\n sed -i \"s/^AUTO_UPDATES .*/AUTO_UPDATES = \\\"0\\\"/g\" /etc/csf/csf.conf\n if [ -e \"/etc/csf/csfpost.d/synproxy.sh\" ]; then\n csf -ra &> /dev/null\n synproxy_reassert -p \"443 80\" --no-quic -q &> /dev/null\n else\n csf -r &> /dev/null\n fi\n fi\n fi\n _BOA_TOOLS_UPDATE=NO\n if [ -e \"${_pthLog}\" ]; then\n if [ ! -x \"/opt/local/bin/xcopy\" ] \\\n || [ ! -e \"${_boaToolsPid}\" ]; then\n _BOA_TOOLS_UPDATE=YES\n fi\n fi\n [ ! -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] && _BOA_TOOLS_UPDATE=YES\n if [ \"${_BOA_TOOLS_UPDATE}\" = \"YES\" ]; then\n _update_boa_tools\n [ -e \"${_pthLog}\" ] && rm -f ${_pthLog}/updateBOAtools*.pid\n [ -e \"${_pthLog}\" ] && touch ${_boaToolsPid}\n if [ \"${1}\" = \"verbose\" ] || [ -z \"${1}\" ]; then\n echo\n echo \"BOA Meta Installers setup completed\"\n echo \"Please check INSTALL.md and UPGRADE.md at https://github.com/omega8cc/boa\"\n echo \"Bye\"\n echo\n fi\n fi\n}\n\n_boa_setup() {\n _BENG_VS=NO\n _VMFAMILY=NO\n _RANDOMIZE=NO\n _VM_TEST=\"$(uname -a)\"\n if [[ \"${_VM_TEST}\" =~ \"-beng\" ]]; then\n _BENG_VS=YES\n _RANDOMIZE=YES\n fi\n _if_hosted_sys\n if [ \"${_hostedSys}\" = \"YES\" ]; then\n _VMFAMILY=HOSTED\n fi\n\n _check_dns_settings\n\n if [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ]; then\n [ -d /run/unbound ] || mkdir -p /run/unbound\n [ -d /run/unbound ] && chown -R unbound:unbound /run/unbound\n fi\n\n if [ ! -e \"/etc/apt/apt.conf.d/00sandboxoff\" ] \\\n && [ -e \"/etc/apt/apt.conf.d\" ]; then\n echo \"APT::Sandbox::User \\\"root\\\";\" > /etc/apt/apt.conf.d/00sandboxoff\n fi\n\n _APT_CONFIG_FILE=\"/etc/apt/apt.conf.d/99ignorestrict\"\n\n # Desired configuration content\n _DESIRED_APT_CONFIG='Acquire::AllowInsecureRepositories \"true\";\n APT::Get::AllowUnauthenticated \"true\";\n Aptitude::CmdLine::Fix-Broken \"true\";'\n\n # Remove leading whitespace from each line\n _CLEANED_DESIRED_APT_CONFIG=$(echo \"${_DESIRED_APT_CONFIG}\" | sed 's/^[[:space:]]\\+//')\n\n # Normalize the existing file content\n if [[ -f \"${_APT_CONFIG_FILE}\" ]]; then\n _CURRENT_APT_CONFIG=$(tr -d '[:space:]' < \"${_APT_CONFIG_FILE}\")\n else\n _CURRENT_APT_CONFIG=\"\"\n fi\n\n # Normalize the cleaned desired configuration content\n _NORMALIZED_DESIRED_APT_CONFIG=$(echo \"${_CLEANED_DESIRED_APT_CONFIG}\" | tr -d '[:space:]')\n\n # Compare normalized contents and update if necessary\n if [[ \"${_CURRENT_APT_CONFIG}\" != \"${_NORMALIZED_DESIRED_APT_CONFIG}\" ]]; then\n echo \"${_CLEANED_DESIRED_APT_CONFIG}\" | tee \"${_APT_CONFIG_FILE}\" > /dev/null\n fi\n\n if [ ! -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] && [ ! -e \"/var/xdrago/manage_solr_config.sh\" ]; then\n# apt-get remove unscd -y --purge --auto-remove -qq &> /dev/null\n# apt-get remove dbus -y --purge --auto-remove -qq &> /dev/null\n# if [ -e \"/usr/share/dbus-1\" ]; then\n# rm -f /usr/share/dbus-1/*/*freedesktop*\n# fi\n userdel -r debian &> /dev/null\n sed -i \"s/^#startup_message off/startup_message off/g\" /etc/screenrc &> /dev/null\n fi\n\n _isScreen=$(screen --version 2>&1)\n if [[ ! \"${_isScreen}\" =~ \"GNU\" ]] || [ -z \"${_isScreen}\" ]; then\n apt-get install screen -y &> /dev/null\n apt-get install net-tools -y &> /dev/null\n apt-get install hostname -y &> /dev/null\n apt-get install ntpsec-ntpdate -y &> /dev/null\n fi\n\n _if_reinstall_curl\n\n _CURL_TEST=$(curl -L -k -s \\\n --max-redirs 10 \\\n --retry 3 \\\n --retry-delay 10 \\\n -I \"http://${_USE_MIR}\" 2> /dev/null)\n if [[ ! \"${_CURL_TEST}\" =~ \"200 OK\" ]]; then\n if [[ \"${_CURL_TEST}\" =~ \"unknown option was passed in to libcurl\" ]]; then\n echo \"ERROR: cURL libs are out of sync! Re-installing..\"\n _if_reinstall_curl\n fi\n echo \"ERROR: ${_USE_MIR} is not available, please try later\"\n exit 1\n else\n _urlHmr=\"http://${_USE_MIR}/versions/${_tRee}/boa/aegir\"\n fi\n\n _if_clean_boa_env\n\n _LSB_TEST=\"$(which lsb_release)\"\n if [ ! -x \"${_LSB_TEST}\" ]; then\n if [ ! -e \"/etc/apt/apt.conf.d/00sandboxoff\" ] \\\n && [ -e \"/etc/apt/apt.conf.d\" ]; then\n echo \"APT::Sandbox::User \\\"root\\\";\" > /etc/apt/apt.conf.d/00sandboxoff\n fi\n _apt_clean_update\n apt-get install lsb-release ${_aptYesUnth}\n fi\n\n ### Fix or install VM system detection\n _check_virt\n\n _BOA_TOOLS_UPDATE=NO\n if [ -e \"${_pthLog}\" ] && [ ! -e \"${_boaToolsPid}\" ]; then\n _BOA_TOOLS_UPDATE=YES\n fi\n [ ! -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] && _BOA_TOOLS_UPDATE=YES\n if [ \"${_BOA_TOOLS_UPDATE}\" = \"YES\" ]; then\n _update_boa_tools\n [ -e \"${_pthLog}\" ] && rm -f ${_pthLog}/updateBOAtools*.pid\n [ -e \"${_pthLog}\" ] && touch ${_boaToolsPid}\n echo\n echo \"BOA Meta Installers setup completed\"\n echo \"Please check INSTALL.md and UPGRADE.md at https://github.com/omega8cc/boa\"\n echo \"Bye\"\n echo\n fi\n}\n\n_count_cpu() {\n _CPU_INFO=\"$(grep -c processor /proc/cpuinfo)\"\n _CPU_INFO=${_CPU_INFO//[^0-9]/}\n _NPROC_TEST=\"$(which nproc)\"\n if [ -z \"${_NPROC_TEST}\" ]; then\n _CPU_NR=\"${_CPU_INFO}\"\n else\n _CPU_NR=$(nproc 2>&1)\n fi\n _CPU_NR=${_CPU_NR//[^0-9]/}\n if [ ! -z \"${_CPU_NR}\" ] \\\n && [ ! -z \"${_CPU_INFO}\" ] \\\n && [ \"${_CPU_NR}\" -gt \"${_CPU_INFO}\" ] \\\n && [ \"${_CPU_INFO}\" -gt 0 ]; then\n _CPU_NR=\"${_CPU_INFO}\"\n fi\n if [ -z \"${_CPU_NR}\" ] || [ \"${_CPU_NR}\" -lt 1 ]; then\n _CPU_NR=1\n fi\n mkdir -p /data/all\n chmod 755 /data/all\n echo ${_CPU_NR} > /data/all/cpuinfo\n chmod 644 /data/all/cpuinfo\n}\n\n_sysctl_update() {\n if [ ! -e \"/root/.no.sysctl.update.cnf\" ] \\\n && [ ! -e \"/var/backups/.sysctl.conf.mod-disable-ipv6-${_xSrl}.log\" ]; then\n [ -d \"/var/backups\" ] || mkdir -p /var/backups\n cd /var/backups\n rm -f /var/backups/sysctl.conf\n curl ${_crlGet} \"${_urlHmr}/conf/var/sysctl.conf\" -o sysctl.conf\n if [ -e \"/var/backups/sysctl.conf\" ]; then\n cp -af /var/backups/sysctl.conf /etc/sysctl.conf\n fi\n if [ -e \"/etc/security/limits.conf\" ]; then\n _IF_NF=$(grep '2097152' /etc/security/limits.conf 2>&1)\n if [ ! -z \"${_IF_NF}\" ]; then\n sed -i \"s/.*2097152.*//g\" /etc/security/limits.conf\n wait\n fi\n _IF_NF=$(grep '524288' /etc/security/limits.conf 2>&1)\n if [ -z \"${_IF_NF}\" ]; then\n echo \"* hard nofile 524288\" >> /etc/security/limits.conf\n echo \"* soft nofile 524288\" >> /etc/security/limits.conf\n echo \"root hard nofile 1048576\" >> /etc/security/limits.conf\n echo \"root soft nofile 1048576\" >> /etc/security/limits.conf\n fi\n _IF_NF=$(grep '65556' /etc/security/limits.conf 2>&1)\n if [ -z \"${_IF_NF}\" ]; then\n echo \"* hard nproc 65556\" >> /etc/security/limits.conf\n echo \"* soft nproc 65556\" >> /etc/security/limits.conf\n fi\n fi\n if [ -e \"/boot/grub/grub.cfg\" ] || [ -e \"/boot/grub/menu.lst\" ]; then\n #echo never > /sys/kernel/mm/transparent_hugepage/enabled\n if [ -e \"/etc/sysctl.conf\" ]; then\n sysctl -p /etc/sysctl.conf &> /dev/null\n fi\n else\n if [ -e \"/etc/sysctl.conf\" ]; then\n sysctl -p /etc/sysctl.conf &> /dev/null\n fi\n fi\n if [ -e \"/etc/default/nginx\" ]; then\n _IF_ULNX=$(grep '524288' /etc/default/nginx 2>&1)\n if [ -z \"${_IF_ULNX}\" ]; then\n sed -i \"s/^ULIMIT=.*//gi\" /etc/default/nginx\n wait\n echo ULIMIT=\\\"-n 524288\\\" >> /etc/default/nginx\n ulimit -n 524288 &> /dev/null\n service nginx restart &> /dev/null\n fi\n fi\n if [ -e \"/etc/security/limits.d\" ] \\\n && [ ! -e \"/etc/security/limits.d/solr9.conf\" ]; then\n echo \"sshd soft nofile 524288\" > /etc/security/limits.d/sshd.conf\n echo \"sshd hard nofile 999999\" >> /etc/security/limits.d/sshd.conf\n echo \"redis soft nofile 65535\" > /etc/security/limits.d/redis.conf\n echo \"redis hard nofile 524288\" >> /etc/security/limits.d/redis.conf\n echo \"nginx soft nofile 524288\" > /etc/security/limits.d/nginx.conf\n echo \"nginx hard nofile 999999\" >> /etc/security/limits.d/nginx.conf\n echo \"jetty9 soft nofile 65535\" > /etc/security/limits.d/jetty9.conf\n echo \"jetty9 hard nofile 524288\" >> /etc/security/limits.d/jetty9.conf\n echo \"solr7 soft nofile 65535\" > /etc/security/limits.d/solr7.conf\n echo \"solr7 hard nofile 524288\" >> /etc/security/limits.d/solr7.conf\n echo \"solr9 soft nofile 65535\" > /etc/security/limits.d/solr9.conf\n echo \"solr9 hard nofile 524288\" >> /etc/security/limits.d/solr9.conf\n echo \"@www-data soft nofile 65535\" > /etc/security/limits.d/www.conf\n echo \"@www-data hard nofile 524288\" >> /etc/security/limits.d/www.conf\n if [ -e \"/etc/init.d/valkey-server\" ]; then\n service valkey-server restart &> /dev/null\n elif [ -e \"/etc/init.d/redis-server\" ]; then\n service redis-server restart &> /dev/null\n fi\n service nginx restart &> /dev/null\n service ssh restart &> /dev/null\n _PHP_V=\"85 84 83 82 81 80 74 73 72 71 70 56\"\n for e in ${_PHP_V}; do\n if [ -e \"/etc/init.d/php${e}-fpm\" ]; then\n service \"php${e}-fpm\" reload &> /dev/null\n fi\n done\n fi\n touch /var/backups/.sysctl.conf.mod-disable-ipv6-${_xSrl}.log\n fi\n}\n\n###\n### Load + normalize _INCIDENT_REPORT\n###\n### Legacy values:\n### NO becomes OFF (see below)\n### YES becomes MINI (see below)\n###\n### Current values:\n### OFF == Total silence, no email alerts\n### ALL == Very noisy, good for debugging\n### MINI == Only the most important alerts (default)\n### CRIT == Only critical if _lvl=ALERT\n###\n_normalize_incident_report() {\n : \"${_INCIDENT_REPORT:=MINI}\"\n _INCIDENT_REPORT=\"${_INCIDENT_REPORT^^}\"\n _INCIDENT_REPORT=\"${_INCIDENT_REPORT//[^A-Z]/}\"\n ###\n ### Map legacy + validate\n ###\n case \"${_INCIDENT_REPORT}\" in\n NO) _INCIDENT_REPORT=\"OFF\" ;;\n YES) _INCIDENT_REPORT=\"MINI\" ;;\n OFF|ALL|MINI|CRIT) : ;;\n *) _INCIDENT_REPORT=\"MINI\" ;;\n esac\n}\n\n# Function to notify about still running backup\n_backup_waiting_notify() {\n _hName=\"$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\n _templog=\"${_bLogB}\"\n cat /root/.remote_backups/schedule/backup_schedule.txt > ${_templog}\n ps axf | grep multiback >> ${_templog}\n ps axf | grep duplicity >> ${_templog}\n ls -la /tmp/duplicity-*-tempdir >> ${_templog}\n tree /root/.cache/duplicity >> ${_templog}\n ls -laR /root/.cache/duplicity >> ${_templog}\n grep \"Out of memory: Killed process.*duplicity\" /var/log/iptables.log >> ${_templog}\n boa info >> ${_templog}\n if [ -n \"${_MY_EMAIL}\" ] && [ \"${_INCIDENT_REPORT}\" != \"OFF\" ]; then\n s-nail -s \"Multiback Waiting Report for [${_hName}] on $(date)\" ${_MY_EMAIL} < ${_templog}\n fi\n}\n\n# Load kTLS module only if it is not already loaded.\n_load_ktls_module() {\n if ! lsmod 2>/dev/null | awk '{print $1}' | grep -qx \"tls\"; then\n if [ -e \"/lib/modules/$(uname -r)/kernel/net/tls/tls.ko\" ] \\\n || modinfo tls >/dev/null 2>&1; then\n modprobe -q tls >/dev/null 2>&1 || true\n grep -qxF \"tls\" /etc/modules 2>/dev/null || printf '%s\\n' \"tls\" >> /etc/modules\n fi\n fi\n}\n\n# Fix CSF config only if Quic HTTP3 support is not enabled yet\n_csf_allow_quic_udp_443() {\n _CSF_CONF=\"/etc/csf/csf.conf\"\n _CSF_CHANGED=\"NO\"\n\n if ! command -v csf >/dev/null 2>&1; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"INFO: csf not found - skipping UDP/443 (QUIC) firewall check\"\n fi\n return 0\n fi\n\n if [ ! -s \"${_CSF_CONF}\" ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"WARN: ${_CSF_CONF} not found or empty - skipping\"\n fi\n return 0\n fi\n\n _csf_add_port_to_list_var() {\n # $1 = VAR (UDP_IN / UDP6_IN), $2 = PORT (443)\n _VAR=\"${1}\"\n _PORT=\"${2}\"\n\n # Extract current value between quotes\n _CUR=\"$(grep -E \"^${_VAR}[[:space:]]*=\" \"${_CSF_CONF}\" 2>/dev/null | head -n1 | sed -E 's/^[^\"]*\"([^\"]*)\".*$/\\1/')\"\n\n # If var not present, do nothing\n if ! grep -q -E \"^${_VAR}[[:space:]]*=\" \"${_CSF_CONF}\" 2>/dev/null; then\n return 0\n fi\n\n # If already present as a whole list item, do nothing\n if echo \",${_CUR},\" | grep -q \",${_PORT},\"; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"INFO: CSF ${_VAR} already includes ${_PORT}\"\n fi\n return 0\n fi\n\n # Append port (handle empty list)\n if [ -n \"${_CUR}\" ]; then\n _NEW=\"${_CUR},${_PORT}\"\n else\n _NEW=\"${_PORT}\"\n fi\n\n # Replace only the FIRST matching line for this var, keep surrounding quotes\n # Make a backup once (csf.conf.bak) if not already present\n if [ ! -e \"${_CSF_CONF}.bak\" ]; then\n cp -af \"${_CSF_CONF}\" \"${_CSF_CONF}.bak\"\n fi\n\n sed -i -E \"0,/^${_VAR}[[:space:]]*=/{s|^(${_VAR}[[:space:]]*=[[:space:]]*\\\").*(\\\".*)|\\1${_NEW}\\2|}\" \"${_CSF_CONF}\"\n\n _CSF_CHANGED=\"YES\"\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"INFO: CSF updated: ${_VAR}=\\\"${_NEW}\\\"\"\n fi\n }\n\n # QUIC needs inbound UDP/443\n _csf_add_port_to_list_var \"UDP_IN\" \"443\"\n\n # If your CSF has separate IPv6 var, update it too\n if grep -q -E '^UDP6_IN[[:space:]]*=' \"${_CSF_CONF}\" 2>/dev/null; then\n _csf_add_port_to_list_var \"UDP6_IN\" \"443\"\n fi\n\n if [ \"${_CSF_CHANGED}\" = \"YES\" ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"INFO: Reloading CSF to apply UDP/443 change\"\n fi\n csf -r >/dev/null 2>&1 || csf -ra >/dev/null 2>&1\n else\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \"INFO: CSF config unchanged\"\n fi\n fi\n\n return 0\n}\n\n###--------------------###\nif [ \"$(id -u)\" -eq 0 ]; then\n\n # Load kTLS module only if it is not already loaded\n _load_ktls_module\n\n # Fix CSF config only if Quic HTTP3 support is not enabled yet\n _csf_allow_quic_udp_443\n\n if ! command -v bc &> /dev/null; then\n apt-get update -qq &> /dev/null\n ${_INITINS} bc &> /dev/null\n fi\n\n if ! command -v curl &> /dev/null; then\n apt-get update -qq &> /dev/null\n ${_INITINS} curl &> /dev/null\n fi\n\n _find_correct_ip\n _find_server_city\n\n [ ! -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] && _locales_check_fix_early\n _os_detection_minimal\n _find_fast_mirror_early\n _verify_boa_keys\n\n ### Prefer Devuan apt sources\n if [ -d \"/var/aegir\" ] && [ ! -e \"/etc/apt/preferences.d/99-prefer-devuan\" ]; then\n if grep -qi 'ID=devuan' /etc/os-release 2>/dev/null; then\n _prefer_devuan_repositories\n fi\n fi\n\n ### Fix VM system detection\n _check_virt\n\n if [ -e \"${_barCnf}\" ]; then\n source ${_barCnf}\n _normalize_incident_report\n fi\n\n ### Notify if multiback backups seem to run for too long\n _DCY=$(pgrep -fc duplicity)\n _MLT=$(pgrep -fc multiback)\n if (( _DCY > 0 )) && (( _MLT > 0 )); then\n _bLogA=\"/var/backups/multiback_waiting_queue.log\"\n _bLogB=\"/var/backups/tmp_multiback_waiting_queue.log\"\n if [ ! -e \"${_bLogA}\" ] && [ ! -e \"${_bLogB}\" ]; then\n _backup_waiting_notify\n fi\n fi\n\n ### Make local OpenSSL new/legacy ssl/certs symlinked to system ssl/certs\n if [ -d \"/var/aegir\" ]; then\n _fix_sync_system_ssl_certs\n fi\n\n ### Fix Solr 4/7/9 conflicting ports\n if [ -d \"/var/aegir\" ]; then\n _fix_start_stop_ports_solr\n fi\n\n ### CVE-2021-44228 Log4j 2 Vulnerability\n ### CVE-2021-45046 Log4j 2 Vulnerability\n ### CVE-2021-45105 Log4j 2 Vulnerability\n _fix_log4j_solr7\n\n ### Linux kernel TCP SACK CVEs mitigation\n ### CVE-2019-11477 SACK Panic\n ### CVE-2019-11478 SACK Slowness\n ### CVE-2019-11479 Excess Resource Consumption Due to Low MSS Values\n if [ -x \"/usr/sbin/csf\" ] && [ -e \"/etc/csf/csf.deny\" ]; then\n _SACK_TEST=$(ip6tables --list | grep tcpmss)\n if [[ ! \"${_SACK_TEST}\" =~ \"tcpmss\" ]]; then\n sysctl net.ipv4.tcp_mtu_probing=0 &> /dev/null\n iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null\n ip6tables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null\n [ -e \"/etc/csf/csfpost.d/synproxy.sh\" ] && synproxy_reassert -p \"443 80\" --no-quic -q &> /dev/null\n fi\n fi\n ### More aggressive mitigation affecting network performance\n # if [ -e \"/proc/sys/net/ipv4/tcp_sack\" ]; then\n # _SACK_TEST=$(cat /proc/sys/net/ipv4/tcp_sack 2>&1)\n # _SACK_TEST=$(echo -n ${_SACK_TEST} | tr -d \"\\n\" 2>&1)\n # if [[ \"${_SACK_TEST}\" =~ \"1\" ]]; then\n # echo \"0\" > /proc/sys/net/ipv4/tcp_sack\n # fi\n # fi\n\n ### Block known attackers IPs\n _CSF_TEST=\"$(which csf)\"\n if [ -x \"${_CSF_TEST}\" ]; then\n _IP_BLOCK=\"47.82.0.0/16 47.79.0.0/16 2.57.121.0/24 2.57.122.0/24 45.148.10.0/24 80.94.92.0/24 92.118.39.0/24 185.177.72.0/24\"\n for _IP in ${_IP_BLOCK}; do\n _FW_TEST=$(csf -g ${_IP} 2>&1)\n if [[ \"${_FW_TEST}\" =~ \"DENY Match:${_IP} Setting\" ]] \\\n && [[ \"${_FW_TEST}\" =~ \"csf.deny: ${_IP}\" ]]; then\n echo \"${_IP} already denied for Brute force SSH/Web Server attacks\"\n else\n csf -d ${_IP} do not delete Brute force SSH/Web Server attacks\n [ -e \"/etc/csf/csfpost.d/synproxy.sh\" ] && synproxy_reassert -p \"443 80\" --no-quic -q &> /dev/null\n fi\n done\n fi\n\n ### Linux kernel CVE-2017-2636 hotfix\n if [ -e \"/etc/modprobe.d\" ] \\\n && [ ! -e \"/etc/modprobe.d/blacklist-n_hdlc.conf\" ]; then\n echo \"install n_hdlc /bin/true\" > /etc/modprobe.d/blacklist-n_hdlc.conf\n rmmod n_hdlc &> /dev/null\n fi\n\n ### Linux kernel CVE-2017-6074 hotfix\n if [ -e \"/etc/modprobe.d\" ] \\\n && [ ! -e \"/etc/modprobe.d/blacklist-dccp-all.conf\" ]; then\n echo \"install dccp /bin/true\" > /etc/modprobe.d/blacklist-dccp-all.conf\n echo \"install dccp_diag /bin/true\" >> /etc/modprobe.d/blacklist-dccp-all.conf\n echo \"install dccp_ipv4 /bin/true\" >> /etc/modprobe.d/blacklist-dccp-all.conf\n echo \"install dccp_ipv6 /bin/true\" >> /etc/modprobe.d/blacklist-dccp-all.conf\n echo \"install dccp_probe /bin/true\" >> /etc/modprobe.d/blacklist-dccp-all.conf\n rmmod dccp &> /dev/null\n rmmod dccp_diag &> /dev/null\n rmmod dccp_ipv4 &> /dev/null\n rmmod dccp_ipv6 &> /dev/null\n rmmod dccp_probe &> /dev/null\n fi\n\n if [ ! -e \"/data/all/cpuinfo\" ]; then\n _count_cpu\n fi\n\n _if_boa_key_tools_update_allowed\n\n if [ \"${_BOA_KEY_TOOLS_UPDATE_ALLOWED}\" = \"YES\" ] \\\n && [ -e \"/opt/etc/fpm/fpm-pool-common.conf\" ] \\\n && [ -e \"/var/xdrago\" ]; then\n if [ ! -z \"${_SKYNET_MODE}\" ] && [ \"${_SKYNET_MODE}\" = \"OFF\" ]; then\n if [ -n \"${SSH_TTY+x}\" ]; then\n echo\n echo \"STATUS: BOA Skynet Agent is Inactive!\"\n echo\n echo \"HINT: Please remove the _SKYNET_MODE=OFF line from\"\n echo \"HINT: ${_barCnf} to enable me again.\"\n echo\n echo \"NOTE: Critically important BOA tools will be still updated\"\n echo\n _if_update_boa_key_tools_only verbose\n exit 0\n else\n _if_update_boa_key_tools_only silent\n exit 0\n fi\n else\n if [ -n \"${SSH_TTY+x}\" ]; then\n echo\n echo \"STATUS: BOA Skynet Agent is Active, OK!\"\n echo\n echo \"HINT: You can add the _SKYNET_MODE=OFF line in\"\n echo \"HINT: ${_barCnf} to disable me, if needed.\"\n echo\n fi\n fi\n else\n if [ -z \"$STY\" ]; then\n _SCREEN_INIT=YES\n fi\n fi\n if [ -d \"/.newrelic\" ]; then\n rm -rf /.newrelic\n fi\n chmod a+w /dev/null\n if [ ! -e \"/dev/fd\" ]; then\n if [ -e \"/proc/self/fd\" ]; then\n rm -rf /dev/fd\n ln -sfn /proc/self/fd /dev/fd\n fi\n fi\n if [ \"${_BOA_KEY_TOOLS_UPDATE_ALLOWED}\" = \"YES\" ]; then\n _boa_setup\n fi\n if [ \"${_BOA_KEY_TOOLS_UPDATE_ALLOWED}\" = \"YES\" ] \\\n && [ -e \"/var/log/barracuda_log.txt\" ]; then\n _fix_sftp_server\n _fix_ping_perms\n _fix_fpm_process_max\n _if_fix_lshell\n _fix_node_in_lshell_access\n # _fix_php_in_lshell_access\n _fix_authorized_keys\n _fix_aio\n _fix_console_print\n _fix_java_symlinks\n _fix_composer_version\n _fix_wkhtml\n _fix_wkhtml_perms\n _fix_eldir\n _if_drupal_patches_update\n _fix_drupal_core_ten\n _fix_drupal_core_eleven\n _fix_pure_ftpd\n _fix_hosting_le\n _fix_newrelic\n _fix_leftovers\n _update_agents\n _sysctl_update\n # _saCoreN=\"SA-CORE-2018-002\"\n # _fix_core_dgd\n # sleep 3\n # _saCoreN=\"SA-CORE-2018-004\"\n # _fix_core_dgd\n # sleep 3\n # _saCoreN=\"SA-CORE-2018-006\"\n # _fix_core_dgd\n # sleep 3\n # _saCoreN=\"SA-CORE-2019-004\"\n # _fix_core_dgd\n # sleep 3\n # _saCoreN=\"3143016-83\"\n # _fix_core_dgd\n fi\n if [ ! -e \"/etc/ssl/private/4096.dhp\" ] && [ -d \"/var/xdrago\" ]; then\n echo \"Generating 4096.dhp -- it may take a very long time...\"\n openssl dhparam -out /etc/ssl/private/4096.dhp 4096 > /dev/null 2>&1 &\n fi\n if [ -e \"/etc/ssl/private/4096.dhp\" ]; then\n chown -R root:ssl-cert /etc/ssl/private\n chmod 640 /etc/ssl/private/*\n chmod 710 /etc/ssl/private\n fi\n if [ ! -e \"/root/.upstart.cnf\" ]; then\n service cron reload &> /dev/null\n fi\n if [ \"${_SCREEN_INIT}\" = \"YES\" ]; then\n if [ \"${_DEBUG_MODE}\" != \"YES\" ]; then\n clear\n fi\n echo\n echo \"The system is ready for BOA installation!\"\n echo\n echo \"We will start screen session for you automatically\"\n echo \"to avoid problems with dropped SSH connections\"\n echo \"during BOA stack installation, which may take up to\"\n echo \"45-60 minutes, depending on your server speed.\"\n echo\n echo \"If your connection will drop, simply log in again\"\n echo \"and re-attach your session with 'screen -R' command.\"\n echo\n echo \"Enjoy!\"\n echo\n if [ -x \"/usr/sbin/aa-teardown\" ]; then\n aa-teardown &> /dev/null\n fi\n else\n exit 0\n fi\nelse\n echo \"ERROR: This script should be run as a root user\"\n exit 1\nfi\n" }, { "path": "CHANGELOG.txt", "content": "\n###\n### Stable BOA-5.9.1-pro/lts - HTTP/3 Edition\n### Date: Sun Feb 8 10:02:06 PM NZDT 2026 in Auckland\n### Welcome Fast Lane HTTPS: HTTP/3 and KTLS\n### 333 commits since BOA-5.8.5-pro\n###\n\n@=> 4 NEW, 12 UPDATED, 32 TOTAL Drupal distros/platforms available\n\n While most of you typically build your own codebases/platforms with Composer\n these days, we still deliver a list of 32 platforms ready to use in your Ægir.\n\n Since these platforms are updated only with BOA releases, they are not really\n intended for production use per se, because you typically need a faster\n lifecycle to keep your sites secure.\n\n However, they provide a wide range of testing playgrounds, because you can\n install only those you wish to test or use, and reinstall if needed, with\n the help of our BOA-only feature that allows you to upgrade your Ægir\n on demand with two simple control files, as described in the built-in docs\n you can always find in ~/static/control/README.txt.\n\n The complete list of 32 is further below, in the section \"Drupal platforms\n available for installation\".\n\n@=> Going Local with Infrastructure\n\n We’ve expanded our network considerably to meet the growing expectations of\n the Data Sovereignty movement. This isn’t just about adding more cities\n to our hosting map — it’s also about going local with infrastructure\n wherever we can.\n\n We no longer rely solely on big-name vendors and hyperscalers. Instead, we’re\n gradually migrating to local providers and data centers in every country where\n we offer hosted BOA for Drupal.\n\n For example, in Canada you can now choose not only Toronto, but also Montreal,\n Calgary, and Vancouver. In Australia, it’s no longer just Sydney — we also\n offer Adelaide, Brisbane, and Perth.\n\n We’ve also added an excellent facility in New Zealand.\n\n Of course, we continue to support our original Singapore location and still\n offer EU, UK, and US options.\n\n@=> Usage disk/sql limits x2 + Aero and Archive plans added to hosted BOA\n\n It's worth mentioning that our hosted BOA plans have received a huge upgrade:\n several new locations have been added around the world, our vendors are now\n local (instead of the previous US-only hyperscalers), and an entirely new\n Archive Tier has been added for those looking to host collections of\n low-traffic sites at low cost.\n\n Take a look if you are interested: https://omega8.cc/hosted\n\n@=> New BOA-5.9.1 PRO/LTS Release\n\n Yes, we said that BOA-LTS would enter complete code freeze for 2026, but\n we think that the major new features and many security updates introduced in\n the last two months must be shared with the entire community before we enter\n a less rapid feature development cycle for the next few months.\n\n The future of 100% Open Source Drupal hosting is brighter than ever!\n\n With BOA-5.9.1 PRO/LTS, we proudly deliver full HTTP/3 and KTLS support —\n a fundamental change in the way modern browsers communicate with modern\n HTTPS web servers — along with the latest OpenSSL 3.5 LTS, which made it\n possible, a clever and very professional tool to diagnose your server hardware\n performance in the context of BOA-specific requirements and capabilities,\n and many critical security and bug fixes related to system components.\n\n This groundbreaking feature not only pushes the boundaries of what BOA\n can achieve but also reaffirms our commitment to staying ahead of the curve\n for modern Drupal deployments.\n\n We are thrilled to introduce BOA-5.9.1 PRO/LTS, our 8th release under the\n new branch structure and dual licensing model. It merges 2 months of\n intense development from the DEV branch, delivering 333 commits packed\n with powerful features, critical fixes, and enhancements.\n\n Thank you to everyone who supports our work by purchasing a BOA PRO license:\n https://omega8.cc/boapro.\n\n@=> Key Improvements Explained\n\n * HTTP/3 and KTLS support. If you run Drupal sites that should feel fast and\n responsive (and stay that way during spikes), this is genuinely good news.\n Why is this a big deal? What should visitors notice?\n\n Read the full story: https://github.com/omega8cc/boa/tree/5.x-dev/HTTP3.md\n\n * Percona 8.4 comes to Excalibur. We no longer need vanilla MySQL 8.4 now that\n Percona has released its own build for Debian Trixie, which can be used on\n Devuan Excalibur. There is no MySQL-to-Percona upgrade option yet, though.\n Please note that we still recommend Devuan Daedalus as the most versatile\n system, which can also support Percona 8.0 and 5.7.\n\n * Curious if your VM is good enough to fully benefit from BOA optimisations\n and deliver a first-class Drupal hosting environment? There’s a deep\n hardware and network analysis tool available: simply type `perftest` as root.\n\n * From now on, all BOA installers will download their components as packaged\n batches instead of dozens of separate little modules. They will also no longer\n rely on fetching complete repositories from GitHub, instead downloading only\n the latest packaged code from our mirrors. You can revert to the old method\n by changing _DL_MODE=BATCH to _DL_MODE=GIT in /root/.barracuda.cnf\n\n@=> New Features\n\n * Add chromium as alternative for wkhtmltopdf\n * Add Java 21 for Solr 9 and Jenkins\n * Add kTLS support in Nginx config\n * Add Red Hat KVM guest to supported virtualization systems\n * Allow access to site-specific well-known/mta-sts.txt file\n * Enable quic/http3 support in Nginx\n * Percona 8.4 comes to Excalibur to replace vanilla MySQL 8.4\n\n@=> New Improvements\n\n * Add _disable_systemd_networkd_for_next_boot\n * Add _init_debian_networkd_handoff in autoinit\n * Add _install_net_rollback in vmnetfix\n * Add aptfast as multi-lane aptitude wrapper for faster downloads\n * Add ciphers required by kTLS in Nginx\n * Add triple check for base-files\n * Improve and modernize Nginx build configuration options\n * Improve autoinit support for some vendors with _init_sysv_net_repair\n * Improve autoinit with _init_sysv_insserv_repair\n * Improve DHCP/NAT support in vmnetfix\n * Improve ffmirror\n * Improve reliability of autoinit on 10+ vendors tested\n * Improve usage info\n * Improve vmnetfix with _iface_has_dhcp_for_if\n * Modernize 301 redirects\n * Nginx: extend log_format to include protocol used\n * Prefer ifupdown over ifupdown2\n * Simplify and sync _if_off_apparmor/_turn_off_apparmor\n * Special-case Java 11/17/21 force install if version is too old\n * Sync Ægir naming convention\n * Sync config for GeoLite2\n * Uninstall cloud-utils if not required -- makes reboot faster\n * Update networking with vmnetfix early\n * Update SSL proxy vhosts if KTLS is missing\n * Use _DL_MODE=BATCH by default\n * Use Java 21 also on older systems if installed\n\n@=> Changes\n\n * Add strict locking to /etc/resolv.conf\n * Enable access_log in proxy so DoS-guard can still work\n * Prioritize modern ed25519 SSH keys\n * Run /var/xdrago/clear.sh every 3 minutes\n * Run /var/xdrago/ip_access.sh every 2 minutes\n * Run /var/xdrago/manage_ltd_users.sh every minute\n * Run /var/xdrago/manage_solr_config.sh every minute\n * Switch default PHP to 8.4\n * Turn off AppArmor in autoinit phase\n * Use nginx restart instead of quietupgrade\n\n@=> Upgrades\n\n * cURL 8.17.0\n * cURL 8.18.0\n * GoAccess 1.9.4\n * ionCube 15.0.0 (up to PHP 8.4)\n * Nginx 1.29.4\n * Nginx 1.29.5\n * OpenSSL 3.4.4\n * OpenSSL 3.5.6 LTS\n * PHP 8.1.34\n * PHP 8.2.30\n * PHP 8.3.29\n * PHP 8.3.30\n * PHP 8.4.16\n * PHP 8.4.17\n * PHP 8.5.1\n * PHP 8.5.2\n * screenFetch 3.9.9\n * Sync dehydrated updates\n * Valkey 9.0.1\n * Valkey 9.0.2\n\n@=> Important Fixes\n\n * Block language-prefix chain URL mutation crawlers spam\n * Block node-chain URL mutation crawlers spam\n * Fix for PHP 5.6 in Block node and language-prefix chain URL mutation spam\n * Percona 8.4 from Trixie requires percona-telemetry-agent\n * Remove unconditional _apt_clean_update running every 3 minutes\n * Removing all .drush.inc files under modules/contrib/webform\n * Restore less noisy _manage_sec_access_paths\n * Restore nginx auto-reload after PHP version update\n * Sync all PHP logs backup/cleanup after upgrade to force PHP-FPM reload\n * Use _check_virt/_not_supported_virt early\n\n@=> Drupal platforms available for installation -- docs/PLATFORMS.md\n\n\t## Drupal 11\n\n\tCK3 - [Commerce 3.2.0] with core (11.3.3) (UPDATED)\n\tCMS - [Drupal CMS 2.0.0] with core (11.3.3) (NEW)\n\tDE1 - [Drupal 11.1.9] with Drush included -- dev/stage/prod\n\tDE2 - [Drupal 11.2.10] with Drush included -- dev/stage/prod (UPDATED)\n\tDE3 - [Drupal 11.3.3] with Drush included -- dev/stage/prod (NEW)\n\tSCR - [Sector 11.0.x-dev] with core (11.3.3) (UPDATED)\n\tTHR - [Thunder 8.3.1] with core (11.3.3) (UPDATED)\n\tVBX - [Varbase 10.1.0] with core (11.3.1) (NEW)\n\n\t## Drupal 10\n\n\tCK2 - [Commerce v.2] with core (10.1.8)\n\tDX0 - [Drupal 10.0.11] with Drush included -- dev/stage/prod\n\tDX1 - [Drupal 10.1.8] with Drush included -- dev/stage/prod\n\tDX2 - [Drupal 10.2.12] with Drush included -- dev/stage/prod\n\tDX3 - [Drupal 10.3.14] with Drush included -- dev/stage/prod\n\tDX4 - [Drupal 10.4.9] with Drush included -- dev/stage/prod\n\tDX5 - [Drupal 10.5.8] with Drush included -- dev/stage/prod (UPDATED)\n\tDX6 - [Drupal 10.6.3] with Drush included -- dev/stage/prod (NEW)\n\tDXP - [DXPR Marketing 10.3.0] with core (10.3.6)\n\tEZC - [EzContent 2.2.15] with core (10.3.6)\n\tFOS - [farmOS 3.5.1] with core (10.6.2) (UPDATED)\n\tLGV - [LocalGov 3.4.0] with core (10.6.3) (UPDATED)\n\tOCS - [OpenCulturas 2.5.4] with core (10.5.8) (UPDATED)\n\tOFD - [OpenFed 12.2.4] with core (10.2.10)\n\tSOC - [Social 12.4.5] with core (10.2.10)\n\tVB9 - [Varbase 9.1.13] with core (10.6.1) (UPDATED)\n\n\t## Drupal 9\n\n\tDL9 - [Drupal 9.5.11] -- dev/stage/prod\n\tOLS - [OpenLucius 2.0.0] with core (9.5.11)\n\tOPG - [Opigno LMS 3.1.0] with core (9.5.11)\n\n\t## Drupal 7\n\n\tCK1 - [Commerce v.1] with core (7.105.1) (UPDATED)\n\tDL7 - [Drupal 7.105.1] -- dev/stage/prod (UPDATED)\n\tUC7 - [Ubercart 3.13] with core (7.105.1) (UPDATED)\n\n\t## Drupal 6\n\n\tDL6 - [Pressflow 6.60.1] -- dev/stage/prod\n\tUC6 - [Ubercart 2.15] with core (6.60.1)\n\n\n###\n### Stable BOA-5.8.5-pro/lts - 30 Years of Heritage Edition\n### Date: Mon Dec 1 09:58:58 AM AEDT 2025 in Sydney\n### Welcome Devuan Excalibur and PHP 8.5\n### 1092 commits since BOA-5.7.12-pro\n###\n\n@=> 30 Years of Heritage -- Why We’re Different\n\n We are unique within the hosting industry for many important reasons.\n\n Our 15 years of Ægir-based hosting, plus earlier experience with Adgrafix\n (the first company to offer a control panel for website management in 1995),\n have helped shape what makes us different today.\n\n We take Open Source seriously, it's not a buzzword for us. It's about freedom\n from corporate control. Here's a short look back at our 15-year Ægir journey\n and 19 years with Drupal.\n\n Read the full story: https://bit.ly/different30y\n\n@=> The Future of Ægir 3 is Bryght!\n\n Omega8.cc is now the lead developer team for Ægir 3 running on BOA\n (Barracuda-Octopus-Ægir stack). We want to thank all past contributors\n who brought Ægir to life – your work makes today’s progress possible.\n\n Because of you, there is still a Bryght Future for Ægir. What to Expect?\n\n Read the full story: https://bit.ly/aegirbryghtfuture\n\n@=> New BOA-5.8.5 PRO/LTS Release\n\n The future of Drupal hosting is here! With BOA-5.8.5 PRO/LTS, we proudly\n deliver both full Drupal 11 support integrated with Ægir and latest PHP 8.5,\n now available on the latest Devuan Excalibur / Debian Trixie system.\n\n This groundbreaking feature not only pushes the boundaries of what the BOA\n can achieve but also reaffirms our commitment to staying ahead of the curve\n for modern Drupal deployments.\n\n Powered by Percona 8.4 and fine-tuned to leverage the latest innovations\n across the stack, this update sets a new standard for hosting next-generation\n Drupal applications while continuing to fully support legacy Drupal versions,\n ensuring smooth operations for every site in your ecosystem, old or new.\n\n We are thrilled to introduce BOA-5.8.5 PRO/LTS, our 7th release under the\n new branch structure and dual licensing model. It merges four months of\n intense development from the DEV branch, delivering 1092 commits packed\n with powerful features, critical fixes, and enhancements.\n\n Thank you to everyone who supports our work by purchasing a BOA PRO license:\n https://omega8.cc/boapro.\n\n As always, this announcement highlights only the most impactful changes.\n For a full breakdown, explore the complete commit history.\n\n@=> Key Improvements Explained\n\n * Any expected downtime during barracuda system upgrades has been reduced\n from 2-3 minutes to 10-14 seconds on average thanks to our improvements\n across the board in the BOA system logic.\n\n * BOA now consistently pauses Ægir tasks queue if any system-backend tasks\n are running -- this includes any barracuda/octopus upgrades, the heavy\n daily.sh script and nightly DB backups, so no Ægir tasks should ever\n collide with those important system tasks.\n\n * The auto-healing system has been rewritten from scratch and greatly\n improved for precision, stability and protection from race conditions,\n with added smart cooldown pause to avoid unnecessary interventions.\n\n * The _SKYNET_MODE=OFF now strictly blocks any updates otherwise applied\n via the autoupboa tool running every 6 minutes, but also blocks any attempt\n to run barracuda or octopus upgrades, even if invoked manually.\n\n * Many vendor-specific issues affecting BOA installation on VPS platforms\n have been addressed for both older and newer Devuan/Debian releases,\n especially for the autoinit procedure recommended as the first step.\n\n * We no longer hardcode Devuan's own APT sources lottery alias deb.devuan.org\n and instead test and pick reputable mirrors to use the fastest in the\n given server's location.\n\n * We limit the messaging noise generated by various parts of the new\n auto-healing system by switching the _INCIDENT_REPORT to NO by default,\n so only really critical incidents like service restarts caused by OOM\n (out of memory) incidents are still reported.\n\n * The legacy _XTRAS_LIST logic has been improved with changes documented.\n Now _XTRAS_LIST is by default EMPTY and extended only minimally depending\n on mode, so almost no BOA xtras are installed by default like before.\n\n * The _CUSTOM_CONFIG_CSF should protect only /etc/csf/csf.conf.\n Previously it blocked CSF/LFD upgrades completely while it should protect\n only the main config file. If the protected config file becomes incompatible\n as a result, it’s the system admin's responsibility to update it manually.\n\n * New control file /root/.dont.touch.permissions.cnf allows blocking any\n otherwise defined/run actions globally by taking precedence over any other\n settings in .barracuda.cnf and site/platform-level INI files.\n\n\n@=> New Features\n\n * Add _UPGRADE_MODE=FAST/FULL mode to speed up barracuda upgrades\n * Add /data/conf/sites-cron-off.ctrl to turn off all sites wget-cron\n * Add autosymlink tool to automate symlinking sites files directories\n * Add cooldown to max/critical load actions in auto-healing\n * Add dhcpfix tool used to fix vendor-specific forced-dns issues if needed\n * Add Droplet Agent to auto-healing\n * Add environment_indicator to Ægir hostmaster control panel\n * Add ffdevuan tool to update the list of reliable and fastest mirrors\n * Add instant SQL fallback for Valkey/Redis to global-valkey.inc\n * Add loadguard as future auto-healing orchestrator for testing\n * Add new dedicated tools: aptcleanup and vmnetfix in autoinit\n * Add support for python 3.13\n * Add synproxy tool: SYNPROXY (TCP/443/80) + QUIC limiter (UDP/443) for CSF\n * Add system level /root/.dont.touch.permissions.cnf\n * Allow _LOCAL_DEVUAN_MIRROR but use _find_fast_devuan_mirror otherwise\n * Auto-enable/disable slow_query_log with /root/.mysqladmin.monitor.cnf\n * PHP 8.5 Support is ready\n * Protect from any autoupboa updates when _SKYNET_MODE=OFF\n * Protect from any barracuda updates when _SKYNET_MODE=OFF\n * Protect from any octopus updates when _SKYNET_MODE=OFF\n * Use MySQL 8.4 from Trixie on Excalibur until Percona releases own version\n\n@=> New Improvements\n\n * Add \"How we build newer codebases for testing\" in docs/BUILDTESTS.md\n * Add waiting before running octopus upgrade on init\n * Always check if /etc/hosts update is needed\n * Always use _spawn_detached procedure for Perl scripts\n * Always use nohup for detached Bash scripts\n * Build OpenSSL 3 w/o no-comp, no-hw\n * Check LE status and run another octopus upgrade if needed on boa install\n * Do not install Git from sources on BOA install\n * Do not send email on Spider Protection on/off\n * Enable APCu by default\n * Improve Ægir accelerated task queue\n * Make Solr/Java versions mapping strict\n * No automatic task queue on CI instance\n * Notify if multiback backups seem to run for too long\n * Pause Ægir queue when /run/boa_run.pid is present\n * Pause Ægir queue when daily.sh runs\n * Pause Ægir tasks queue during system DB backups\n * Prevent a flood of alerts on services up/down status if uptime < 15 min\n * Reload nginx if access log is missing or empty\n * Run _CHECK_MIRROR twice to prime DNS cache before the final speed test\n * Run _satellite_download_for_local_build only once on install\n * Run auto-healing only on fully installed system\n * Run improved scan_nginx.sh every 5 seconds\n * Save CPU cycles by disabling never used master Ægir cron/task queue\n * Sync /root/.allow.clamav.cnf and /root/.deny.clamav.cnf logic\n * Update APT sources on each upgrade\n * Update Devuan mirrors daily\n * Upgrade some held packages if needed and then rebuild from sources\n * Use _find_fast_devuan_mirror by default but static for archived beowulf\n * Use 180s opcache.revalidate_freq for heavy apps like CiviCRM\n * Use 60s opcache.revalidate_freq by default\n * Use Atomic lock/unlock to prevent TOCTOU race conditions globally\n * Use separate verbose logs for barracuda/octopus upgrade details and errors\n * Use special /var/log/boa/reset_no_new_password.pid to allow auto-healing\n\n@=> Changes\n\n * Add New Relic support for PHP 8.4\n * Add Pinterest to $is_crawler list in Nginx configuration\n * Always log all barracuda/octopus upgrades, even self-upgrades\n * Debian Buster has been archived already\n * Display BOA Skynet Agent mesages only for logged in root\n * Do not automate /root/.force.reinstall.cnf\n * Don't invoke old proc_num_ctrl (replaced by new-generation auto-healing)\n * Don't run codebasecheck daily unless /root/.allow-codebasecheck.cnf exists\n * Drop legacy IMAP in PHP on Excalibur\n * Force _VALKEY_MAJOR_RELEASE=9 unless _CUSTOM_CONFIG_VALKEY=YES\n * Force slow Ægir tasks cron mode on VM with 4GB RAM or less\n * Move APCu config to parent INI\n * Move Zend OPcache config to parent INI\n * Remove 60s wait on boa reboot\n * Remove Percona 8.3 support\n * Restore the _SQLMONITOR feature\n * Turn _INCIDENT_REPORT globally off by default\n * Use _BINLOG_KEEP_HOURS 24\n * Use Ægir install check for /var/aegir/.drush/hm.alias.drushrc.php\n * Use cache.backend.chainedfast for selected bins\n * Use slower _iteration in second.sh in auto-healing system\n\n@=> Upgrades\n\n * Commerce 3.2.0 with core 11.2.8\n * CSF/LFD 15.00\n * cURL 8.16.0\n * Drupal 10.4.9\n * Drupal 10.5.6\n * Drupal 11.1.9\n * Drupal 11.2.8\n * Drupal 7.103.2 +Extra core\n * Drupal 7.105.1 +Extra core LTS\n * Drupal CMS 1.2.8 with core 11.2.8\n * Duplicity 3.0.6\n * farmOS 3.4.6 with core 10.4.9\n * Git 2.51.0\n * LocalGov 3.3.1 with core 10.5.6\n * New Relic 12.2.0.27\n * Nginx 1.29.1\n * Nginx 1.29.3\n * Node v22.20.0\n * Node v22.21.0\n * OpenCulturas 2.5.4 with core 10.5.6\n * Openjdk 11.0.29\n * OpenSSH 10.2p1\n * OpenSSL 3.4.3\n * PHP 8.3.24\n * PHP 8.3.25\n * PHP 8.3.26\n * PHP 8.3.27\n * PHP 8.3.28\n * PHP 8.4.11\n * PHP 8.4.12\n * PHP 8.4.13\n * PHP 8.4.14\n * PHP 8.4.15\n * PHP APCu 5.1.27\n * PHP igbinary 3.2.16\n * PHP igbinary 3.2.17 for 8.5\n * PHP imagick 3.8.0\n * PHP Yaml Pecl 2.2.5\n * PHP_MCRYPT 1.0.9 for 7.3 and newer\n * PHPREDIS 6.3.0\n * Pure-FTPd 1.0.52\n * Python 3.13.9 for Duplicity\n * REDIS integration module 8.x-1.11.2 for Drupal 11.x\n * Sector 11.0.x-dev with core 11.2.8\n * Thunder 8.2.6 with core 11.2.8\n * Unbound 1.24.1\n * Unbound 1.24.2\n * Valkey 7.2.11\n * Valkey 9.0.0\n * Varbase 10.0.8 with core 10.5.6\n * Varbase 9.1.12 with core 10.5.2\n * vnStat 2.13\n\n@=> Important Fixes\n\n * Add _fix_stop_solr to Fix Solr 7/9 conflicting ports\n * Add _if_drupal_patches_update — fixes #1892\n * Allow cron web based requests even with HTTP Basic enabled in Ægir\n * Always call updatedb with -y in Ægir Provision backend\n * Always fix /etc/hosts before checking /etc/hostname\n * Auto-update hostname if doesn’t match /etc/hostname\n * Cron-only PHP entrypoint for Drupal 8+ w/ auth_basic turned off on the fly\n * Detect and fix broken downloads in /data/conf/patches/ — fixes #1906\n * Do not add date stamps to scripts — fixes #1891\n * Do not run duplicate unbound-control reload\n * Don't execute daily.sh until all installation procedures are finalized\n * Duplicity backups: replace --file-to-restore w/ --path-to-restore (#1901)\n * Fix access control for packages view in Ægir control panel\n * Fix broken _XTRAS_LIST logic and document changes\n * Hotfix for legacy vnStat installs — fixes #1908\n * Improve _if_mydumper_is_locked procedure action/reporting in auto-healing\n * Improve _solr_health_check_fix to detect stale pid files\n * Install igbinary before redis extension to avoid redis ext build failure\n * Install key DNS tools early with autoinit\n * Java 17 should be set as default on Daedalus\n * Limited Shell wrapper for Drush improvements — fixes #1907\n * Make local OpenSSL new/legacy ssl/certs symlinked to system ssl/certs\n * Remove duplicate unbound auto-healing\n * Remove Permissions-Policy headers from Nginx level\n * Remove server own IP from /etc/hosts if exists\n * Set /etc/hostname before barracuda install\n * Stop displaying useless expired one-time login link on boa install\n * The _CUSTOM_CONFIG_CSF should protect only /etc/csf/csf.conf\n * The maxmemory update for Valkey was missing — fixes #1893\n * Update Nodejs/NPM install logic to always force upstream — fixes #1910\n * Use drupal-ten-aegir-core-01.patch for Drupal 11.1.x\n * Use strict check for virt-what tool\n\n@=> Drupal platforms available for installation -- docs/PLATFORMS.md\n\n\t## Drupal 11\n\n\tCK3 - [Commerce 3.2.0] with core (11.2.8) (NEW)\n\tCMS - [Drupal CMS 1.2.8] with core (11.2.8) (NEW)\n\tDE1 - [Drupal 11.1.9] with Drush included -- dev/stage/prod (NEW)\n\tDE2 - [Drupal 11.2.8] with Drush included -- dev/stage/prod (NEW)\n\tSCR - [Sector 11.0.x-dev] with core (11.2.8) (NEW)\n\tTHR - [Thunder 8.2.6] with core (11.2.8) (NEW)\n\n\t## Drupal 10\n\n\tCK2 - [Commerce v.2] with core (10.1.8)\n\tDX0 - [Drupal 10.0.11] with Drush included -- dev/stage/prod\n\tDX1 - [Drupal 10.1.8] with Drush included -- dev/stage/prod\n\tDX2 - [Drupal 10.2.12] with Drush included -- dev/stage/prod\n\tDX3 - [Drupal 10.3.14] with Drush included -- dev/stage/prod\n\tDX4 - [Drupal 10.4.9] with Drush included -- dev/stage/prod (NEW)\n\tDX5 - [Drupal 10.5.6] with Drush included -- dev/stage/prod (NEW)\n\tDXP - [DXPR Marketing 10.3.0] with core (10.3.6)\n\tEZC - [EzContent 2.2.15] with core (10.3.6)\n\tFOS - [farmOS 3.4.6] with core (10.4.9) (NEW)\n\tLGV - [LocalGov 3.3.1] with core (10.5.6) (NEW)\n\tOCS - [OpenCulturas 2.5.4] with core (10.5.6) (NEW)\n\tOFD - [OpenFed 12.2.4] with core (10.2.10)\n\tSOC - [Social 12.4.5] with core (10.2.10)\n\tVB9 - [Varbase 9.1.12] with core (10.5.2) (NEW)\n\tVBX - [Varbase 10.0.8] with core (10.5.6) (NEW)\n\n\t## Drupal 9\n\n\tDL9 - [Drupal 9.5.11] -- dev/stage/prod\n\tOLS - [OpenLucius 2.0.0] with core (9.5.11)\n\tOPG - [Opigno LMS 3.1.0] with core (9.5.11)\n\n\t## Drupal 7\n\n\tCK1 - [Commerce v.1] with core (7.105.1) (NEW)\n\tDL7 - [Drupal 7.105.1] -- dev/stage/prod (NEW)\n\tUC7 - [Ubercart 3.13] with core (7.105.1) (NEW)\n\n\t## Drupal 6\n\n\tDL6 - [Pressflow 6.60.1] -- dev/stage/prod\n\tUC6 - [Ubercart 2.15] with core (6.60.1)\n\n\n###\n### Stable BOA-5.7.12-pro - Full Edition\n### Date: Tue Jul 29 08:44:02 AM AEST 2025 in Sydney\n###\n\n@=> New BOA-5.7.12 PRO Release\n\n This maintenance release delivers critical hot-fixes and essential\n component upgrades to ensure maximum stability and compatibility across\n all environments.\n\n Immediate upgrade of both Barracuda and Octopus is strongly recommended\n to benefit from these fixes and avoid potential issues.\n\n@=> Important Fixes\n\n * Add _elevenValidatorPatch to fix Drupal 11 CMS distro fatal error\n * Fix typo in --with-avif for PHP 8.1+ — fixes #1881\n * Removing all .drush.inc files only in Drupal 11 -- fixes #1885 and #5\n\n@=> Changes\n\n * Back to non-phar drush8 to restore PHP-CLI live PHP switch capability\n\n@=> Upgrades\n\n * Drush 8.5.0.4 classic\n * Unbound 1.23.1\n\n\n###\n### Stable BOA-5.7.11-pro - Full Edition\n### Date: Fri Jul 25 06:53:03 PM BST 2025 in London\n### Welcome Drupal 11—Ægir Mission Impossible—Again!\n###\n\n@=> New BOA-5.7.11 PRO Release\n\n Drupal 11 with Ægir 3: They Said It Couldn’t Be Done — We Did It Anyway\n\n The future of Drupal hosting is here! With BOA-5.7.11 PRO, we proudly deliver\n what many thought impossible—full Drupal 11 support integrated with Ægir 3.\n\n This groundbreaking feature not only pushes the boundaries of what the BOA\n can achieve but also reaffirms our commitment to staying ahead of the curve\n for modern Drupal deployments.\n\n This release marks a major milestone: for the first time, BOA users can\n seamlessly install, manage, and scale Drupal 11 sites with all the automation,\n performance, and reliability you’ve come to expect.\n\n Powered by Percona 8 and fine-tuned to leverage the latest innovations\n across the stack, this update sets a new standard for hosting next-generation\n Drupal applications while continuing to fully support legacy Drupal versions,\n ensuring smooth operations for every site in your ecosystem, old or new.\n\n We are thrilled to introduce BOA-5.7.11 PRO, our 5th release under the\n new branch structure and dual licensing model. It merges seven months of\n intense development from the DEV branch, delivering over 340 commits packed\n with powerful features, critical fixes, and enhancements.\n\n Thank you to everyone who supports our work by purchasing a BOA PRO license:\n https://omega8.cc/boapro.\n\n As always, this announcement highlights only the most impactful changes.\n For a full breakdown, explore the complete commit history.\n\n@=> New Features\n\n * Drupal 11 support (requires Percona 8)\n * Install or update CiviCRM CLI Tool phar\n * MultiCore Apache Solr 9 support\n * Use Valkey and drop Redis support\n * Write usage reports also to ~/static/usage/\n\n@=> Improvements\n\n * Add _mysql_high_load procedure\n * Add --with-avif to compatible PHP versions 8.1+\n * Add check for downloaded dehydrated script integrity\n * Add fstab helper for Linode Volumes\n * Add mysql root password reset helper\n * Allow to force symlinks mode with empty /data/conf/force_symlinks.conf\n * Drupal 10+ core patches files are no longer added to codebase\n * Drupal 11 site installation details including admin pwd in the task log\n * Drupal 11 site is installed via site-platform-local Drush\n * Improve _PHP_CLI detection, also from static/control/cli.info\n * Improve permissions fix to include parent dir if app root != web root\n * Local Drush locking/unlocking no longer adds control files in codebase\n * Lock Local Drush and Symfony Console Input/Style in daily.sh\n * Lock/Unlock Local Drush is more reliable with both Provision and bash\n * More robust support for real IP detection behind vaious proxies\n * Symfony Console Input/Style locking more reliable with live diff/patch\n * Use faster SQL auto-healing for Too many connections\n * Use older CSF/LFD for legacy systems\n * Use queue.redis_reliable but only for core D8 to D10\n\n@=> Changes\n\n * Always use system Drush 8 PHAR instead of Ægir local Drush\n * Install System Drush 8 as PHAR (self-contained)\n * Mark Apache Solr 4 with Jetty 9 as (deprecated)\n * Solr is no longer included via ALL keyword in the _XTRAS_LIST\n\n@=> Upgrades\n\n * CSF 14.24\n * cURL 8.14.1\n * dehydrated 0.7.3\n * Drush 8.5.0.4\n * MultiCore Apache Solr 9.8.1\n * Nginx 1.29.0\n * OpenSSH 10.0p2\n * OpenSSL 3.4.2\n * PHP 8.1.33\n * PHP 8.2.29\n * PHP 8.3.23\n * PHP 8.4.10\n * Valkey 7.2.10\n\n@=> Important Fixes\n\n * Allow LE with HTTP Basic Auth fixed by Naurisr in #1790\n * Remove too aggressive bots protection on /civicrm URLs\n\n@=> Drupal platforms available for installation -- docs/PLATFORMS.md\n\n\t## Drupal 11\n\n\tCK3 - [Commerce v.3] with core (11.2.2)\n\tDE2 - [Drupal 11.2.2]\n\tSCR - [Sector 11.0.x-dev] with core (11.2.0)\n\tTHR - [Thunder 8.2.1] with core (11.2.2)\n\n\t## Drupal 10\n\n\tCK2 - [Commerce v.2] with core (10.1.8)\n\tDX0 - [Drupal 10.0.11]\n\tDX1 - [Drupal 10.1.8]\n\tDX2 - [Drupal 10.2.12]\n\tDX3 - [Drupal 10.3.14]\n\tDX4 - [Drupal 10.4.8]\n\tDX5 - [Drupal 10.5.1]\n\tDXP - [DXPR Marketing 10.3.0] with core (10.3.6)\n\tEZC - [EzContent 2.2.15] with core (10.3.6)\n\tFOS - [farmOS 3.3.1] with core (10.3.6)\n\tLGV - [LocalGov 3.1.3] with core (10.5.1)\n\tOCS - [OpenCulturas 2.2.1] with core (10.3.6)\n\tOFD - [OpenFed 12.2.4] with core (10.2.10)\n\tSOC - [Social 12.4.5] with core (10.2.10)\n\tVBX - [Varbase 10.0.6] with core (10.5.1)\n\tVB9 - [Varbase 9.1.10] with core (10.5.1)\n\n\t## Drupal 9\n\n\tDL9 - [Drupal 9.5.11]\n\tOLS - [OpenLucius 2.0.0] with core (9.5.11)\n\tOPG - [Opigno LMS 3.1.0] with core (9.5.11)\n\n\t## Drupal 7\n\n\tCK1 - [Commerce v.1] with core (7.103.1)\n\tDL7 - [Drupal 7.103.1]\n\tUC7 - [Ubercart 3.13] with core (7.103.1)\n\n\t## Drupal 6\n\n\tDL6 - [Pressflow 6.60.1]\n\tUC6 - [Ubercart 2.15] with core (6.60.1)\n\n\n###\n### Stable BOA-5.6.0-pro - Full Edition\n### Date: Tue Dec 31 06:12:44 AM AEDT 2024 in Sydney\n### Happy New Year!\n###\n\n@=> New BOA-5.6.0 PRO Release – Happy New Year!\n\n We're thrilled to introduce BOA-5.6.0 PRO, our latest release and the fourth\n under our new branch structure and dual licensing model.\n\n This PRO release brings the project fully in sync with the DEV branch,\n which has been actively developed over the past two months, incorporating\n over 750 commits since BOA-5.5.0.\n\n We extend our heartfelt thanks to all of you who support our work\n by purchasing a BOA Pro license: https://omega8.cc/boapro.\n\n As always, this announcement covers only the most impactful new features,\n critical fixes, and enhancements. For a comprehensive list of all updates,\n please refer to the full commit history.\n\n@=> New Features\n\n * Active Sites Databases Backups are available in ~/static/files/dbackup/\n * Add experimental support for Cloudflare R2 Object Storage\n * Add mergecsf tool to join and de-duplicate legacy csf configuration\n * Add perftest tool to test hardware performance within VM\n * Add php-cli access for [grp:ltd-shell-more]\n * Add smtpgapps tool to install and configure msmtp on Devuan\n * Add support for all AWS S3 regions, including dual-stack endpoints\n * Add support for php-rebuild or php-reinstall on barracuda upgrade\n * Add support for separate /root/.deny.solr7.cnf and /root/.deny.jetty9.cnf\n * Add verifyvhostsdns tool to check all vhosts for aliases with invalid DNS\n * New Relic Integration for Drupal with Drush Compatibility (8, 12, 13)\n * PHP 8.4 is fully supported and installed by default\n * Remote System Backups use `global`, `data` and optional `custom` buckets\n\n * Completely New Backups! There is too much to cover, so please refer to\n our extensive new documentation pages for all details.\n\n This new feature is exclusive to BOA PRO and will not be ported to LTS.\n\n New PRO Backups for BOA SysAdmin:\n https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_ROOT.md\n\n New PRO Backups for Octopus Lshell User:\n https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_USER.md\n\n New PRO Backups Retention Policy Configuration:\n https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_RETENTION.md\n\n New PRO Backups Supported Regions and Bucket Creation Guidelines:\n https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_REGIONS.md\n\n\n@=> Improvements\n\n * Add _backup_waiting_notify to make admin aware of the backup status\n * Add _csf_lfd_gateway_allow()\n * Add _linode_vm_postinstall()\n * Add _turn_off_apparmor unless /root/.keep_apparmor_on.cnf\n * Add /etc/cron.hourly/systemtime\n * Add auto-restore of backup_schedule\n * Add boa info to all backup reports\n * Add cleanup for /var/lib/redis/ on OOM incident\n * Add d7security_client-7.x-1.3 to o_contrib_seven and Hostmaster\n * Add early aa-teardown on init to make sure that AppArmor is turned off\n * Add function to auto-repair incomplete backup sets\n * Add local Ægir Third Party Libraries\n * Add more checks to make sure that OpenSSL is fully up to date\n * Add support for /root/.turn.off.auto.update.cnf\n * Add support for cloudflare-dns-ssl-py.info and cloudflare-dns-ssl-sh.info\n * Add wkhtmltox_0.12.6.1-3 for Daedalus\n * Ægir Hostmaster: Log wget cron runs\n * Ægir Provision: Install local Drush automatically on platform verify and unlock\n * Always run dist-upgrade twice -- helps with slow access to Devuan servers\n * Configure backups --concurrency dynamically\n * Disable _if_start_screen with noscreen in the args\n * Disable backup_schedule on systems with too low free RAM\n * Do not install CSF until BOA installation is complete on Linode\n * Do not install csf/lfd on Linode early\n * Do not reinstall Duplicity unless /root/.force.duplicity.reinstall.cnf exists\n * Drupal 7 now supports and expects Trusted Host Patterns\n * Improve all wget/curl downloads with proper re-try logic\n * Improve and simplify _switch_php()\n * Improve sysctl.conf template\n * Improve tools/le/hooks/cloudflare logic\n * Install or upgrade csf/lfd monitoring early\n * Install wkhtmltopdf from packages first to get all dependencies\n * Integrate original _SKYNET_MODE docs/history\n * More fixes in the vdrush wrapper to support Drush 13\n * Move /data/disk/arch to global and /home to data backups\n * Move certain log scanners from the slow minute.sh to fast second.sh loop\n * Replace direct exec with _forward_to_shell in shell wrapper\n * Report also on newrelic-daemon and monagent versions in boa info\n * Run guest-water.sh right after CSF install or upgrade\n * Run orphaned duplicity processes cleanup separately\n * Sync _sql_busy_detection with max_connect_errors\n * Sync barracuda.cnf templates and docs\n * Sync sshd restart procedure across all scripts\n * Update barracuda config with missing vars if any\n * Update email template to remove confusing legacy details\n * Update xboa email templates\n * Use include/exclude instead of exclude/include logic\n * Use just one graceful csf restart on upgrade\n * Use newer, supported --copy-links option in Duplicity\n * Use noscreen in non-interactive scripts launched by parent scripts or cron\n * Waiting 8 minutes before attempting to run enforced post-install upgrade\n\n@=> Changes\n\n * Add docs/IPv6.md to explain why BOA disables IPv6 by default\n * Disable confusing hosting_client_send_welcome with non-working login link\n * Disable memory swap when running duplicity\n * Disable no longer supported GSSAPIAuthentication in SSH config\n * Disable performance_schema for Percona 5.7 but enable for 8.0+\n * Disable ssl_stapling and fix http2 directive\n * Do not auto-re-enable swap\n * Enforce Composer 2.8.2 (because 2.8.3+ breaks previously working builds)\n * Force sysctl.conf.mod-disable-ipv6\n * Introducing the New BOA Branching Scheme -- see docs/BRANCHES.md\n * Move /bin/websh to /opt/local/bin/websh\n * Newest Python should be installed only with barracuda or backup tools\n * Remove hosting_cron_use_backend.txt support\n * Remove no longer supported legacy _SCOUT_KEY\n * Remove no longer supported legacy HHVM\n * Set SOLR WAIT to 8s to speed up reboot and services restarts\n * The oldest NewRelic supported PHP version is 7.2\n * Update and Sync nice/renice logic for scripts and services\n * Update boa-mirrors-2024-12.txt\n * Updates for lshell.conf template\n * Use gzip to compress classic myslqdump backups\n * Use zero tolerance mode for SSH/FTP failed login attempts\n * Use zstd to compress mydumper sql backups\n * We have now doubled the disk space in all our hosted plans\n\n@=> Upgrades\n\n * Composer 2.8.2\n * cURL 8.11.1\n * Drupal 7.103.1\n * Drush 8.5.0.1\n * Duplicity 3.0.3.2\n * ionCube 14.0.0 (up to PHP 8.3)\n * New Relic 11.4.0.17\n * Nginx 1.27.3\n * OpenSSL 3.4.0\n * PHP 8.1.31\n * PHP 8.2.27\n * PHP 8.3.15\n * PHP 8.4.2\n * PHP APCu 5.1.24\n * PHP MCRYPT 1.0.7\n * Unbound 1.23.1\n * Use phpredis 4.3.0 with PHP 5.6\n * Use phpredis 6.1.0 for 7.4 and newer\n\n@=> Important Fixes\n\n * Ægir Hostmaster: Improve hosting_cron_queue reliability\n * Ægir Hostmaster: Unset variables at the end of the loop\n * Ægir Provision: Add backup mode ctrl file cleanup on clone and migrate\n * Ægir Provision: Add more supported compression variants\n * Ægir Provision: Do not confuse PDO and MySQLi conventions\n * Ægir Provision: Fix Drush 13 support by invoking vendor/drush/drush/drush.php\n * Ægir Provision: Follow symlinks to include all files in custom backup task only\n * Ægir Provision: Improve function revoke()\n * Ægir Provision: Prioritize '.tar.zst' as provision_backup_suffix\n * Ægir Provision: Use supported localhost in can_grant_privileges()\n * Allow _php_if_versions_cleanup_cnf if Master Ægir was not upgraded yet\n * Barracuda downgrade protection should not rely on key/barracuda_key.txt\n * Constant E_STRICT is deprecated in PHP 8.4\n * Disable shell wrapper on system stop/start early\n * Double check if /etc/init.d/nginx is really updated\n * Excessive email notifications due to DHCP error checks #1829\n * Final fixes in shell wrapper make it rock solid again\n * Fix and sync all apt options\n * Fix autoinit conflicting functions\n * Fix for --enable-redis-lzf also in _php_extensions_update()\n * Fix for counting symlinked files in resources usage monitoring\n * Fix for duplicate http2 in all vhosts on upgrade\n * Fix for platforms deployed using Manage with Git method\n * Fix for SFTP chroot by using external mode in Subsystem sftp\n * Fix the bug in the shell wrapper when composer is both a command and argument\n * Fix the logic for Devuan base-files update for Daedalus\n * Fix the logic in _ifnames_grub_check_sync()\n * Improve the http2/ssl_stapling logic\n * Legacy MCRYPT can’t be used with PHP 8.4\n * Make sure that both web and app root dirs are group writable\n * Make sure we add keys in a new line in xboa\n * More capabilities to satisfy complex composer tasks\n * Octopus downgrade protection should not rely on tools/key/octopus_key.txt\n * Patch hosting_cron.module automatically to make web cron 100% reliable\n * Remove duplicate ssl directives in all vhosts templates\n * Sync include/openssl extended check for latest version\n * Sync max allowed PHP-FPM versions running (11)\n * Sync maxBooleanClauses for new Solr cores to 4096\n * Sync PHP 8.3 precedence -- it's still default version\n * Use dash by default and limit the use of _forward_to_shell\n\n\n###\n### Stable BOA-5.5.0-pro - Full Edition\n### Date: Sat 26 Oct 2024 09:49:51 AM PDT in Santa Clara\n###\n\n@=> New BOA-5.5.0 PRO Release – Thank You for Your Support!\n\n We're thrilled to introduce BOA-5.5.0 PRO, our latest release and the third\n under our new branch structure and dual licensing model.\n\n This PRO release brings the project fully in sync with the DEV branch,\n which has been actively developed over the past several months, incorporating\n nearly 400 commits since BOA-5.4.0.\n\n BOA-5.5.0 PRO also comes equipped with 26 Ægir-ready platforms, supporting\n either Drupal core alone or various popular Drupal distributions—seven of\n which are new! These platforms include options like Commerce, DXPR Marketing,\n EzContent, farmOS, LocalGov, OpenCulturas, OpenFed, OpenLucius, Opigno LMS,\n Sector, Social, Thunder, Ubercart, and Varbase.\n\n We extend our heartfelt thanks to all of you who support our work\n by purchasing a BOA Pro license: https://omega8.cc/boapro.\n\n As always, this announcement covers only the most impactful new features,\n critical fixes, and enhancements. For a comprehensive list of all updates,\n please refer to the full commit history.\n\n@=> New Features\n\n * Added codebasecheck tool for codebase compatibility check with Percona 8.0\n * Added Drush 13 support by invoking vendor/drush/drush/drush.php directly\n * Added dedicated memorytuner (for testing for now)\n * Added mysqltuner5 and mysqltuner8\n * Added bash version scan_nginx.sh -- the Nginx DoS Guard\n * Added support for more granular load limits like 1.2 2.5 3.\n * Added support for non-standard /hdd mount point\n * Added support for /mnt/ paths in Drush\n * Added sqlclean and vhostcheck tools for root\n * SQL Adminer access moved to Octopus Ægir HTTPS vhost URL at /sqladmin\n * Added incident_email_report() feature to all monitor/check/ scripts\n * Allow SSH based access authorization to SQL Adminer at new /sqladmin/ URL\n * Added incident detection and email reporting for LE certs renewal failures\n * Added screen auto-start in boa, barracuda and octopus\n * Added support for Percona 8.4 LTS (for testing only, you should use 8.0)\n * Added support for Percona 8.3 (for testing only, you should use 8.0)\n * Added support for Percona 8.0 (production ready)\n\n@=> Improvements\n\n * Added _redis_cold_restart to mysql restart in the monitor/check/ scripts\n * Rewrite the code used to install many new Drupal distros in Octopus\n * Added Troubleshooting Docs in docs/FIXME.md (more entries soon)\n * Faster _sql_busy_detection() in the monitor/check/ scripts\n * Added _mysql_downgrade_protection() to avoid downgrade from Percona 8.0\n * Many improvements in the Nginx DoS Guard in the monitor/check/ scripts\n * Do not use fast firewall block unless /root/.instant.csf.block.cnf\n * Pause some new monitors sub-tasks during BOA upgrades and backups\n * Use underscore as prefix for all functions and camelCase vars\n * Block only relevant ports using the monitor/check/ scripts\n * Added docs on _NGINX_DOS_ variables\n * Added doc on PHP versions management — fixes #1807\n * Added separate docs/PHP-FPM.md and docs/DRUSH-CLI.md\n * Added docs on Importance of Keeping SKYNET Enabled in BOA\n * Added _CPU_TASK_RATIO to the CPU logic in auto-healing scripts\n * Display currently used GRUB config in boa info\n * Make the not_supported_virt() BOLD ENOUGH in boa info\n * Added WARNING if /root/.allow.any.virt.cnf exists in boa info\n * Display _DSK Usage for relevant partitions only in boa info\n * Improved _XSY System Uptime/Load/Kernel/Disk/Memory Report in boa info\n * Added Lshell version to boa info\n * Always attach basic boa info report to barracuda upgrade log/email\n * Improve check_php_rebuild() and add separate check_php_ssl_version()\n * Explained _INCIDENT_EMAIL_REPORT variable\n * Explained _SQL_MAX_TTL variable\n * Explained _SQL_LOW_MAX_TTL variable\n * Split big minute.sh into smaller auto-healing scripts\n * Added procedure to fix empty or missing .dhp files\n * Improved /root/.dont.use.fancy.bash.login.cnf logic\n * Improved the octopus upgrade email tpl\n * Added Key Services Uptime Report to boa info\n * Pretty large defunct code cleanup\n\n@=> Changes\n\n * Install python3-full packages\n * Duplicity: Remove Python 2 support and require OpenSSL 3\n * Remove restrictions for opcache_compile_file (Grav CMS support)\n * Removed legacy manage_ip_auth_access() for SQL Adminer access\n * PHP 8.3 is the new default version\n * Prefer system default Python3 for Lshell and src build for Duplicity\n * Always run ifnames_grub_check_sync in DEMO mode unless ctrl file exists\n * Remove chrony if preinstalled\n * PHP 8.1 is the max version supported on Stretch and Jessie\n * New Relic removed support for legacy PHP 7.0 and 7.1\n * Run _update_boa_tools only when new serial or pid key is detected\n * Redis extension 8.x-1.8.2 (with not needed db schema update reverted)\n * Disabled backboa install in auto mode\n * Allow all 7.x PHP versions on legacy (Debian) systems\n * Amazon EC2 No Longer Supported (system crashes, doesn't support Devuan)\n * Use legacy PHP 7.x by default on legacy Debian systems\n\n@=> Upgrades\n\n * Lshell 0.10\n * Composer 2.8.1\n * Unbound 1.21.1\n * OpenSSL 3.3.2\n * PHP 8.3.13\n * PHP 8.2.25\n * PHP 8.1.30\n * OpenSSH 9.9p1\n * Python 3.12.5 (for Duplicity)\n * cURL 8.10.1\n * Nginx 1.27.2\n * ionCube 13.3.1 (also for PHP 8.3)\n * MyQuick 0.16.7-3\n * CSF 14.21\n * Duplicity 3.0.2\n\n@=> Important Fixes\n\n * Fix PATH in the websh wrapper (fixes git and OpenSSL issues)\n * Fix for _PHP_FPM_TIMEOUT logic\n * Remove apt-listchanges on Debian (for legacy systems with broken debconf)\n * Improve _if_fix_python() procedure logic\n * Fix the logic for _update_boa_tools on init\n * Do not remove usage.sh — fixes #1824\n * Add cleanup for exclude.tag (could result with no files on clone)\n * Do not restart sshd every minute\n * Do not reload nginx every few minutes by default\n * cURL version upgrade should happen only with barracuda upgrade\n * Fix for too broad cleanup in /var/xdrago/log/\n * Ignore all dynamic requests related to css/js while they are generated\n * Do not log redirects (Nginx)\n * Inconsistent checks for SSL version in check_php_rebuild — fixes #1815\n * Use _CURL_VRN=7.50.1 for Wheezy compatibility\n * Use separate log for mysql notices — fixes #1805\n * Add built-in /run/unbound setup — fixes #1804\n * Percona 5.7 still depends on legacy packages naming — fixes #1808\n * Compatibility with legacy Python 3.5\n\n@=> Drupal platforms available for installation -- docs/PLATFORMS.md\n\n * Commerce Kickstart 2.77 (7.101.1)\n * Commerce Base 2.40 (10.1.8)\n * Commerce Kickstart 3.0.0 (10.3.6)\n * DXPR Marketing 10.3.0 (10.3.6)\n * EzContent 2.2.15 (10.3.6)\n * farmOS 3.3.1 (10.3.6)\n * LocalGov 3.0.11 (10.3.6)\n * OpenCulturas 2.2.1 (10.3.6)\n * OpenFed 12.2.4 (10.2.10)\n * OpenLucius 2.0.0 (9.5.11)\n * Opigno LMS 3.1.0 (9.5.11)\n * Sector 10.0.0-rc5 (10.2.10)\n * Social 12.4.5 (10.2.10)\n * Thunder 7.3.7 (10.3.6)\n * Ubercart 2.15 (6.60.1)\n * Ubercart 3.13 (7.101.1)\n * Varbase 9.1.6 (10.3.6)\n * Varbase 10.0.2 (10.3.6)\n * Pressflow 6.60.1 (core only)\n * Drupal 7.101.1 (core only)\n * Drupal 9.5.11 (core only)\n * Drupal 10.0.11 (core only)\n * Drupal 10.1.8 (core only)\n * Drupal 10.2.10 (core only)\n * Drupal 10.3.6 (core only)\n * Drupal 10.4.x-dev (core only)\n\n\n###\n### Stable BOA-5.4.0-pro - Full Edition\n### Date: Wed 14 Aug 2024 06:24:03 AM AEST in Sydney\n###\n\n@=> New BOA PRO Release & Comparison with LTS and DEV Branches\n\n We are excited to announce the release of BOA-5.4.0 PRO and BOA-5.4.0 LTS,\n marking the second release under our new branch structure and dual licensing\n model, which began with BOA-5.2.0.\n\n These new PRO and LTS versions bring the project fully up to date with the\n DEV branch, which has been actively developed over the past several months.\n\n As always, this announcement highlights only the most significant new features,\n critical fixes, and improvements. For a detailed list of all changes,\n please refer to the commit history.\n\n@=> New Features\n\n * Simplify and speed up BOA install/upgrades -- please check all details in\n the updated and greatly improved documentation:\n\n docs/INSTALL.md\n docs/UPGRADE.md\n docs/SELFUPGRADE.md\n docs/MAJORUPGRADE.md\n\n * AppArmor BOA integration for more strict system protection (needs docs)\n * Barracuda install without Octopus is now possible -- docs/INSTALL.md\n * Enable instant php-cli version switch for Ægir backend -- docs/DRUSH.md\n * Improve Ruby Gems and Node/NPM security and speed x3 -- docs/GEM.md\n * Let's Encrypt for Ægir Hostmaster installed automatically -- docs/SSL.md\n * Let's Encrypt Live Mode is enabled by default -- docs/SSL.md\n * Add three manual backup modes in Ægir (incomplete feature at the moment)\n * New Relic support with Octopus/Platform/Site Config -- docs/NEWRELIC.md\n * Restore _AEGIR_UPGRADE_ONLY {aegir} as supported barracuda upgrade mode\n * Restore {aegir|platforms|both} as supported octopus upgrade modes\n * Security Considerations for Multi-Ægir Systems -- docs/SECURITY.md\n * Use /root/.deny.clamav.cnf to auto-disable clamav if installed\n * Use /root/.deny.java.cnf to auto-disable Solr and Jetty if not used\n\n * Drush 12 in Ægir Tasks: Dynamically Utilize Site-Local Drush for\n the updatedb Operations on Drupal 10+ (needs docs).\n\n For now here is a brief explanation on how it works:\n\n # Both Migrate and Clone tasks in Ægir by default run the updatedb\n with Ægir own Drush 8 in the final deploy internal procedure.\n\n # This may cause unexpected issues in Drupal 10 and newer versions, so\n we have added a switch which allows you to tell Ægir to skip running\n `updatedb` on Drupal 10+ -- either globally with empty control file\n ~/static/control/DisAutoUpDb.info or per site with empty control file\n ~/static/control/sitename_DisAutoUpDb.info where `sitename` is the site\n main domain name used in its Drush alias. You could then unlock the\n Site-Local Drush and run it manually with `vdrush` in the platform\n app root (not web root) to better control what happens on `updatedb`\n using command: `vdrush @site-alias updatedb`\n\n # Automatic mode does it even better for Drupal 10+ Here's how it works,\n given no control file listed above exists:\n\n 1. Platform Verify task locks Site-Local Drush and patches Drupal core.\n\n 2. If the site is migrated to different platform or cloned to different\n platform, Ægir will check if **both old and new** platforms have\n the Site-Local Drush in their codebases.\n\n 3. If Site-Local Drush is detected in both platforms Ægir will unlock\n Drush in both platforms, will also revert the Drupal core patch it\n normally needs to use its own Drush 8.\n\n 4. Now Ægir will run the Site-Local Drush for `updatedb` command and\n will report all details in the task log in the admin interface.\n\n 5. Once the `updatedb` is complete, Ægir will automatically apply\n the Drupal core patch again and will lock Site-Local Drush, so you\n could run any other tasks in the control panel as usual. Magic!\n\n@=> Drupal platforms available for installation -- docs/PLATFORMS.md\n\n * Drupal 10.4.x-dev\n * Drupal 10.3.1\n * Drupal 10.2.7\n * Drupal 10.1.8\n * Drupal 10.0.11\n * Social 12.4.2 (10.2.6)\n * Thunder 7.3.0 (10.3.1)\n * Varbase 10.0.0 (10.3.1)\n * Varbase 9.1.3 (10.2.6)\n\n * Drupal 9.5.11\n * OpenLucius 2.0.0 (9.5.11)\n * Opigno LMS 3.1.0 (9.5.11)\n\n * Commerce 1.72\n * Commerce 2.77\n * Drupal 7.101.1\n * Ubercart 3.13\n\n * Pressflow 6.60.1\n * Ubercart 2.15\n\n@=> Improvements\n\n * Add better protection from duplicate sql tasks\n * Improve Ægir tasks messages to identify new improvements in the backend\n * Update Drush 10+ aliases on the fly within Ægir deploy procedure\n * Add BOA Roadmap & Progress Update in ROADMAP.md\n * Add bring_all_ram_cpu_online\n * Add CSF self-update debugging log in /var/backups/csf/water/\n * Add Dual License and BOA Branches Explained in DUALLICENSE.md\n * Add INI (platform level) docs in docs/ini/platform/INI.md\n * Add INI (site level) docs in docs/ini/site/INI.md\n * Add killer script for hanging apt-get update\n * Add support for /root/.force.queue.runner.cnf\n * Add switch_to_bash_in_octopus\n * Detect and remove stale pid faster\n * Display also system-manufacturer in the welcome messages and reports\n * Do not lower proc nice on init and major OS upgrades\n * Do not restart slow starting services during major OS upgrade\n * Execute post-install octopus auto-upgrade on boa and octopus install\n * Explain how upgrades affect BOA special shell wrapper\n * Improve and simplify is_logged_in early check in global.inc\n * Improve rsyslog to use separate log files for cron, mail, lfd, iptables\n * Limit noise printed in the console\n * Protect csf.allow from removing custom entries\n * Rewrite and improve all BOA project docs to use Markdown\n * Rewrite and improve the main README.md\n * Simplify upgrade docs\n * Turn Off AppArmor while running octopus\n * Update tests for Amazon EC2 environment detection\n * Use `drush11 aliases` or `drush11 sa` for Drupal 8+ core and PHP 8.2+\n * Use new `fancynow` welcome screen only for interactive root sessions\n * Nginx: Sync js/css aggregation support\n * Nginx: Sync static files regex\n\n@=> Changes and Upgrades\n\n * Add compatibility with Redis 8.x-1.7.1\n * Add igbinary support to PHP 5.6\n * Add recommended security and privacy HTTP headers in Nginx config\n * Add required now $settings['state_cache'] = TRUE; in global.inc\n * Adjust patches and PHP versions\n * AdvAgg is no longer added to D8+ o_contrib\n * Barracuda upgrade after boa install is now automated\n * Build OpenSSH from sources by default\n * cURL 8.9.1\n * Disable man-db/auto-update to speed up also autoinit and boa install\n * Duplicity 3.0.0\n * Force mysql root password update on barracuda upgrade\n * Git 2.45.2\n * Image Optimize toolkit binaries are now included by default\n * Install Python 3.12.4 for Duplicity\n * ionCube 13.0.4\n * Launch daily.sh automatically after barracuda upgrade\n * Lshell 0.9.18.10\n * MySecureShell master-29-06-2024\n * New Relic 19.9.9.93\n * New Relic no longer supports PHP 5.6\n * Nginx 1.27.0\n * Nginx: http2 is now a separate directive\n * OpenSSL 3.0.14 LTS\n * Re-enable cleanup for GHOST distros revisions\n * Remove /etc/apt/preferences\n * Remove cloud-utils if detected\n * Remove legacy i386/x32 support\n * Remove no longer supported MariaDB code\n * Remove not used mysql_hourly.sh\n * Removing old boa-init no longer needed after introducing fast autoinit\n * Removing systemd cleanup from boa, now handled by the fast autoinit\n * Replace mail with s-nail\n * Replace pdnsd with unbound\n * Restrict also find/scp to prevent lshell escape\n * Upgrade to openjdk 11.0.24\n * Use /etc/ssh for OpenSSH built from sources (no new server keys, finally)\n * Use maximum compatible PhpRedis versions for legacy PHP\n * Use PermitRootLogin prohibit-password\n * We no longer allow to install BOA on Debian to avoid confusion\n * We no longer override server sshd keys to avoid confusion\n * Nginx: Remove the legacy X-XSS-Protection header\n * Nginx: block bytedance and PetalBot aggressive crawlers\n\n@=> Important Fixes\n\n * Add python3.5 compatibility for Stretch\n * Add second cron entry for critically important /var/xdrago/clear.sh\n * Add support for legacy python3.4\n * Always copy hostmaster LE cert to /etc/ssl/private/ if just updated\n * Avoid any AppArmor code on legacy Debian systems\n * Bash 5.2 compatibility\n * Detect broken GIT early and reinstall from sources\n * Do not install PHP 8.2 8.3 with _OPENSSL_EOL_VRN and _OPENSSL_LEGACY_VRN\n * Do not use --with-http_v3_module for Nginx on legacy systems\n * Do not use --with-imap for PHP on Jessie\n * Do not use --with-imap for PHP on major upgrade on any OS\n * Do not use --with-sodium for PHP on Jessie\n * Fix confusing ICU logic\n * Fix for ignored nofile limits\n * Fix for iptables paths backward compatibility\n * Fix for non-blocking ntpdate\n * Fix New Relic APT config\n * Fix Percona apt config logic\n * Fix platforms symlinking in the limited shell account\n * Fix Pure-FTPD install and config\n * Force crontab update on major OS upgrade\n * Improve resolvconf auto-config\n * Let's Encrypt actually supports wildcard names already\n * Make sure that _PHP_SINGLE_INSTALL exists before disabling other versions\n * Modernize Percona keys logic\n * Nginx: Sync http2 in legacy tpl\n * Remove blocking cnf file if php-max is used\n * Show PHP patch results on _DEBUG_MODE=YES\n * Sync for python3.11\n * Sync PHP extensions existence check directly, not just via ctrl files\n * Sync PhpRedis build options with versions compatibility\n * Sync with python3.9\n * Update wkhtmltopdf versions logic\n * Use cURL 7.71.1 on Jessie\n * Use cURL 8.2.1 on Stretch\n * Use OpenSSH 8.3p1 on Jessie\n * Use OpenSSH 9.3p1 on Stretch\n * Use OpenSSL 1.0.2u on Jessie\n * Use OpenSSL 1.1.1w on Stretch\n * Fix for composer.json and composer.lock protection\n\n\n###\n### Stable BOA-5.3.0-pro - Full Edition\n### Date: Mon 12 Aug 2024 05:33:46 AM AEST in Sydney\n###\n\n@=> New BOA LTS Release & Comparison with PRO and DEV Branches\n\n We are excited to announce the release of the latest BOA LTS version,\n marking the first LTS release since the introduction of our new branch\n structure and dual licensing model, which began with the BOA-5.2.0 release.\n\n This LTS version brings the project up to date with BOA-5.3.0-pro, which\n has been available for several months. Both BOA-5.3.0-pro and BOA-5.3.0-lts\n are officially released today.\n\n Looking ahead, BOA-5.4.0-pro will be released within the next 48 hours,\n incorporating all recent developments from the DEV branch.\n\n Please note that the project README and documentation displayed on GitHub\n by default apply primarily to the BOA DEV branch, and shortly to BOA PRO.\n These do not cover BOA LTS. If you are working with the LTS version, ensure\n you switch to the appropriate branch to access legacy documentation\n relevant to BOA LTS.\n\n As always, we highlight only the most critical fixes and improvements in\n this announcement. For a comprehensive list of changes, please refer to\n the commit history.\n\n@=> New Features\n\n * PHP 8.3 Support\n\n * Update sFTP password and password expiration date with temporary pid file\n ~/static/control/run-sftp-password-update.pid\n Now the main Octopus limited shell user can easily self-update password\n based access if still has working SSH keys but lost working password.\n New password will be written to ~/static/control/new-USER-password.txt\n\n * Add boa cleanup {detect|purge} {user|batch} to automate Octopus instances\n cleanup. Requires existence of /data/disk/USER/log/CANCELLED file and\n no vhosts existing in /data/disk/USER/config/server_master/nginx/vhost.d/\n It will archive only config files and delete everything else, but will not\n delete any databases nor db users (yet).\n\n@=> Improvements\n\n * Add ltd-shell account client access to moved sites files in static/files\n * Always install legacy OpenSSL first and force new on upgrade\n * Disable man-db/auto-update to speed up barracuda upgrades\n * MySQL: Disable performance_schema by default\n * MySQL: Do not run mysql_cleanup.sh on servers with >100 dbs\n * Nginx DoS-Guard: Add ignore_admin to protect site admin activity\n * Nginx DoS-Guard: Catch typical hack probe requests early\n * Nginx DoS-Guard: Detect and block ‘unknown’ IPs requests\n * Nginx DoS-Guard: Track and block 500/403/404 flood\n * Prepare for but do not enable http3/quic yet\n * Use cold solr7 restart only on barracuda upgrade\n\n@=> Changes and Upgrades\n\n * Build PHP --with-bz2\n * Build Redis with --enable-redis-lzf --enable-redis-igbinary\n * Composer 2.7.7\n * cURL 8.7.1\n * Drupal 7.101.1\n * Enable ClassicTrack for Ægir tasks by default\n * ionCube 13.0.2\n * Nginx 1.26.0\n * OpenSSH 9.8p1\n * OpenSSL LTS with 3.0.13 (new default version)\n * PHP 8.1.29\n * PHP 8.2.22\n * PHP 8.3.10\n * PHP APCu 5.1.23\n * PHP igbinary 3.2.15\n * PHP imagick 3.7.0\n * Ruby 3.3.4\n * Use _USE_FPM=1024 as minimum\n * Use phpredis 6.0.2 for 7.2 and newer\n\n@=> Important Fixes\n\n * Add clamd/freshclam to auto-healing\n * Add cleanup for ctrl files blocking PHP upgrade\n * Always check if all /var/xdrago/* scripts are present or force update\n * Always install openjdk-11-jre-headless\n * Fix for vdrush @site updb in Drush 12\n * Fix protection from duplicate sql backups\n * Legacy PHP versions require legacy OpenSSL version\n * More protection from race conditions in auto-healing\n * Remove old auto-healing pids if detected\n * Restore ULIMIT in nginx init.d\n * Sync autoupboa cron to not collide with sql backups\n * The adduser no longer automates —home\n * Use only php-fpm reload instead of start on upgrade\n * Use PHP 7.4 in run_drush8_cmd if available\n\n\n###\n### Stable BOA-5.2.0 - Full Edition\n### Date: Wed 03 Apr 2024 02:11:56 PM CEST in Warsaw\n###\n\n@=> Notes on new available BOA branches and licenses\n\n BOA is available in three main branches, but only LTS for installation:\n\n * LTS which remains completely free to use without any kind of license\n as it was from the beginning (previously named HEAD or STABLE).\n This branch should be considered as BOA LTS with slow updates, focused\n on both security and bug fixes, but very limited new features additions.\n\n * DEV which requires paid license for both install and upgrade and includes\n the latest features, security and bug fixes and installed services versions.\n This branch shouldn't be used in production without extensive testing.\n\n * PRO which requires paid license and is available only as an upgrade\n from either LTS or DEV (or previous HEAD/STABLE) is the branch with regular\n monthly or bi-monthly releases, closely following tested DEV branch.\n\n Once you install BOA LTS and want to upgrade to PRO with license obtained\n from https://omega8.cc/licenses you will need to use up-pro command.\n\n Once you install BOA LTS or PRO and want to upgrade to DEV with license\n from https://omega8.cc/licenses you will need to use up-dev command.\n\n Old commands using in-head, in-stable, up-head and up-stable no longer work\n to avoid confusion and have been replaced with in-lts and up-lts in all\n installation and upgrade scripts.\n\n Please make sure to read updated docs/INSTALL.txt and docs/UPGRADE.txt\n\n@=> New Features\n\n * Add autodaedalus tool for easy automated major system upgrades\n * Add Linux Containers (LXC) guest as supported (tested only by others)\n * Add mysql_cleanup running hourly to keep known caches overhead at minimum\n * Add OpenVZ Containers guest as supported (tested only by others)\n * Add support for ~/static/control/disable_user_register_protection.info\n * Add support for du command in limited shell with /root/.allow.du.cnf\n * Debian Bookworm and Devuan Daedalus support (needs further testing)\n * Full Drupal 10.2 support for install and upgrades from Drupal 9 and 10\n\n@=> Improvements\n\n * Add control/enable-drush-sa.info for native drush sa command\n * Add hyperv qemu and kvm aws as supported\n * Add ltd-shell alias vdrush:vendor/bin/drush\n * Do not enforce newrelic_background_job(FALSE)\n * Document BOA planned features in the ROADMAP.txt\n * Document Drush usage in docs/DRUSH.txt\n * Make it clear that only Devuan Chimaera should be used in production\n * New Relic: Separate Web and Drush stats\n * Purge firewall deny rules before reboot for faster system restart\n * README rewrite and improvements\n\n@=> Changes and Upgrades\n\n * Ægir D10 Platforms: 3x Drupal core 10.0.11\n * Ægir D10 Platforms: 3x Drupal core 10.1.8\n * Ægir D10 Platforms: 3x Drupal core 10.2.4\n * Ægir D10 Platforms: Social 12.2.2 with core 10.2.4\n * Ægir D10 Platforms: Thunder 7.2.0 with core 10.2.4\n * Ægir D10 Platforms: Varbase 9.1.1 with core 10.2.4\n * Disable support for several built-in legacy D7 distros\n * Do not enable /root/.fast.cron.cnf by default\n * Drush 8.4.12.9\n * Nginx 1.24.0\n * Nginx: update ssl_ciphers remove 4 weak but leave 2 to support Safari 6-8\n * OpenSSH 9.7p1\n * OpenSSL LTS with 3.0.13 (prepare, optional)\n * PHP 8.1.27\n * PHP 8.2.17\n * Redis 7.0.15\n * Remove legacy Ubuntu support\n\n@=> Important Fixes\n\n * Always revert to iptables-legacy from nf_tables\n * Fix for broken cURL self-healing\n * Fix for cURL/libcurl version conflict\n * Force Nginx cold restart if status is locked\n * Improve auto-healing for duplicate move_sql and mysql_backup\n * Improve downgrade_protection\n * Revert \"Sync /etc/security/limits.conf\"\n * Update Drush yml sites aliases also for Ægir system user\n\n\n###\n### Stable BOA-5.1.0 - Full Edition\n### Date: Sat 04 Nov 2023 03:26:41 PM CET in Warsaw\n###\n### Documenting details in progress...\n###\n\n@=> New Features\n\n * Automatically detect and add known web-root dir names on Add New Platform\n * Lock Drush in any platform with Ægir task: Verify + Lock Drush\n * Manage pid files in platforms web-root for Drush Lock/Unlock status\n * Unlock Drush in any platform with new Ægir task: Unlock Local Drush\n\n@=> Improvements\n\n * Document ~/static/control/FastTrack.info in docs/FASTTRACK.txt\n * Improve BOA forks compatibility with standalone Ægir paths\n * Improve tasks labels in the Ægir control panel\n * Use Ægir backend built-in chmod for Unlock Drush w/o external scripts\n\n@=> Changes and Upgrades\n\n * Ægir D10 Platforms: 3x Drupal core 10.1.6\n * Ægir D10 Platforms: Social 12.0.0-rc3 with core 10.0.11\n * Ægir D10 Platforms: Thunder 7.1.2 with core 10.1.6\n * Ægir D10 Platforms: Varbase 9.0.16 with core 10.1.6\n * Enable hosting_site_backup_manager Ægir extension by default again\n * Fix permissions and ownership on every Platform Verify for Drupal 8/9/10\n * OpenSSL 3.1.4\n * PHP 8.1.25\n * PHP 8.2.12\n\n@=> Important Fixes\n\n * Added missing web-root paths in built-in platforms for Drupal 9/10\n * Fix the ability to rename existing platforms in the Ægir control panel\n * Multiple fixes for built-in permissions and ownership Ægir scripts\n\n\n###\n### Stable BOA-5.0.0 - Full Edition\n### Date: Thu 26 Oct 2023 09:55:22 PM CEST in Warsaw\n###\n### Documenting details in progress...\n###\n\n@=> New Features\n\n * Add support for verbose Drush like 'drush -vvv @site status'\n * Ægir in BOA is now fully compatible with PHP 8.1 and 8.2\n * Do not purge cache tables listed in /root/.my.cache.exceptions.cnf\n * Drupal 10 is fully supported (needs docs)\n * Drupal 10 platforms available: Thunder, Varbase, Drupal 10.1 and 10.0\n * Make system reboot much faster, also with 'boa reboot' command\n * OpenSSL 3.x optional/test support with /root/.install.modern.openssl.cnf\n\n@=> Improvements\n\n * Always install latest Composer on barracuda upgrade\n * Enable ~/static/control/FastTrack.info by default (needs docs)\n * Minimize services downtime on upgrade using soft reload only if possible\n * Site Local Drush is no longer removed on platform Verify (only locked)\n * Use 'barracuda php-idle disable' to speed up major upgrades\n\n@=> Changes and Upgrades\n\n * Ægir D10 Platforms: 3x Drupal core 10.0.11\n * Ægir D10 Platforms: 3x Drupal core 10.1.5\n * Ægir D10 Platforms: Thunder 7.1.2 with core 10.1.5\n * Ægir D10 Platforms: Varbase 9.0.16 with core 10.1.5\n * Ægir D7 Platforms: Commerce 1.72 with core 7.98.1\n * Ægir D7 Platforms: Commerce 2.77 with core 7.98.1\n * Ægir D7 Platforms: Guardr 2.57 with core 7.98.1\n * Ægir D7 Platforms: OpenOutreach 1.69 with core 7.98.1\n * Ægir D7 Platforms: Opigno LMS 1.59 with core 7.98.1\n * Ægir D7 Platforms: Panopoly 1.92 with core 7.98.1\n * Ægir D7 Platforms: Ubercart 3.13 with core 7.98.1\n * Ægir D9 Platforms: 3x Drupal 9.5.11\n * Ægir D9 Platforms: OpenLucius 2.0.0 with core 9.5.11\n * Ægir D9 Platforms: Opigno LMS 3.1.0 with core 9.5.11\n * Ægir D9 Platforms: Social 11.9.14 with core 9.5.11\n * BOA requires at least PHP 7.4 or newer as default version\n * Change redis_perm_ttl from 6h to 24h\n * Do not inlcude advagg/cdn in o_contrib_eight\n * Drupal 10: add minimum patch for core\n * Drupal 10: disable not working yet welcome email on install\n * Drupal 10: fix compatibility and add missing code in Drush 8\n * Drupal 10: lock vendor/drush\n * Drupal 10: lock vendor/symfony/console/Input\n * Drupal 10: replace psr/log in core with Drush 8 version\n * Drush Launcher is not supported anymore so removed\n * Enable /root/.fast.cron.cnf by default (needs docs)\n * Remove confusing -bin suffix from Drush 10+ (needs docs)\n * Set _PURGE_BACKUPS default to 14 or 7 on hosted BOA\n * Set Composer Install Support in Ægir Backend as disabled by default\n * The redis_use_modern is no longer optional in the INI files\n * Update vendor code in the Ægir backend / Provision\n * Use _STRONG_PASSWORDS=YES by default\n * Use _USE_MYSQLTUNER=NO by default\n\n@=> Important Fixes\n\n * Do not enable redis on D7/D6 automatically, it works anyway\n * Fast DNS Cache Server (pdnsd) install is no longer optional since 2014 (!)\n * Fix for hosting_cron_queue() with ADV_CRON_MAX_PLL logic\n * Make sure that expired password will not hang backend task\n * Nginx: Add missing no-cache checks from @cache to @drupal\n * Nginx: Move exceptions to the /index.php location\n * Nginx: The css/js aggregation logic has changed in Drupal 10.1\n\n\n###\n### Cutting Edge BOA-5.0.0-dev - Initial Edition\n### Date: Sat 06 May 2023 08:42:31 AM EEST in Kyiv\n### Слава Україні!\n###\n### Documenting details in progress...\n###\n\n@=> New Features\n\n * Add 'barracuda php-idle disable/enable' (needs docs)\n * Automatic BOA System Major Upgrade Tool -- see docs/UPGRADE.txt\n * Debian Bullseye and Buster support\n * Devuan Chimaera and Beowulf support (systemd-free Debian alternative)\n * Make Composer running with PHP defined in ~/static/control/cli.info\n * Make PHP-CLI for Composer and Drush configurable on the fly (needs docs)\n * New multi-step BOA install procedure -- see docs/INSTALL.txt\n * PHP 8.2 support\n\n@=> Major Improvements\n\n * Barracuda first upgrade after boa install no longer requires reboot\n * Use all available CPU cores for much faster PHP, Nginx, OpenSSL etc builds\n\n@=> Important Changes\n\n * BOA requires the classic network interface naming convention (needs docs)\n * Disable all nightly codebase cleanup procedures\n * Nginx: Add PATCH to allowed $request_method list\n * Nginx: Remove deprecated upload_progress support\n * Remove AdvAgg and CDN from D9+ o_contrib\n * Rewrite the _PHP_MULTI_INSTALL cleanup to make it optional (needs docs)\n * Stop running any Drush operations on Drupal 8+ in daily.sh\n * Switch to Redis Server 7.x by default\n * The php-all should no longer include 7.3 and older versions (needs docs)\n * Ubuntu support is deprecated\n * Use php-max to install ALL nine (9) PHP versions (needs docs)\n\n@=> Important Fixes\n\n * Discover the system IPv4 once and store in a file\n * Fix several issues with ~/static/control/MyQuick.info logic\n * Maintain csf.allow/ignore backup on serial update in /var/backups/csf/\n * Nginx: Fix protected access to /update.php\n * Nginx: Protect composer.json if exists in the Drupal web-root\n\n\n###\n### NEW BOA-4.2.0-stable - Full Edition\n### Date: Sat 06 May 2023 07:42:19 AM EEST in Ivano-Frankivsk\n### Слава Україні!\n###\n### Documenting details in progress...\n###\n\n@=> New Features\n\n * Add 'barracuda php-idle disable/enable' (needs docs)\n * Automatic BOA System Major Upgrade Tool -- see docs/UPGRADE.txt\n * Debian Bullseye and Buster support\n * Devuan Chimaera and Beowulf support (systemd-free Debian alternative)\n * Make Composer running with PHP defined in ~/static/control/cli.info\n * Make PHP-CLI for Composer and Drush configurable on the fly (needs docs)\n * New multi-step BOA install procedure -- see docs/INSTALL.txt\n * PHP 8.2 support\n\n@=> Major Improvements\n\n * Barracuda first upgrade after boa install no longer requires reboot\n * Use all available CPU cores for much faster PHP, Nginx, OpenSSL etc builds\n\n@=> Important Changes\n\n * BOA requires the classic network interface naming convention (needs docs)\n * Disable all nightly codebase cleanup procedures\n * Remove AdvAgg and CDN from D9+ o_contrib\n * Rewrite the _PHP_MULTI_INSTALL cleanup to make it optional (needs docs)\n * Stop running any Drush operations on Drupal 8+ in daily.sh\n * Switch to Redis Server 7.x by default\n * The php-all should no longer include 7.3 and older versions (needs docs)\n * Ubuntu support is deprecated\n * Use php-max to install ALL nine (9) PHP versions (needs docs)\n\n@=> Important Fixes\n\n * Discover the system IPv4 once and store in a file\n * Maintain csf.allow/ignore backup on serial update in /var/backups/csf/\n\n\n###\n### Stable BOA-4.1.4-rel - Full Edition\n### Date: Fri Dec 10 22:30:49 CET 2021 in Warsaw\n###\n### Documenting details in progress...\n###\n\n@=> New Features\n\n *\n *\n *\n\n@=> Major Improvements\n\n *\n *\n *\n\n@=> Important Changes\n\n *\n *\n *\n\n@=> Important Fixes\n\n *\n *\n *\n\n\n### Stable BOA-4.1.3 Release - Full Edition\n### Date: Thu Sep 24 18:51:49 CEST 2020\n### Milestone URL: https://github.com/omega8cc/boa/milestones/4.1.3\n\n# Release Notes:\n\n This BOA release is a second transitional release before switching to rolling\n release policy. Detailed changelog will follow.\n\n This BOA update provides latest PHP versions, system updates, including\n security fixes, many bug fixes, latest Ægir version ..but no Ægir platforms\n are installed by default anymore, unless their keywords are listed in the file\n\n ~/static/control/platforms.info (please read further below for details)\n\n TL;DR\n * Yes, blazing fast site clone/migrate mode is available even for giant sites!\n * Yes, BOA still supports Pressflow 6 (LTS version only!)\n * No, we no longer install any supported distros as platforms by default.\n\n@=> Super fast site cloning and migration mode (NEW!)\n\n It is now possible to enable blazing fast migrations and cloning even sites\n with complex and giant databases with this empty control file:\n\n ~/static/control/MyQuick.info\n\n By the way, how fast is the super-fast? It's faster than you would expect!\n We have seen it speeding up the clone and migrate tasks normally taking\n 1-2 hours to... even 3-6 minutes! Yes, that's how fast it's!\n\n This file, if exists, will enable a super fast per table and parallel DB\n dump and import, although without leaving a conventional complete database\n dump file in the site archive normally created by Ægir when you run\n not only the backup task, but also clone, migrate and delete tasks, hence\n also restore task will not work anymore.\n\n We need to emphasise this again: with this control file present all normally\n super slow tasks will become blazing fast, but at the cost of not keeping\n an archived complete database dump file in the archive of the site directory\n where it would be otherwise included.\n\n Of course the system still maintains nightly backups of all your sites\n using the new split sql dump archives, but with this control file present\n you won't be able to use restore task in Ægir, because the site archive\n won't include the database dump -- you can still find that sql dump split\n into per table files in the backups directory, though, in the subdirectory\n with timestamp added, so you can still access it manually, if needed.\n\n@=> Drupal platforms and Composer support\n\n We no longer install any supported Drupal distros as platforms by default, but\n you can customize Octopus platform list via control file, which will be used\n on the next Octopus upgrade (you can request it individually if you are on\n hosted Ægir service):\n\n ~/static/control/platforms.info\n\n This file, if exists and contains a list of symbols used to define supported\n platforms, allows to control/override the value of _PLATFORMS_LIST variable\n normally defined in the /root/.${_USER}.octopus.cnf file, which can't be\n modified by the Ægir instance owner with no system root access.\n\n IMPORTANT: If used, it will replace/override the value defined on initial\n instance install and all previous upgrades. It takes effect on every future\n Octopus instance upgrade, which means that you will miss all newly added\n distributions, if they will not be listed also in this control file.\n\n Supported values which can be written in this file, listed in a single line\n or one per line:\n\n Drupal 9 based\n\n THR ----------- Thunder\n\n Drupal 8 based\n\n LHG ----------- Lightning\n OPG ----------- Opigno LMS\n SOC ----------- Social\n VBE ----------- Varbase\n\n Drupal 7 based\n\n D7P D7S D7D --- Drupal 7 prod/stage/dev\n AGV ----------- aGov\n CME ----------- Commerce v.2\n CS7 ----------- Commons\n DCE ----------- Commerce v.1\n GDR ----------- Guardr\n OA7 ----------- OpenAtrium\n OAD ----------- OpenAid\n OLS ----------- OpenLucius\n OOH ----------- OpenOutreach\n OPC ----------- OpenPublic\n OPO ----------- Opigno LMS\n PPY ----------- Panopoly\n RST ----------- Restaurant\n UC7 ----------- Ubercart\n\n Drupal 6 based\n\n D6P D6S D6D --- Pressflow (LTS) prod/stage/dev\n DCS ----------- Commons\n UCT ----------- Ubercart\n\n You can also use special keyword 'ALL' instead of any other symbols to have\n all available platforms installed, including newly added in all future BOA\n system releases.\n\n Examples:\n\n ALL\n LHG VBE D7P D7S D7D\n\n Composer will now use PHP 7.3 by default, and you can find many useful hints at:\n https://github.com/omega8cc/boa/blob/master/docs/COMPOSER.txt\n\n IMPORTANT: You must switch your ~/static/control/cli.info to 7.2 or newer\n PHP version (BOA hosted on Omega8.cc comes with 7.4, 7.3 and 7.2), because\n D8 based distros require at least PHP 7.2 -- this also means that to run\n the sites installed after switching cli.info to 7.2 or newer, you will also\n need to either switch your ~/static/control/fpm.info to 7.2 or newer, or\n more probably, to not break any existing sites not compatible with PHP 7.2+\n you will need to list these D8 sites names in ~/static/control/multi-fpm.info\n\n Please check for more information:\n https://learn.omega8.cc/how-to-quickly-switch-php-to-newer-version-330\n\n BOA supports Drupal 8 codebases both with classic directory structure like\n in Drupal 7 and also Drupal 8 distros you can download from Drupal.org, but\n if you use Composer based codebase with different structure, the platform path\n is not the codebase root directory, but the subdirectory where you see the\n Drupal own index.php and \"core\" subdirectory. It can be platform-name/web or\n platform-name/docroot or something similar depending on the distro design.\n\n\n### Stable BOA-4.1.2 Release - Full Edition\n### Date: Tue Sep 22 05:30:08 CEST 2020\n### Milestone URL: https://github.com/omega8cc/boa/milestones/4.1.2\n\n# Release Notes:\n\n This BOA release is a transitional release before switching to rolling\n release policy. Detailed changelog will follow.\n\n\n### Stable BOA-4.0.1 Release - Full Edition\n### Date: Mon May 6 01:14:59 CEST 2019\n### Milestone URL: https://github.com/omega8cc/boa/milestones/4.0.1\n\n# Release Notes:\n\n This BOA release provides three new PHP versions, system updates, including\n security fixes, many bug fixes, latest Ægir version, plus all included\n Drupal distributions updated to latest versions, and supplied with latest\n Drupal 7 or Drupal 8 core, if possible. Yes, BOA still supports Pressflow 6.\n Yes, Debian Stretch is supported. No newer Ubuntu releases are supported yet.\n Yes, we have added Solr 7 support and every 5 minutes updates!\n\n Four Drupal 8 based popular distributions have been included by default,\n plus much improved Composer support and automatic permissions-fix-magic\n on Platform and Site Verify tasks. No more manual fixes!\n\n By the way, Composer will now use PHP 7.3 by default, and you can find\n many useful hints at:\n https://github.com/omega8cc/boa/blob/master/docs/COMPOSER.txt\n\n Big improvements and changes are coming to (auto)managing Solr cores too!\n Solr cores are are now created every 5 minutes if needed, instead of during\n the nightly procedure only, and Solr 7 is used by default. Existing Solr 4\n cores will continue to work as before, but the system will create new Solr 7\n cores for all compatible sites, and will update the sites/foo.com/solr.php\n accordingly. For existing Solr 4 cores there can be namespace conflicts,\n so please make sure to check the updated sites/foo.com/solr.php file and\n adjust your site configuration if needed.\n\n Note: If you are using WinSCP and/or Putty on Windows, or Transmit/Coda\n by Panic on a Mac, please check the Known Issues section at the bottom of this\n BOA-4.0.1 release notes.\n\n@=> Solr 7 and Solr 4 support changes and improvements\n\n Both Solr 7 and Solr 4 powered by Jetty 9 server are available. Supported\n integration modules are limited to latest versions of either search_api_solr\n (D8/Solr7 and D7/Solr7 ) or apachesolr (D7/Solr4 and D6/Solr4).\n\n Currently supported versions are listed below:\n\n https://ftp.drupal.org/files/projects/search_api_solr-8.x-2.7.tar.gz\n https://ftp.drupal.org/files/projects/search_api_solr-7.x-1.14.tar.gz\n https://ftp.drupal.org/files/projects/apachesolr-7.x-1.11.tar.gz\n https://ftp.drupal.org/files/projects/apachesolr-6.x-3.1.tar.gz\n\n Note that you still need to add preferred integration module along with\n any its dependencies in your codebase since this feature doesn't modify\n your platform or site - it only creates Solr core with configuration\n files provided by integration module: schema.xml and solrconfig.xml etc.\n\n Important: search_api_solr-8.x-2.x is different from all previous versions,\n as it requires Composer to install the module and its dependencies, then\n you will need to configure it, and only then you will be able to generate\n customized Solr core config files, which you should upload in the path:\n sites/foo.com/files/solr/ and wait 5-10 minutes to have them activated\n on the Solr 7 core the system will create for you.\n\n This will affect the running every 5 minutes auto-installer, hence\n no need to wait until next morning to be able to use new Solr core. Win!\n\n Once the Solr core is ready to use, you will find a special file in your\n site directory: sites/foo.com/solr.php with details on how to access\n your new Solr core with correct credentials.\n\n Side note: the sites/foo.com/solr.php will be automatically deleted on every\n site Verify task in Ægir, to prevent copying it across with incorrect\n access credentials when you clone the site. As soon as the site is verified,\n its sites/foo.com/solr.php will get re-created automatically within 5-10 min.\n and the cloned site will also get its own Solr core created.\n\n For more details please check the docs at:\n https://github.com/omega8cc/boa/blob/master/docs/SOLR.txt\n\n@=> Drupal 8.7.0 platforms and Composer support\n\n Since BOA-4.0.1 new Drupal 8.7.0 based platforms are included:\n\n Lightning 3.3.0 -------------- https://drupal.org/project/lightning\n Thunder 8.2.39 --------------- https://drupal.org/project/thunder\n Varbase 8.6.8 ---------------- https://drupal.org/project/varbase\n Social 8.5.1 (8.6.15 core) --- https://drupal.org/project/social\n\n IMPORTANT: You must switch your ~/static/control/cli.info to 7.1 or newer\n PHP version (BOA hosted on Omega8.cc comes with 7,1, 7.2 and 7.3), because\n D8 based distros require at least PHP 7.1 -- this also means that to run\n the sites installed after switching cli.info to 7.1 or newer, you will also\n need to either switch your ~/static/control/fpm.info to 7.1 or newer, or\n more probably, to not break any existing sites not compatible with PHP 7.1+\n you will need to list these D8 sites names in ~/static/control/multi-fpm.info\n\n Please check for more information:\n https://learn.omega8.cc/how-to-quickly-switch-php-to-newer-version-330\n\n BOA supports Drupal 8 codebases both with classic directory structure like\n in Drupal 7 and also Drupal 8 distros you can download from Drupal.org, but\n if you use Composer based codebase with different structure, the platform path\n is not the codebase root directory, but the subdirectory where you see the\n Drupal own index.php and \"core\" subdirectory. It can be platform-name/web or\n platform-name/docroot or something similar depending on the distro design.\n\n As you have discovered if you have already tried, the path you should use\n in Ægir when adding Composer based codebase as a platform is the directory\n where index.php resides, so effectively anything above that directory is not\n available for web requests and thus safely protected.\n\n The information from Ægir project docs saying \"When verifying a platform,\n Ægir runs composer install if a composer.json file is found.\" doesn't apply\n to BOA. We have disabled this. There are several reasons, most importantly:\n\n a/ having this feature enabled is actually against the codebase management\n workflow in Ægir, because it may modify codebase on a live site,\n\n b/ some tasks launch verify many times during clone and migrate, which\n results with giant overhead and conflicts if we allowed it to run composer\n install many times in parallel,\n\n c/ from our experience, having this poorly implemented feature enabled breaks\n clone and migration tasks between platforms when both have the composer.json\n file. It just doesn't make any sense in our opinion. The implementation\n should be improved to make it actually work similarly to Drush Makefiles.\n\n You should think about Composer like it was Drush Make replacement, and you\n should not re-build nor upgrade the codebase on a platform with sites already\n hosted. Just use it to build new codebases and then add them as platforms\n when the build works without errors.\n\n@=> Important PHP versions availability changes\n\n Still on PHP 5.6? You should switch to PHP 7.3 — It’s twice as fast as 5.6!\n But don't switch blindly -- even sites already running on PHP 7.0 before\n are most probably not ready for PHP 7.2 or 7.3 without proper fixes.\n\n Note: BOA-4.0.1 release removes PHP 5.3, 5.4 and 5.5, if installed.\n In addition to still supported, even if officially deprecated 5.6 and 7.0\n versions, this release adds support for PHP 7.3, 7.2 and 7.1\n\n Please check the PHP officially supported versions list at:\n http://php.net/supported-versions.php\n\n In our limited testing Drupal 7 core version included in this release works\n without noticeable issues with both PHP 7.2 and 7.3, although many contrib\n modules may not be ready to switch your instance to 7.3 or 7.2 just yet,\n especially if you have not used PHP 7.0 already.\n\n We recommend to test your sites clones with newer PHP versions using BOA\n multi-PHP-version support via ~/static/control/multi-fpm.info before\n switching your instance to use 7.3 or 7.2 by default.\n\n Please check for more information:\n https://learn.omega8.cc/how-to-quickly-switch-php-to-newer-version-330\n\n We still include Pressflow 6 platforms, because in the meantime the LTS\n community support made the latest Pressflow 6 version compatible with PHP 7.2\n\n If you still have a reason to use Drupal 6 core, we recommend to use\n our version: https://github.com/omega8cc/pressflow6/tree/pressflow-plus\n\n@=> BOA release policy changes\n\n In over 15 months since BOA-3.2.2 release we have tested a more agile\n approach with Rolling Release policy for BOA system part known as Barracuda.\n\n We have implemented many changes and updates only in BOA HEAD and used\n carefully tested HEAD in production. This worked flawlessly and allowed us\n to keep all BOA hosted and maintained systems continuosly updated without\n waiting for stable release.\n\n BOA project is very complex, build atop of many packages and individually\n built from sources components, plus other projects like Ægir, Drush and\n Drupal core and distributions -- each of them with their own release policy.\n\n After years of efforts to keep healthy balance between providing necessary\n upgrades and avoiding BOA users maintenance fatigue due to frequent releases,\n which usually results with skipping releases which has many adverse effects,\n including requirement to keep new versions backward compatible with 2-3 years\n old releases, we have decided that it's time to introduce Rolling Release\n policy for Barracuda while still using standard point releases policy for\n Octopus installer, which covers Ægir, Drush and Drupal platforms updates.\n\n We will still use point releases for Barracuda when there will be major\n changes introduced, like deprecating old PHP versions or changing components\n like Let's Encrypt integration agents or methods.\n\n BOA project docs will be updated to reflect these changes once another\n standard point release is made either for Octopus, Barracuda or both.\n The docs will explain how to run Barracuda system continuous updates properly.\n\n # New features:\n\n * Add auto-cleanup for empty old platforms in /var/aegir\n * Add experimental support for autoslave and cache_consistent\n * Add initial Composer docs\n * Add jsmin support for PHP7 #1250\n * Add mongodb extension for PHP 7 and Drupal 8.2.x support #1127\n * Add redis_oom_check() to monitoring\n * Add set_composer_manager_vendor_dir INI variable\n * Add support for include/exclude filelist for duplicity. #1159\n * Add support for Percona 5.7 and use MariaDB 10.1 by default\n * Add UTF8MB4 Convert Drush extension #1047\n * Automatically check and remove drush from codebase\n * Debian Stretch support #1176\n * Do not run Verify daily if ~/static/control/noverify.info exists\n * Install ClamAV daemon by default\n * PHP 7.3, 7.2 and 7.1 Support #1126\n * Run manage_solr_config.sh every 5 minutes\n * Update Solr with BOA #1305\n * Use _DB_BACKUPS_TTL variable for local and cluster db backups rotation\n\n # Changes:\n\n * Add innodb_default_row_format = dynamic — fixes #1366\n * Advanced Nginx microcaching to improve cache HITs #1271\n * Change to dashes in bucket names and upgrade boto/duplicity #1247\n * Create fpm.info and cli.info ctrl files on Octopus install\n * Deprecate MariaDB 5.5 and force 10.1 instead\n * Enable uploadprogress.so for testing on PHP 7+\n * Force Composer to use PHP 7.2 if available #1213\n * Higher PHP CLI limits to make Composer happy\n * Increase default TTLs to make BOA more friendly for big sites\n * Make DNS Cache Server pdnsd optional -- needs DCS keyword in _XTRAS_LIST\n * Minimum 4 GB RAM and 2 CPU (with Solr minimum 8 GB RAM and 4+ CPU rec.)\n * Re-verify LE enabled sites daily\n * Refresh the tasks list more frequently\n * Remove deprecated PHP versions #801\n * Remove problematic opcache.fast_shutdown\n * Remove ultimate_cron and background_process from the blacklist\n * Replace Google DNS servers for Cloudflare DNS servers #1317\n * Replace the complex public IP detection with an external API #1089\n * Set PHP CLI to FPM version if only FPM is defined\n * SQL: disable innodb_adaptive_hash_index by default\n * Upgrade imagick to 3.4.3 for PHP7 support #1253\n * Use /root/.backboa.autoupdate by default\n * Use utf8mb4/utf8mb4_general_ci by default\n\n # System upgrades:\n\n * Adminer 4.7.0\n * CSF/LFD 12.10\n * Drush 8.2.3.1\n * Galera 10.0.37\n * Lshell 0.9.18.9\n * MariaDB Server 10.1.39\n * MariaDB Server 10.2.19\n * MariaDB Server 10.3.14\n * MySQLTuner 1.7.15\n * Nginx 1.16.0\n * Node.js v10.x LTS\n * OpenSSH Server 8.0p1\n * OpenSSL 1.0.2r for Nginx\n * PHP 7.3.5, 7.2.18, 7.1.29, 7.0.33, 5.6.40\n * PHP Redis extension 4.2.0\n * Pure-FTPd 1.0.49\n * Redis Module 8.x mod-05-02-2019\n * Redis Server 4.0.14\n * Ruby 2.6.0\n * Use latest Duplicity and dependencies\n\n # Fixes:\n\n * Add fix_ping_perms()\n * Add libzip-dev to satisfy PHP 7.3 requirements\n * Add nginx config to mitigate SA-CORE-2018-002\n * Add patches for CORE-2018-004 and SA-CORE-2018-002\n * Add procedure satellite_fix_broken_entity_module()\n * Add re_set_default_php_cli() procedure\n * Add redis_slow_check()\n * Ajax 200 parsererror on every Drupal site #1344\n * Avoid potentially problematic --force-yes for apt-get\n * Backboa AWS S3 backup integration no longer working #1138\n * Backboa not installed #1310\n * Backboa: Certificate error #1141\n * Cannot switch php-cli, cannot create varbase composer project. #1308\n * Check sshd not ssh version\n * CiviCRM 4.7 not working under BOA #1223\n * Crawlers see 403 on public path #1329\n * Debian 9 (Stretch) _apt user + _STRICT_BIN_PERMISSIONS errors #1352\n * Do not lock old/all hostmaster platforms automatically\n * Downgrade MySecureShell until we can figure out compatibility issues\n * Errors using site with CiviCRM #1304\n * Extra cleanup for any codebase level drush copy\n * Fix for empty old hostmaster platforms cleanup\n * Fix for incomplete logic in multi-fpm mode\n * Fix for jessie-backports\n * Fix SA-CORE-2018-006 for D8 and D7\n * Fix the site specific composer_manager dir also for D8\n * Fix to include gitlab.com in ~/.ssh/known_hosts\n * Improve gpg keys handling\n * Improve pdnsd self-repair procedures\n * Infinite loop on INFO: Retrieving F1656F24C74CD1D8 key.. #1323\n * Known issues with contrib module Redirect in Drupal 8 and BOA #1239\n * Make sure redis-server is up immediately after upgrade\n * Make sure that ~/.rvmrc is fixed\n * Make sure that composer permissions are fixed\n * Make sure that the ownership on static/control is correct\n * Make sure to fix Redis permissions\n * Nginx: the \"ssl\" directive is deprecated since 1.15.0\n * No live certificates from Let's Encrypt #1255\n * No Web Server is added when BOA is installed locally #1306\n * PSA-2018-003: Drupal core security release #1283\n * Remove deprecated option UsePrivilegeSeparation if exists\n * Restore Jessie default apt mode on Stretch+\n * Solr dir is not defined in in setup_solr() #1370\n * SSHD - use without-password for backward compatibility\n * Switching out DNS servers caused breakage #1318\n * Sync permissions fix on platform verify for D8, D7, D6\n * Sync Solr 7 memory management logic\n * The _PERMISSIONS_FIX var gets overridden to YES daily basis #1311\n * The innodb_lazy_drop_table has been deprecated in Percona\n * Update ~/static/control/README.txt if needed\n * Update boa info [more] for current years #1248\n * Update lshell.config to not break valid D8 specific Drush commands\n * Update, sync and de-duplicate Zend OPcache config directives\n * Updated default robots.txt #1172\n * Use gpg2 directly instead of deprecated apt-key\n * Use IP directly as a last fallback\n * xboa migrate Solr 7 data #1376\n\n # Known issues:\n\n * SSH/SFTP WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!\n In short, nothing to worry about, but please read on how to fix this:\n https://learn.omega8.cc/2019-remote-host-identification-ssh-388\n\n * PHP 7.1+ can't be installed w/ MariaDB 10.2+ until compatibility is fixed:\n https://jira.mariadb.org/browse/MDEV-14555\n\n * Existing Solr 4 cores may experience namespace conflicts.\n Please make sure to check the updated sites/foo.com/solr.php file\n and adjust your site configuration if needed.\n\n * Error decoding SFTP packet -- affects WinSCP/Putty\n We recommend to use CybderDuck for reliable SFTP access.\n For known fix please check https://bit.ly/2HMGd6u -- quote below:\n >>>>>\n Basically we need to set the ‘Preferred SFTP protocol version’ to 3.\n How to do this:\n Edit the connection in WinSCP\n Open the Advanced menu\n Choose Advanced\n This will bring up a new popup.\n Under Environment click on SFTP\n Change ‘Preferred SFTP protocol version’ to 3\n Save the changes.\n >>>>>\n\n * SFTP connection doesn't work with Transmit nor Coda by Panic software.\n We have not figured out the workaround yet, so we recommend using\n working alternatives on a Mac, like Cyberduck or ForkLift.\n\n * The filefield_nginx_progress module, which is deprecated for years,\n no longer works and breaks upload fields. The module has been removed\n from the supported modules list, and will be automatically disabled\n if active in any D7 site daily, so we recommend to use the current\n similar alternative (even if not so fancy) included now by default:\n https://www.drupal.org/project/file_resup\n\n\n### Stable BOA-3.2.2 Release - Full Edition\n### Date: Sat Jan 20 11:03:34 PST 2018\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.2.2\n\n# Release Notes:\n\n This BOA release provides system security upgrades, many bug fixes,\n latest Ægir version, plus all supported Drupal distributions updated\n to latest versions, and supplied with latest Drupal 7 core, if possible.\n Thanks to Drush 8.1.15-dev we support also the newest Drupal 8.4.4 core.\n\n@=> Important changes planned in the next BOA feature release\n\n BOA-3.2.2 is the last release still supporting PHP 5.3, 5.4 and 5.5 versions.\n These versions will be *removed* in the next release, and instead\n there will be support for PHP 7.1 and 7.2 added.\n\n Future releases will no longer include Pressflow 6 platforms, but Pressflow 6\n will be fully supported, and can still use PHP 5.6 -- We recommend to use\n our version: https://github.com/omega8cc/pressflow6/tree/pressflow-plus\n\n # Changes:\n\n * Add support for WOFF 2.0\n * Commerce 2.51\n * Guardr 2.40\n * OpenAtrium 2.624\n * Panopoly 1.49\n\n # System upgrades:\n\n * Adminer 4.3.1\n * Galera 10.0.33\n * MariaDB 10.1.30\n * MariaDB 10.2.12\n * MariaDB 5.5.59\n * Nginx 1.13.8\n * OpenSSL 1.0.2n (used only in Nginx)\n * PHP 5.6.33\n * PHP 7.0.27\n * PHP extension for Redis 3.1.6\n * Pure-FTPd 1.0.49\n * Redis Server 4.0.6\n * Ruby 2.4.2\n * Use Redis integration mod-30-12-2017 (D7)\n\n # Fixes:\n\n * Add mongo to the list of permissions exceptions, if installed\n * Do not delete empty platforms if ~/static/control/platforms.info is used\n * Do not restart Redis daily if /root/.high_traffic.cnf exists\n * Fix Drupal 8 detection for distros with vendor dir moved out of docroot\n * Fix requirements for the latest compass version\n * Hints config update\n * LE not renewing expired certificates due to IPv6 DNS entries -- #1179\n * Notifications about new BOA editions are sent to notify@omega8.cc -- #1219\n * Override fastcgi_params to make geoip headers work again\n * Redirect module conflict with manual cron execution in D8 -- #1215\n * Remove hmac-ripemd160 MAC, deprecated in OpenSSH 7.6 -- #1217\n * The _SSH_ARMOUR=YES not compatible with OpenSSH 7.6 -- #1218\n * Update keys for rvm.io\n * Update LE License to LE-SA-v1.2-November-15-2017.pdf\n * Use advagg-7.x-2.30\n * Use modified rvm-installer.sh for user-level installations\n * Use reroute_email-7.x-1.3\n * Use rvm_silence_path_mismatch_check_flag=1\n\n\n### Stable BOA-3.2.1 Release - Full Edition\n### Date: Sat Oct 7 19:58:53 PDT 2017\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.2.1\n\n# Release Notes:\n\n This BOA release provides system security upgrades, many bug fixes,\n latest Ægir version, plus all supported Drupal distributions updated\n to latest versions, and supplied with latest Drupal 7 core, if possible.\n Thanks to Drush 8.1.15-dev we support also the newest Drupal 8.4 core.\n\n@=> Important changes planned in the next BOA release\n\n BOA-3.2.1 is the last release still supporting PHP 5.3, 5.4 and 5.5 versions.\n These versions will be *removed* in the next release, and instead\n there will be support for PHP 7.1 and 7.2 added.\n\n Future releases will no longer include Pressflow 6 platforms, but Pressflow 6\n will be fully supported, and can still use PHP 5.6 -- We recommend to use\n our version: https://github.com/omega8cc/pressflow6/tree/pressflow-plus\n\n@=> Drupal 6 vanilla core is deprecated starting with BOA-3.2.1\n\n Drupal 6 vanilla core is no longer supported. It was never really supported,\n but could still work. Those running Drupal 6 instead of supported Pressflow 6\n will notice that their site displays only the homepage and all links/menus\n no longer display expected content. This change is a result of new rewrite\n in the Nginx configuration, required to properly support both Drupal 8 and\n Drupal 7. Time to migrate to latest, included in this release, Pressflow 6!\n\n # Changes:\n\n * Add chained commands to forbidden list in lshell\n * Add Nginx Headers More module support\n * Add support for --include/exclude-filelist for duplicity -- #1158\n * Add support for upcoming MariaDB 10.2\n * Auto-update duplicity if installed\n * Deny bots on non-prod domains, not only on aliases -- #1178\n * Do not pause the tasks queue during mysql backup\n * Do not truncate queue and accesslog tables by default\n * Enable New Relic integration for PHP 7.0\n * Install ipset to improve CSF performance\n * mongodb.so for D8.2 and PHP7.0 -- #1128\n * Run 3 queue tasks in parallel by default\n * Use redis_scan_enable = FALSE by default\n\n # System upgrades:\n\n * CSF 10.22\n * Drush micro-8-07-10-2017\n * Galera 10.0.32\n * MariaDB 10.1.28\n * MariaDB 10.2.9\n * MariaDB 5.5.57\n * Nginx 1.13.5\n * Node 6.x version bump -- #1129\n * OpenSSH 7.6p1\n * OpenSSL 1.0.2l (used only in Nginx)\n * PHP 5.6.31\n * PHP 7.0.24\n * PHP extension for Redis 3.1.4\n * Pure-FTPd 1.0.46\n * Redis Server 4.0.2\n * Update Redis module for Drupal 8\n * Upgrade drush to support Drupal 8.4 -- #1206\n * Upgrade wkhtmltopdf and wkhtmltoimage to 0.12.4\n\n # Fixes:\n\n * Add SSH (RSA) keys how-to\n * Add support for tar.xz archives\n * Add symlink suggested in #999\n * Allow a bit higher load limits for queue runner\n * Barracuda is not installing ipset so csf doesn't work -- #1203\n * Deprecate no longer working distros\n * Disable innodb_corrupt_table_action in 10.2\n * Do not enable entitycache in the Commons distro\n * Exclude special https.* proxy vhosts from daily cleanup\n * Fix permissions on password files for HTTP Basic Auth -- #1187\n * Fix syntax and race conditions in fire/water\n * Galera compatibility: do not edit mysql.user directly\n * Improve CSF race conditions protection\n * Improve default system cron queue\n * Improve repo.psand.net/pubkey update\n * Improved PHP OPCache default configuration\n * Linux kernel CVE-2017-2636 hotfix\n * Linux kernel CVE-2017-6074 hotfix\n * Make sure that not supported tools are not re-installed on VServer\n * Move excludes first as they are more specific than includes -- #1168\n * PHP not installed after Wheezy to Jessie upgrade -- #999\n * Redirect module breaks Drupal 8 sites in BOA if present -- #1061\n * Remove --numeric-ids option from xboa -- #1146\n * Restart DB server on upgrade only if config has changed\n * Run fast enough fire.sh again\n * Silence mysql cleanup output -- #1180\n * Site in subdirectory cookie is not set correctly -- #1211\n * Sync PHP disable_functions across all versions\n * Update default robots.txt -- #1172\n * Use --skip-add-locks — Galera Cluster compatibility\n * Use absolutely graceful MySQLD restart procedure\n * VServer 4.1.42-vs2.3.8.6-beng compatibility\n * Wait for MySQLD availability before running DB backup\n * Whitelist known search engines bots IPs\n\n\n### Stable BOA-3.2.0 Release - Full Edition\n### Date: Sun Feb 26 09:11:39 PST 2017\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.2.0\n\n# Release Notes:\n\n This BOA release provides many new features, system security upgrades, many\n improvements and bug fixes, latest Ægir version, plus all supported Drupal\n platforms updated to latest versions, and supplied with latest Drupal 7 core,\n if possible.\n\n The reason we list here also new features and changes already listed in\n previous BOA-3.1.4 version is that they were supposed to be included in this\n (3.2.0) release, since we normally don't include new features in bugfix\n releases, but we had to publish more bugfix/security releases in the 3.1.x\n series than initially expected, while new features were already pushed to HEAD\n in anticipation of delayed 3.2.0 release.\n\n We have also moved some new features originally intended to be included\n in the (3.2.0) release to the next 3.3.0 milestone, which is expected\n in about one month after 3.2.0 release.\n\n@=> Magic permissions fix now happens on-the-fly\n\n The most interesting new Ægir feature is probably the ability to fix files\n permissions and ownership on any site and platform, without waiting for\n the running daily magic fix. Now it happens on-the-fly, when you run normal\n platform and site Verify tasks.\n\n@=> MariaDB 10.1 is now the new default version\n\n If you are already running 10.0, BOA will upgrade it to _DB_SERIES=10.1\n but if you still run _DB_SERIES=5.5 it will continue to use MariaDB 5.5\n on your system (not recommended).\n\n# New features and enhancements:\n\n * Add Microsoft Hyper-V to supported virtualization systems\n * Add support for _HOURLY_DB_BACKUPS=YES via Percona XtraBackup\n * Add support for ‘boa version’ command\n * Add support for /root/.my.batch_innodb.cnf weekly procedure\n * Add support for /root/.my.restart_after_optimize.cnf procedure\n * Add support for fix_ownership and fix_permissions on-the-fly\n * Add support for latest 3.18.44-vs2.3.7.5-beng VS kernel\n * Add support for latest 4.1.33-vs2.3.8.5.2-beng VS kernel\n * Add support for the Open Lucius Distribution to Ægir —- #888\n * Add support for the Opigno LMS Distribution to Ægir —- #953\n * Automatically whitelist CloudFlare and Sucuri IPs (faster version)\n * Bundle Opigno LMS dependencies: TinCanPHP and pdf.js\n * Configure _INNODB_LOG_FILE_SIZE automatically\n * Docs for Twig Debbuging in Drupal 8.2.x and BOA #1085\n * Improve InnoDB performance\n * Improve Let's Encrypt docs\n * Include advagg, cdn, and robotstxt in o_contrib_eight -- #1096\n * Install ClamAV and RKhunter by default —- #1019\n * Make boost cache clearing configurable via _CLEAR_BOOST variable -- #1115\n * MariaDB 10.1 support (new default version) -- #866\n * Open LDAP ports 389 and 3268 for outgoing TCP connections\n * Speed up mysql stop/start\n * Update S3 regions list for backboa backups\n * Use blazing fast Redis (SCAN) method on wildcard cache delete\n * Use Redis_CacheCompressed mode, if available (saves a ton of RAM)\n\n# Changes:\n\n * Allow to run global OPTIMIZE only once per month, on the last Sunday\n * Always update barracuda, boa and octopus wrappers, ignore _SKYNET_MODE=OFF\n * Enable ARCHIVE Storage Engine in MariaDB 10.1\n * Force _CUSTOM_CONFIG_SQL=NO on MariaDB major upgrade/reinstall\n * Remove exception for cache_form bin in Redis configuration\n * Remove no longer supported textile module\n * Run db OPTIMIZE only weekly, if configured\n * Use bzip2 also for standard db backups\n * Use lower system load limit for queue runner\n * Use MySQLTuner to configure SQL limits — enabled by default\n\n# System upgrades:\n\n * CSF/LFD 9.30\n * Drupal 7.54.2\n * Drush micro-8-07-02-2017\n * Duplicity 0.7.11 (please run 'backboa install' to upgrade)\n * MariaDB 10.1.21\n * MariaDB 5.5.54\n * MariaDB Galera Cluster 10.0.29\n * Nginx 1.11.10\n * OpenSSL 1.0.2k (used only in Nginx)\n * PHP 5.6.30\n * PHP 7.0.16\n * Pure-FTPd 1.0.45\n * Redis 3.2.8\n * Redis D8/D7 integration mod-09-02-2017\n * Use ImageMagick 7.0.4-6 if built from sources\n * Use Redis integration mod-14-02-2017 (D7)\n\n# Fixes:\n\n * Can't add clients on BOA3 -- #926\n * Do not add newer InnoDB settings when old server version is in use -- #1122\n * Do not disable site_readonly daily on migrated instances\n * Fix the not working hostmaster LE cert auto-update (typo)\n * Force vnstat restart on version upgrade\n * Improve disable_chattr() and enable_chattr() logic\n * Improve docs/FAQ.txt as suggested in #1119\n * Improve userprotect initial-only setup -- #926\n * MariaDB server not running properly alert -- #1122\n * Migration should re-use Let's Encrypt certs in HTTPS proxy vhosts -- #1106\n * Randomize SQL backup schedule\n * Rebuild hosting_custom_settings feature after enabling Redis on install\n * Sync db server (optional) restart with optimize\n * Sync max_execution_time for PHP-FPM\n * Sync max_input_time for PHP-FPM\n * Update docs/SSL.txt -- #1109\n * Whitelist /dev/urandom in open_basedir\n\n\n### Stable BOA-3.1.4 Release - Full Edition\n### Date: Tue Dec 20 14:09:21 PST 2016\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.1.4\n### Latest hotfix added on: Wed Dec 21 12:44:58 PST 2016\n\n# Release Notes:\n\n This BOA release provides system security upgrades, many improvements\n and bug fixes, latest Ægir version, plus all supported Drupal platforms\n updated to latest versions, and supplied with latest Drupal 7 core,\n if possible.\n\n@=> Magic permissions fix now happens on-the-fly\n\n The most interesting new Ægir feature included in this release is probably\n the ability to fix files permissions and ownership on any site and platform,\n without waiting for the running daily magic fix. Now it happens on-the-fly,\n when you run normal platform and site Verify tasks.\n\n@=> MariaDB 10.1 is now the new default version\n\n If you are already running _DB_SERIES=10.0, this BOA release will upgrade it\n to _DB_SERIES=10.1 -- but if you still run _DB_SERIES=5.5 it will continue\n to use MariaDB 5.5 on your system.\n\n# New features and enhancements:\n\n * Add Microsoft Hyper-V to supported virtualization systems\n * Add support for ‘boa version’ command\n * Add support for fix_ownership and fix_permissions on-the-fly\n * Add support for latest 3.18.44-vs2.3.7.5-beng VS kernel\n * Add support for latest 4.1.33-vs2.3.8.5.2-beng VS kernel\n * Automatically whitelist CloudFlare and Sucuri IPs (faster version)\n * Configure _INNODB_LOG_FILE_SIZE automatically\n * MariaDB 10.1 support (new default version) -- #866\n * Use Redis_CacheCompressed mode, if available (saves a ton of RAM)\n\n# Changes:\n\n * Always update barracuda, boa and octopus wrappers, ignore _SKYNET_MODE=OFF\n * Enable ARCHIVE Storage Engine in MariaDB 10.1\n * Force _CUSTOM_CONFIG_SQL=NO on MariaDB major upgrade/reinstall\n * Remove no longer supported textile module\n * Run db OPTIMIZE only weekly, if configured\n * Use MySQLTuner to configure SQL limits — enabled by default\n\n# System upgrades:\n\n * CSF 9.28\n * Drush micro-8-17-12-2016\n * MariaDB 10.1.20\n * MariaDB Galera Cluster 10.0.28\n * Nginx 1.11.7\n * OpenSSH 7.4p1 (if installed from sources)\n * OpenSSL 1.0.2j (used only in Nginx)\n * PHP 5.6.29\n * PHP 7.0.14\n * PHPRedis 3.1.0\n * Redis 3.2.6\n * Use mydropwizard-6.x-1.6\n * Use Redis module mod-20-12-2016\n\n# Fixes:\n\n * Allow to run downgrade to _DB_SERIES 5.5 (experimental, not recommended!)\n * Always reinstall cURL from packages if broken\n * AMP support -- #948\n * Archive PHP logs in /var/backups/php-logs/\n * Check if bind should be installed early enough\n * Do not enable innodb-defragment — it may crash the server\n * Fix for check_root_keys_pwd()\n * Fix for disable_chattr()\n * Fix for missing PHP config regression -- #1105\n * Fix for VnStat sysconfdir\n * Fix the check in detect_deprecated_php()\n * Ignore search lines to avoid breaking pdnsd config -- #1069\n * Improve SQL defaults\n * Make sure innodb_buffer_pool_instances is always defined\n * Migration between installation profiles -- #1076\n * Monitor more lines when /root/.hr.monitor.cnf exists\n * Multiply already high opcache.max_accelerated_files\n * Nginx: Set Access-Control-Allow-Origin header only for static files\n * Remove duplicate config updates and restarts\n * Remove various tmp/dot files breaking du command\n * Sync the new on-the-fly permissions magic with BOA daily.sh logic\n * The .git/* files are downloadable -- #1091\n * Triple check that all sql tables are upgraded\n * Update JS module to 7.x-2.1 -- #586\n * Update migrate docs to avoid issues with already migrated instances\n * Use long enough wait times for big SQL servers restarts\n * Use Open Atrium own patched Drupal core -- #1083\n\n\n### Stable BOA-3.1.3 Release - Barracuda Edition\n### Date: Mon Sep 12 17:54:50 PDT 2016\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.1.3\n\n# Release Notes:\n\n This BOA release provides important security upgrades and bug fixes.\n You should upgrade via 'barracuda up-stable system' immediately.\n Note: Octopus upgrade is **not** included in this BOA release.\n\n Technically, even by running normal system update with previous BOA release\n you would apply all security upgrades, since they are provided by MariaDB\n packages, and thus enforced no matter if we release new BOA version, or not,\n so we are doing this purely to make sure that all users have been alerted\n about the situation affecting their systems.\n\n# Changes:\n\n * Move Nginx cache cleanup to daily cleanup procedure\n * Use standard hourly schedule for self-update in clear.sh\n\n# System upgrades:\n\n * Add all Tika versions from 1.1 to 1.13 in /opt/tika9/\n * MariaDB 10.0.27 (critical security upgrade)\n * MariaDB Galera Cluster 10.0.27 (critical security upgrade)\n * MongoDB database driver 1.6.14 for all PHP versions < 7 -- fixes #981\n * Pure-FTPd 1.0.43\n\n# Fixes:\n\n * Check if curl works and re-install if needed before running auto-update\n * Log LE renewal attempts\n * Log out all users after lshell em upgrade\n * Make sure that cURL is always listed in packages\n * Move permissions fix overrides check to the correct place\n * Nginx: default FastCGI cache levels value may exhaust all inodes -- #2791885\n\n# Known problems:\n\n https://github.com/omega8cc/boa/milestones/3.1.x\n\n\n### Stable BOA-3.1.2 Release - Full Edition\n### Date: Sat Aug 20 14:43:43 PDT 2016\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.1.2\n### Latest hotfix added on: Thu Aug 25 09:17:59 PDT 2016\n\n# Release Notes:\n\n This BOA release provides system security upgrades, improvements\n and bug fixes, plus all supported Drupal platforms updated to latest\n versions, and supplied with latest Drupal 7 core.\n\n@=> You can use NPM to install Grunt/Gulp/Bower -- #1028 by @pricejn2 (thanks!)\n\n Now the same ~/static/control/compass.info file will activate not only\n RVM, which can be used to install Compass Tools, but also NPM, which\n can be used to install Grunt/Gulp/Bower.\n\n You will need to re-initialize your account to have it added, by\n deleting the control file, and adding it again after ~10 minutes.\n\n More details: https://github.com/omega8cc/boa/blob/master/docs/RVM.txt\n\n@=> Redis integration works with Drupal 8 -- with no effort on your side\n\n We have added a smart activation procedure, to meet the D8 Redis module\n requirements. The system will add Redis integration to your Drupal 8\n sites automatically, but will keep it inactive, until the module will be\n installed properly, during nightly system autonomous maintenance.\n\n This means that Redis will start working in every existing and newly\n installed Drupal 8 site with some initial delay, to get things installed\n in the correct order, and still without any effort on your side.\n\n# Other enhancements:\n\n * Add mydropwizard to Drush extensions for Drush Make D6 support\n * Add support for Drupal 8 specific development.services.yml file\n * Allow to configure stable/head BOA auto-upgrades via _AUTO_VER variable\n * Compatibility with Multi-byte UTF-8 support in Drupal 7\n\n# Changes:\n\n * Add Adminer database manager and deprecate Chive manager -- #1036\n * Enable Let's Encrypt LIVE mode via ~/static/control/ssl-live-mode.info\n * Force /root/.use.curl.from.packages.cnf to install cURL from packages\n * Run db sqlmagic auto conversion also on test/dev sites, if activated\n\n# System upgrades:\n\n * CSF 9.11\n * Drush micro-8-23-07-2016\n * Lshell 0.9.18.8 (security update for shell escalation issues)\n * MariaDB 10.0.26\n * MariaDB 5.5.51\n * Mysqltuner v1.6.15\n * Nginx 1.11.3\n * OpenSSH 7.3p1 (if installed from sources)\n * PHP 5.5.38\n * PHP 5.6.25\n * PHP 7.0.10\n * PHPRedis dev5-11-08-2016\n * PHPRedis dev7-11-08-2016\n * Redis 3.2.3\n * Redis D8 integration mod-12-08-2016\n * vnStat 1.15\n\n# Fixes:\n\n * Avoid race conditions on web system user update\n * Debian Jessie 8.3+ needs grub update -- fixes #912\n * Detection of Amazon AWS / EC2 instance -- fixes #930\n * Disable Redis integration until module is installed (D8 only)\n * Do not force --default-character-set=utf8 -- see #1020\n * Don’t set $MANPATH when npm support is enabled\n * Fix for openssh-sftp-server status on Jessie\n * FMG installation hangs on keyring install -- fixes #1050\n * Force InnoDB in sqlmagic for Drupal 7+ -- see #1020\n * Ignore ~/control/multi-fpm.info on too old Octopus (2.4) instances\n * Linux Kernel CVE-2016-5696 mitigation\n * Mitigate httpoxy vulnerability\n * Nginx: Fix for not working autodiscover flood protection\n * Nginx: Fix for the add_header inheritance\n * Nginx: Improve fastcgi_cache_valid TTL settings\n * Octopus auto-upgrade should set _AUTOPILOT=YES on the fly -- fixes #1041\n * Remove deprecated MyISAM exceptions in sqlmagic command\n * Run detect_cdorked_malware() only if /usr/sbin/nginx exists\n * Run registry-rebuild directly after hostmaster upgrade\n * Single _tmp_ dir is enough to require forced cleanup (Drush cache)\n * Sync keyring install command with BOA standard -- #1052\n * Sync modules auto en/dis for Drupal 8\n * Update check_boa_php_compatibility()\n * Upgrade to panels-7.x-3.7 (security) in all distros using the module\n * Whitelist elFinder requests\n * Workaround for aegir_backup_export_path\n\n# Known problems:\n\n https://github.com/omega8cc/boa/milestones/3.1.x\n\n\n### Stable BOA-3.1.1 Release - Full Edition\n### Date: Wed Jun 22 12:24:17 PDT 2016\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.1.1\n### Latest hotfix added on: Fri Jun 24 06:01:07 PDT 2016\n\n# Release Notes:\n\n This BOA release provides system security upgrades, improvements\n and bug fixes, plus all supported Drupal platforms updated to latest\n versions, and supplied with latest Drupal 7 core (security release).\n\n# New features and enhancements:\n\n * Add _SSH_ARMOUR feature\n * Add strict check for supported virtualization systems\n * Allow to install ImageMagick from sources when _MAGICK_FROM_SOURCES=YES\n\n# Changes:\n\n * Deprecate support for old Solr versions <4\n * Switch cluster support to 3.x\n\n# System upgrades:\n\n * Drush micro-8-15-06-2016\n * MariaDB 5.5.50\n * Nginx 1.11.1\n * PHP 5.5.37\n * PHP 5.6.23\n * PHP 7.0.8\n * Redis 3.2.1\n\n# Fixes:\n\n * Add compatibility with magick src\n * Add ToC (Table of Contents) for the Let's Encrypt section in docs/SSL.txt\n * Downgrade JSmin from 2.0.1 to 2.0.0 -- fixes #993\n * Fix for legacy cluster support\n * Fix for virtualbox detection -- see #972\n * Fix permissions on sites directories\n * Fix sites/all/drush permissions compatibility with Drush 8.2\n * Improve protection for custom solrconfig.xml and schema.xml -- fixes #969\n * Migration: xboa supports only Ægir 2.x -- #960\n * Reinstall default-jre on major OS upgrade, if needed -- fixes #986\n * Remote Drush support regression -- fixes #984\n * The ~/static/control/README.txt is not updated on octopus upgrade #965\n * Update docs/SOLR.txt to match currently supported procedures -- fixes #963\n * Use st_runner() wrapper only for apt-get/aptitude\n\n# Known problems:\n\n https://github.com/omega8cc/boa/milestones/3.1.x\n\n\n### Stable BOA-3.1.0 Release - Full Edition\n### Date: Thu May 26 16:41:40 PDT 2016\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.1.0\n### Latest hotfix added on: Mon May 30 08:55:03 PDT 2016\n\n @=> Includes Ægir Hostmaster 3.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 8 customized for BOA\n\n# Release Notes:\n\n This BOA release includes new features, system upgrades, improvements\n and bug fixes, with most notable features and changes listed below.\n All supported Drupal platforms have been updated to latest versions.\n\n @=> Let's Encrypt free SSL certificates are supported directly in Ægir\n @=> PHP-FPM version can be switched per site hosted on the same instance\n @=> Both Ægir control panel and its backend are compatible with PHP 7.0.7\n @=> Support for forced Drush cache clear in the Ægir backend\n @=> BOA can run Debian Wheezy to Debian Jessie upgrades easily\n\n More details on new features, enhancements and changes can be found below.\n\n\n ###\n#-### Let's Encrypt free SSL certificates are supported directly in Ægir\n ###\n\n You can find these important Let's Encrypt topics discussed below:\n\n # Introduction\n # How it works?\n # How to add Letsencrypt.org SSL certificate to hosted site?\n # How to add Letsencrypt.org SSL certificate to the Ægir Hostmaster site?\n # How to modify/renew Letsencrypt.org SSL certificate for SSL enabled site?\n # Are there any requirements, limitations or exceptions?\n # How to enable live mode?\n # How to replace Let's Encrypt certificate with custom certificate?\n\n [ Available also at: https://omega8.cc/node/381 ]\n\n This BOA release opens a new era in SSL support for all hosted Drupal sites.\n The old method of creating SSL proxy vhosts is officially deprecated,\n as explained in the docs/SSL.txt how-to:\n\n NOTE ###===>>>\n\n The old how-to is still useful if you prefer to use SSL termination separated\n from your Ægir system, or if you don't want to use built-in Letsencrypt.org\n SSL certificates support (available since BOA-3.1.0).\n\n But if you can use Letsencrypt.org SSL certificates, or you are willing to use\n also built-in BOA feature which allows you to replace Letsencrypt.org SSL\n certificate with any third-party certificate per site, while still managing SSL\n via Ægir control panel (for redirects, forced/required SSL mode), we highly\n recommend to use Ægir built-in SSL support, which is enabled and ready to use\n in all Octopus instances since BOA-3.1.0 release.\n\n NOTE ###===>>>\n\n * How it works?\n\n BOA leverages letsencrypt.sh utility to talk to Letsencrypt.org servers,\n and on the Ægir side it's using new `hosting_le` extension, which replaces\n self-signed SSL certificates generated by Ægir with Let's Encrypt ones.\n You can find more information on both at these URLs:\n\n https://github.com/lukas2511/letsencrypt.sh\n https://github.com/omega8cc/hosting_le\n\n * How to add Letsencrypt.org SSL certificate to hosted site?\n\n In your Ægir control panel please go to the site's node Edit tab, then\n under `SSL Settings > Encryption` choose either `Enabled` or `Required`,\n if you want to enable HTTP->HTTPS redirection on the fly. Now click `Save`\n and wait until you will see the Verify task completed. Done!\n\n NOTE: SSL Settings are not available in the Add Site form, only in Edit.\n\n * How to add Letsencrypt.org SSL certificate to the Ægir Hostmaster site?\n\n !!! WARNING\n !!! ###===>>> Don't enable SSL option for the Hostmaster site in Ægir\n !!! WARNING\n\n Let's Encrypt SSL for Ægir control panel is handled in BOA outside of\n the control panel, and you should never enable it within control panel.\n\n During octopus upgrade you will see this message, explaining what to do:\n\n BOA [02:44:59] ==> UPGRADE B: Letsencrypt SSL initial mode: DEMO\n BOA [02:44:59] ==> UPGRADE B: LE -- No real SSL certs will be generated\n BOA [02:44:59] ==> UPGRADE B: LE -- To enable live SSL mode, please delete file:\n BOA [02:44:59] ==> UPGRADE B: LE -- /data/disk/o1/tools/le/.ctrl/ssl-demo-mode.pid\n BOA [02:44:59] ==> UPGRADE B: LE -- Then run octopus forced upgrade\n\n * How to modify/renew Letsencrypt.org SSL certificate for SSL enabled site?\n\n When you modify aliases or redirections, Ægir will re-create the SSL\n certificate on the fly, to match current settings and aliases to list.\n\n BOA runs auto-renewal checks for you weekly, and forces renewal if there is\n less than 30 days to the certificate expiration date (Let's Encrypt certs\n are valid for up to 90 days before they have to be renewed).\n\n Also every Verify task against SSL enabled site runs this check on the fly.\n\n * Are there any requirements, limitations or exceptions?\n\n Yes, there are some:\n\n * All aliases must have valid DNS names pointing to your server IP address\n * Even with aliases redirection enabled all aliases are listed as SAN names\n * Avoid renaming SSL-enabled sites; move aliases between site's clones instead\n * Before you rename a site, disable SSL first; then re-enable once it's renamed\n\n NOTE: The Subject Alternative Names (SAN) is a feature which allows to issue\n multi-domain / multi-subdomain SSL certificates -- it is automated in BOA.\n\n Let's Encrypt API for live, real certificates has its own requirements\n and limits you should be aware of. Please visit their website for details:\n\n https://letsencrypt.org/docs/rate-limits/\n\n To make this new BOA feature easy to test before you will be ready to\n generate real, live SSL certificates, BOA comes with Let's Encrypt demo\n mode enabled by default, so it will not hit limits enforced for live,\n real Let's Encrypt SSL certificates. It allows to generate \"fake\" certs,\n similar to self-signed certificate used in BOA by default.\n\n NOTE: All sites with one or more keywords (listed below) in the site's\n main name (this exception rule doesn't apply to aliases) will be ignored,\n and they will receive only self-signed SSL certificates generated by Ægir,\n once you will switch their SSL settings to `Enabled` or `Required`.\n\n `.(dev|devel|temp|tmp|temporary|test|testing|stage|staging).`\n\n Examples: `foo.temp.bar.org`, `foo.test.bar.org`, `foo.dev.bar.org`\n\n NOTE: This exception rule doesn't apply to aliases which are not used\n as a redirection target. Even aliases with listed special keywords in their\n names will be listed as SAN entries, as long as they are valid DNS names.\n\n * How to enable live mode?\n\n It is enough to delete the `[aegir_root]/tools/le/.ctrl/ssl-demo-mode.pid`\n control file and run Verify task on any SSL enabled site again.\n\n NOTE: If you are on hosted BOA, you don't have an access to this location\n on your system, so please open a ticket at: https://omega8.cc/support\n\n You could switch it back and forth to demo/live mode by adding and deleting\n the control file, and it will re-register your system via Let's Encrypt API,\n but we have not tested how it may affect already generated live certificates\n once you will run the switch many times, so please try not to abuse\n this feature.\n\n It is important to remember that once you will switch the Let's Encrypt mode\n to demo from live, or from live to demo, by adding or removing the\n `[aegir_root]/tools/le/.ctrl/ssl-demo-mode.pid` control file, it will not\n replace all previously issued certificates instantly, because certificates\n are updated, if needed, only when you (or the BOA system for you during its\n daily maintenance, if used) will run Verify tasks on SSL enabled sites.\n\n These BOA specific Verify tasks are normally scheduled to run weekly,\n between Monday and Sunday, depending on the first character in the site's\n main name, so both live and demo certificates may still work in parallel\n for SSL enabled sites until it will be their turn to run Verify and update\n the certificate according to currently set Let's Encrypt mode.\n\n NOTE: You may find some helpful details in the Verify task log -- look for\n lines with `[hosting_le]` prefix.\n\n * How to replace Let's Encrypt certificate with custom certificate?\n\n 1. Create an empty control file (replace `example.com` with your site name):\n\n `[aegir_root]/tools/le/.ctrl/dont-overwrite-example.com.pid`\n\n 2. Replace `privkey.pem` symlink with single file containing your custom\n certificate key -- use `privkey.pem` as a filename in the directory:\n\n `[aegir_root]/tools/le/certs/example.com/`\n\n 3. Replace `fullchain.pem` symlink with single file containing your custom\n certificate and all intermediate certificates beneath it -- use\n `fullchain.pem` as a filename in the same directory:\n\n `[aegir_root]/tools/le/certs/example.com/`\n\n 4. Run Verify task for your site in the Ægir control panel. Done!\n\n NOTE: If you are on hosted BOA, you don't have an access to this location\n on your system, so please open a ticket at: https://omega8.cc/support\n\n\n ###\n#-### Support for PHP-FPM version switch per Octopus instance (also per site)\n ###\n\n ### ~/static/control/fpm.info\n ###\n ### This file, if exists and contains supported and installed PHP-FPM version,\n ### will be used by running every 2-3 minutes system agent to switch PHP-FPM\n ### version used for serving web requests by this Octopus instance.\n ###\n ### IMPORTANT: If used, it will switch PHP-FPM for all Drupal sites\n ### hosted on the instance, unless multi-fpm.info control file also exists.\n ###\n ### Supported values for single PHP-FPM mode which can be written in this file:\n ###\n ### 7.0\n ### 5.6\n ### 5.5\n ### 5.4\n ### 5.3\n ###\n ### NOTE: There must be only one line and one value (like: 7.0) in this file.\n ### Otherwise it will be ignored.\n ###\n ### It is now possible to make all installed PHP-FPM versions available\n ### simultaneously for sites on the Octopus instance with additional\n ### control file:\n ###\n ### ~/static/control/multi-fpm.info\n ###\n ### This file, if exists, will switch all hosted sites to highest\n ### available PHP-FPM version within the 5.3-5.6 range, with ability\n ### to override PHP-FPM version per site, if the site's name is listed\n ### in this additional control file, as shown below:\n ###\n ### foo.com 7.0\n ### bar.com 5.5\n ### old.com 5.3\n ###\n ### NOTE: Each line in the multi-fpm.info file must start with main site name,\n ### followed by single space, and then the PHP-FPM version to use.\n ###\n\n\n ###\n#-### Support for PHP-CLI version switch per Octopus instance (all sites)\n ###\n\n ### ~/static/control/cli.info\n ###\n ### This file, while similar to fpm.info, if exists and contains supported\n ### and installed PHP version, will be used by running every 2-3 minutes\n ### system agent to switch PHP-CLI version for this Octopus instance, but\n ### it will do this for all hosted sites. There is no option to switch this\n ### or override per site hosted.\n ###\n ### NOTE: While current Ægir version 3.x included in BOA works fine with\n ### latest PHP 7.0, many hosted sites, especially using Pressflow 6 core or\n ### older Drupal 7 core without required patch we have included since 7.43.2,\n ### will not work properly and Ægir tasks run against those sites may fail,\n ### so it's recommended to use PHP-CLI 5.6, unless you have verified that all\n ### sites on the instance support PHP 7.0 without issues.\n ###\n ### Supported values which can be written in this file:\n ###\n ### 7.0\n ### 5.6\n ### 5.5\n ### 5.4\n ### 5.3\n ###\n ### There must be only one line and one value (like: 5.6) in this control file.\n ### Otherwise it will be ignored.\n ###\n\n\n ###\n#-### Support for forced Drush cache clear in the Ægir backend\n ###\n\n ### ~/static/control/clear-drush-cache.info\n ###\n ### Octopus instance will pause all scheduled tasks in its queue, if it will\n ### detect a platform build from the makefile in progress, to make sure\n ### that no other running task could break the build.\n ###\n ### This is great, until there will be a broken build, and Drush will fail\n ### to clean up all leftovers from its .tmp/cache directory, which in turn\n ### will pause all tasks in the queue for up to 24-48 hours, until the cache\n ### directory will be automatically purged by running daily cleanup tasks,\n ### designed to not touch anything not old enough (24 hours at minimum)\n ### to not break any running builds.\n ###\n ### If you need to unlock the tasks queue by forcefully removing everything\n ### from the Ægir backend Drush cache, you can create an empty control file:\n ### ~/static/control/clear-drush-cache.info\n ###\n\n\n ###\n#-### BOA can run Debian Wheezy to Debian Jessie upgrades easily\n ###\n\n This feature works like it worked before for `_LENNY_TO_SQUEEZE=YES` and then\n for `_SQUEEZE_TO_WHEEZY=YES`. But make sure you follow all the steps exactly\n as listed below:\n\n 1. Upgrade both barracuda and octopus to current stable:\n\n $ cd;wget -q -U iCab http://files.aegir.cc/BOA.sh.txt;bash BOA.sh.txt\n $ barracuda up-stable\n $ octopus up-stable all both\n\n NOTE: You can upgrade octopus selectively, if you still need one running\n the old stable BOA-2.4.9 version, example:\n\n $ octopus up-2.4 o1 force\n $ octopus up-stable o2 force\n $ octopus up-stable o3 force\n\n 2. Add to your /root/.barracuda.cnf this line:\n\n _WHEEZY_TO_JESSIE=YES\n\n 3. Run another barracuda upgrade with command:\n\n $ barracuda up-stable\n\n 4. If there are no errors reported, try to run manual update:\n\n $ aptitude update\n $ aptitude full-upgrade\n\n It should tell you that there are no packages to upgrade left.\n\n 5. Reboot your system (preferably via remote console)\n\n $ reboot\n\n 6. Run barracuda upgrade again:\n\n $ barracuda up-stable\n\n 7. Try to run manual update:\n\n $ aptitude update\n $ aptitude full-upgrade\n\n It should tell you that there are no packages to upgrade left.\n\n 8. Congrats! You are running BOA stable on Debian Jessie.\n\n\n# New features and enhancements:\n\n * Add all aliases as Subject Alternative Names in Let's encrypt certs -- #941\n * Add auto-renewal procedure for Let's encrypt certs -- #942\n * Add option to exclude *.tar.gz Drush archives in backboa -- #936\n * Add Restaurant 1.11\n * Add support for arbitrarily selected redirection targets as valid SSL names\n * Allow to define PHP-FPM version per site hosted -- #935\n * Allow to use drush7 and drush8 on command line directly\n * Even with redirection enabled all aliases are listed as SAN names -- #964\n * Feature: _WHEEZY_TO_JESSIE major upgrade procedure -- #870\n * Let's encrypt support -- #500\n * New Relic integration compatibility with multi-FPM mode\n * Support for forced Drush cache clear in the Ægir backend\n * Use Let's encrypt for Hostmaster site (after Octopus upgrade) -- #940\n\n# Changes:\n\n * Do not allow XtraDB to crash the server due to single broken cache table\n * Nginx: Use faster 301/302 redirects\n * Nginx: Use only TLSv1.1 TLSv1.2\n * Redis: Exclude cache_form bin again to avoid rare issues with contrib\n * Use dynamic httpredir.debian.org mirrors\n\n# System upgrades:\n\n * cURL 7.49.0 (if installed from sources)\n * Jetty 9.2.16.v20160414\n * Nginx 1.11.0\n * PHP 5.5.36\n * PHP 5.6.22\n * PHP 7.0.7\n * Redis 3.2.0\n * SLF4J 1.7.21\n\n# Fixes:\n\n * Add compatibility with \"config.sh\" renamed to \"config\" in letsencrypt.sh\n * Add ssl_trusted_certificate directive required by ssl_stapling\n * Add warning: \"Don't enable SSL option for the Hostmaster site in Ægir\" -- #962\n * Check if parent dir exists before touching ctrl file -- #945\n * Do not clear drush cache on every hosting-dispatch -- #943\n * Do not create Letsencrypt cert for Hostmaster if still in demo mode\n * Do not force PHP rebuild on new cURL install from sources\n * Drush is broken error -- clear drush cache before testing it -- #946\n * Fix for backward compatibility with FPM pool tpl in 2.4\n * Fix for Chive auth (via SSH) access filtering\n * Fix for conflicting Jetty libs\n * Fix ownership and attr on usr home dirs / subdirs\n * Improve sub-accounts zombie cleanup\n * Let's Encrypt SSL - switching from demo to live -- #959\n * Make backboa sub-tasks delays optional and disable them by default -- #919\n * Nginx: Fix for ssl_dhparam if/else logic\n * Remove deprecated wildcard HTTPS warning\n * Run registry-rebuild before updatedb with --no-cache-clear -- #938\n * Set LE mode to DEMO on initial setup -- both on octopus install and upgrade\n * Skynet upgrades for limited shell configuration -- #950\n * Something is stuck after BOA upgrade to 3.0.2 -- #951\n * The makefile based platform creation fails with permissions error -- #943\n * The site's files should have Ægir backend user as an owner\n * Use strict paths checks to avoid running chown/chmod on parent dirs\n\n# Known problems:\n\n https://github.com/omega8cc/boa/milestones/3.1.x\n\n\n### Stable BOA-3.0.2 Release - Full Edition\n### Date: Tue May 3 22:26:09 PDT 2016\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.0.2\n### Latest hotfix added on: Fri May 6 08:42:13 PDT 2016\n\n @=> Includes Ægir Hostmaster 3.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 8 customized for BOA\n\n# Release Notes:\n\n This BOA release includes several important system upgrades, improvements\n and bug fixes. All supported platforms have been updated to latest versions.\n\n @=> Latest Drupal 7 core version used in BOA in all built-in platforms is\n compatible with latest PHP 7.0.6 -- you can switch your Octopus instance\n easily via fpm.info control file: https://omega8.cc/node/330 but please\n don't use 7.0 in cli.info, because it is not supported in the Ægir\n backend yet. PHP 7.0 can't be used if you have any Pressflow 6 site.\n\n# New features and enhancements:\n\n * Add idna_convert to hostmaster for IDN domain names auto-conversion -- #916\n * Allow to disable redis.path.inc feature via INI variable -- #815\n * Drupal 7.43.2 (with PHP 7 compatibility patch)\n * PHP 7 compatibility improvements -- #716\n * Pressflow 6.38.2 (only version update)\n * Truncate giant watchdog tables\n\n# Changes:\n\n * Disable (temporarily) support for outdated ERPAL distro\n * Disable auto-upgrade for legacy Octopus instances\n * Disable page cache only in hostmaster\n * Disable PAMAuthentication in pure-ftpd\n * Force PHP 5.6 or 5.5 cli.info in Octopus 2.4.9\n * Force Redis SOCKET mode if PORT was used before\n * Redis module mod-03-05-2016\n * Redis: Limit methods to define site prefix\n * Redis: Use maxmemory-policy volatile-ttl\n * Set redis_client_base\n * Use Redis in hostmaster\n * Use standard profile by default\n\n# System upgrades:\n\n * Drush micro-8-24-04-2016\n * MariaDB 10.0.25\n * MariaDB 5.5.49\n * MariaDB Galera Cluster 10.0.25\n * Nginx 1.9.15\n * OpenSSL 1.0.2h (used only in custom built Nginx)\n * PHP 5.5.35\n * PHP 5.6.21\n * PHP 7.0.6\n\n# Fixes:\n\n * Add check_boa_php_compatibility() procedure -- fixes #906\n * Add patch for registration error (Commons)\n * Avoid duplicate entries in hosting_cron on hostmaster install -- #928\n * Cron not running on cloned sites -- fixes #922\n * Disable hosting-pause / Provision -- not needed in BOA, may hang upgrade\n * Do not force TERM\n * Do not set $conf['redis_eval_enabled'] = TRUE;\n * Enable _DEBUG_MODE=YES on Octopus upgrade from BOA-2.4.9\n * Experimental hosting_git error, platform not installed -- fixes #904\n * Improve the provision_autoload_register_prefix check\n * Make sure that auto-generated robots.txt is OK -- fixes #925\n * Make sure that hostmaster cron is never disabled\n * Make sure to not set PHP 7 as system default\n * Restart php-fpm on upgrade as soon as possible\n * Run registry-rebuild directly after hostmaster-migrate\n * Run update_php_cli_cron() twice\n * Use inetutils-syslogd on VZ systems -- fixes #905\n * Use syncpass during hostmaster upgrade\n * Workaround for hostmaster upgrade from 2.x\n\n# Known problems:\n\n https://github.com/omega8cc/boa/milestones/3.1.1\n\n\n### Stable BOA-3.0.1 Release - Full Edition\n### Date: Mon Apr 11 18:49:43 PDT 2016\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.0.1\n\n @=> Includes Ægir Hostmaster 3.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 8 customized for BOA\n\n# Release Notes:\n\n This BOA release includes important fixes and improvements in the upgrade\n procedure from BOA-2.4.9 and in the initial install procedures, along with\n support for latest Drupal 8.0.x and 8.1.x as custom platforms you can create\n in the ~/static directory tree. We list here also all hot-fixes applied\n after initial BOA-3.0.1 release.\n\n @=> BOA will not include built-in Drupal 8 platforms until Drupal 8 will\n support symlinks in the codebase, like all previous core versions.\n\n @=> Octopus Ægir instances hosted on Power Engine option will *not* receive\n upgrade to BOA-3.x unless requested via https://omega8.cc/support\n to prevent issues with (often) customized Hostmaster modules not ready\n for Drupal 7 based Ægir control panel. All hosted BOA systems will still\n continue to receive the Barracuda system upgrades.\n\n @=> It is possible to host previous stable BOA-2.4.9 Octopus instances\n on systems with Barracuda upgraded to BOA-3.0.1\n\n# Known problems:\n\n https://github.com/omega8cc/boa/milestones/3.0.2\n\n# New features and enhancements:\n\n * Allow boa in-octopus to specify version {stable|head|2.4}\n\n# Changes:\n\n * Allow to execute compass over SSH\n * Allow to upload dot-files via SFTP\n * Remove/don't install not used blocks in Hostmaster\n\n# System upgrades:\n\n * Add mydropwizard-6.x-1.4 to all existing D6 platforms\n * Drush micro-8-08-04-2016\n * Lshell 0.9.18.3 -- #895\n * Nginx 1.9.14\n * PHP 5.5.34\n * PHP 5.6.20\n * PHP 7.0.5 (for testing only)\n * Redis module 7.x-3.12\n\n# Fixes:\n\n * 3.0.0 clean install is broken -- #899\n * boa in-2.4 fails to install on Debian Jessie -- #898\n * Can't git pull -- #890\n * CiviCRM error on verification D6 site -- #897\n * D7 API compatibility fix for node_save() in Hostmaster\n * Do not switch default PHP to 7.0 if installed\n * Drush issues: no aliases available -- #887\n * Fix for 3.x to 3.x upgrades\n * Fix for FPM master proc monitor\n * Fix for input filters upgrade path\n * Fix for series test to avoid downgrade attempts\n * Fix the legacy install mode -- #898\n * Less and more no longer allowed -- #896\n * Limit the list of allowed_shell_escape commands\n * Missing VBO options -- #892\n * Overlay header title not showing -- #889\n * Problems installing rvm / compass -- #895\n * Remove deprecated sftp restriction\n * Require BOA-2.4.9 before upgrade to BOA-3.x also in barracuda -- #886\n * Switch octopus upgrade mode automatically to legacy if needed\n * tar and gunzip fails because of permission denied -- #894\n * Use Drush 8 on command line -- #887\n * vi and vim both open nano instead of vim -- #893\n\n\n### Stable BOA-3.0.0 Release - Full Edition\n### Date: Wed Mar 30 10:48:54 PDT 2016\n### Milestone URL: https://github.com/omega8cc/boa/milestones/3.0.0\n### Latest hotfix added on: Wed Apr 6 17:40:12 PDT 2016\n\n @=> Includes Ægir Hostmaster 3.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 8 customized for BOA\n\n# Release Notes:\n\n This BOA release includes complete Ægir 3 with Drush 8, and introduces\n full support for latest Drupal 8.0.5 and Drupal 8.1.0-beta2 as custom\n platforms you can create in the ~/static directory tree.\n\n @=> BOA will not include built-in Drupal 8 platforms until Drupal 8 will\n support symlinks in the codebase, like all previous core versions.\n\n @=> All supported Ægir platforms have been updated to their latest releases\n\n @=> Octopus Ægir instances hosted on Power Engine option will *not* receive\n upgrade to BOA-3.x unless requested via https://omega8.cc/support\n to prevent issues with (often) customized Hostmaster modules not ready\n for Drupal 7 based Ægir control panel. All hosted BOA systems will still\n continue to receive the Barracuda system upgrades.\n\n @=> It is possible to host previous stable BOA-2.4.9 Octopus instances\n on systems with Barracuda upgraded to BOA-3.0.0\n\n# Known problems:\n\n https://github.com/omega8cc/boa/milestones/3.0.1\n\n While clean 3.0.0 install worked in our tests before the release, it doesn't\n work for others. Until this problem is fixed properly without regressions,\n we are switching boa installer back to 2.4.9, which makes getting 3.0.0\n on initial installation a two step operation: first 'boa in-stable' install\n to get 2.4.9, and then 'barracuda up-stable' plus 'octopus up-stable' upgrade\n to get 3.0.0, because upgrades for barracuda and octopus from 2.4.9 to 3.0.0\n work fine.\n\n This also means that 'boa in-octopus' will still install the legacy 2.4.9\n octopus extra instances, and you can upgrade them to 3.0.0 with standard\n 'octopus up-stable' mode.\n\n It is still possible to test/debug boa 3.0.0 clean installs -- just create\n an empty /root/.debug-boa-installer.cnf file before running the installer.\n\n# New features and enhancements:\n\n * Add Hosting Git optional feature -- fixes #753\n * Add mydropwizard module to D6 o_contrib by default\n * Add support for ap-northeast-2 Asia Pacific (Seoul) S3\n * Add support for PHP 7.0 -- experimental ! -- fixes #716\n * Add support for VServer kernel 4.1.19-vs2.3.8.4-beng\n * BOA with Ægir Hostmaster 3.x -- fixes #715\n * Switch to Drush 8 for Drupal 8 -- fixes #729\n * Allow to randomize duplicity full backup schedule\n * Monitor and block SSH connections flood\n * Run registry-rebuild in drush_provision_drupal_post_provision_deploy()\n\n# Changes:\n\n * Add linkchecker module to Contrib [F]orce[D]isabled\n * Deny sudo/su switch if used for root access - fixes #879\n * Do not install / remove auditd on VServer systems\n * Do not install / remove udev on VServer systems\n * Merge hosting_advanced_cron into Ægir core cron\n * Use Redis 7.x-3.x integration module\n\n# System upgrades:\n\n * Boto 2.39.0-fix-python-2.7.9 (please run 'backboa install' to upgrade)\n * CSF 8.16\n * Drush mini-8-08-03-2016\n * Duplicity 0.7.06 (please run 'backboa install' to upgrade)\n * Lshell 0.9.18.3\n * MongoDB database driver 1.6.13 for all PHP versions < 7 -- fixes #521\n * Nginx 1.9.14\n * OpenSSH 7.2p2 (if installed from sources)\n * OpenSSL 1.0.2g (used only in custom built Nginx)\n * PHP 5.5.34\n * PHP 5.6.20\n * PHP 7.0.5 (for testing only)\n * Twig C extension for PHP - v.1.24.0\n * Use PHP jsmin 2.0.1 ext with newer PHP versions - fixes #878\n\n# Fixes:\n\n * [system] sync fix_locales for root -- fixes #880\n * Add mydropwizard-6.x-1.4 to all existing D6 platforms\n * Auto-Update lshell.conf on all systems\n * Fix for 3.x to 3.x upgrades\n * Fix for entitycache 1.2 to 1.5 upgrade problem #868\n * Fix for FPM master proc monitor\n * Fix for series test to avoid downgrade attempts\n * Numerous lshell problems -- fixes #896 #895 #894 #893 #890\n * Problems installing rvm / compass -- fixes #895\n * Require 2.4.9 before upgrade to 3.0.0 also in barracuda -- fixes #886\n * Restart rsyslog/sysklogd aggressively enough\n * Switch boa meta installer to 2.4.9 until #899 is fixed\n * Switch octopus upgrade mode automatically to legacy if needed\n * Sync max_user_connections\n * Update map $http_user_agent $is_crawler\n * Use Drush 7 on command line until #887 is fixed\n\n\n### Stable BOA-2.4.9 Release - Full Edition\n### Date: Sat Feb 27 15:22:11 GMT 2016\n### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.9\n\n @=> Includes Ægir Hostmaster 2.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 7 customized for BOA\n\n# Release Notes:\n\n This BOA release includes latest Drupal 7 and Pressflow 6 security updates,\n along with bug fixes and other system software updates.\n\n @=> All supported Ægir platforms have been updated to their latest releases\n\n @=> What are BOA plans for Drupal 6 support after February 24th, 2016?\n\n We will support Drupal/Pressflow 6 in all new releases, as long as\n available PHP versions will allow to use it (we run our own Pressflow 6\n based site on PHP 5.6 for many months with zero issues). For more details\n please check: https://github.com/omega8cc/boa/issues/824\n\n @=> Even if deprecated PHP versions are still included in this release,\n any Octopus instance running PHP older than 5.5 will not be able to\n receive upgrade to BOA-2.4.9, as announced before -- Please switch your\n Octopus to PHP 5.6 or at least 5.5 to be able to upgrade not only\n the Barracuda system part of BOA, but also Octopus Satellite --\n The how-to can be found at: https://omega8.cc/node/330\n\n @=> Drupal 8 support for custom platforms in the ~/static directory tree\n will be included, along with Drush 8 and Hostmaster 3.x in the upcoming\n BOA-3.0.0 release: https://github.com/omega8cc/boa/milestones/3.0.0\n Note: BOA will not include built-in Drupal 8 platforms until Drupal 8\n will support symlinks in the codebase, like all previous core versions\n\n# System upgrades:\n\n * MariaDB Galera Cluster 10.0.24\n * Nginx 1.9.12\n\n# Fixes:\n\n * Do not force Ruby with RVM for root on every upgrade\n * SQL max_user_connections autoconf value can be too low -- fixes #873\n\n\n### Stable BOA-2.4.8 Release - Full Edition\n### Date: Sat Feb 20 11:28:05 GMT 2016\n### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.8\n### Latest hotfix added on: Mon Feb 22 18:28:51 GMT 2016\n\n @=> Includes Ægir Hostmaster 2.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 7 customized for BOA\n\n# Release Notes:\n\n This BOA release includes several important system upgrades and bug fixes,\n with most notable features and changes listed below.\n\n @=> Debian 8 Jessie is fully supported, but includes only PHP 5.5 and 5.6\n\n @=> All supported Ægir platforms have been updated with latest Drupal cores\n\n @=> Even if deprecated PHP versions are still included in this release,\n any Octopus instance running PHP older than 5.5 will not be able to\n receive upgrade to BOA-2.4.8, as announced before -- Please switch your\n Octopus to PHP 5.6 or at least 5.5 to be able to upgrade not only\n the Barracuda system part of BOA, but also Octopus Satellite --\n The how-to can be found at: https://omega8.cc/node/330\n\n @=> Drupal 8 support for custom platforms in the ~/static directory tree\n will be included, along with Drush 8 and PHP 7 in the *upcoming*\n BOA-3.0.0 release: https://github.com/omega8cc/boa/milestones/3.0.0\n Note: BOA will not include built-in Drupal 8 platforms until Drupal 8\n will support symlinks in the codebase, like all previous core versions\n\n @=> What are BOA plans for Drupal 6 support after February 24th, 2016?\n\n We will support Drupal/Pressflow 6 in all new releases, as long as\n available PHP versions will allow to use it (we run our own Pressflow 6\n based site on PHP 5.6 for many months with zero issues). For more details\n please check: https://github.com/omega8cc/boa/issues/824\n\n# Changes:\n\n * Add \"boa info\" and 'boa info more' helper command\n * Add branch support in the boa wrapper\n * Allow to force re-install with /root/.force.reinstall.cnf present\n * Allow to run existing Octopus 2.4 on the upcoming Barracuda 3.0\n * Deny Octopus upgrade unless it is running on a compatible PHP version 5.5+\n * Full backboa backups are scheduled on Sunday, unless custom _AWS_FLC is set\n * Full duobackboa backups will run on Saturday, unless custom _AWS_FLC is set\n * Make base nice configurable via _B_NICE variable\n * Nginx: Sync htaccess level protection with Drupal core\n * Nginx: Update map $http_user_agent $is_crawler\n * Only instance already running 2.4.8 can upgrade to upcoming 3.0.0\n * Remove no longer supported T1lib in PHP\n * Remove support for deprecated OS versions -- fixes #802\n * Replace in-legacy and up-legacy with version specific commands\n * Revert \"Issue #2377819: Gzipping backups suppresses file permissions errors\"\n * Run minimal modules en/dis procedure on Wednesday and full on Saturday\n * Skip legacy PHP 5.3 and 5.4 on Jessie\n * Support for Debian 8 Jessie -- fixes #702\n * The _MODULES_FIX variable is set to YES by default\n * The _PERMISSIONS_FIX variable is set to YES by default -- fixes #593\n\n# System upgrades:\n\n * Git 2.7.0 (if installed from sources)\n * MariaDB 10.0.24\n * MariaDB 5.5.48\n * Nginx 1.9.11\n * OpenSSH 7.1p2 (if installed from sources)\n * OpenSSL 1.0.2f (used only in custom built Nginx)\n * PHP 5.5.32\n * PHP 5.6.18\n * PHP: Imagick 3.3.0\n * Redis 3.0.7\n * Ruby 2.3.0\n\n# Fixes:\n\n * Add duobackboa docs\n * Add missing libs in Jessie\n * Allow to install a specific PHP version on a local install -- fixes #848\n * Allow to run upgrade from not really 3.x HEAD to 2.4.8\n * Automate /root/.force.reinstall.cnf and improve docs\n * Disable Octopus 3.x specific version check (tmp) for 2.4.8\n * Disable spinner on Jessie\n * Do not force rebuild on systems installed with 2.4.8\n * Do not kill long running php-fpm childs\n * Do not run the old D7 core fix on newer BOA versions -- fixes #842\n * Do not wait for simple sed replacements -- fixes #838\n * Fix a typo in some locCnf variable calls -- fixes #854\n * Fix for ignored boa_platform_control.ini\n * Fix for MariaDB version check\n * Fix for not working S3 bucket connection test\n * Fix for process.max and pm.max_children\n * Fix for undefined locCnf variable in BOND - fixes #748\n * Fix the logic in mysql_proc_kill()\n * Fix too aggressive Jetty monitoring\n * Force clean rsyslog/sysklogd restart if required\n * Force rebuild for affected services built from sources -- CVE-2015-7547\n * Improve backup sub-tasks randomized schedule\n * Improve initial install how-to with screen\n * Locales check should not be used with screen session -- fixes #871\n * Nginx: Remove duplicate $args on redirects\n * Nginx: Workaround for broken autocomplete\n * Remove dependency on _MODULES_FIX=YES -- fixes #592\n * Remove no longer used _SSL_FROM_SOURCES logic\n * Remove systemd on Debian Jessie -- fixes #840\n * Restart syslog hourly\n * Run drush cache cleanup only once per account\n * Speed up backup tasks by removing extra conn_test\n * Speed up backup tasks by running extended cleanup and reporting weekly\n * Speed up initial setup procedure\n * Sync wait randomizer max value\n * Upgrade wkhtmltopdf and wkhtmltoimage to 0.12.3 - fixes #858\n * Use date %u day of week (1..7); 1 is Monday\n * Whitelist missing upload progress path\n\n\n### Stable BOA-2.4.7 Release - Full Edition\n### Date: Fri Dec 4 08:09:21 PST 2015\n### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.7\n### Latest hotfix added on: Thu Dec 10 10:10:26 PST 2015\n\n @=> Includes Ægir Hostmaster 2.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 7 customized for BOA\n\n# Release Notes:\n\n This BOA release includes several important system upgrades and bug fixes,\n with most notable features and changes listed below.\n\n @=> All supported Ægir platforms have been updated with latest Drupal cores\n\n @=> Drupal 8 support for custom platforms in the ~/static directory tree\n will be included, along with Drush 8 and PHP 7 in the *upcoming*\n BOA-3.0.0 release: https://github.com/omega8cc/boa/milestones/3.0.0\n\n @=> This BOA release (2.4.7) is the last release which still supports\n deprecated PHP versions: 5.3 and 5.4 -- You should switch to PHP 5.6\n or at least 5.5 as soon as possible, or you will not be able to upgrade\n to newer BOA versions after 2.4.7 -- https://omega8.cc/node/330\n\n @=> What are BOA plans for Drupal 6 support after February 24th, 2016?\n\n We will support Drupal/Pressflow 6 in all new releases, as long as\n available PHP versions will allow to use it (we run our own Pressflow 6\n based site on PHP 5.6 for many months with zero issues). For more details\n please check: https://github.com/omega8cc/boa/issues/824\n\n @=> SSH (RSA) keys for root are required by newer OpenSSH versions used in BOA\n\n BOA installs SSH from sources by default (Debian only). This means that\n password based access for root will not work once BOA is installed or\n upgraded to current stable version. It is a result of OpenSSH changes\n in recent releases and not BOA specific change. BOA will deny the initial\n install and Barracuda will refuse to run upgrade if it detects that system\n root has no SSH (RSA) keys added and only password based access is available.\n You can still modify this behaviour in /usr/etc/sshd_config but future\n OpenSSH versions may still revert such changes, so it is not recommended.\n\n @=> BOA switched from SPDY to HTTP/2 + PFS on all supported OS versions\n\n# Changes:\n\n * Allow to disable SQL monitoring with /root/.no.sql.cpu.limit.cnf -- #799\n * Disable page caching on the fly where needed\n * Disable temporarily support for broken Restaurant distro\n * Do not rebuild features and entities on cache clear\n * Document new requirement: SSH (RSA) keys for root -- fixes #786 #833\n * Make ioncube_loader optional and disable by default with _PHP_IONCUBE=NO\n * Nginx SSL: enable OCSP stapling by default\n * Nginx SSL: enable OCSP stapling for existing HTTPS vhosts\n * Nginx: Add ssl_dhparam to existing vhosts, if needed\n * Nginx: HTTP/2 replaces SPDY -- fixes #624\n * PHP: Add YAML extension with LibYAML\n * Preserve customized /etc/sysctl.conf -- fixes #789\n * Run modules ON/OFF only weekly -- requires _MODULES_FIX=YES (default is NO)\n * Run most of crontab, install and upgrade tasks with low priority using\n nice and ionice -- fixes #780\n\n# System upgrades:\n\n * cURL 7.45.0 (if installed from sources)\n * GEOS 3.5.0 (requires _PHP_GEOS=YES)\n * Git 2.6.1 (if installed from sources)\n * MariaDB 10.0.22\n * MariaDB 5.5.47\n * MariaDB Galera Cluster 10.0.22\n * Nginx 1.9.7\n * OpenSSL 1.0.2e (used only in custom built Nginx)\n * PHP 5.5.30\n * PHP 5.6.16\n * Redis 3.0.5\n\n# Fixes:\n\n * Add /root/.skip_cleanup.cnf support\n * Add feature branch testing in HEAD\n * Avoid load spikes caused by long running tasks\n * Avoid race conditions on multi-line sed replacement -- fixes #806\n * Clean up any remaining procs zombies\n * Clean up postfix queue to get rid of bounced emails\n * Disable ioncube and opcache for HHVM\n * Disable Redis for Hostmaster in the backend\n * Do not allow to install non-standard OpenSSH on Ubuntu\n * Do not break /data/all/cpuinfo permissions on Octopus upgrade\n * Do not run 'apt-get autoremove' automatically\n * Do not use wrapper for dot-files cleanup\n * Document better BOA aggressive installation behavior -- fixes #811\n * Document boa in-octopus command -- fixes #817\n * Don't strip $args from $request_uri in redirects\n * Fix cron schedule for upgrades\n * Fix for /etc/sudoers on _SQUEEZE_TO_WHEEZY\n * Fix for broken Git on Ubuntu\n * Fix for DNS on _SQUEEZE_TO_WHEEZY\n * Fix for not working PHP rebuild check\n * Fix for not working syncpass tool\n * Fix for Ruby rebuild on _SQUEEZE_TO_WHEEZY\n * Fix PHP deprecated warning in D8 -- fixes #804\n * Ignore 'env COLUMNS' sent by Drush remotely -- fixes #373\n * Ignore daily.sh in clear.sh\n * Improve _SQUEEZE_TO_WHEEZY procedure -- #627\n * Improve cron tasks schedule\n * Improve daily cleanup performance + support for /root/.giant_traffic.cnf\n * Improve devpts check -- fixes #788\n * Improve docs/MIGRATE.txt\n * Improve resolv.conf auto-recovery procedure\n * Improve system check -- fixes #811\n * Move Redis restart procedure to correct script\n * PHP: Add missing path to open_basedir for CLI\n * Remove debug code to not kill the initial install\n * Remove not working /etc/logrotate.d/lshell -- fixes #823\n * Update advagg auto configuration variables -- fixes #792\n * Update boa/lib/functions/helper.sh.inc with current OS -- fixes #787\n * Update FPM workers autoconf logic\n * Update the cache cleanup logic\n * Use better placeholder for solr_integration_module variable\n * Use correct DPkg::Options for dist-upgrade -- fixes #627\n * Use known MySQLTuner version -- fixes #827\n * Use LibYAML 0.1.6\n * Use opcache.restrict_api\n * Use sha256 for self-signed certs\n\n\n### Stable BOA-2.4.6 Release - Full Edition\n### Date: Sat Sep 19 11:09:09 PDT 2015\n### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.6\n### Latest hotfix added on: Mon Sep 21 05:18:33 PDT 2015\n\n @=> Includes Ægir Hostmaster 2.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 7 customized for BOA\n\n# Release Notes:\n\n This BOA release includes several important system upgrades and bug fixes.\n All supported Ægir platforms have been updated with latest Drupal cores.\n\n# Changes:\n\n * Add Twig C extension to PHP - v.1.22.1\n * Allow to customize auto-upgrades mode\n * Disable support for broken OpenScholar and Recruiter\n * Open default Postgres port for outgoing connections\n * Remove support for deprecated Feature Server distro\n * Remove support for deprecated OpenAcademy distro\n * Remove support for deprecated OpenBlog distro\n * Remove support for deprecated OpenChurch v.1 distro\n * Remove support for deprecated OpenDeals distro\n * Use distro specific Drupal core for problematic distros\n\n# System upgrades:\n\n * cURL 7.44.0 (if installed from sources)\n * Duplicity 0.7.05 (please run 'backboa install' to upgrade)\n * Jetty 7.6.17.v20150415\n * Jetty 8.1.17.v20150415\n * MariaDB 10.0.21\n * MariaDB 5.5.45\n * MariaDB Galera Cluster 10.0.21\n * Nginx 1.9.4\n * OpenSSH 7.1p1 (if installed from sources)\n * PHP 5.6.13, 5.5.29, 5.4.45\n * PHP: ionCube loader 5.0.18\n * Pure-FTPd 1.0.42\n * Redis 3.0.4\n * Ruby 2.2.3, 2.0.0-p647\n * Use pecl-jsmin-1.1.0\n\n# Fixes:\n\n * Allow to re-install deleted D7/D6 platforms when dev doesn't exist\n * Do not install phpunit -- it adds many PHP tools we don't need\n * Drush requires php-eval to run drush_find_tmp() in sql-sync\n * Fix apache cleanup\n * Fix invalid regex in the INI docs\n * Improve auto-healing for SSHd\n * Improve Nginx DoS an DDoS protection\n * Improve pdnsd auto-healing\n * Improve SSL Docs to add more detail about multidomain certificates #757\n * Issue #766 - Fix for broken boa in-octopus procedure\n * Nginx: Fix support for s3/files/styles (s3fs)\n * Restart PHP-FPM if too many running childs are detected\n * Sync .htaccess with D7 core\n * Sync keywords for exceptions in daily.sh with global.inc\n * Use short sleep on firewall temp blocks cleanup\n\n\n### Stable BOA-2.4.5 Release - Full Edition\n### Date: Fri Jul 10 11:25:43 PDT 2015\n### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.5\n### Latest hotfix added on: Fri Jul 10 14:49:11 PDT 2015\n\n @=> Includes Ægir Hostmaster 2.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 7 customized for BOA\n\n# Release Notes:\n\n This BOA release includes PHP security upgrade for versions 5.6, 5.5 and 5.4\n plus security upgrade for Redis server and four updated Octopus platforms.\n\n Support for Drupal 8 is temporarily removed, because now it would require\n an upgrade to Drush 8, which in turn completely removes support for PHP 5.3,\n while it's still more important to support legacy Pressflow 6 sites, if they\n are not ready to move beyond PHP 5.3 yet, than trying to support some\n (too fast) moving targets like Drupal 8 beta, and Drush 8 head.\n\n# Updated Octopus platforms:\n\n Commerce 2.26 ---------------- https://drupal.org/project/commerce_kickstart\n Commons 3.28 ----------------- https://drupal.org/project/commons\n OpenAtrium 2.43 -------------- https://drupal.org/project/openatrium\n Panopoly 1.25 ---------------- https://drupal.org/project/panopoly\n\n# Changes:\n\n * Drupal 8 is not supported until we can switch to Drush 8 and remove PHP 5.3\n\n# System upgrades:\n\n * Nginx 1.9.2\n * PHP 5.4.43\n * PHP 5.5.27\n * PHP 5.6.11\n * Redis 3.0.2\n\n\n### Stable BOA-2.4.4 Release - Full Edition\n### Date: Fri Jul 3 12:08:29 PDT 2015\n### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.4\n### Latest hotfix added on: Thu Jul 9 10:28:42 PDT 2015\n\n @=> Includes Ægir Hostmaster 2.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 7 customized for BOA\n\n# Release Notes:\n\n This BOA release includes several important system upgrades and bug fixes.\n\n All supported Ægir platforms have been updated with latest Drupal cores.\n\n This version automatically switches all hosted sites to PHP 5.5 on systems\n hosted and managed remotely by Omega8.cc support team, unless you have\n explicitly switched your Octopus instance to use PHP version you prefer.\n Using PHP older than 5.5 is strongly discouraged, for security, stability and\n performance reasons.\n\n# Changes:\n\n * Do not change mysql root password by default -- workaround for #642\n * Enable advagg_async_generation by default\n * Logic update for /root/.high_traffic.cnf\n * Redis Integration Module: Update to version mod-26-06-2015\n * Use modern ssl_ciphers in all templates by default\n\n# System upgrades:\n\n * cURL 7.43.0 (if installed from sources)\n * Drush mini-7-30-06-2015 -- fixes #734\n * MariaDB 5.5.44\n * MariaDB Galera Cluster 10.0.20\n * Nginx 1.9.1\n * OpenSSH 6.9p1 (if installed from sources)\n * OpenSSL 1.0.1p (if installed from sources)\n * PHP 5.4.42\n * PHP 5.5.26\n * PHP 5.6.10\n * PHPRedis master-27-06-2015\n * Pure-FTPd 1.0.41\n * vnStat 1.14\n\n# Fixes:\n\n * Add 'grep' to overssh -- a list of commands allowed to execute over SSH\n * Broken pdnsd configuration breaks DNS resolver -- fixes #701\n * Do not force update_agents()\n * Do not modify rkey/debug args in barracuda log/system upgrade mode\n * Don't remove Drupal 6 core themes -- fixes #738\n * Fix for legacy vnStat config\n * Fixed backboa/duobackboa retrieve from remote host -- fixes #741\n * Improve system cron tasks queue\n * Incorrect permissions on /usr/bin/optipng - fixes #722\n * Mitigate LOGJAM - fixes #723\n * Restart Postfix after system DNS update -- #701\n * Skip daily reload on high traffic instances\n * Sync SQL connection limits with _PHP_FPM_WORKERS variable - fixes #699\n * Use _AWS_URL to properly handle us-east-1 exception\n * Use 2048 bit where possible - see #723\n * Use better default value for advagg_cache_level - fixes #726\n\n\n### Stable BOA-2.4.3 Release - Full Edition\n### Date: Tue May 19 13:40:40 PDT 2015\n### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.3\n### Latest hotfix added on: Fri Jun 5 04:43:50 PDT 2015\n\n @=> Includes Ægir Hostmaster 2.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 7 customized for BOA\n\n# Release Notes:\n\n This BOA release is focused on Ægir platforms update with latest Drupal core\n included. There are also a few system updates and bug fixes, as listed below.\n\n# Changes:\n\n * Redis Integration Module: Update to version mod-08-05-2015\n * Use HTTPS intermediate mode to support legacy systems like XP/IE8 - see #718\n\n# System upgrades:\n\n * Drush mini-7-08-05-2015\n * MariaDB 10.0.19\n * MariaDB Galera Cluster 10.0.19\n * PHP 5.4.41\n * PHP 5.5.25\n * PHP 5.6.9\n * Redis 3.0.1\n\n# Fixes:\n\n * CiviCRM known bugs and regressions fixed\n * Improve drush aliases cleanup\n * Redis: sync net.core.somaxconn with tcp-backlog\n * sqlmagic: do not escape backslashes and EOL character - fixes #672\n * SQL dump definer regexp causes invalid SQL during migrate/clone - #2497091\n * Fix for backward compatibility with old Galera versions\n\n\n### Stable BOA-2.4.2 Release - Full Edition\n### Date: Mon Apr 27 11:12:09 PDT 2015\n### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.2\n### Latest hotfix added on: Fri May 1 02:07:54 PDT 2015\n\n @=> Includes Ægir Hostmaster 2.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 7 customized for BOA\n\n# Release Notes:\n\n This BOA release includes 15 updated Ægir platforms with latest Drupal core,\n 2 new features and enhancements, 13 new software versions, 3 other changes,\n plus over 20 bug fixes.\n\n# Updated Octopus platforms:\n\n aGov 1.7 --------------------- https://drupal.org/project/agov\n Commerce 1.36 ---------------- https://drupal.org/project/commerce_kickstart\n Commerce 2.23 ---------------- https://drupal.org/project/commerce_kickstart\n Commons 2.24 ----------------- https://drupal.org/project/commons\n Commons 3.25 ----------------- https://drupal.org/project/commons\n Guardr 2.11 ------------------ https://drupal.org/project/guardr\n OpenAid 2.1 ------------------ https://drupal.org/project/openaid\n OpenAtrium 2.33 -------------- https://drupal.org/project/openatrium\n OpenChurch 1.17-b2 ----------- https://drupal.org/project/openchurch\n OpenChurch 2.1-b7 ------------ https://drupal.org/project/openchurch\n OpenOutreach 1.19 ------------ https://drupal.org/project/openoutreach\n OpenPublic 1.5 --------------- https://drupal.org/project/openpublic\n Panopoly 1.21 ---------------- https://drupal.org/project/panopoly\n Recruiter 1.6 ---------------- https://drupal.org/project/recruiter\n Restaurant 1.0-b12 ----------- https://drupal.org/project/restaurant\n\n @=> NOTE: Drupal 8 support is broken in this release, because latest Drush\n doesn't support older Drupal 8 beta versions, while new D8 beta is not\n released and tested yet, and we really need latest Drush to fix broken\n D6->D7 upgrade path, so we could prepare for full Ægir 3, which comes\n with D7 in the frontend.\n\n# New features and enhancements:\n\n * Re-create files/robots.txt if older than 7 days\n * Restore default DNS when /root/.use.default.nameservers.cnf exists\n\n# Changes:\n\n * Enable SPDY and PFS by default - fixes #545\n * Use GitLab as a secondary mirror\n * Whitelist drush pm-updatestatus\n\n# System upgrades:\n\n * cURL 7.42.1 (if installed from sources)\n * Drush mini-7-25-04-2015\n * Duplicity 0.7.02 (please run 'backboa install' to upgrade)\n * MariaDB 5.5.43\n * MariaDB Galera Cluster 10.0.17\n * MySecureShell master-20-03-2015\n * Nginx 1.8.0\n * OpenSSH 6.8p1 (if installed from sources)\n * OpenSSL 1.0.2a (if installed from sources)\n * PHP 5.6.8, 5.5.24, 5.4.40\n * PHPRedis master-18-03-2015\n * Redis 3.0.0\n * Ruby 2.2.2\n\n# Fixes:\n\n * Add service cron start to migrate docs - fixes #654\n * BOA.sh.txt should update installers when invoked interactively - fixes #644\n * Do not add Google DNS when custom DNS is expected\n * Do not count requests for images derivatives if private files mode is used\n * Do not create conflicting plain HTTP proxy for single IP mode - fixes #465\n * Force csf/lfd update before and after running barracuda upgrade - fixes #685\n * How to enable permanent redirect to HTTPS with single IP - #465\n * Improve DNS self-healing magic - see #674\n * Improve FPM auto-healing to properly detect conflicting instances\n * Make sure that dl mirrors never get blocked\n * Nginx: Stop the POST flood to /autodiscover/autodiscover.xml\n * Nginx: Use dummy db fastcgi_param placeholders if any of them is empty\n * Remove aggresive firewall cleanup - fixes #688\n * Remove onetime fix intended to sync new defaults - fixes #678\n * Update absolute URLs to files for sites cloned/migrated/renamed\n * Update composer on barracuda upgrade\n * Use _TOMCAT_TO_JETTY=NO in cnf template to avoid confusion - see #676\n * Use correct placeholder in the xboa proxy - fixes #655\n * Use MAIN_SITE_NAME instead of possibly fake SERVER_NAME - see #385\n * Where to add the SSL redirect configuration snippet - fixes #681\n\n\n### Stable BOA-2.4.1 Release - Full Edition\n### Date: Sun Mar 8 14:56:51 PDT 2015\n### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.1\n### Latest hotfix added on: Wed Mar 11 11:58:52 PDT 2015\n\n @=> Includes Ægir Hostmaster 2.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 7.0.0-alpha9 customized for BOA\n\n# Release Notes:\n\n This new BOA release includes one new and 12 updated Ægir platforms,\n 8 new features and enhancements, 15 new software versions, 10 other changes,\n plus over 38 bug fixes, with most notable features and changes listed below:\n\n @=> Add duobackboa with /root/.duobackboa.cnf file to run duplicate backups\n @=> Add SSL with TLS/SNI on server with one IP, multiple certificates support\n @=> Add support for Octopus batch migration - see docs/MIGRATE.txt for details\n @=> Allow to use _PHP_GEOS=YES with all PHP versions\n\n# New Octopus platforms:\n\n OpenAid 2.0 ------------------ https://drupal.org/project/openaid\n\n# Updated Octopus platforms:\n\n Commerce 1.33 ---------------- https://drupal.org/project/commerce_kickstart\n Commerce 2.21 ---------------- https://drupal.org/project/commerce_kickstart\n Commons 2.22 ----------------- https://drupal.org/project/commons\n Commons 3.22 ----------------- https://drupal.org/project/commons\n Drupal 8.0.0-b7 -------------- https://drupal.org/drupal-8.0\n Guardr 2.8 ------------------- https://drupal.org/project/guardr\n OpenAtrium 2.32 -------------- https://drupal.org/project/openatrium\n OpenChurch 2.1-b5 ------------ https://drupal.org/project/openchurch\n OpenOutreach 1.16 ------------ https://drupal.org/project/openoutreach\n OpenScholar 3.20.0 ----------- http://theopenscholar.org\n Panopoly 1.18 ---------------- https://drupal.org/project/panopoly\n Recruiter 1.5 ---------------- https://drupal.org/project/recruiter\n\n# New features and enhancements:\n\n * Add compatibility with latest VS beng kernel\n * Add duobackboa with /root/.duobackboa.cnf file to run duplicate backups\n * Add support for multivalued fields in SOLR 4 - pull request #626\n * Add support for mysqladmin proc logging\n * Add support for Octopus batch migration - see docs/MIGRATE.txt for details\n * Add support for scout/mysql monitoring\n * CSF: Add popular ports 222 and 2222 to TCP_OUT by default\n * SSL with TLS/SNI on server with one IP, multiple certificates - fixes #465\n\n# Changes:\n\n * Allow to run automated SQL conversion only weekly\n * Allow to use _PHP_GEOS=YES with all PHP versions\n * Do not send extra nocache cookie on GET requests\n * Drush mini-7-07-03-2015\n * Make barracuda wrapper available on initial install to avoid confusion\n * Nginx: Update for crawlers exceptions list\n * Redis Integration Module: Update to version mod-05-03-2015\n * Remove dependency on legacy Drush 4\n * Use latest Apache Solr Search 6.x-3.x config\n * Use latest Apache Solr Search 7.x-1.x config\n\n# System upgrades:\n\n * Apache Solr 4.9.1\n * cURL 7.41.0 (if installed from sources)\n * Git 2.3.0 (if installed from sources)\n * Jetty 9.2.7.v20150116\n * MariaDB 10.0.17\n * MariaDB 5.5.42\n * MariaDB Galera Cluster 10.0.17\n * Nginx 1.7.10\n * OpenSSL 1.0.2 (if installed from sources)\n * PHP 5.4.38\n * PHP 5.5.22\n * PHP 5.6.6\n * PHP: ionCube loader 4.7.4\n * Pure-FTPd 1.0.37\n * Ruby 2.2.1\n * Use duplicity 0.7.01 and boto 2.36.0 - fixes #630\n * Vnstat 1.13\n\n# Fixes:\n\n * [provision] False \"load on system too heavy\" messages - fixes #619\n * [provision] Issue #2350695 - Profile is registered twice, also as a module\n * [provision] Nginx: Remove webform keyword from regex locations - fixes #599\n * Add also manage_ltd_users to the list - fixes #616\n * Avoid installing New Relic with no valid license key provided - fixes #608\n * Do not add no longer used symlink\n * Do not create conflicting plain HTTP proxy for single IP mode - fixes #465\n * Do not delete backboa while duplicity is running\n * Do not replace any contrib in latest OA - fixes #2420131\n * Do not run D7 core hotfix on already fixed instances\n * Fix for legacy systems autoupdate logic\n * Fix for missing chattr -i on web user update\n * Fix for missing datestamp\n * Fix for too dangerous pdnsd auto-config logic\n * Fix pdnsd restarts procedures - fixes #610\n * Fix permissions for pdnsd if needed\n * Fix variable in autoupboa - pull request #629\n * Force php.ini update\n * Hotfix for cluster instances\n * Hotfix for OpenSSL/cURL versions out of sync\n * How to enable permanent redirect to HTTPS with single IP - #465\n * Issue #2425963 - Broken slider in Commerce Kickstart 2.21\n * Make sure that @hostmaster alias works after migration\n * Provide a patch for older civicrm versions to make them Drush 7 compatible\n * Randomize backups schedule to avoid issues with AWS limits\n * Reload nginx service automatically - #465\n * Remove conflicting pdnsd restarts to avoid race conditions - fixes #610\n * Remove deprecated sysctl options\n * Remove post-install leftovers if needed\n * Single PHP-version installation fails - fixes #598\n * Typo - fixes #539\n * Unable to connect to SOLR on latest head - fixes #623\n * Update installers as expected, also with _SKYNET_MODE=OFF - fixes #644\n * Update meta-installers for new stable\n * Update the upgrade procedure how-to - fixes ##616\n * Use civicrm-4.5.6 compatible with Drush 7\n * Use correct AWS Endpoint when us-east-1 Region is specified\n * Use correct open_basedir for lshell user - fixes #603\n * Use separate loops for symlinks and ghost cleanup\n * Workaround for EntityMalformedException in Open Outreach - fixes #229\n * Workaround for missing interface/lo.pdnsd on legacy systems\n * Workaround for SA-CONTRIB-2015-063 - Webform - Cross Site Scripting\n\n\n### Stable BOA-2.4.0 Release - Full Edition\n### Date: Wed Feb 4 20:30:04 CET 2015\n### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.0\n### Latest hotfix added on: Sat Feb 21 10:18:15 UTC 2015\n\n @=> Includes Ægir Hostmaster 2.x-head with improvements\n @=> Includes Ægir Provision 3.x-head with improvements\n @=> Includes Drush 7.0.0-alpha8 customized for BOA\n\n# Release Notes:\n\n This new BOA release includes 7 updated Ægir platforms, over 28 new features\n and enhancements, 12 new software versions, over 36 important changes, plus\n over 100 bug fixes, with most notable features and changes listed below:\n\n @=> Added Support for latest Drupal 8.0.0-beta with D8B platform keyword\n @=> Added Support for latest Drupal 8.0.0-dev with D8D platform keyword\n @=> Added Support for latest PHP 5.6\n @=> BOA can auto-detect its fastest download mirror on install, upgrade etc.\n @=> BOA Code Refactoring to make it modular and easier to read (in progress)\n @=> BOA Skynet auto-updates can be turned off with _SKYNET_MODE=OFF\n @=> Cron is run only for live sites with no tmp, temp, dev, test etc keywords\n @=> Force single PHP version with command keyword on install and upgrade\n @=> Introducing Support for HHVM -- see docs/HHVM.txt for details.\n @=> PHP 5.5 is used by default on new installs instead of old 5.3\n @=> PHP-FPM (and HHVM) runs now as a separate, very limited system user\n @=> Removed Support for legacy PHP 5.2\n @=> Sites Names Exceptions and Special Keywords have changed\n @=> The _MODULES_FIX variable is set to NO by default\n @=> The _PERMISSIONS_FIX variable is set to NO by default\n @=> The built-in registry-rebuild on every Verify task is not run by default\n @=> The Dev-Mode works only for site aliases, no longer for main site name\n\n Please read further below for more details.\n\n# Caveats for self-hosted BOA:\n\n We recommend to proceed with major upgrade procedure as follows:\n\n $ cd;wget -q -U iCab http://files.aegir.cc/BOA.sh.txt;bash BOA.sh.txt\n $ barracuda up-stable\n $ barracuda up-stable system\n $ octopus up-stable all both\n $ bash /var/xdrago/manage_ltd_users.sh\n $ bash /var/xdrago/daily.sh\n\n# Updated Octopus platforms:\n\n aGov 1.6 --------------------- https://drupal.org/project/agov\n Commerce 1.32 (with 1.11) ---- https://drupal.org/project/commerce_kickstart\n Guardr 2.7 ------------------- https://drupal.org/project/guardr\n OpenAtrium 2.26 -------------- https://drupal.org/project/openatrium\n OpenChurch 1.17-b1 ----------- https://drupal.org/project/openchurch\n OpenPublic 1.4 --------------- https://drupal.org/project/openpublic\n Panopoly 1.15 ---------------- https://drupal.org/project/panopoly\n\n# New features and enhancements:\n\n * Add backboa variables to configure full backup cycle and log verbosity.\n * Add Backdrop CMS compatibility in global.inc (experimental)\n * Add Drupal 8 compatibility in global.inc\n * Add Drush Make Local - fixes #332\n * Add safe_cache_form_clear Drush extension by default - fixes #568\n * Add support for writable .aws directory in the web user home.\n * Allow to set _PHP_SINGLE_INSTALL on command line - on install and upgrade.\n * Allow to use both platform specific and ALL keyword in _PLATFORMS_LIST.\n * BOA auto-selects the fastest download mirror on install, upgrade and update.\n * Detect critically low free RAM and forcefully restart services if needed.\n * Detect OOM incidents and forcefully restart services if needed.\n * Improve backboa with AWS connection testing.\n * Install latest D8-dev with D8D keyword specified.\n * Monitor and rotate PHP error logs if too big (over 1 GB).\n * Monitor the number of master PHP-FPM processes and force restart if needed.\n * New 'nodns' option to skip DNS and SMTP checks on the fly.\n * Nginx: Add support for images derivatives with URI shortcuts - fixes #481\n * Nginx: Add support for URI shortcuts for sites in subdirectories.\n * PHP: Add HHVMinfo.\n * PHP: Add support for latest 5.6\n * PHP: Allow to define version to install and use on command line - fixes #536\n * PHP: Disable not used CLI versions if _PHP_SINGLE_INSTALL is defined.\n * PHP: Disable not used FPM and CLI versions.\n * PHP: HHVM experimental support - fixes #443\n * Provide default value for composer_manager_vendor_dir variable - fixes #385\n * Redis: Allow to configure remote IP via _REDIS_LISTEN_MODE /cluster support.\n * Use cron scheduler fast mode (every 10 sec) if /root/.fast.cron.cnf exists.\n * Use Drush Make Local for Hostmaster with download mirrors auto-detection.\n\n# Changes:\n\n * Alter the cron_interval for existing sites to match Ægir default.\n * Change required exceptions keywords to .temporary. and .testing.\n * Dev mode detection and URLs protection - now works only for aliases.\n * Do not display .cnf files contents if _DEBUG_MODE is not set to YES.\n * Do not restart Redis daily if /root/.high_traffic.cnf exists - fixes #533\n * Drush 7 is now used by default instead of Drush 6.\n * Drush: Upgrade to mini-7-02-02-2015\n * Force _TOMCAT_TO_JETTY=YES - fixes #570\n * Hostmaster: Use Drush Make Local instead of downloading contrib with Drush\n * Limit status messages verbosity if _DEBUG_MODE is not set to YES\n * Make it possible to opt-out from BOA Skynet auto-updates - fixes #557\n * Nginx: Block SEOkicks crawler.\n * PHP: Always use by default version 5.5\n * PHP: Disable legacy 5.2 version if installed.\n * PHP: Ignore --with-curlwrappers defined in _PHP_EXTRA_CONF for 5.5 and 5.6\n * PHP: Rebuild to remove --with-curlwrappers unless added in _PHP_EXTRA_CONF\n * PHP: Remove no longer working custom config protection - see #559\n * PHP: Tune FPM defaults for speed and RAM optimization.\n * PHP: Use built-in Zend OPcache in 5.5\n * PHP: Use built-in Zend OPcache in 5.6\n * Redis Integration Module: Update to version mod-14-12-2014\n * Reload system cron hourly.\n * Remove deprecated RC4 from ssl_protocols.\n * Remove the _O_CONTRIB_UP variable/feature.\n * Run cron for 3 sites at once max.\n * Set _MODULES_FIX=NO by default\n * Set _PERMISSIONS_FIX=NO by default\n * Site mode detection and cron protection - cron works only for live sites\n * Split huge BARRACUDA script into lib includes.\n * Switch to special limited system user also in PHP-FPM mode - fixes #551\n * There is no need to update drupalgeddon every 5 minutes.\n * Use 86400 as a default cron_interval to sync with Drupal default.\n * Use MySQLTuner only if _USE_MYSQLTUNER=YES is set in .barracuda.cnf\n * Use provision_civicrm 6.x-2.x directly.\n * Use separate versioning for Ægir extensions download URLs.\n * Run built-in registry-rebuild on Verify only if empty ctrl file\n sites/all/modules/registry-rebuild.ini exists.\n\n# System upgrades:\n\n * cURL 7.40.0 (if installed from sources)\n * Git 2.2.1 (if installed from sources)\n * MariaDB 10.0.16\n * MariaDB 5.5.42\n * MariaDB Galera Cluster 10.0.16\n * Nginx 1.7.9\n * PHP 5.4.37\n * PHP 5.5.21\n * PHP 5.6.5\n * PHP: ionCube loader 4.7.3\n * Redis 2.8.19\n * Ruby 2.2.0\n\n# Fixes:\n\n * Add CONTRIBUTING.txt guidelines.\n * Add in docs/HINTS.txt Helper locations to avoid 404 on legacy images paths.\n * Add still missing updates for migrated instances.\n * Add warning about vCloud Air incompatibility with Drupal.\n * Aliases are wiped out after site rename - fixes #542\n * Allow slower DNS response.\n * Always disable spinner when running boa in-octopus.\n * Avoid broken install on D8 core where sites/all doesn't exist by default.\n * Avoid confusing EXIT: You must specify already installed PHP version.\n * Avoid sed warnings in old stable and legacy modes.\n * Backward compatibility with Drush 6.\n * Block attempts to lookup /etc/passwd via web shell.\n * Check only LANG environment variable in locale test - fixes #584\n * Compare $new_uri with d()->name and not d()->uri in the Site Rename Check.\n * Delete duplicity ghost pid file if older than 2 days.\n * Do not confuse D7 with D8 or Backdrop CMS.\n * Do not force cURL reinstall from packages - fixes #565\n * Do not try to add platforms nodes if no new platform has been installed.\n * Do not update backboa if duplicity is running.\n * Document when to use /root/.fast.cron.cnf\n * Drupal 8 removed drupal_mail()\n * Drupal 8 requires container_yamls defined.\n * Drupal 8 requires read permissions in sites/all\n * Drupal 8 requires trusted_host_patterns defined in settings.php\n * Drupal 8 with $clean_urls=1 should use /cron/ URI.\n * Drush 7 requires composer.\n * Fix and Improve Squeeze to Wheezy upgrade procedure.\n * Fix for $HOME detection if not set for some reason.\n * Fix for Drush aliases protection.\n * Fix for octopus batch upgrade mode.\n * Fix for octopus single upgrade mode.\n * Fix for pdnsd install/update logic.\n * Fix missing symlinks after broken openjdk-6 upgrade.\n * Fix path to PHP-CLI if needed.\n * Fix public IP auto-detection on AWS in Octopus.\n * Fix the logic for aegir/platforms upgrade mode.\n * Fix the logic for TMPDIR set on the fly - fixes #552\n * Fix: LANGUAGE (en_US.UTF-8) is not compatible with LC_ALL (). Disabling it.\n * Force _PHP_MULTI_INSTALL to match defined _PHP_FPM_VERSION on cluster nodes.\n * Force _THIS_DB_HOST=localhost on AWS.\n * HHVM: Add /home/ to open_basedir so access to the .tmp works - fixes #569\n * HHVM: Add workarounds for potential security issues - fixes #443\n * Improve Ægir tasks scheduling and load spikes protection.\n * Improve docs for backboa.\n * Improve pdnsd configuration update by removing non-IP lines early enough.\n * Improve procs monitor.\n * Improve web wrapper.\n * Increase inotify defaults to improve lsyncd support.\n * Issue #2372653: Add --no-autocommit when dumping MySQL tables.\n * Jetty: Detect if running as zombie and force restart if needed.\n * Make sure that AcceptEnv is set in sshd_config.\n * Make sure to never run cron on just cloned site.\n * MariaDB patch is no longer needed.\n * Monitor lsyncd and xinetd if installed and expected to run.\n * Never delete tmp dirs to avoid Drush/PHP segfaults and race conditions.\n * Nginx: Add missing variables in subdirectory config template.\n * Nginx: Fix for D8-specific /cron/ location regex.\n * Nginx: Force clean URLs for Drupal 8.\n * Nginx: Helper locations to avoid 404 on legacy images paths (subdir only)\n * Nginx: Hide X-Drupal-Cache-Tags header.\n * Nginx: Use safe fallback for mysteriously empty $db_port\n * PHP: Avoid version guessing for Octopus when _PHP_SINGLE_INSTALL is used.\n * PHP: Make sure that _PHP_SINGLE_INSTALL takes precedence.\n * PHP: OPcache configuration for Drupal 8 - fixes #419\n * PHP: Re-install libmagickwand-dev to avoid broken extension build.\n * PHP: The fallback version should be detected and not hardcoded.\n * Prevent 'Could not change permissions' warnings with CiviCRM - fixes #523\n * Remove Drupal 8 specific code from settings template used in older Drupal.\n * Remove known sensitive credentials from barracuda upgrade log.\n * Revert \"Issue #2313327: Fixed Unknown options for provision-verify.\"\n * Run agents update on cluster nodes.\n * Run single mirror check - fixes #565\n * RVM: Install also eventmachine-1.0.3\n * Set files paths on D8 install to avoid using system default /tmp.\n * Silence confusing noise - fixes #589\n * Skip auto-update for agents not compatible with older versions.\n * Skip extra SQL connection test on AWS.\n * Standardize platforms version and naming convention.\n * Support for _NGINX_NAXSI is experimental (don't use)\n * Symlinks directories expected by Drush/Ægir in D8 root.\n * Sync defaults for hosting_advanced_cron_default_interval\n * Syntax error - fixes #587\n * Syntax error - fixes #588\n * The _NGINX_FORWARD_SECRECY=YES is ignored on Debian Wheezy - fixes #591\n * The /login suffix is no longer supported in Drupal 8 and results with 404.\n * The backend verify sub-task breaks site import for Drupal 8.\n * Tomcat is not used anymore - see #570\n * Use consistent stderr 2 stdout redirects in grep checks.\n * Use correct _THIS_DB_HOST on master instance.\n * Use correct pid file in procs monitor.\n * Use correct user to run drush test commands.\n * Use extended display mode for messages longer than 200 chars.\n * Use faster mysqldump mode/flags.\n * Use mirror to download complete vendor directory for Drush 7.\n * Use more intuitive PHP keyword naming convention.\n * Use mutatable interface in install_8.inc - fxes #2409085\n * Use recommended releases for views404 and views_accelerator - fixes #578\n * Use release specific o_contrib downloads.\n * Use safe tmp cleanup to avoid race conditions.\n * Where to set _USE_MYSQLTUNER variable - fixes #594\n\n\n### Stable BOA-2.3.8 Release - Full Edition\n### Date: Sat Nov 29 09:58:45 SGT 2014\n### Includes Ægir 2.x-head with improvements\n\n# Release Notes:\n\n This new BOA release includes new features, improvements and bug fixes.\n\n#-### Support for optional Drupalgeddon daily checks on all hosted D7 sites\n\n ~/static/control/drupalgeddon.info\n\n Previously enabled by default, now requires this control file to still\n run daily, because it may generate some false positives not always possible\n to avoid or silence, so it no longer makes sense to run this check daily,\n especially after BOA has run it automatically for a month and finally even\n disabled automatically all clearly compromised sites.\n\n Note that your system administrator may still enable this with root level\n control file /root/.force.drupalgeddon.cnf, so it will still run, even\n if you will not create the Octopus instance level empty control file:\n ~/static/control/drupalgeddon.info\n\n Please note that current version of Drupalgeddon Drush extension needs\n the 'update' module to be enabled to avoid even more false positives,\n so BOA will enable the 'update' module temporarily while running this\n check, which in turn will result with even more emails notices sent\n to the site admin email, if these notices are enabled.\n\n#-### Support for automated BOA upgrades: weekly and one-time\n\n You can configure BOA to run automated upgrades to latest stable version\n for both Barracuda and all Octopus instances with three variables, empty\n by default. All three variables must be defined to enable auto-upgrade.\n You can set _AUTO_UP_MONTH and _AUTO_UP_DAY to any date in the past\n if you wish to enable only weekly system upgrades.\n\n Remember that one-time upgrades will include complete upgrade to latest BOA\n stable for Barracuda and all Octopus instances, while weekly upgrade is\n designed to run only 'barracuda up-stable system' upgrade.\n\n _AUTO_UP_WEEKLY= #------ Day of week (1-7) for weekly system upgrades\n _AUTO_UP_MONTH= #------- Month (1-12) to define date of one-time upgrade\n _AUTO_UP_DAY= #--------- Day (1-31) to define date of one-time upgrade\n\n All three variables should be added in your /root/.barracuda.cnf file.\n\n# Updated Octopus platforms:\n\n ERPAL 2.2 -------------------- https://drupal.org/project/erpal\n\n# New features and enhancements in this release:\n\n * Support for automated BOA upgrades: weekly and one-time.\n\n# Changes in this release:\n\n * Drupalgeddon daily checks on all hosted D7 sites are now optional.\n\n# Fixes in this release:\n\n * Issue #508 - The _EASY_HOSTNAME is not required in local install mode.\n * Issue #516 - Do not break binaries detection with 'which'.\n\n\n### Stable BOA-2.3.7 Release - Full Edition\n### Date: Tue Nov 25 15:44:48 PST 2014\n### Includes Ægir 2.x-head with improvements\n\n# Release Notes:\n\n This new BOA release includes updated versions of all supported Drupal\n platforms to provide latest Drupal 7.34 and Pressflow 6.34 cores, plus\n new features, improvements and bug fixes.\n\n We recommend that you upgrade your D7 sites using this safe workflow:\n\n https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298\n\n For up-to-date information on #Drupageddon please check:\n\n https://omega8.cc/drupageddon-psa-2014-003-342\n\n#-### Support for locking/unlocking web server write access in all codebases\n\n This new, auto-enabled by default protection will enhance your system\n security, especially for sites in custom platforms you maintain\n in the ~/static directory tree.\n\n It is important to understand that your web server / PHP-FPM runs as your\n shell/ftps user, although with a different group. This allows to maintain\n virtual chroot for Octopus instances, which significantly improves security.\n\n However, it had a serious drawback: the web server had write access in all\n your platforms codebases located in the ~/static directory tree, because\n all files you have uploaded there have the same owner.\n\n While it allows you to use code management which requires web hooks, it also\n opens a door for possible attack vectors, like for the infamous #drupageddon\n disaster, where Drupal allowed attackers to create .php files intended\n to be used as backdoors in future attacks - inside your codebase.\n\n Even if it could affect only custom platforms you maintain in the ~/static\n directory tree, since all built-in Octopus platforms always had Drupal core\n completely write-protected, plus, even if created by attacking bot, these\n extra .php files are completely useless for attackers, because BOA default\n restricted configuration doesn't allow to execute not whitelisted, unknown\n .php files, having codebase writable by your web server is still dangerous,\n because at least theoretically it may open a possibility to overwrite valid\n .php files, so they could be used as an entry point in a future attack.\n\n BOA now protects all your codebases by reverting (daily) ownership on all\n files and directories in your codebase (modules and themes) so they are\n owned by the Ægir backend user and not your shell/ftps user.\n\n While this new default procedure protects all your codebases in the ~/static\n directory tree, and even in the sites/all directory tree, and even in the\n sites/foo.com/modules|themes tree in all your built-in Octopus platforms,\n you can still manage the code and themes with your main and extra shell\n accounts as usual, because your codebase is still group writable, and your\n shell accounts are members of the group not available for the web server.\n\n You can easily disable this default daily procedure with a single switch:\n\n ~/static/control/unlock.info\n\n You can also exclude any custom platform you maintain in the ~/static\n directory tree from this global procedure by adding an empty skip.info\n control file in the given platform root directory, so all other platforms\n are still protected, and only excluded platform is open for write access\n also for the web server. But normally you should never need this unlock!\n\n Please note that this procedure will not affect any platform if you have\n the non-default _PERMISSIONS_FIX=NO setting in your /root/.barracuda.cnf\n file. It will also skip any platform with fix_files_permissions_daily\n variable set to FALSE in the given platform active INI file.\n\n# Updated Octopus platforms:\n\n Commerce 1.32 ---------------- https://drupal.org/project/commerce_kickstart\n Commerce 2.20 ---------------- https://drupal.org/project/commerce_kickstart\n Commons 2.21 ----------------- https://drupal.org/project/commons\n Commons 3.20 ----------------- https://drupal.org/project/commons\n Guardr 2.5 ------------------- https://drupal.org/project/guardr\n Open Atrium 2.25 ------------- https://drupal.org/project/openatrium\n Open Outreach 1.13 ----------- https://drupal.org/project/openoutreach\n Panopoly 1.14 ---------------- https://drupal.org/project/panopoly\n\n# New features and enhancements in this release:\n\n * Support for locking/unlocking web server write access in all codebases.\n\n# Changes in this release:\n\n * Do not force site_readonly to be disabled on non-dev sites.\n\n# System upgrades in this release:\n\n * MariaDB 10.0.15\n\n# Fixes in this release:\n\n * Allow any single site to use 1/2 of available SQL connections max.\n * Clean up dot files after installing or updating RVM.\n * Do not run extra updates on systems running latest head version.\n * Improve ghost sites cleanup.\n * Issue #467 - Centralize control files outside of codebases tree.\n * Issue #498 - ERPAL: Fatal error: Unsupported operand types.\n * Issue #499 - RVM: Add oily_png gem version 1.1.1\n * Issue #504 - Add docs/RVM.txt\n * Issue #504 - Remove ~/.rvm/scripts/notes script breaking lshell.\n * Issue #509 - Do not delete anything from hostmaster site level modules.\n * It is safe to run manage_ltd_users every minute.\n * Never touch hostmaster aliases and vhosts even they appear broken.\n * Nginx: Fix for possible problem with files/imagecache in legacy D6 sites.\n * Use gnupg2 by default.\n * Use latest Ruby 2.1.x or 2.0.x available.\n * Use verbose RVM install mode to improve debugging.\n\n\n### Stable BOA-2.3.6 Release - Full Edition\n### Date: Mon Nov 17 08:11:17 SGT 2014\n### Includes Ægir 2.x-head with improvements\n\n# Release Notes:\n\n This new BOA release includes updated versions of all supported Drupal\n platforms to provide latest Drupal 7.33 core, plus great new features,\n improvements and bug fixes.\n\n We recommend that you upgrade your D7 sites using this safe workflow:\n\n https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298\n\n For up-to-date information on #Drupageddon please check:\n\n https://omega8.cc/drupageddon-psa-2014-003-342\n\n#-### Support for automated, encrypted, daily backups to Amazon S3\n\n * This new feature is available on self-hosted BOA and hosted Power Engines.\n * Note that provided 'backboa' tool uses symmetric password-only encryption.\n * You can configure AWS Region you prefer to use and Backup Rotation policy.\n\n It will archive all directories required to restore your data (sites files,\n databases archives, Nginx configuration and more) on a freshly installed BOA:\n\n /etc /var/aegir /var/www /home /data\n\n It will start to run nightly at 2:08 AM (server time) only once you will add\n five required _AWS_* variables in the /root/.barracuda.cnf file and run the\n special command 'backboa install' while logged in as root.\n\n To restore any file from backups created with 'backboa' tool, you can use\n the same script on the same or any other BOA server.\n\n Please read docs/BACKUPS.txt at https://github.com/omega8cc/boa for details.\n\n# Updated Octopus platforms:\n\n Commons 3.19 ----------------- https://drupal.org/project/commons\n Open Atrium 2.24 ------------- https://drupal.org/project/openatrium\n Open Deals 1.35 -------------- https://drupal.org/project/opendeals\n OpenChurch 1.15 -------------- https://drupal.org/project/openchurch\n OpenChurch 2.0-b2 ------------ https://drupal.org/project/openchurch\n OpenScholar 3.16.0 ----------- http://theopenscholar.org\n Panopoly 1.13 ---------------- https://drupal.org/project/panopoly\n Restaurant 1.0-b10 ----------- https://drupal.org/project/restaurant\n Ubercart 2.14 ---------------- https://drupal.org/project/ubercart\n Ubercart 3.8 ----------------- https://drupal.org/project/ubercart\n\n# New features and enhancements in this release:\n\n * Add support for automated, encrypted, daily backups to Amazon S3.\n * Automatic shutdown for sites with known #Drupageddon users/roles added.\n * Drush drupalgeddon extension added in all accounts.\n * Make _STRONG_PASSWORDS length configurable: 8-128, YES (32), NO (8).\n * Support for web and db clusters with MariaDB Galera (work in progress).\n * Apply SA-CORE-2014-005 hot-fix daily everywhere, also on BOA (any version)\n servers left on the auto-pilot.\n\n# Changes in this release:\n\n * Do not force site_readonly to be disabled on non-dev sites.\n * Ignore disabled sites in daily monitoring and healing procedures.\n * Remove support for abandoned Managing News distro.\n * Remove support for abandoned Open Atrium 6.x distro.\n * Remove support for abandoned Spark distro.\n * Remove support for abandoned Totem distro.\n * Set _PERMISSIONS_FIX=YES by default, so important fixes can be applied.\n * Update BOA wrappers hourly.\n\n# System upgrades in this release:\n\n * cURL 7.39.0 (if installed from sources)\n * Drush: Upgrade command line version 6 to mini-6-30-10-2014\n * Nginx 1.7.7\n * PHP 5.4.35\n * PHP 5.5.19\n * PHP: Zend OPcache master-08-11-2014\n\n# Fixes in this release:\n\n * Add scout user if _SCOUT_KEY is not empty or cron entry exists.\n * Always escape dots in preg_replace() to not truncate www. by mistake.\n * Check if directory tree exists before running extended checks/fixes.\n * Clear drush cache directly before running hostmaster-migrate.\n * Disable scout if installed and enable later.\n * Do not export LC_CTYPE on initial install.\n * Do not use Redis on provision-save.\n * Fix for edge case when incorrect permissions were set in custom platform.\n * Fix for openatrium-7.x-2.22-7.32.1\n * Fix for site_readonly mode in migrated instances.\n * Force setting to avoid issues with not expected to work RVM self-update.\n * Hint for Apache Solr Attachments and Java path possible confusion.\n * Improve web wrapper filtering.\n * Issue #2163979 - Check if field_info_field_map() is available.\n * Issue #2373923 - HTTPS and aliases redirection problem with Nginx.\n * Issue #438 - PHP: Remove support for 5.5 built-in Zend OPcache.\n * Issue #452 - PHP build could be broken also with MariaDB newer than 5.5.40\n * Issue #456 - Aliases redirection: problems with AdvAgg paths.\n * Issue #457 - Aliases redirection: 404 file not found for resources.\n * Issue #461 - Remote Import needs Drush strict=0 mode.\n * Issue #463 - The yajl-ruby gem needs native binaries building.\n * Issue #480 - Normalize /etc/hosts to avoid FQDN mapped to 127.0.1.1\n * Issue #490 - Nginx: Block semalt botnet.\n * Issue #496 - RVM 1.26.0 introduces signed releases (rvm: not found error).\n * Make sure that hostmaster site usage is not counted.\n * Move DB GRANTS setup for master instance to the correct level.\n * Move redis server daily restart to daily.sh agent.\n * Nginx: Fail if required db creds are empty to never create a broken vhost.\n * Remove hardcoded DNS for files.aegir.cc\n * Strict Permissions on All Binaries are default, not optional.\n * There is no point in running MySQLTuner on initial install.\n * Whitelist mysql command for overssh in lshell.\n\n\n### Stable BOA-2.3.5 Release - Full Edition\n### Date: Wed Oct 15 16:28:25 PDT 2014\n### Includes Ægir 2.1 with improvements\n### Latest hotfix added on: Thu Oct 16 08:55:02 PDT 2014\n\n# Release Notes:\n\n This new BOA release includes important updates and bug fixes.\n\n * All new Drupal 7 platforms received Drupal core security upgrade.\n For details please read: https://www.drupal.org/SA-CORE-2014-005\n\n * All existing Drupal 7 built-in platforms will receive a hot-fix for\n this known vulnerability: https://www.drupal.org/SA-CORE-2014-005\n once you will run 'barracuda up-stable' command on your server.\n This procedure is automated on hosted and managed Ægir at Omega8.cc\n\n * Your custom D7 platforms created in the ~/static directory tree\n will be checked in the next 12 hours after the upgrade, and if you\n have not applied this patch yet, it will be applied automatically\n for you - but only if there is at least one active site present\n in the given custom D7 platform. Note that while this procedure is\n automated on hosted and managed Ægir at Omega8.cc, on self-hosted\n BOA systems it will work only if you will set _PERMISSIONS_FIX=YES\n in /root/.barracuda.cnf (default is NO)\n\n We recommend that you upgrade your D7 sites using safe workflow:\n\n https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298\n\n# Updated Octopus platforms:\n\n aGov 1.5 --------------------- https://drupal.org/project/agov\n Commerce 1.31 ---------------- https://drupal.org/project/commerce_kickstart\n Commerce 2.19 ---------------- https://drupal.org/project/commerce_kickstart\n ERPAL 2.1 -------------------- https://drupal.org/project/erpal\n Guardr 1.14 ------------------ https://drupal.org/project/guardr\n Open Atrium 2.22 ------------- https://drupal.org/project/openatrium\n Open Outreach 1.12 ----------- https://drupal.org/project/openoutreach\n OpenPublic 1.2 --------------- https://drupal.org/project/openpublic\n Panopoly 1.12 ---------------- https://drupal.org/project/panopoly\n Recruiter 1.3 ---------------- https://drupal.org/project/recruiter\n\n# New features and enhancements in this release:\n\n * Explain that Solr self-provisioning works only if _MODULES_FIX=YES is set.\n * Reverify all sites daily if /root/.force.sites.verify.cnf ctrl file exists\n and _PERMISSIONS_FIX=YES is set in /root/.barracuda.cnf (default is NO)\n\n# Changes in this release:\n\n * Security: Remove support for SSLv3 due to POODLE vulnerability.\n * Disable Redis in Hostmaster until we will fix the Views based pages/blocks.\n * Disable site_readonly for non-dev sites by default.\n * Drush: Upgrade command line version 6 to mini-6-04-10-2014\n * Enable AllowUserFXP in Pure-FTPd config by default.\n * Remove support for already deprecated non-LTS Ubuntu versions.\n * Run manage_ip_auth_access only once per minute.\n * The INI variable redis_flush_forced_mode is enabled by default (again).\n * Use sysklogd instead of rsyslog on Ubuntu.\n\n# System upgrades in this release:\n\n * MariaDB 5.5.40\n * Nginx 1.7.6\n * OpenSSH 6.7p1 (if installed from sources)\n * OpenSSL 1.0.1j (if installed from sources) - security upgrade.\n * PHP 5.5.18\n * PHPRedis: master-03-10-2014\n\n# Fixes in this release:\n\n * Add auto-detection of Legacy Ruby patch level update on old systems.\n * Add cleanup for ghost/broken sites dirs leftovers.\n * Add missing cleanup for backup_migrate leftovers.\n * Always cleanup pid files on exit/abort.\n * Apply patch for SA-CORE-2014-005 in all shared D7 cores/built-in platforms.\n * Compass Tools: Install 1.9.3 ffi expected by older themes.\n * Fix db_port entry in all vhosts hourly.\n * Fix for broken erpal-7.x-2.0-7.31.1\n * Fix for broken site level drushrc.php file.\n * Fix for false alarm caused by ghost sites leftovers.\n * Fix for incorrect hash filtering on systems with OpenSSL built from sources.\n * Fix locales: Numerous fixes and improvements -- thanks ar-jan!\n * Fix typo in REVISIONS.\n * Force site Verify via frontend if drushrc.php has been fixed.\n * Issue #435 - SQL: Remove deprecated table_cache +update table_open_cache\n * Issue #440 - Improve innodb_buffer_pool_size calculation and add 10%\n * Issue #441 - New Relic is not disabled after removing newrelic.info file.\n * Issue #442 - Skip locked/fpmcheck if /root/.high_traffic.cnf exists.\n * Issue #444 - PHP: Remove useless sed replacement in pool.d/www{*}.conf\n * Issue #445 - Remote Import: update 6.x-2.x branch for Ægir 2.x and Drush 6\n * Issue #447 - Export LANG, LANGUAGE and all LC_ environment variables.\n * Issue #447 - Improve locales consistency.\n * Issue #447 - Set default LC_CTYPE and LC_COLLATE environment variables.\n * Issue #447 - Simplify locales configuration on Ubuntu.\n * Issue #448 - Enforce locale settings by configuring defaults.\n * Issue #452 - PHP build is broken with latest MariaDB 5.5.40\n * Make sure that db_port is never empty and defaults to 3306.\n * Make sure that firewall monitoring scripts never run simultaneously.\n * Make sure that standard caching is enabled in hostmaster.\n * Pause hostmaster tasks when RVM install for any user is running.\n * PHP: Do not run rebuilds if not needed.\n * PHP: Fix for broken upgrade logic on libcurl or libssl packages upgrade.\n * Remove acquia_connector from latest Commons to avoid broken installs.\n * Remove all legacy gems and re-install RVM/Ruby for root from scratch.\n * Remove legacy replacement to avoid converting symlinked includes into files.\n * SQL: Use correct defaults if MySQLTuner test failed.\n * Workaround for Drupal flood using 127.0.0.1 for all requests behind proxy.\n\n\n### Stable BOA-2.3.4 Release - Full Edition\n### Date: Wed Oct 15 09:51:08 PDT 2014\n### Includes Ægir 2.1 with improvements\n\n Release Notes and changelog for BOA-2.3.4 has been merged into BOA-2.3.5\n above after security upgrades related to OpenSSL and SSLv3 have been added\n shortly after 2.3.4 release.\n\n\n### Stable BOA-2.3.3 Release - Full Edition\n### Date: Sat Sep 27 01:25:46 PDT 2014\n### Includes Ægir 2.1 with improvements\n\n# Release Notes:\n\n This BOA Edition includes important fixes to address some issues discovered\n after BOA-2.3.1 release. Please read also the release notes for BOA-2.3.1\n further below before running the upgrade!\n\n#-### Important details on CiviCRM versions compatibility and profiles support\n\n * All BOA-2.3.x Editions fully support latest CiviCRM 4.5.0 for Drupal 7.\n * CiviCRM for Drupal 6 is not supported because of known CiviCRM issues.\n * CiviCRM support for Drupal 7 works great when added in sites/all/modules\n * CiviCRM support for Drupal 7 also works when added in profiles/foo/modules\n but no CiviCRM cron is currently managed until this known issue is fixed,\n therefore BOA-2.3.3 will check all platforms on the Octopus instance and if\n it will detect any with CiviCRM added in the installation profile directory\n tree, it will refuse to upgrade such instance to not break things for those\n using currently not fully supported CiviCRM codebase structure.\n\n# New Octopus platforms:\n\n OpenChurch 2.0-b1 ------------ https://drupal.org/project/openchurch\n\n# Updated Octopus platforms:\n\n ERPAL 2.0 -------------------- https://drupal.org/project/erpal\n Guardr 1.13 ------------------ https://drupal.org/project/guardr\n Open Outreach 1.11 ----------- https://drupal.org/project/openoutreach\n OpenChurch 1.14 -------------- https://drupal.org/project/openchurch\n OpenPublic 1.0-rc5 ----------- https://drupal.org/project/openpublic\n OpenScholar 3.15.1 ----------- http://theopenscholar.org\n\n# New features and enhancements in this release:\n\n * Add makefiles for CiviCRM 4.4.7\n * Add makefiles for CiviCRM 4.5.0\n\n# Changes in this release:\n\n * Drush: Upgrade command line version 6 to mini-6-27-09-2014\n * Restart SSH hourly.\n * The INI variable redis_flush_forced_mode is now disabled by default.\n * Use aegir_custom_settings-6.x-3.12\n * Use Provision CiviCRM boa-2.3.3-dev\n\n# System upgrades in this release:\n\n * MariaDB 10.0.14\n * Nginx 1.7.5\n * PHP 5.4.33\n * PHP 5.5.17\n * PHPRedis: master-02-09-2014\n * Redis 2.8.17\n\n# Fixes in this release:\n\n * Add extra cleanup for Drush related caches.\n * Always respect _SSH_PORT if set.\n * Always start cron before aborting on error.\n * Do not add duplicate cron entry for runner.sh\n * Do not allow system only upgrades if Master Instance is still on 2.2.x\n * Do not disable _DNS_SETUP_TEST\n * Enable path_alias_cache by default also in the hostmaster site.\n * Fix for broken pdnsd configuration if wrong IPs are detected.\n * Fix for insufficient permissions on files/civicrm/ConfigAndLog\n * Fix for insufficient permissions on files/civicrm/custom\n * Fix for insufficient permissions on files/civicrm/dynamic\n * Fix for missing cron entry for Scout, if _SCOUT_KEY is not empty.\n * Fix the not working procedure to revert hostmaster features.\n * Force problematic gems install to add them on accounts with enabled RVM.\n * Fox for Java version for Jetty 9 on newer systems.\n * Hardcode files.aegir.cc DNS entry.\n * Improve docs/ctrl/system.ctrl readability.\n * Install openjdk on CI instances by default.\n * Issue #411 - Unable to update Octopus Instance - Reports PHP on 5.2\n * Issue #423 - Make sure that innodb_buffer_pool_size is not smaller than 64M\n * Issue #424 - Update mysqltuner.pl to support MariaDB 10.0\n * Make sure that lsb-release is installed properly.\n * Make the check_civicrm_compatibility more reliable to avoid false alarms.\n * New Relic not enabled if no custom ~/static/control/{fpm|cli}.info exists.\n * Nginx: Auto-Switch to wildcard all vhosts existing in the Master Instance.\n * Nginx: Avoid any downtime on upgrade by using www53.fpm.socket temporarily.\n * Nginx: Convert all config templates to wildcard mode in legacy instances.\n * Nginx: Convert all Octopus vhosts to wildcard mode on Barracuda upgrade.\n * Nginx: Convert config to use PHP 5.2 if the instance still depends on it.\n * Nginx: Delete ghost, outdated or broken config includes in all instances.\n * Nginx: Delete ghost, outdated or broken vhosts in all instances.\n * Nginx: Force special vhosts access rules rebuild hourly.\n * Nginx: Improve wildcard conversion procedure on some really old instances.\n * Purge all ghost delete tasks before running hostmaster-migrate / upgrade.\n * Purge Drush related caches cleanly when needed.\n * Recreate possibly broken vhosts.\n * Remove duplicate cron entry for runner.sh to avoid critical system load.\n * Remove legacy replacement to not convert config symlinks into regular files.\n * Run check_civicrm_compatibility only on upgrade.\n * Single feature revert may not be enough.\n * Update contrib in Open Atrium D7 to maintain upgrade path.\n * Update cron defaults and remove legacy code.\n * Update default SSL Wildcard Nginx Proxy to use wildcard listen mode.\n * Use strict regex in vhosts listen mode conversion to not break ports.\n\n\n### Stable BOA-2.3.2 Release - Full Edition\n### Date: Thu Sep 18 15:16:33 PDT 2014\n### Includes Ægir 2.1 with improvements\n\n Release Notes and changelog for BOA-2.3.2 has been merged into BOA-2.3.3\n above after several hotfixes and various updates have been added shortly\n after 2.3.2 release to address all identified post-release issues.\n\n\n### Stable BOA-2.3.1 Release - Full Edition\n### Date: Sun Sep 14 15:53:25 SGT 2014\n### Includes Ægir 2.1 with improvements\n### Latest hotfix added on: Mon Sep 15 19:10:07 SGT 2014\n\n# Release Notes:\n\n This major BOA Edition introduces many new features, changes and fixes.\n\n You should carefully read about some caveats further below **before** running\n this major upgrade on your system. Please secure a fresh system backup first.\n\n If you haven't run full barracuda+octopus upgrade to latest BOA Stable\n Edition yet, don't use any partial/system upgrade modes.\n\n Once new BOA Stable is released, you must run *full* upgrades with commands:\n\n $ cd;wget -q -U iCab http://files.aegir.cc/BOA.sh.txt;bash BOA.sh.txt\n $ barracuda up-stable\n $ octopus up-stable all both\n\n @=> Key new features:\n\n * BOA-2.3.1 comes with new, shiny Ægir 2.1 stable version!\n * Support for Drupal sites in subdirectories is enabled by default\n * Solr 4 cores can be added/updated/deleted via site level INI settings\n * Super-easy to use New Relic support with per Octopus license key\n * Ability to add new Octopus instances with new, simple command syntax\n\n @=> Ægir control panel new features:\n\n * The list of sites is searchable by name or installation profile\n * Sites have dedicated tabs: Backups, Task log, Edit and Packages\n * Platform have tabs: Add site, Clients, Task log, Edit and Packages\n * You can schedule tasks against filtered sites in batches\n * Scheduling tasks in batches is available also on the platform view\n * Scheduling tasks in batches is available also on the profile view\n * Scheduling tasks in batches is available also on the client view\n * You can schedule tasks also against platforms in batches\n * You can safely apply db updates via 'Run db updates' task on any site\n * The new 'Clients' menu item allows to list and manage sub-accounts\n * Profiles are listed with both human-readable and machine names\n * It is now possible to choose any existing alias or the main site name\n as a redirect target, but without the need to rename the site --\n it will just re-verify the site and create new vhost automatically\n\n @=> Ægir control panel changes:\n\n * The hosting/signup form is still available but not included in the menu\n * The node/add/site form is no longer included in the main menu\n * The optional pseudo-CDN-aliases feature is now disabled by default\n\n @=> Other important changes:\n\n * Support for PHP 5.2 has been officially deprecated\n * The www53 PHP-FPM pool has been switched from port to default socket mode\n * All existing vhosts must use wildcard in the Nginx 'listen' directive\n * Legacy mode for Install and Upgrade moves to 2.2.x branch\n * DB credentials are no longer in settings.php, only in drushrc.php\n * Latest Drush 6 version is used in the Ægir backend by default\n\n But what if you are not ready for this major upgrade and you would like\n to have more time for testing, but still be able to run system upgrades,\n thus effectively still using previous version 2.2.9 ?\n\n#-### Legacy mode for Install and Upgrade moves to 2.2.x branch\n\n From now on, the 'legacy' install and upgrade mode available in all meta-\n installers will utilize branch 2.2.x instead of deprecated 2.1.x series.\n\n This means that starting with meta installers updated to use BOA-2.3.1\n version you can use commands like shown below to update Barracuda, Octopus\n and also to install more Octopus instances, while still using version 2.2.9:\n\n $ boa in-legacy public server.mydomain.org my@email o1\n $ barracuda up-legacy system\n $ octopus up-legacy o1\n $ boa in-legacy public server.mydomain.org my@email o2 mini\n etc.\n\n Remember to update your meta-installers first!\n\n $ cd;wget -q -U iCab http://files.aegir.cc/BOA.sh.txt;bash BOA.sh.txt\n\n Note also that if you will upgrade to current 'stable', it is not possible\n to downgrade back to the 'old stable' with 'legacy' mode, so please proceed\n with care!\n\n Remember also that current legacy version will not receive any further\n updates, even for security issues (besides those provided as packages by\n your OS vendor - Debian or Ubuntu, which will still work), because it is\n already different enough from current 2.3.1 stable, so we can't reliably\n maintain both with working upgrade path.\n\n#-### Caveats: This upgrade will force wildcard in the Nginx 'listen' directive\n\n If you have old enough BOA system which still uses legacy IP mode and not\n a wildcard in the Nginx 'listen' directive, which is both Ægir and BOA\n standard for a long time already, this upgrade will fix the problem and\n update directives only in vhosts known and controlled by BOA.\n\n If you have any other vhosts, located in standard or non-standard Nginx/BOA\n directories for vhosts, you have to update them manually after upgrade to\n BOA-2.3.0 or newer, or they will take over all other vhosts on the system\n and cause redirects to /install.php which results with Nginx error 403 or 404,\n depending on the prior configuration.\n\n It will happen because IP based 'listen' directive in Nginx has higher\n priority, and will mess things horribly if there are vhosts using wildcard\n and some using the main system IP address.\n\n What and how to replace? Here are the commands you need to run as root:\n\n $ sed -i \"s/.*listen.*:80;/ listen \\*:80;/g\" /path/to/vhost.file\n $ service nginx reload\n\n Note: this **doesn't** affect special vhosts for SSL enabled sites, if used,\n because they are designed to use IP based 'listen' directives to provide\n separation between SSL enabled IPs and their associated certificates,\n while their associated 'upstream' block may even point to either local or\n remote IP address, so there is no wildcard to use in this case, and it will\n not conflict with all other vhosts managed by Ægir, because all SSL enabled\n vhosts listen on other IP addresses than the main system IP, which is\n by default used by all vhosts with wildcard in the 'listen' directive.\n\n The problem may happen only when you have vhosts using wildcard and also\n some vhosts using **main** system IP address in the 'listen' directive,\n which may happen also unintentionally during upgrade to BOA-2.3.0 or never,\n if there are either vhosts BOA doesn't control, or there are ghost vhosts\n not yet purged if you didn't upgrade to BOA-2.2.9 before, or there are\n some disabled sites, so their vhosts will not be re-created by Ægir\n during this major upgrade (because only active sites can be re-verified).\n\n While BOA will fix also any such ghost vhosts anyway, it will not be able\n to detect and fix vhosts outside of the standard directories managed by Ægir.\n\n#-### Ability to add new Octopus instances with new, simple command syntax\n\n It is now possible to add stable Octopus instances w/o forcing Barracuda\n upgrade, plus optionally with no platforms added by default -- usage:\n\n $ boa {in-octopus} {email} {o2} {mini|max|none}\n\n#-### The www53 PHP-FPM pool has been switched from port to default socket mode.\n\n Note that we are breaking backward compatibility here, so it will cause\n downtime on upgrade from any too old BOA version, until you will upgrade also\n Octopus instance(s) and update any other non-standard vhosts or includes\n still using legacy port mode for 'fastcgi_pass' Nginx directive.\n\n If you have 'fastcgi_pass 127.0.0.1:9090;' in any custom vhost or Nginx\n include file on the Octopus instance, you should replace it with:\n\n fastcgi_pass unix:/var/run/o1.fpm.socket;\n\n where 'o1' is your corresponding Octopus system username.\n\n Note that if you have custom vhosts or includes in the Ægir Master Instance,\n you should instead replace 'fastcgi_pass 127.0.0.1:9090;' with:\n\n fastcgi_pass unix:/var/run/www53.fpm.socket;\n\n where '53' is related to PHP version defined via _PHP_FPM_VERSION in your\n /root/.barracuda.cnf file. Note that while variable has a dot, the socket\n name doesn't.\n\n#-### Support for PHP 5.2 has been officially deprecated\n\n While Barracuda 2.3.1 can continue to run and even upgrade if needed also\n the very old PHP 5.2 version, only Octopus instances running at least PHP 5.3\n or newer in both FPM and CLI mode can be upgraded to Octopus 2.3.1 Edition.\n\n If you are still using PHP 5.2 in your Octopus instance, you will not\n receive Ægir nor Drupal Platforms upgrade, but the Barracuda part of your\n system will receive upgrade to 2.3.1 anyway, so it will be ready to support\n your outdated Octopus instance upgrade as soon as you will switch it to\n modern and secure PHP version -- which is easy!\n\n Let's quote the original how-to for reference:\n\n#-### Support for PHP FPM/CLI version safe switch per Octopus instance\n\n This allows to easily switch PHP version by the instance owner w/o system\n admin (root) help. All you need to do is to create ~/static/control/fpm.info\n and ~/static/control/cli.info file with a single line telling the system\n which available PHP version should be used (if installed): 5.5 or 5.4 or 5.3\n\n Only one of them can be set, but you can use separate versions for web access\n (fpm.info) and the Ægir backend (cli.info). The system will switch versions\n defined via these control files in 5 minutes or less. We use external control\n files and not any option in the Ægir interface to make sure you will never\n lock yourself by switching to version which may cause unexpected problems.\n\n#-### Support for New Relic monitoring with per Octopus instance license key\n\n This new feature will disable global New Relic monitoring by deactivating\n server-level license key, so it can safely auto-enable or auto-disable it\n every 5 minutes, but per Octopus instance -- for all sites hosted on\n the given instance -- when a valid license key is present in the special\n new ~/static/control/newrelic.info control file.\n\n Please note that valid license key is a 40-character hexadecimal string\n that New Relic provides when you sign up for an account.\n\n To disable New Relic monitoring for the Octopus instance, simply delete\n its ~/static/control/newrelic.info control file and wait a few minutes.\n\n Please note that on a self-hosted BOA you still need to add your valid\n license key as _NEWRELIC_KEY in the /root/.barracuda.cnf file and run\n system upgrade with at least 'barracuda up-stable' first. This step is\n not required on Omega8.cc hosted service, where New Relic agent is already\n pre-installed for you.\n\n#-### Solr 4 cores can be added/updated/deleted via site level INI settings\n\n;;\n;; This option allows to activate Solr 4 core configuration for the site.\n;;\n;; Only Solr 4 powered by Jetty server is available. Supported integration\n;; modules are limited to latest versions of either search_api_solr (D7 only)\n;; or apachesolr (will use Drupal core specific version automatically).\n;;\n;; Currently used versions are listed below:\n;;\n;; https://ftp.drupal.org/files/projects/search_api_solr-7.x-1.6.tar.gz\n;; https://ftp.drupal.org/files/projects/apachesolr-7.x-1.7.tar.gz\n;; https://ftp.drupal.org/files/projects/apachesolr-6.x-3.0.tar.gz\n;;\n;; Note that you still need to add preferred integration module along with\n;; any its dependencies in your codebase since this feature doesn't modify\n;; your platform or site - it only creates Solr core with configuration\n;; files provided by integration module: schema.xml and solrconfig.xml\n;;\n;; This setting affects only the running daily maintenance system behaviour,\n;; so you need to wait until next morning to be able to use new Solr 4 core.\n;;\n;; Once the Solr core is ready to use, you will find a special file in your\n;; site directory: sites/foo.com/solr.php with details on how to access\n;; your new Solr core with correct credentials.\n;;\n;; The site with enabled Solr core can be safely migrated between platforms,\n;; integration module can be moved within your codebase and even upgraded,\n;; as long as it is using compatible schema.xml and solrconfig.xml files.\n;;\n;; Supported values for the solr_integration_module variable:\n;;\n;; apachesolr\n;; search_api_solr\n;;\n;; To delete existing Solr core simply comment out this line.\n;; The system will cleanly delete existing Solr core next morning.\n;;\n;; IMPORTANT if you are using self-hosted BOA: _MODULES_FIX=YES must be set\n;; in the /root/.barracuda.cnf file (this is default value) to make this\n;; feature active.\n;;\n;solr_integration_module = your_module_name_here\n\n;;\n;; This option allows to auto-update your Solr 4 core configuration files:\n;;\n;; schema.xml\n;; solrconfig.xml\n;;\n;; If there is new release for either apachesolr or search_api_solr, your\n;; Solr core will not be automatically upgraded to use newer schema.xml and\n;; solrconfig.xml, unless allowed by switching solr_update_config to YES.\n;;\n;; This option will be ignored if you will set solr_custom_config to YES.\n;;\n;solr_update_config = NO\n\n;;\n;; This option allows to protect custom Solr 4 core configuration files:\n;;\n;; schema.xml\n;; solrconfig.xml\n;;\n;; To use customized version of either schema.xml or solrconfig.xml, you need\n;; to switch solr_custom_config to YES below and if you are using hosted\n;; Ægir service, submit a support ticket to get these files updated with\n;; your custom versions. On self-hosted BOA simply update these files directly.\n;;\n;; Please remember to use Solr 4 compatible config files.\n;;\n;solr_custom_config = NO\n\n\n# Updated Octopus platforms:\n\n aGov 1.4 --------------------- https://drupal.org/project/agov\n Guardr 1.12 ------------------ https://drupal.org/project/guardr\n Open Academy 1.1 ------------- https://drupal.org/project/openacademy\n Restaurant 1.0-b9 ------------ https://drupal.org/project/restaurant\n Ubercart 3.7 ----------------- https://drupal.org/project/ubercart\n\n# New features and enhancements in this release:\n\n * Ability to add new Octopus instances with new, simple command syntax\n * Add default aggressive php-fpm monitoring + /root/.no.fpm.cpu.limit.cnf\n * Allow to define always disabled modules via _MODULES_FORCE variable.\n * Better wait limits on connection testing for slow network / long distance.\n * Issue #1927522 - Add support for easy Solr cores self-management.\n * Issue #362 - Add imageapi_optimize binaries via IMG in _XTRAS_LIST\n * Issue #376 - Add New Relic support with per Octopus instance license key.\n * Make firewall management faster with randomized schedule.\n * Procs monitor runs every 3 seconds.\n * Run mysql_proc_control every 5 seconds for better results.\n * You can safely apply db updates via 'Run db updates' task on any site.\n\n# Changes in this release:\n\n * DB credentials are no longer visible in settings.php, only in drushrc.php\n * Delete default profiles in the hostmaster platform.\n * Disable _DEBUG_MODE if not enabled on the fly.\n * Disable newrelic-sysmond unless /root/.enable.newrelic.sysmond.cnf exists.\n * Drush: Upgrade command line version 6 to mini-6-14-09-2014\n * Nginx: Remove deprecated code - _HTTP_WILDCARD is already used by default.\n * Nginx: Use limit_conn protection only for known dynamic requests.\n * Redis Integration Module (cache_backport): Update to version 6.x-1.0-rc2\n * Redis Integration Module: Update to version mod-12-09-2014\n * Remove _ALLOW_UNSUPPORTED legacy and no longer working properly feature.\n * Remove dependency on Update Manager globally.\n * Remove deprecated multi-instance labels in the New Relic configuration.\n * Replace old hosting_civicrm_cron with newer hosting_civicrm module.\n * Set hosting_default_profile to 'minimal' to improve Ubercart 3 visibility.\n * The www53 PHP-FPM pool has been switched from port to default socket mode.\n * Use Provision CiviCRM boa-2.3.1-dev\n\n# System upgrades in this release:\n\n * cURL 7.38.0 (if installed from sources)\n * Git 2.1.0 (if installed from sources)\n * Jetty 7.6.16.v20140903\n * Jetty 8.1.16.v20140903\n * Jetty 9.2.3.v20140905\n * PHP 5.3.29 EOL! Please read: http://php.net/archive/2014.php#id2014-08-14-1\n * PHP 5.4.32\n * PHP 5.5.16\n * Redis 2.8.14\n\n# Fixes in this release:\n\n * Add cleanup for _GIT_FORCE_REINSTALL if added in .barracuda.cnf\n * Add missing drush cache-clear drush to improve upgrade path.\n * Add new features in the README.txt\n * Add wheezy to the exceptions list where required.\n * Allow to clear drush cache without directory restrictions.\n * Always set correct TMP path for supported users.\n * Cleanup for cron pid files in user specific .tmp dirs.\n * Count properly also symlinked files directories (improved).\n * D6 colorbox module requires old 1.3.18 library.\n * Delete drush_make leftovers.\n * Delete duplicate menu items on upgrade.\n * Do not allow to install SSH from sources on Trusty to avoid problems.\n * Do not skip daily.sh during barracuda system only update.\n * Eldir theme: Use max width for buttons, if possible.\n * Explain why installing RVM may take longer than expected.\n * Fix cleanup for drush aliases in sub-accounts.\n * Fix daily cleanup for user specific .tmp directories.\n * Fix docs/HINTS.txt\n * Fix for broken mariadb.list\n * Fix for broken, way too aggressive PHP-FPM monitoring.\n * Fix for ghost dirs cleanup.\n * Fix for ghost vhosts cleanup.\n * Fix for missing symlinks to existing platforms.\n * Fix for not working protection from blocking local IPs on multi-IP systems.\n * Fix for subdirs_support universal check.\n * Fix for unreliable _IS_OLD check on Octopus instances upgrade.\n * Fix for warning \"Could not create directory .\" on Hostmaster site Verify.\n * Fix the fields order in the site edit form.\n * Fix the regex to not whitelist unexpected IP ranges inadvertently.\n * Force cURL rebuild if installed with outdated OpenSSL version.\n * Guard against destructive or insecure tasks run on the hostmaster site.\n * Improve cleanup for empty platforms directories.\n * Improve monitoring to protect against convert trying to overload the system.\n * Issue #2330781 - Use Drush dt() wrapper instead of not always available t()\n * Issue #357 - Fix the logic for Git (re)install from sources.\n * Issue #360 - Exclude special --CDN vhosts from daily cleanup.\n * Issue #361 - Update and improve docs/FAQ.txt\n * Issue #369 - Automatically download and fix /bin/websh if missing.\n * Issue #369 - Restore classic /bin/sh symlink automatically if needed.\n * Issue #373 - Set correct TMP, TEMP, TMPDIR env variables in limited shell.\n * Issue #373 - Too restrictive lshell forbidden list breaks drush sql-sync.\n * Issue #380 - Nameserver / pdnsd problem -- Fixes also Issue #2007990.\n * Issue #381 - Zend OPcache forced adds useless noise in the log.\n * Issue #388 - Version 6.x-2.x of provision_civicrm requires hosting_civicrm\n * Issue #389 - hosting_civicrm breaks site install form with confusing error.\n * Issue #390 - Duplicate platforms nodes are created after upgrade to 2.3.0\n * Issue #395 - Validate username isn't reserved before running install script.\n * Issue #396 - Locale isn't getting set properly.\n * Issue #397 - Not actually prompted for platforms during installation.\n * Issue #398 - Make locales setup/fix for Debian always OS compatible.\n * Issue #399 - The hitimes gem needs to be pre-installed to support Omega4.\n * Issue #400 - CiviCRM is not installed on 2.3.0\n * Issue #401 - Create sites/all/* subdirs in Hostmaster early enough.\n * Issue #402 - Fix for ghost or disabled vhosts which still listen on IP.\n * Issue #405 - Installer hangs due to yes/no dialog - \"Untrusted packages\"\n * Issue #406 - Force keyring reinstall also upon 'GPG error'.\n * Issue #407 - Fix for 'username is already taken' error on a local VM install\n * Issue #408 - Fix for multiple funny typos. Thanks ar-jan!\n * Make it clear that subdomain and subdirectory name must be identical.\n * Make sure that keys subdirectory exists to avoid active platforms cleanup.\n * Make the PHP-FPM processes monitor less aggressive by default.\n * New Relic not enabled if no custom ~/static/control/{fpm|cli}.info exists.\n * Nginx: Add config symlinks only on legacy instances.\n * Nginx: Add cron access support for subdir sites.\n * Nginx: Convert all vhosts to wildcard mode on Barracuda upgrade.\n * Nginx: Disable monitoring for POST requests related to cart/checkout URI.\n * Nginx: Do not touch nginx_wild_ssl.conf during this upgrade.\n * Nginx: Improve wildcard conversion procedure on some really old instances.\n * Nginx: Remove deprecated code and config templates.\n * Nginx: Sanitize aliases in vhost_disabled.tpl.php to avoid warnings.\n * Nginx: Update config includes to match optional BOA features improvements.\n * Nginx: Update unified configuration templates in Provision to unfork BOA.\n * Nginx: Update vhosts templates to match BOA improvements.\n * PHP: Avoid unintended duplicate rebuilds.\n * PHP: Sync disable_functions list.\n * Protect sites/all/drush\n * Provision: Backport provision_hosting_feature_enabled()\n * Provision: Remove legacy subdir code and update checks.\n * Redis config should sync with PHP-CLI, not PHP-FPM.\n * Remove legacy procs monitoring code.\n * Remove no longer needed limreq global fixes.\n * Remove no longer needed/used contrib updates.\n * Remove redundant file_exists() if is_readable() is also used.\n * Replace old hosting_civicrm_cron with newer hosting_civicrm module.\n * Restart pdnsd before running barracuda upgrade.\n * Restore BOA formatting for tasks log to improve readability.\n * Restore BOA naming convention and docs in Hostmaster.\n * Restore BOA naming convention for Installation profiles in Hostmaster.\n * Restore BOA strict _hosting_valid_fqdn* testing procedures in Hostmaster.\n * Restore BOA weight defaults in the form in Hostmaster.\n * Restore punycode in Hostmaster.\n * Restore tasks sort to always show tasks scheduled and running at the top.\n * Sanitize cli.info and fpm.info\n * Set _PLATFORMS_LIST properly.\n * Silence early sed replacements to avoid confusion.\n * Simplify colorbox-1.3.18 download.\n * Simplify colorbox-1.5.13 download.\n * Switch branch on the fly and add support for Ægir vanilla mode.\n * Sync /tmp access restrictions.\n * The hosting_civicrm_cron is now a submodule and should be also auto-enabled.\n * The wildcard transition **doesn't** affect vhosts for SSL enabled sites.\n * There is no need to force backend clone from GitHub on initial upgrade.\n * Update for the Hostmaster welcome page.\n * Update FPM monitoring settings.\n * Use as short labels on the site node as possible.\n * Use control files properly to not run redundant Jetty/Solr upgrade.\n * Use correct paths to platform level drushrc.php file.\n * Use correct Provision version on initial upgrade to 2.3.0\n * Use Drush6 with @hostmaster.\n * Use is_dir() instead of file_exists() when checking directory existence.\n * Use is_file() and is_link() instead of file_exists() before trying unlink()\n * Use is_readable() and file_exists() instead of file_exists() for backup.\n * Use is_readable() check instead of insufficient file_exists() for includes.\n * Use is_readable() instead of file_exists() when checking alias existence.\n * Install latest Git even if not specified via _XTRAS_LIST but previous\n version built from sources is detected.\n * Issue #2278847 - Derivatives can't be created on install with Drush and\n Ægir or when no vhost is available yet (Drupal Commons)\n\n\n### Stable BOA-2.3.0 Release - Full Edition\n### Date: Mon Sep 8 08:42:01 PDT 2014\n### Includes Ægir 2.1 with improvements\n\n Release Notes and changelog for BOA-2.3.0 has been merged into BOA-2.3.1\n above after several hotfixes and some great new features have been added\n shortly after 2.3.0 release to address all identified post-release issues.\n\n\n### Stable BOA-2.2.9 Release - Full Edition\n### Date: Wed Aug 6 17:08:10 PDT 2014\n### Includes Ægir 2.x-boa-custom version.\n### Latest hotfix added on: Fri Aug 15 09:37:04 PDT 2014\n\n# Release Notes:\n\n This release includes updated versions of all supported Drupal platforms to\n provide latest Drupal 7 and Pressflow 6 core, plus some changes, improvements,\n bug fixes, and many updated Octopus platforms.\n\n NOTE: Since the first Edition in the BOA-2.3.x series is not ready for release\n yet, and new Drupal core has been released to fix security issues, followed\n by yet another release to fix serious regressions, followed by yet another\n security release, we have decided to make it available to everyone and release\n yet another stable BOA-2.2.x Edition.\n\n IMPORTANT! This is the last Edition in the 2.2.x series, which marks the end\n of Drupal 5, PHP 5.2 and Drush 4 support. Next Edition will open 2.3.x series,\n which will allow us to provide newer Ægir version with built-in Drush 6\n support, sites in subdirectories, and many Ægir User Interface improvements.\n\n If you still host any Drupal 5 sites or you are using PHP 5.2 for D6 sites,\n you will not be able to upgrade to the next 2.3.x Edition and you will have to\n stay on the 'legacy' BOA 2.2.x version, which will receive only system\n security upgrades, but no further feature nor bugfix releases.\n\n This also means that from now on the 'legacy' 2.2.x version will no longer\n receive Drupal core upgrades, even if there will be security core releases.\n\n It is time to upgrade away from Drupal 5 and away from PHP 5.2, if still used.\n\n# Updated Octopus platforms:\n\n aGov 1.2 --------------------- https://drupal.org/project/agov\n Commerce 1.29 ---------------- https://drupal.org/project/commerce_kickstart\n Commerce 2.17 ---------------- https://drupal.org/project/commerce_kickstart\n Commons 2.20 ----------------- https://drupal.org/project/commons\n Commons 3.17 ----------------- https://drupal.org/project/commons\n ERPAL 2.0-b5 ----------------- https://drupal.org/project/erpal\n Guardr 1.11 ------------------ https://drupal.org/project/guardr\n Open Atrium 2.21 ------------- https://drupal.org/project/openatrium\n Open Outreach 1.10 ----------- https://drupal.org/project/openoutreach\n OpenPublic 1.0-rc4 ----------- https://drupal.org/project/openpublic\n Panopoly 1.11 ---------------- https://drupal.org/project/panopoly\n Restaurant 1.0-b2 ------------ https://drupal.org/project/restaurant\n\n# New features and enhancements in this release:\n\n * Allow to define always disabled modules via _MODULES_FORCE variable.\n * Eldir: Add subtle 3D and round some edges.\n * Eldir: Improve spacing and hide useless headers.\n * Fix permissions on sites/all/{modules,libraries,themes} on Platform Verify.\n * Make firewall management faster with randomized schedule.\n * Merge pull request #362 from pricejn2/imageapi-optimize-binaries\n * RVM: Add exceptions for gems which can't be installed in Limited Shell.\n * Shell: Compass Tools: Allow to access guard.\n * Shell: Improve config to better support advanced Drush commands over SSH.\n\n# Changes in this release:\n\n * Drush: Upgrade command line version 6 to mini-6-14-08-2014\n * Nginx: Add DBot to is_crawler list.\n * Remove no longer supported NodeStream distro.\n * Run complete modules-dis-list weekly (Saturday) and basic list daily.\n\n# System upgrades in this release:\n\n * MariaDB 10.0.13\n * MariaDB 5.5.39\n * Nginx 1.7.4\n * OpenSSL 1.0.1i (if installed from sources)\n * PHP: ionCube loader 4.6.1\n * PHP: Zend OPcache master-30-07-2014\n\n# Fixes in this release:\n\n * Add cleanup for .tmp in sub-accounts.\n * Add cleanup for drush-backups leftovers.\n * Add cleanup for various /var/backups/* leftovers.\n * Add daily auto-cleanup for ghost vhosts, platforms and drush aliases.\n * Add exception for symlinked /data/all\n * Add hint for HTTPS-only mode forced in local.settings.php\n * Allow to clear drush cache without directory restrictions.\n * Avoid \"Is a directory\" noise in the log.\n * Commons 2.20 has changed its profile name from drupal_commons to commons.\n * Do not modify site_footer on hostmaster upgrade.\n * Do not rename the legacy Commons profile name.\n * Fix -mtime expected values.\n * Fix cleanup for .restore vhost leftovers.\n * Fix cleanup for drush aliases in sub-accounts.\n * Fix for unreliable _IS_OLD check on Octopus instances upgrade.\n * Fix Nginx monitor to respect all whitelisted POST requests in both modes.\n * Fix permissions on sites/all/{modules,libraries,themes} globally.\n * Fix weird typo in global.inc\n * Improve cleanup for empty platforms directories.\n * Improve RVM cleanup.\n * Issue #2278847 - Derivatives (Drupal Commons) can't be created on install.\n * Issue #334 - Backported provision_civicrm #1485920\n * Issue #334 - Delete the civicrm_class_loader variable after deploying.\n * Issue #334 - Install civicrm in any location (sites/ profiles + contrib).\n * Issue #360 - Exclude special --CDN vhosts from daily cleanup.\n * Make sure that /keys subdirectory exists to avoid active platforms cleanup.\n * Make sure that local IPs are never blocked by mistake.\n * Never touch websh wrapper to avoid high load because of redirect loop.\n * Nginx: Detected $device is not used in Boost config, only in Speed Booster.\n * Nginx: Fix limreq also for some really old vhosts.\n * Nginx: Modify only vhosts known as included in the protected mode.\n * Remove /var/run/daily-fix.pid if exists when it shouldn't.\n * Remove debugging mode in old codebases cleanup.\n * Remove no longer needed/used contrib updates.\n * Restore default websh wrapper symlink as fast as possible.\n * Run manage_ltd_users every 3 minutes instead of every minute.\n * Simplify colorbox-1.3.18 download.\n * Simplify colorbox-1.5.13 download.\n * Uninstall css_emimage only on hostmaster upgrade.\n * Update and improve docs/FAQ.txt\n * Update regex for exceptions in Nginx monitoring.\n\n\n### Stable BOA-2.2.8 Release - Full Edition\n### Date: Sat Jul 26 15:31:29 PDT 2014\n### Includes Ægir 2.x-boa-custom version.\n### Latest hotfix added on: Tue Aug 5 14:47:17 PDT 2014\n\n# Release Notes:\n\n This release includes updated versions of all supported Drupal platforms to\n provide latest Drupal 7 and Pressflow 6 core, plus some changes, improvements,\n bug fixes, and six (6) updated Octopus platforms.\n\n NOTE: Since the first Edition in the BOA-2.3.x series is not ready for release\n yet, and new Drupal core has been released to fix security issues, followed by\n yet another release to fix serious regressions, we have decided to make it\n available to everyone and release yet another stable BOA-2.2.x Edition.\n\n IMPORTANT! This is the last Edition in the 2.2.x series, which marks the end\n of Drupal 5, PHP 5.2 and Drush 4 support. Next Edition will open 2.3.x series,\n which will allow us to provide newer Ægir version with built-in Drush 6\n support, sites in subdirectories, and many Ægir User Interface improvements.\n\n If you still host any Drupal 5 sites or you are using PHP 5.2 for D6 sites,\n you will not be able to upgrade to the next 2.3.x Edition and you will have to\n stay on the 'legacy' BOA 2.2.x version, which will receive only system\n security upgrades, but no further feature nor bugfix releases.\n\n This also means that from now on the 'legacy' 2.2.x version will no longer\n receive Drupal core upgrades, even if there will be security core releases.\n\n It is time to upgrade away from Drupal 5 and away from PHP 5.2, if still used.\n\n# Updated Octopus platforms:\n\n Commerce 1.28 ---------------- https://drupal.org/project/commerce_kickstart\n Commerce 2.16 ---------------- https://drupal.org/project/commerce_kickstart\n Commons 3.16 ----------------- https://drupal.org/project/commons\n Open Outreach 1.8 ------------ https://drupal.org/project/openoutreach\n OpenBlog 1.0-v3 -------------- https://drupal.org/project/openblog\n Panopoly 1.8 ----------------- https://drupal.org/project/panopoly\n\n# New features and enhancements in this release:\n\n * Allow to force OpenSSL etc. re-install with _SSL_FORCE_REINSTALL=YES\n * Auto-Move no longer used shared codebases to /var/backups/codebases-cleanup\n\n# Changes in this release:\n\n * Drush: Upgrade command line version 6 to mini-6-29-07-2014\n * Issue #334 - Update provision_civicrm version - code by ixiam - thanks!\n * Redis Integration Module: Update to version mod-21-07-2014\n * Uninstall css_emimage in hostmaster to avoid broken upgrades.\n * Update for Contrib [F]orce[D]isabled modules list.\n * Use more aggressive defaults for _PURGE_BACKUPS and _PURGE_TMP if not set.\n\n# System upgrades in this release:\n\n * PHP 5.4.31\n * PHP 5.5.15\n\n# Fixes in this release:\n\n * Add auto-cleanup for civimail ghost leftovers.\n * Add cleanup drush aliases in the main SSH account properly.\n * Add cleanup for RVM archives and logs.\n * Fix for default value on hot fix update.\n * Fix for dev regression - it shouldn't set $conf['cache'] on valid dev URLs.\n * Fix the logic for custom _DEL_OLD_EMPTY_PLATFORMS defaults.\n * Issue #333 - Update BOA changelog URL shortcut.\n * Nginx: Automate SPDY test to determine if OpenSSL re-install is required.\n * Nginx: Silence access log for already protected /civicrm admin requests.\n * Remove special one-time variables if set, once used.\n * RVM: Install OS compatible Ruby version + various related adjustments.\n * Silence useless noise in the log.\n * Sync firewall limits.\n\n\n### Stable BOA-2.2.7 Release - Full Edition\n### Date: Thu Jul 17 03:11:47 CEST 2014\n### Includes Ægir 2.x-boa-custom version.\n### Latest hotfix added on: Fri Jul 18 18:21:40 CDT 2014\n\n# Release Notes:\n\n This release includes some nice new features, improvements, bug fixes, one\n new Octopus platform, five (5) updated Octopus platforms, along with latest\n Drupal core security upgrades for all supported platforms.\n\n NOTE: Since the first Edition in the BOA-2.3.x series is not ready for release\n yet, and new Drupal core has been released today to fix security issues,\n we have decided to make it available to everyone and release yet another\n stable BOA-2.2.x series Edition.\n\n IMPORTANT! This is the last Edition in the 2.2.x series, which marks the end\n of Drupal 5, PHP 5.2 and Drush 4 support. Next Edition will open 2.3.x series,\n which will allow us to provide newer Ægir version with built-in Drush 6\n support, sites in subdirectories, and many Ægir User Interface improvements.\n\n If you still host any Drupal 5 sites or you are using PHP 5.2 for D6 sites,\n you will not be able to upgrade to the next 2.3.x Edition and you will have to\n stay on the 'legacy' BOA 2.2.x version, which will receive only system\n security upgrades, but no further feature nor bugfix releases.\n\n This also means that from now on the 'legacy' 2.2.x version will no longer\n receive Drupal core upgrades, even if there will be security core releases.\n\n It is time to upgrade away from Drupal 5 and away from PHP 5.2, if still used.\n\n# New Octopus platforms:\n\n OpenPublic 1.0-b23 ----------- https://drupal.org/project/openpublic\n\n# Updated Octopus platforms:\n\n Commerce 1.27 ---------------- https://drupal.org/project/commerce_kickstart\n Commons 3.15 ----------------- https://drupal.org/project/commons\n ERPAL 2.0-b4 ----------------- https://drupal.org/project/erpal\n Guardr 1.9 ------------------- https://drupal.org/project/guardr\n Open Deals 1.33 -------------- https://drupal.org/project/opendeals\n\n# New features and enhancements in this release:\n\n * Add early auto-repair procedure if Provision is missing for any reason.\n * Add support for Debian Squeeze LTS updates.\n * Add support for Debian Squeeze Stable Proposed Updates.\n * Add views_accelerator in all D7 platforms by default via o_contrib bundle.\n * Issue #307 - Support for Compass Tools via RVM with local user gems.\n * Make $conf['cache'] configurable via disable_drupal_page_cache INI variable.\n\n# Changes in this release:\n\n * Nginx: Send Boost compatible Cache-Control headers also with Speed Booster.\n\n This is to mimic Drupal core behaviour when full-page cache is disabled,\n even if it is not really disabled via disable_drupal_page_cache INI variable.\n Note that Speed Booster continues to ignore Cache-Control headers sent by\n Drupal backend, as before, to force its own TTL set via INI variable:\n speed_booster_anon_cache_ttl or in the custom local.settings.php code.\n\n * Add css_emimage to hostmaster makefile to remove dependency on o_contrib.\n * Do not upgrade existing o_contrib, only add new if missing in old platforms.\n * Drush: Upgrade command line version 6 to mini-6-16-07-2014\n * Limited Shell configuration update.\n * Nginx: Do not log HTTPS redirects.\n * PHP: AutoRemove 5.2 from _PHP_MULTI_INSTALL if no instance is using it.\n * Prefer dash if available.\n * Redis Integration Module: Update to version mod-10-07-2014\n * The ?nocache=1 in the URL should also force $conf['cache'] = 0; on the fly.\n * Update lfd default configuration.\n\n# System upgrades in this release:\n\n * cURL 7.37.1 (if installed from sources)\n * Nginx 1.7.3\n * PHP 5.4.30\n * PHP 5.5.14\n * PHPRedis: master-06-07-2014\n * Redis 2.8.13\n\n# Fixes in this release:\n\n * Authorized IPs detection - it should ignore serial/remote console logins.\n * BND --- Bind9 DNS Server (available on Debian only).\n * Clear packages cache more aggressively to avoid issues during OS upgrades.\n * Configure RVM env properly if installed in the user home directory.\n * Contrib update: filefield-6.x-3.13\n * Disable redis integration during hostmaster upgrade.\n * Do not allow known bots to activate nocache and noredis URLs behaviour.\n * Do not use css_emimage in hostmaster to avoid broken upgrades.\n * Fix for o_contrib update logic.\n * Fix for possible permissions problem with redis log file.\n * Fix incorrect version in the permissions fix.\n * Fix legacy test logic to allow head instances to upgrade to another 2.2.x\n * Fix regex in procs monitor.\n * Fix the check for legacy systems on upgrade.\n * Force keyring reinstall if reported as broken.\n * Issue #316 - Octopus upgrade fails because of missing cd $_ROOT/.drush/sys\n * Issue #319 - XTRAS_LIST settings are being overwritten (Ubuntu).\n * Issue #320 - Compass Tools available on Squeeze, Wheezy, Precise and Trusty.\n * Issue #324 - HTTPS results in redirect loop on AWS due to ignored _MY_OWNIP.\n * Issue #328 - The /bin/sh symlink modified daily causes false lfd alarm.\n * Make it clear that we recommend and support Debian 64bit.\n * Make sure that redis and cache_backport are available for hostmaster.\n * Purge no longer used jdk leftovers.\n * Readme improvements.\n * Remove no longer needed tmp chown -R\n * Remove no longer used /data/src directory.\n * Remove remote_import if found if the wrong directory.\n * Sanitize logs lines before analyzing them.\n * The list of platforms symbols can be in a single line or one per line.\n * There is no need to force SHELL in the websh wrapper.\n * Update nginx documentation URL.\n * Use static ftp.debian.org instead of unreliable http.debian.net mirrors.\n\n\n### Stable BOA-2.2.6 Release - Full Edition\n### Date: Sat Jun 21 06:14:18 PDT 2014\n### Includes Ægir 2.x-boa-custom version.\n### Latest hotfix added on: Mon Jul 14 14:54:04 CDT 2014\n\n# Release Notes:\n\n This release includes great new features, improvements, important changes,\n many bug fixes, plus 3 new and 7 updated Octopus platforms.\n\n IMPORTANT! This is the last Edition in the 2.2.x series, which marks the end\n of Drupal 5, PHP 5.2 and Drush 4 support. Next Edition will open 2.3.x series,\n which will allow us to provide newer Ægir version with built-in Drush 6\n support, sites in subdirectories, and many Ægir User Interface improvements.\n\n If you still host any Drupal 5 sites or you are using PHP 5.2 for D6 sites,\n you will not be able to upgrade to the next 2.3.x Edition and you will have to\n stay on the 'legacy' BOA 2.2.x version, which will receive only system\n security upgrades, but no further feature nor bugfix releases.\n\n This also means that from now on the 'legacy' 2.2.x version will no longer\n receive Drupal core upgrades, even if there will be security core releases.\n\n It is time to upgrade away from Drupal 5 and away from PHP 5.2, if still used.\n\n# New Octopus platforms:\n\n aGov 1.0-rc8 ----------------- https://drupal.org/project/agov\n ERPAL 2.0-b2 ----------------- https://drupal.org/project/erpal\n Restaurant 1.0-a5 ------------ https://drupal.org/project/restaurant\n\n# Updated Octopus platforms:\n\n Commerce 2.15 ---------------- https://drupal.org/project/commerce_kickstart\n Commons 2.18 ----------------- https://drupal.org/project/commons\n Commons 3.14 ----------------- https://drupal.org/project/commons\n Guardr 1.5 ------------------- https://drupal.org/project/guardr\n Open Atrium 2.19 ------------- https://drupal.org/project/openatrium\n Open Outreach 1.7 ------------ https://drupal.org/project/openoutreach\n Panopoly 1.6 ----------------- https://drupal.org/project/panopoly\n\n# New features and enhancements in this release:\n\n * Drush aliases based workflows are now supported also remotely over SSH.\n\n This is significant improvement since we have added automatically generated\n and updated Drush aliases for the on-the-server use in BOA-2.2.0\n\n * Add gems: compass_radix v2 and compass_twitter_bootstrap\n * Add support for automatic Scout App upgrade on RVM/Ruby/Gems upgrade.\n * Install headless JRE and only if Solr is expected to run.\n * Issue #2268889 - Allow to whitelist IPs for chive, cgp and sqlbuddy access.\n * Issues #2248907 #1299526 - Allow to use comments for admin notes.\n * Nginx: Disable proxy_buffering to avoid useless extra layer in local proxy.\n * SQL: Allow to change InnoDB log file size via _INNODB_LOG_FILE_SIZE variable\n * Use better subdirectory tree for Drush extensions.\n * Add support for disable_user_register_protection INI variable on the\n platform level - on self-hosted BOA and Power Engines only.\n\n * Issue #2240277 - Customize Octopus platforms list via control file.\n\n ~/static/control/platforms.info\n\n This file, if exists and contains a single line with supported platforms\n symbols, allows to control/override the value of _PLATFORMS_LIST variable\n normally defined in the /root/.${_USER}.octopus.cnf file, which can't be\n modified by the Ægir instance owner with no system root access.\n\n IMPORTANT: If used, it will replace/override the value defined on initial\n instance install and all previous upgrades. It takes effect on every\n future Octopus instance upgrade, which means that you will miss all newly\n added distributions, if they will not be listed also in this control file.\n\n Supported values which can be written in this file - remember: all in a\n single line, space separated, so not one per line, as listed below\n only for readability:\n\n # D7P D7S D7D --- Drupal 7 prod/stage/dev\n # D6P D6S D6D --- Pressflow 6 p/s/d\n # AGV ----------- aGov\n # CME ----------- Commerce v.2\n # CS7 ----------- Commons 7\n # DCE ----------- Commerce v.1\n # DCS ----------- Commons 6\n # ERP ----------- ERPAL\n # FSR ----------- Feature Server\n # GDR ----------- Guardr\n # MNS ----------- Managing News\n # OA7 ----------- Open Atrium D7\n # OAM ----------- Open Atrium D6\n # OAY ----------- Open Academy\n # OBG ----------- OpenBlog\n # OCH ----------- OpenChurch\n # ODS ----------- Open Deals\n # OOH ----------- Open Outreach\n # OSR ----------- OpenScholar\n # PPY ----------- Panopoly\n # RER ----------- Recruiter\n # RST ----------- Restaurant\n # SRK ----------- Spark\n # TTM ----------- Totem\n # UC7 ----------- Ubercart D7\n # UCT ----------- Ubercart D6\n\n You can also use special keyword 'ALL' to have all available platforms\n installed, including newly added in the future BOA system releases.\n\n Examples:\n\n ALL\n D7P D6P OAM MNS OOH RST\n\n * Issue #314 - Make _BACKEND_ITEMS configurable via _BACKEND_ITEMS_LIST\n\n You can whitelist extra binaries to make them available for web server\n requests, in addition to already whitelisted, known as safe binaries.\n\n NOTE: This feature is available only on self-hosted BOA systems.\n\n Please be aware that you could easily open security holes by whitelisting\n commands which may provide access to otherwise not available parts of\n the system, because the exec() in PHP doesn't respect other limitations\n like open_basedir directive.\n\n You should list only filenames, not full paths, for example:\n\n _BACKEND_ITEMS_LIST=\"git foo bar\"\n\n# Changes in this release:\n\n * Add memcache, memcache_admin to the list of automatically disabled modules.\n * Add support for Debian Squeeze LTS updates.\n * Add support for Debian Squeeze Stable Proposed Updates.\n * Add varnish to the list of automatically disabled modules.\n * Add watchdog_live to the list of automatically disabled modules.\n * Disable and remove not used init scripts on known VM systems.\n * Drush: Upgrade command line version 6 to mini-6-21-06-2014\n * Fast DNS Cache Server (pdnsd) install is no longer optional.\n * Install only vanilla core platforms by default (can be overridden)\n * Nginx: Update default limit_conn settings.\n * Nginx: Use only newer control file to force DoS monitor aggressive mode.\n * Sync permissions with new defaults in the hardened setup.\n * Update files ownership to match defaults in the hardened setup.\n * Use dynamic mirror selection provided by Debian instead of forced static.\n\n * The BOA project has moved to Github!\n\n We no longer use repositories and issue queues on drupal.org, in an effort\n to avoid fragmentation and duplication. We have moved all downloads used\n by Barracuda and Octopus to our mirrors a few months ago, and it helped to\n make BOA faster and more reliable during both system install and upgrades.\n\n The next step is to use http://boa.readthedocs.org as a new home for all\n future documentation efforts - it will build the docs, including printable\n versions, on the fly, using dedicated Github repository as a backend, where\n you can help migrate existing docs and improve them, both via boa-docs\n project issue queue and pull requests:\n\n https://github.com/omega8cc/boa-docs\n\n We also encourage you to use drupal.stackexchange.com for BOA support:\n\n http://drupal.stackexchange.com/questions/tagged/aegir\n\n Please use our Github project for contributing code, reporting bugs,\n and also suggesting new features and ideas:\n\n https://github.com/omega8cc/boa\n\n# System upgrades in this release:\n\n * cURL 7.37.0 (if installed from sources)\n * MariaDB 10.0.12\n * MariaDB 5.5.38\n * MySecureShell 1.33\n * Nginx 1.7.2\n * OpenSSL 1.0.1h (if installed from sources)\n * PHP 5.4.29\n * PHP 5.5.13\n * PHP: Zend OPcache master-28-05-2014\n * Redis 2.8.11\n * Ruby 2.1.2\n\n# Fixes in this release:\n\n * Add caveats to docs/REMOTE.txt\n * Add explicit whitelisting in websh wrapper to avoid any edge case problems.\n * Add info about Two-Factor Auth for Chive in the welcome email template.\n * Add missing exceptions in global.inc and simplify docs/REMOTE.txt\n * Add missing wrapper exceptions required by daily.sh script.\n * Clean up packages cache on finale()\n * Create symlink for boa wrapper on the initial install only.\n * Delete daily both files and directories in the ~/static/trash/\n * Do not remove bundler in CI instances if /root/.keep.bundler.cnf exists.\n * Explain that _ALLOW_UNSUPPORTED works only with head.\n * Fix for _NGINX_DOS_LIMIT logical error in the scan_nginx template.\n * Fix for already installed Open Atrium 2.18 7.28.1\n * Fix for Postfix configuration.\n * Fix incorrect version in the permissions fix.\n * Fix permissions after every upgrade.\n * Fix permissions and owner/group required for feeds (upload) support.\n * Fix regex in procs monitor.\n * Force apticron re-install if apticron.conf is outdated.\n * Generate /data/all/cpuinfo daily to be used in Provision.\n * GPL Ghostscript should be available for the web (PHP-FPM) access.\n * Issue #2248037 - Add Platform and Site INI files Templates on Verify task.\n * Issue #2262935 - Modules dir must be group writable in custom platforms.\n * Issue #315 - Upgrading from older versions of BOA fails\n * Issue #316 - Upgrade fails because of missing cd $_ROOT/.drush/sys line.\n * Issue #319 - XTRAS_LIST settings are being overwritten (Ubuntu)\n * Issue #324 - HTTPS results in redirect loop on AWS due to ignored _MY_OWNIP.\n * PHP: Add protection from switching to not installed CLI or FPM version.\n * PHP: Do not block getenv function.\n * Provision: Use /data/all/cpuinfo generated by BOA daily, if exists.\n * Remove redundant downloads silencer.\n * Remove remote_import if found in the wrong directory.\n * Sanitize logs lines before analyzing them.\n * SQL: Do not run update_innodb_log_file_size() if the size is the same.\n * Sync BOND with BARRACUDA.\n * Update for switch_to_bash procedure.\n * Use already downloaded patches.\n * Use Debian release specific proposed-updates.\n * Use full path to sqlmagic in daily.sh to avoid 'command not found' error.\n * Use static ftp.debian.org instead of unreliable http.debian.net mirrors.\n * Fix for authorized IPs detection in the protected vhosts logic - it should\n ignore serial/remote console logins.\n * Provision: Use higher hardcoded threshold to avoid breaking tasks due to\n high load on multi-CPU systems when provision can't determine the real load.\n\n\n### Stable BOA-2.2.5 Release - Full Edition\n### Date: Thu May 8 11:59:23 PDT 2014\n### Includes Ægir 2.x-boa-custom version.\n### Latest hotfix added on: Sat May 10 09:05:19 PDT 2014\n\n# Release Notes:\n\n This release includes no new features, but does include bug fixes plus latest\n Drupal 7.28.1 and Pressflow 6.31.2 core in all built-in Octopus platforms.\n There are also three updated distributions included, as listed below.\n We also list here all hot-fixes applied to previous stable after its release.\n\n# Important - Read This First! (for self-hosted BOA only)\n\n If you haven't run full barracuda+octopus upgrade to latest BOA Stable\n Edition yet, don't use any partial upgrade modes explained in docs/UPGRADE.txt\n Once new BOA Stable is released, you must run *full* upgrades with commands:\n\n $ barracuda up-stable\n $ octopus up-stable all both\n\n For silent, logged mode with email message sent once the upgrade is\n complete, but no progress is displayed in the terminal window, you can run\n alternatively, starting with screen session to avoid incomplete upgrade\n if your SSH session will be closed for any reason before the upgrade\n will complete:\n\n $ screen\n $ barracuda up-stable log\n $ octopus up-stable all both log\n\n Note that the silent, non-interactive mode will automatically say Y/Yes\n to all prompts and is thus useful to run auto-upgrades scheduled in cron.\n\n If you have skipped some recent BOA releases, and you have new default config\n option: _PERMISSIONS_FIX=NO in your /root/.barracuda.cnf configuration file,\n plus, you are not sure if you follow best practices for managing permissions\n as recommended in our docs: https://omega8.cc/node/116 then we recommend\n that you change it to _PERMISSIONS_FIX=YES temporarily, or even permanently\n if your VPS is fast enough, and then run this powerful script as root:\n\n $ bash /var/xdrago/daily.sh\n\n Note that BOA 'legacy' mode is still at version 2.1.3\n\n# Updated Octopus platforms:\n\n Commons 3.12 ----------------- https://drupal.org/project/commons\n Open Atrium 2.18 ------------- https://drupal.org/project/openatrium\n Open Outreach 1.6 ------------ https://drupal.org/project/openoutreach\n\n# Changes in this release:\n\n * Add rsyslog/sysklogd to auto-healing procedures.\n * Make the aggressive scan_nginx mode optional and use old mode by default.\n * Nginx: Add HiScan to blocked crawlers list.\n * Nginx: Add Riddler to blocked crawlers list.\n * PHP: Use pm.process_idle_timeout = 10s for speed and RAM optimization.\n\n# System upgrades in this release:\n\n * MySecureShell 1.33\n * PHP 5.4.28\n * PHP 5.5.12\n\n# Fixes in this release:\n\n * Always define _PHP_CN variable properly.\n * Firewall: Sync CONNLIMIT for web ports with updated limit_conn in Nginx.\n * Fix for _NGINX_DOS_LIMIT logical error in the scan_nginx template.\n * Force Pure-FTPd server re-install if key files are missing for any reason.\n * Issue #2237167 - Improve authorized IPs detection in all protected vhosts.\n * Issue #2262935 - Modules dir must be group writable in custom platforms.\n * Nginx: Do not overwrite custom symlinks to the Under Construction template.\n * Nginx: Update limit_conn in all instances and vhosts on Barracuda upgrade.\n * PHP: Delete pear in legacy paths, if still exists.\n * PHP: Fix for CVE-2014-0185 privilege escalation in FPM (doesn't affect BOA)\n * Postfix: Force re-install if broken permissions detected on upgrade.\n * Pressflow 6: Fix #GH 84 by using drupal_page_is_cacheable().\n * Pressflow 6: Merge pull request #GH 85 from pressflow/SA-CORE-2014-002-fix.\n * Pressflow 6: Remove duplicate openid_update_6001().\n * Revert \"Force MariaDB 5.5 re-install\".\n * Set the TERM env variable if missing to avoid errors.\n * Skip packages set on hold when running apticron.\n * The ~/static/control must be writeable by lshell user to manage ctrl files.\n * Add extra cron semaphore to prevent concurrent cron invocations via\n multiple running runner.sh instances.\n\n\n### Stable BOA-2.2.4 Release - Full Edition\n### Date: Wed Apr 30 17:03:36 PDT 2014\n### Includes Ægir 2.x-boa-custom version.\n### Latest hotfix added on: Fri May 2 04:54:25 PDT 2014\n\n# Release Notes:\n\n This release includes several bug fixes along with five updated platforms,\n plus some hot-fixes applied to previous stable after its release. We have\n also added a fix for known problem is recent Drupal 7.27 [#2245331] hence\n the change from Drupal 7.27.1 to 7.27.2 in all D7 platforms.\n\n# Updated Octopus platforms:\n\n ### Drupal 7.27.2\n\n Commerce 1.25 ---------------- https://drupal.org/project/commerce_kickstart\n Commerce 2.14 ---------------- https://drupal.org/project/commerce_kickstart\n Commons 3.11 ----------------- https://drupal.org/project/commons\n Panopoly 1.5 ----------------- https://drupal.org/project/panopoly\n\n ### Pressflow 6.31.1\n\n Commons 2.17 ----------------- https://drupal.org/project/commons\n\n Note: Always read and follow upgrade procedure if explained in the distro\n release notes, like for Panopoly 1.5 at https://drupal.org/node/2255133\n\n# New o_contrib modules:\n\n * print-6.x-1.19 (includes patch to auto-detect /usr/bin/wkhtmltopdf)\n * print-7.x-2.0 (includes patch to auto-detect /usr/bin/wkhtmltopdf)\n\n# New features and enhancements in this release:\n\n * Support for session.gc_maxlifetime configurable via INI files.\n\n You can control session garbage collector (EOL) per site and per platform.\n The value (in seconds) of the session_gc_eol variable is used as\n session.gc_maxlifetime value and specifies the number of seconds after which\n data will be seen as 'garbage' and potentially cleaned up, resulting with\n $_SESSION variable discarded and affected authenticated users logged out.\n\n BOA default defined in the system level global.inc file is 86400 == 24h.\n\n# Changes in this release:\n\n * Drush: Upgrade command line version 6 to mini-6-26-04-2014\n * Nginx: Use higher defaults for limit_conn to avoid error 503 (CloudFlare)\n * Nginx: Use more aggressive limits against spambots trying to rgstr accounts.\n * Redis: Integration module (the modern variant) upgrade to 7.x-2.x-o8-2.6-B\n\n# System upgrades in this release:\n\n * Nginx 1.7.0\n * PHP 5.5.12\n * Redis 2.8.9\n\n# Fixes in this release:\n\n * Add symlinks in the home directory if missing (every 5 minutes).\n * Add warning that Compass Tools install and upgrade may take a LONG time.\n * Always define _PHP_CN variable properly.\n * Do not delete symlinks to wrappers to avoid false LFD alarms.\n * Fix for 'Force backward compatible SERVER_SOFTWARE'.\n * Fix in websh for _IN_PATH logic to not break backend Drush tasks.\n * Fix the logic for wrappers update and symlinks.\n * Improve status messages to display when silent mode is used on upgrade.\n * Improve whitelisting in the websh wrapper.\n * Issue #2238805 - Command filtering - no word containing *drush* is allowed.\n * Issue #2241495 - wkhtmltopdf stopped working after upgrade.\n * Issue #2247997 - Update docs/REMOTE.txt with workaround for websh issue.\n * Issue #2250397 - Always follow (limited) redirects in cURL requests.\n * Issue #GH-304 - [rvm] use $_RUBY_VERSION as default.\n * Issue #GH-305 - Check disk usage before running install/upgrade.\n * Issue #GH-306 - Allow ruby 1.8 to remain installed.\n * Nginx: Allow to configure keywords for aggressive requests rate monitoring.\n * Nginx: Do not overwrite custom symlinks to the Under Construction template.\n * Nginx: Sync FastCGI timeouts with other Nginx and PHP-FPM defaults.\n * PHP: Add /opt/local/bin/php tmp symlink on barracuda/octopus upgrade.\n * PHP: Allow to set custom _PHP_FPM_TIMEOUT but not lower than 60 (in seconds)\n * PHP: Always respect _PHP_FPM_WORKERS variable if set to numeric value > 0\n * PHP: Better defaults for realpath_cache_ttl and realpath_cache_size.\n * PHP: Fix for CVE-2014-0185 privilege escalation in FPM (doesn't affect BOA)\n * PHP: pm.max_children was not properly updated on FPM version self-switch.\n * PHP: Sync incorrect default_socket_timeout with max_execution_time (180s).\n * PHP: Use 30s for pm.process_idle_timeout - it prevents too high RAM usage.\n * PHP: Variable _PROCESS_MAX_FPM is not used on the Satellite Instance level.\n * Postfix: Force re-install if broken permissions detected on upgrade.\n * Prevent duplicate cron invocations with more strict delays.\n * Restart rsyslog once the install or upgrade is complete.\n * Set the TERM env variable if missing to avoid errors.\n * Shell: Proper fix for wildcard in the path (cd command only)\n * Standardize install and upgrade for Chive, SQL Buddy and CGP.\n * Sync Redis timeout with default FPM timeout (180s).\n * Sync SQL connect_timeout with default mysql.connect_timeout in PHP (60s).\n * The ~/static/control must be writeable by lshell user to manage ctrl files.\n * Update the logic for multi-version PHP support in BOND.\n * Update the logic for multi-version PHP support in docs/REMOTE.txt\n\n\n### Stable BOA-2.2.3 Release - Full Edition\n### Date: Fri Apr 18 12:57:40 PDT 2014\n### Includes Ægir 2.x-boa-custom version.\n\n# Release Notes:\n\n This release includes several bug fixes and security upgrades both for the\n system services and Drupal core, along with three updated platforms and new\n features, including support for MariaDB 10.0 and Ubuntu 14.04 LTS Trusty.\n\n# Updated Octopus platforms:\n\n ### Drupal 7.27.1\n\n Guardr 1.3 ------------------- https://drupal.org/project/guardr\n Open Atrium 2.17 ------------- https://drupal.org/project/openatrium\n Recruiter 1.2 ---------------- https://drupal.org/project/recruiter\n\n# New features and enhancements in this release:\n\n * Add docs/FAQ.txt\n * Add support for MariaDB 10.0 or 5.5 install via _DB_SERIES variable.\n * Add support for Ubuntu 14.04 LTS Trusty.\n * Improve auto-healing for multi-version PHP-FPM setup.\n * Improve docs/UPGRADE.txt\n * Improve health check for protected vhosts during live SSH-auth update.\n * Nginx: More aggressive limits against spambots trying to register accounts.\n\n# Changes in this release:\n\n * Issue #GH-299 - Force disable LESS developer mode on production sites.\n * Move custom scripts to /opt/local/bin/\n * Nginx: Use higher defaults for limit_conn to avoid error 503 (CloudFlare)\n * Normalize localhost entry in /etc/hosts to avoid FQDN mapped to 127.0.0.1\n * PHP: Do not use separate FPM pool for cron if _PHP_FPM_DENY is empty.\n\n# System upgrades in this release:\n\n * MariaDB 5.5.37\n\n# Fixes in this release:\n\n * Add 'exit 0' line if missing.\n * Add /opt/local/bin to PATH by default.\n * Add symlinks for wrappers only temporarily.\n * Add warning that Compass Tools install and upgrade may take a LONG time.\n * Better gem uninstall options.\n * Compass: Multiple fixes for various expected gems versions install/upgrades.\n * Do not override lshell env_path in websh wrapper.\n * Do not use monitored bin path for custom scripts to avoid LFD false alarms.\n * Extra db GRANT for 127.0.0.1 not added when migrating site.\n * Improve auto-healing to create required directories in /var/run/ if missing.\n * Issue #2230269 - New Jetty 9 version overrides JETTY_PORT=8099 with 8080.\n * Issue #2235991 - Drush make needs better exceptions in websh wrapper.\n * Issue #2236475 - Clarify what the Legacy mode really means.\n * Issue #2238965 - Add missing path to switch_to_bash().\n * Issue #2241013 - Git commands should be whitelisted in websh wrapper.\n * Issue #2241495 - wkhtmltopdf stopped working after upgrade.\n * Issue #GH-301 - Update the list of restricted keywords for Octopus username.\n * Issue #GH-304 - [rvm] use $_RUBY_VERSION as default.\n * Make sure that permissions on Chive Manager dir/files are correct.\n * Note: _SSL_FROM_SOURCES=YES is ignored and not needed on Wheezy and Precise.\n * PHP: Add /opt/local/bin/php tmp symlink on barracuda/octopus upgrade.\n * PHP: Allow to set custom _PHP_FPM_TIMEOUT but not lower than 60 (in seconds)\n * PHP: Always respect _PHP_FPM_WORKERS variable if set to numeric value > 0\n * PHP: pm.max_children was not properly updated on FPM version self-switch.\n * PHP: Variable _PROCESS_MAX_FPM is not used on the Satellite Instance level.\n * Remove the line with header TABLE_NAME (sqlmagic).\n * Reset PATH to avoid RVM overrides after Compass Tools install/upgrade.\n * Shell: Allow to run 'drush cache-clear drush' in any directory.\n * The _PHP_MODERN_ONLY variable is no longer used.\n * Ubuntu 14.04 LTS Trusty requires MariaDB 10.0\n * Use hostname -b instead of deprecated hostname -v.\n\n\n### Stable BOA-2.2.2 Release - Barracuda Edition\n### Date: Tue Apr 8 07:24:18 PDT 2014\n### Includes Ægir 2.x-boa-custom version.\n\n# Release Notes:\n\n This is a bug-fix only release to address issues discovered after recent\n major BOA-2.2.0 and subsequent BOA-2.2.1 Releases.\n\n The most important problem fixed in this Release is related to known OpenSSL\n security issue, which has been fixed in OpenSSL 1.0.1g\n\n To learn more please visit: http://heartbleed.com\n\n @=> Note for those on self-hosted BOA (skip this if you are on a hosted Ægir)\n\n We recommend that you enable _SSL_FROM_SOURCES=YES option in your system\n /root/.barracuda.cnf file, to always build latest OpenSSL from sources.\n Note that it will also trigger OpenSSH and cURL install from sources, plus\n subsequent PHP rebuild to include latest SSL libraries.\n\n Note that _SSL_FROM_SOURCES=YES will not force the build from sources on\n Debian Wheezy and Ubuntu Precise, to avoid confirmed conflicts and because\n both OS versions already provide custom, patched OpenSSL packages.\n\n This Release doesn't include any updates to the Octopus installer, so there is\n no point in running full upgrade. It is enough to run the barracuda only,\n system upgrade in the \"silent mode\" with:\n\n $ screen\n $ barracuda up-stable system\n\n The system will send you an email with results when the upgrade is complete,\n but there will be no upgrade progress displayed in the console. You can watch\n it, if you prefer, with command (DATE/TIME are placeholders for real values):\n\n $ tail -f /var/backups/reports/up/barracuda/DATE/barracuda-up-DATE-TIME.log\n\n# System upgrades in this release:\n\n * Nginx 1.5.13\n * OpenSSL 1.0.1g (if installed from sources)\n * PHP 5.4.27\n * PHP 5.5.11\n\n# Fixes in this release:\n\n * Chive Authentication via SSH session may break Nginx due to race conditions.\n * Drush specific dt() wrapper is required in Provision for custom platforms.\n * Fix Compass Tools support for Omega (gems dependencies via bundle install).\n * Fix default shell for system level cron tasks.\n * Fix for csf firewall compatibility test.\n * Force better health check on protected vhosts on live SSH-auth update.\n * Improved health check for protected vhosts during live SSH-auth update.\n * Issue #2229555 - On fresh boa install link missing durring install.\n * Issue #2229715 - Tasks queue doesn't work on the Master Instance.\n * Issue #2231093 - Add new line before 'UseDNS no' in the sshd_config file.\n * Issue #2235991 - Drush make needs better exceptions in websh wrapper.\n * Issue #294 - New Relic ext not installed even if _NEWRELIC_KEY is not empty.\n * Nginx: Backup and re-create default wildcard SSL cert/key with rsa:4096\n * Nginx: Generate 4096 bit long DH parameters when _NGINX_FORWARD_SECRECY=YES\n * Normalize localhost entry in /etc/hosts to avoid FQDN mapped to 127.0.0.1\n * PHP: Better default workers limits for the ondemand mode.\n * PHP: max_input_time should be set to 180 and not 60, by default.\n * PHP: Zend OPcache directive opcache.enable=1 must be set in all ini files.\n * Reset PATH to avoid RVM overrides after Compass Tools install/upgrade.\n * The 'scp' command is broken in limited shell.\n * Too broad whitelisting breaks commands in limited shell with 'tmp' keyword.\n * Too restrictive open_basedir defaults break access to valid PEAR paths.\n * Too restrictive open_basedir defaults break access to valid Tika paths.\n * Use rsa:4096 by default in self-signed certs for Nginx and FTPS.\n\n\n### Stable BOA-2.2.1 Release - Full Edition\n### Date: Tue Apr 1 10:28:45 SGT 2014\n### Includes Ægir 2.x-boa-custom version.\n\n# Release Notes:\n\n This is a bug-fix only release to address issues discovered after recent\n major BOA-2.2.0 Release.\n\n# Fixes in this release:\n\n * Chive Authentication via SSH session doesn't work on some older instances.\n * Compass Tools don't use correct paths to Ruby 2.1.1\n * Cron for sites doesn't work on old instances without Nginx wildcard vhost.\n * FTPS (FTP over SSL) connections may experience TLS problems.\n * PHP: Disabled 'assert' may cause warnings on features revert.\n * PHP: Disabled 'create_function' may break some contrib modules or code.\n * The 'git pull' command is broken in limited shell.\n * The 'rsync' command is broken in limited shell.\n * The 'drush dl foo' command can't be run outside of site directory.\n\n# Known Issues on systems upgraded to BOA-2.2.1 (and 2.2.0) releases\n\n ==> Updated on Tue Apr 8 01:26:47 PDT 2014\n\n @=> Issues fixed in BOA head (running the hotfix in stable is enough):\n\n * Chive Authentication via SSH session may break Nginx due to race conditions.\n * Drush specific dt() wrapper is required in Provision for custom platforms.\n * Issue #2229715 - Tasks queue doesn't work on the Master Instance.\n * PHP: max_input_time should be set to 180 and not 60, by default.\n * The 'scp' command is broken in limited shell.\n * Too broad whitelisting breaks commands in limited shell with 'tmp' keyword.\n * Too restrictive open_basedir defaults break access to valid Tika paths.\n * Zend OPcache directive opcache.enable=1 must be set in all php.ini files.\n\n To fix all those problems you can run as root on self-hosted system:\n\n $ wget -q -U iCab http://files.aegir.cc/update/boa221fix.txt\n $ bash boa221fix.txt\n\n We have fixed this on all hosted and remotely managed Ægir instances already.\n\n @=> Other issues fixed in BOA head (run 'barracuda up-head system' to apply):\n\n * PHP: New Relic extension not installed even if _NEWRELIC_KEY is not empty.\n * Too restrictive open_basedir defaults break access to valid PEAR paths.\n\n\n### Stable BOA-2.2.0 Release - Full Edition\n### Date: Mon Mar 31 06:44:08 SGT 2014\n### Includes Ægir 2.x-boa-custom version.\n\n# Release Notes:\n\n There are many important changes and improvements in this release\n you should be aware of *before* running your BOA system upgrade.\n\n Even if you are on a hosted BOA system with upgrades managed for you,\n it is very important to read at least this extensive release notes.\n\n Here is a list of topics covered in detail further below:\n\n * New 'legacy' mode available for installs and upgrades\n * Important Note For Those Using Our Hosted Ægir Service!\n * Custom php.ini protection has changed and will not honor old settings\n * Barracuda no longer supports Percona since 2.2.0 release\n * Support for PHP FPM/CLI version safe switch per Octopus instance\n * All PHP FPM workers in 5.5, 5.4 and 5.3 now use the 'ondemand' mode\n * Drush aliases are now automatically copied to all relevant accounts\n * Drush is now restricted to use only trusted modules installed by default\n * The ~/.drush and other important directories and symlinks are protected\n * Support for safely configurable cache bins exceptions in Redis\n * Two-Factor-like Authentication to protect access to Chive DB Manager\n * Support for session.cookie_lifetime configurable via INI files\n * Support for files permissions-fix exceptions via platform level INI file\n * High-performance JavaScript callback handler (js) in all platforms\n\n And if you are more curious, read also the big changelog further below,\n which covers only a small number of over 560 commits since BOA-2.1.3 release.\n\n But what if you are not ready for this major upgrade and you would like\n to have more time for testing, but still be able to run system upgrades,\n thus effectively still using previous version 2.1.3 with standard command\n 'barracuda up-stable system', as explained in the docs/UPGRADE.txt?\n\n#-### New 'legacy' mode available for installs and upgrades\n\n We are introducing special 'legacy' mode both for BOA installs and upgrades.\n\n This means that starting with BOA-2.2.0 you can use commands like:\n\n $ boa in-legacy public server.mydomain.org my@email o1\n $ barracuda up-legacy system\n $ octopus up-legacy o1\n etc.\n\n These special 'legacy' commands allow you to install and/or upgrade the 'old\n stable', once the 'new stable' is released. But only until another 'stable'\n is released, of course. Thus you can use it only as an interim solution\n if you are not yet ready for latest 'stable' BOA Edition, for any reason,\n but you want to update at least the low level system packages, kernel etc.\n\n Note also that if you will upgrade to current 'stable', it is not possible\n to downgrade back to the 'old stable' with 'legacy' mode, so please proceed\n with care!\n\n This option will be particularly important once we release *next* major BOA\n Edition. It will come with terminated support for Drush 4, Drupal 5 and, yes,\n PHP 5.2 (finally). This step is required to use latest Drush 6+ with supported\n Drupal cores versions and supported PHP versions, which in fact is required\n to introduce the real Ægir 2.0 in BOA -- we are still using older, customized\n for backward compatibility, Ægir 2 HEAD version, so it is time to move on and\n stay up to date with everything, get new features like ability to manage\n Drupal sites in subdirectories etc.\n\n Once that *next* major BOA Edition is released, we will freeze the 'legacy'\n mode at 2.2.x series level, which will receive only security upgrades and\n no further feature nor bugfix releases. At that point you will have to stick\n to the 'legacy' BOA version if you will need to run PHP 5.2 and Drupal 5\n with Ægir based on Drush 4. It will be still possible, but not recommended\n and not really supported, besides security related issues outside of Drupal.\n This also means that at that point the 'legacy' version will no longer\n receive Drupal core upgrades, even if there will be security core releases.\n\n Note that we don't use the term \"major release\" in the known convention\n for versions naming. It is because the first digit, for historical reasons,\n refers to the Ægir version supported, the second digit refers to BOA stack\n major release, and the last digit refers to both feature and bugfix BOA\n stack upgrades.\n\n#-### Important Note For Those Using Our Hosted Ægir Service!\n\n NOW is the time (and last chance) to upgrade all your legacy Drupal 5 sites\n and outdated Drupal 6 sites still not compatible with at least PHP 5.3,\n because once we upgrade to the *next* major BOA Edition, it will be no longer\n possible to still run Drupal sites not compatible with PHP 5.3 -- there\n were literally years of this legacy support provided, and this finally\n comes to the end, because we will not use the BOA 'legacy' mode on our own\n servers. It will be still available for remotely managed 'Ægir on Your Own\n Server' option, though, but only on request: https://omega8.cc/support\n\n#-### Custom php.ini protection has changed and will not honor old settings\n\n If you have custom settings in any of your php.ini files protected with\n old variable in the /root/.barracuda.cnf, make a backup of your ini files\n before running this upgrade. While these files will not get overwritten,\n they will no longer be used, because we have introduced new, standardized\n directory structure to properly support multi-PHP-versions systems.\n\n Respective php.ini files are now located in /opt/phpXX/etc/phpXX.ini\n for FPM and /opt/phpXX/lib/php.ini for CLI, where XX is 55, 54, 53 or 52,\n depending on the versions listed via _PHP_MULTI_INSTALL variable in the\n /root/.barracuda.cnf file. Also the variables used to protect ini files\n from being overwritten have changed to _CUSTOM_CONFIG_PHPXX.\n\n If you need any non-standard settings in any of active ini files, don't\n overwrite them with the old files, but rather carefully review and apply\n only the differences you need.\n\n#-### Barracuda no longer supports Percona since 2.2.0 release\n\n If you have used Percona before, Barracuda will force upgrade to MariaDB 5.5\n and PHP rebuild automatically. We plan to add possibility to install\n MariaDB 10.0 once released as stable and tested. MariaDB is the default\n DB server in Barracuda for a long time already.\n\n#-### Support for PHP FPM/CLI version safe switch per Octopus instance\n\n This allows to easily switch PHP version by the instance owner w/o system\n admin (root) help. All you need to do is to create ~/static/control/fpm.info\n and ~/static/control/cli.info file with a single line telling the system\n which available PHP version should be used (if installed): 5.5 or 5.4 or 5.3\n\n Only one of them can be set, but you can use separate versions for web access\n (fpm.info) and the Ægir backend (cli.info). The system will switch versions\n defined via these control files in 5 minutes or less. We use external control\n files and not any option in the Ægir interface to make sure you will never\n lock yourself by switching to version which may cause unexpected problems.\n\n Note that the same version will be used in all platforms and all sites hosted\n on the same Octopus instance. Why not to try latest and greatest PHP 5.5 now?\n\n#-### All PHP FPM workers in 5.5, 5.4 and 5.3 now use the 'ondemand' mode\n\n This change will help to better manage memory use, especially on systems with\n multiple PHP versions running in parallel. This will also free resources\n and allocate them dynamically only when requests are coming and only to\n the active FPM pools. Note that the 'ondemand' mode doesn't affect Zend\n OPcache, because it is managed by the parent process(es) which stay(s) active.\n\n The net result is that on a vanilla BOA install, without non-hostmaster sites\n running, the complete stack consumes just ~200 MB of RAM (in total, so with\n MariaDB, Redis and Nginx etc. included) with all three PHP-FPM versions\n running in parallel: 5.5, 5.4 and 5.3:\n\n CPU[#* 2.0%]\n Mem[|||||||||||||###***********************************209/1002MB]\n Swp[ 0/0MB]\n\n magic:~# ps axf | grep fpm\n 8380 ? Ss 0:00 php-fpm: master process (/opt/php55/etc/php55-fpm.conf)\n 8391 ? Ss 0:00 php-fpm: master process (/opt/php54/etc/php54-fpm.conf)\n 8402 ? Ss 0:00 php-fpm: master process (/opt/php53/etc/php53-fpm.conf)\n magic:~#\n\n#-### Drush aliases are now automatically copied to all relevant accounts\n\n While Ægir manages Drush aliases for its backend needs, they are normally\n not available for the main nor the extra shell users on the instance.\n\n But starting with 2.2.0, BOA automatically manages copies of all Drush\n aliases, by adding them, updating or removing, every 5 minutes, once it\n detects that there are changes applied, like: the site has been migrated\n to another platform, or associated client/owner has been updated, etc.\n\n You no longer need to `cd` to the respective site directory to perform\n some available Drush tasks. Just check the available aliases list with\n `drush aliases` and then enjoy the beauty of `drush @foo.com command` syntax.\n\n#-### Drush is now restricted to use only trusted modules installed by default\n\n Note: this change affects only Ægir backend/system user, typically o1,\n while all other limited shell accounts are not affected, because they are\n already individually jailed with protected custom php.ini and special\n Drush wrappers and settings.\n\n This means that you can skip this section if you are on a hosted Ægir.\n\n Customized Drush now included in BOA by default, will be able to use only\n extensions/commands bundled with contrib modules which are either a part\n of modules added in every platform via shared o_contrib/o_contrib_seven\n symlink located in the platform core modules directory, or are included\n in the built-in platforms installation profiles space, or in the system\n account, protected .drush sub-directory.\n\n This means that any Drush extension/command bundled with contrib module\n uploaded to the sites/all/modules space in all built-in platforms will be\n ignored and not available on command line for the backend user. The same\n applies to site level contrib space, if used.\n\n Additionally, any Drush extension/command bundled with custom platforms\n located in the ~/static directory tree will be completely ignored by Drush,\n no matter where uploaded: core, profiles, sites/all or sites/foo.com space.\n\n This is not a problem in hosted environments, where users normally never\n should have an access to the Ægir backend user, anyway.\n\n If you have any reason to use Drush on command line as an Ægir backend/system\n user, for example to escape limited shell restrictions, we recommend to\n install vanilla Drush 6, for example in /opt/tools/drush/vanilla/drush/ and\n then symlink it into /usr/local/bin/ with custom name, so it will be available\n automatically in your backend o1 user's PATH.\n\n Further improvements to secure sites and instances in a completely locked\n virtual jails are planned in next BOA releases, which will address all other\n known and even potential security issues in Ægir.\n\n#-### The ~/.drush and other important directories and symlinks are protected\n\n There are directories, files and symlinks which should be protected from\n any changes and managed exclusively by the BOA system. The reasons may vary\n from security to avoidable support requests when the less experienced user\n will delete his sites or platforms symlinks, while they can't be easily nor\n automatically recreated. It also prevents the sub-accounts users from using\n their account home directory as a private upload/archive disk space.\n\n#-### Support for safely configurable cache bins exceptions in Redis\n\n Sometimes you may want to exclude some problematic cache bins from Redis\n so they will use default SQL engine, at least until related issue will be\n fixed either in your contrib code or in the Redis integration module.\n\n Normally you had to edit the local.settings.php file which is both tedious\n and dangerous because of extra steps: https://omega8.cc/node/230 to add\n a line, for example: $conf['cache_class_cache_foo'] = 'DrupalDatabaseCache';\n Plus, it had to be done for every site separately.\n\n Now you can simply list the cache bins to exclude, comma separated, either\n in the site or platform level active INI file.\n\n Example: redis_exclude_bins = \"cache_views,cache_foo,cache_bar\"\n\n#-### Two-Factor-like Authentication to protect access to Chive DB Manager\n\n We are introducing Two-Factor-like Authentication logic - now extended also\n to protect Chive DB Manager, Collectd Graph Panel and SQL Buddy DB Manager.\n You must be logged in via SSH and run any auto-continuos command, for example:\n `ping -i 30 google.com` to keep the access open for your IP address.\n\n Why is this important?\n\n While BOA forces HTTPS connection for Chive, anyone who knows the URL can\n access it and attempt to either run brute-force attack to get into your\n site's database, or at least attempt to hammer the server and cause DoS-like\n effects, at least until the system will block his IP on the firewall.\n\n The other important reason is that your site's DB credentials change only\n when you migrate or rename the site, and otherwise remain intact. Now, what\n if you have an employee or a freelancer whom you no longer want to be able\n to access your site? If you think that deleting his SFTP sub-account is\n enough, think again. He still can access your site's database via Chive, if\n he knows the site's DB credentials and the Chive URL.\n\n But now it's no longer possible. Only the visitor who is able to successfully\n authenticate himself via SSH, and keeps active SSH session, will be able\n to access the Chive URL. The rest of the world will see just dummy Nginx 403\n Access Denied error.\n\n And in case you are using self-hosted BOA, the same protection is applied\n also to Collectd Graph Panel and SQL Buddy DB Manager.\n\n#-### Support for session.cookie_lifetime configurable via INI files\n\n You can control session cookies expiration (TTL) per site and per platform.\n The value (in seconds) of the session_cookie_ttl variable is used as\n session.cookie_lifetime value.\n\n BOA default defined in the system level global.inc file is 86400 == 24h.\n\n We also recommend that you enable and configure built-in session_expire\n module, which allows you to keep the sessions DB table tidy. Make sure that\n TTL set via session_cookie_ttl variable is *lower* than TTL configured\n in the session_expire module, because the module does not care about PHP\n settings and simply deletes old entries from the sessions table on cron run.\n\n#-### Support for files permissions-fix exceptions via platform level INI file\n\n You can opt-out from globally enabled daily-permissions-fix procedure per\n platform with new fix_files_permissions_daily variable.\n\n This feature can be useful when you prefer to manage custom platform in\n a monolithic codebase mode in Git, so forcing permissions could conflict\n with your workflow or development tools. Otherwise you should never disable\n this to avoid issues with Ægir tasks related to sites on this platform.\n\n Note that the system level option _PERMISSIONS_FIX (introduced in BOA-2.1.0\n and set to NO by default) should be also enabled with YES in the system level\n /root/.barracuda.cnf file, if you prefer to have permissions fixed in all\n sites on all platforms, except those with fix_files_permissions_daily = FALSE\n set in the platform level, active INI file.\n\n#-### High-performance JavaScript callback handler (js) in all platforms\n\n All platforms, both built-in and custom in the ~/static directory tree, enjoy\n automatically added High-performance JavaScript callback handler (js) support,\n which requires extra /js.php file in the platform root and also proper Nginx\n rewrites. The module itself is also included in the built-in o_contrib bundle.\n\n All you need is to enable the module, if recommended by any other module,\n and enjoy much faster page generation, where possible. You can review the\n full list of modules which will benefit from this great helper module on its\n project page: https://drupal.org/project/js\n\n\n Enjoy another super-fast and even more powerful BOA Edition!\n\n\n# New Octopus platforms:\n\n ### Drupal 7.26.4\n\n Guardr 1.1 ------------------- https://drupal.org/project/guardr\n\n# Updated Octopus platforms:\n\n ### Drupal 7.26.4\n\n Commerce 1.24 ---------------- https://drupal.org/project/commerce_kickstart\n Commerce 2.13 ---------------- https://drupal.org/project/commerce_kickstart\n Commons 3.9.1 ---------------- https://drupal.org/project/commons\n Drupal 7.26.4 ---------------- https://drupal.org/drupal-7.26\n Open Academy 1.0 ------------- https://drupal.org/project/openacademy\n Open Atrium 2.15 ------------- https://drupal.org/project/openatrium\n Open Deals 1.32 -------------- https://drupal.org/project/opendeals\n Open Outreach 1.5 ------------ https://drupal.org/project/openoutreach\n OpenBlog 1.0-a3 -------------- https://drupal.org/project/openblog\n OpenChurch 1.12 -------------- https://drupal.org/project/openchurch\n OpenScholar 3.12.1 ----------- http://theopenscholar.org\n Panopoly 1.2 ----------------- https://drupal.org/project/panopoly\n Recruiter 1.1.2 -------------- https://drupal.org/project/recruiter\n Spark 1.0-b1 ----------------- https://drupal.org/project/spark\n Totem 1.1.2 ------------------ https://drupal.org/project/totem\n Ubercart 3.6 ----------------- https://drupal.org/project/ubercart\n\n ### Pressflow 6.30.1\n\n Commons 2.16 ----------------- https://drupal.org/project/commons\n Feature Server 1.2 ----------- http://bit.ly/fserver\n Managing News 1.2.4 ---------- https://drupal.org/project/managingnews\n Open Atrium 1.7.2 ------------ https://drupal.org/project/openatrium\n Pressflow 6.30.1 ------------- http://pressflow.org\n Ubercart 2.13 ---------------- https://drupal.org/project/ubercart\n\n# New features and enhancements in this release:\n\n * Add High-performance JavaScript callback handler (js) in all platforms.\n * Add session_expire module to shared contrib space in all platforms.\n * Add support for session.cookie_lifetime configurable via INI variable.\n * Allow to control swap clear with control file /root/.no.swap.clear.cnf\n * Auto-Update all BOA install and upgrade wrappers daily.\n * Default system /bin/sh symlink target replaced with /bin/websh wrapper.\n * Disable tcp_slow_start_after_idle for better SPDY performance.\n * Improve the logic in the global.inc for faster processing.\n * Issue #1217486 - Add o_contrib symlinks on platform Verify task.\n * Issue #1310054 - Add support for drush aliases in all lshell accounts.\n * Issue #2148335 - Add Default Localhost Vhost.\n * Issue #2166641 - Make hard-coded load thresholds configurable.\n * Issue #2170079 - Use _CUSTOM_CONFIG_LSHELL to protect lshell.conf template.\n * Issue #2226919 - Custom Platforms in Version Control (skip permissions fix).\n * Lshell: Update /etc/lshell.conf only when required instead of every 5 min.\n * Manage extra db GRANT for 127.0.0.1 to allow SSH tunneling for SQL access.\n * New option _REDIS_LISTEN_MODE to configure PORT or SOCKET mode globally.\n * Nginx: Add support for protected PHP-FPM monitor.\n * Nginx: Force aggressive no-cache headers for the under construction page.\n * Nginx: Switch to buffered logging when /root/.high_traffic.cnf exists.\n * PHP: Add support for FPM/CLI version safe switch per Octopus instance.\n * PHP: Allow to install and run all supported versions: 5.5, 5.4, 5.3, 5.2\n * PHP: Extra php.ini files automatically managed per system and shell user.\n * PHP: FPM workers in 5.5, 5.4 and 5.3 will use 'ondemand' mode by default.\n * PHP: Use separate FPM pools per Octopus instance.\n * PHP: Use TCP Socket mode for all FPM pools and Port mode for legacy vhosts.\n * Protect ~/.drush and other important directories and symlinks from changes.\n * Redis: Allow to exclude cache bins on the fly, per site or per platform.\n * Save 295 seconds on BOA Install and Upgrade.\n * Set and auto-manage strict permissions on some important config files.\n * Set PHP CLI version in the /bin/websh wrapper on the fly.\n * Use Two-Factor-like Authentication logic for Chive DB Manager access.\n * Improve `sqlmagic fix file.sql` to properly replace INSERT INTO with\n INSERT IGNORE INTO (a workaround for duplicate keys in the DB dump)\n * Use the same trick with modules/local-allow.info to temporarily make\n civicrm.settings.php writable, if exists.\n\n# Changes in this release:\n\n * Add ~/static/trash/* to automatic daily cleanup.\n * Add coder to auto-disabled modules -- see #2068771\n * Allow 'drush uli' as root, but deny root access to Drush by default.\n * Disable D8 install via _ALLOW_UNSUPPORTED until next release.\n * Do not enable SYNFLOOD protection by default.\n * Do not force old_short_name in any profile file directly.\n * Firewall: Allow to connect to Apple Push Notification service (APNs)\n * Issue #289 - Update lshell env_path for RVM and install/update global gems.\n * Issue #292 - Open standard RTMP port 1935.\n * Lshell: Use latest Drush 6 (master) by default and remove other versions.\n * Nginx and PHP-FPM: Better default timeout limits.\n * Nginx: Add apk, pxl, ipa to known mime types / download extensions.\n * Nginx: Use text/xml mime type for .xml URLs and restore other mime defaults.\n * Open local access for web based sites cron.\n * Open outgoing port 2525 for custom SMTP connections.\n * Percona DB server is no longer supported.\n * PHP: Always build from sources.\n * PHP: Disable 5.2 FPM if installed, but not used.\n * PHP: Only critical errors are enabled by default in the CLI mode.\n * PHP: Reloading FPM hourly no longer makes any sense.\n * PHP: Remove support for deprecated APC and Memcached.\n * PHP: Restore MailParse support - 2.1.6\n * PHP: Use aggressive disable_functions defaults (further tuned per FPM pool).\n * Redis: Integration module (the modern variant) upgrade to 7.x-2.x-o8-2.6-A\n * Redis: Use modern version with enabled fast lock and aggressive flush mode.\n * Remove insecure exception for wkhtmltopdf uploaded in the user space.\n * Rename master repository on GitHub from legacy nginx-for-drupal to boa.\n * Set _STRICT_BIN_PERMISSIONS=YES by default.\n * Upgrade Compass Tools on every upgrade, not just on new BOA release.\n * Use 60s opcache.revalidate_freq by default to save disk I/O on live sites.\n * Use Ruby Version Manager (RVM) by default to manage Compass Tools etc.\n * Use RVM for global gem installation and updates.\n * Use search_api_solr-7.x-1.4 for new installs.\n * Use web based cron by default to benefit from Zend OPcache.\n * Do not check existence nor auto-config Purge/Expire unless INI variable\n purge_expire_auto_configuration is set to TRUE (automatically, when\n the module is detected as enabled).\n * New naming convention for Ubercart 3.x platforms: [ud2] to support upgrades\n from uberdrupal profile, and [aq3] to support upgrades from acquia profile.\n Note that you have to choose Vanilla Testing profile to see [ud2] or\n Vanilla Minimal to see [aq3] platform in the Add Site form.\n * GitHub is now our main repository, we re-open the issue queue there\n for patches merge requests, while d.o has a code mirror status from now on.\n * Make it crystal clear that Ubuntu is barely supported, rarely tested and\n thus not recommended.\n * The \"Run cron\" extra task has been removed for security reasons. Site cron\n can be run either via standard, scheduled in Ægir procedure, which uses\n local, but web based request to the protected /cron.php URL, or on command\n line, or from the site admin area, as usual.\n\n# System upgrades in this release:\n\n * Bazaar Version Control System (bzr) 2.6.0\n * Collectd Graph Panel (CGP) master-30-03-2014\n * cURL 7.36.0 (if installed from sources)\n * Git 1.9.1 (if installed from sources)\n * Jetty 7.6.14, 8.1.14, 9.1.3\n * Limited Shell 0.9.16.5-om8\n * MariaDB 5.5.36\n * MySecureShell 1.32\n * Nginx 1.5.12\n * OpenSSH 6.6p1 (if installed from sources)\n * OpenSSL 1.0.1f (if installed from sources)\n * PHP 5.4.26\n * PHP 5.5.10\n * PHP: Imagick 3.1.2\n * PHP: ionCube loader 4.5.3\n * PHP: MongoDB 1.4.5 (optional add-on)\n * PHP: Zend OPcache master-09-03-2014\n * PHPRedis: master-22-03-2014\n * Redis 2.8.8\n * Ruby 2.1.1 (from now on compiled from sources)\n\n# Fixes in this release:\n\n * Add fix_collectd_nginx for Collectd config update.\n * Add missing panopoly_demo app in the Panopoly distro to fix broken install.\n * Add missing variables to active INI files, if needed.\n * Avoid way too long Speed Booster TTL for bots, especially for rss feeds.\n * Changing old_short_name mapping to: uberdrupal->testing and acquia->minimal\n * Do not force old_short_name if already set in db/drushrc.\n * Do not run swap clean when heavy tasks like cdp backup run.\n * Drush: Simplify and improve access restrictions logic when aliases are used.\n * Excessive and useless Drush internal cache clear in daily.sh removed.\n * Fix default PATH in all sub-scripts.\n * Fix for broken cURL from sources install logic.\n * Fix for drush make broken by websh fix for cd wildcard crash fix.\n * Fix for multi-IP cron access.\n * Fix missing /dev/fd early enough to avoid broken tasks in Ægir.\n * Fix the logic in manage_ip_auth_access()\n * Fix to avoid daily services maintenance/cron freeze if Jetty didn't stop.\n * Force backward compatible SERVER_SOFTWARE to silence core warnings.\n * Force OpenSSH rebuild on OpenSSL upgrade (if installed from sources).\n * Issue #1317322 - Filters UI broken.\n * Issue #1991908 - Fix the syslog flood caused by collectd df plugin.\n * Issue #2057213 - Use better SQL GRANT style.\n * Issue #2110589 - Unable to install BOA correctly on Debian 6.0 and OpenVZ\n * Issue #2141283 - Drush aliases like `drush dbup` no longer work properly.\n * Issue #2144801 - Display bug on add site.\n * Issue #2144947 - Install new Ruby for better compatibility with new gems.\n * Issue #2150557 - Make the check and update procedure for UseDNS safe.\n * Issue #2152383 - Fix for [js module] - add js_server_software variable.\n * Issue #2159881 - Drush is broken because Console_Table URL no longer works.\n * Issue #2161115 - AdvAgg: Strictly follow RFC 2616 14.21\n * Issue #2167141 - Do not exclude --with-ldap --with-gmp in the PHP on Wheezy.\n * Issue #2172089 - Fix for syntax error.\n * Issue #2173209 - Do not use legacy (removed) symlink for version check.\n * Issue #2175197 - Regex configuration not matching esi/ssi tags.\n * Issue #2177837 - process.max not set correctly for PHP 5.5 and 5.4\n * Issue #2182671 - Solr 4 with Jetty 8 does not start after upgrade.\n * Issue #2188907 - Update docs criteria for not rebuilding ssh, ssl, and curl.\n * Issue #2199229 - CiviCRM 4.4.4 Requires change in the Nginx configuration.\n * Issue #288 - SMTP Authentication Module depends on fsockopen.\n * Lshell: Fix for crash on wildcard cd.\n * Lshell: Remove symlinks for legacy drush_make.\n * Modules can be incorrectly whitelisted from dis by installation profile.\n * Nginx: Add exceptions for known video players.\n * Nginx: Avoid downtime on upgrade because of too low variables_hash_max_size\n * Nginx: Better gzip defaults.\n * Nginx: Default value of variables_hash_max_size is too low.\n * Nginx: Do not overwrite gzip_types.\n * Nginx: Improve fastcgi defaults.\n * Nginx: Remove too broad regex for 'flag' keyword in the URI.\n * Nginx: Send Access-Control-Allow-Origin * header also for /favicon.ico\n * Nginx: Use port 9090 in nginx_octopus_include.conf by default (PHP-FPM 5.3)\n * Nginx: Use Redirect 301 for legacy paths /sites/default/files/*\n * Once you have next 2.3.x installed, you can't downgrade to legacy 2.2.x\n * PHP: Add protection for instance level php.ini files.\n * PHP: Fix for broken build when --with-ldap is used.\n * PHP: Fix for broken dependencies in newer Debian and Ubuntu systems.\n * PHP: Fix for forced rebuild mode if lib curl is broken or updated with apt.\n * PHP: Fix for GEOS 3.4.2 and multi-version install.\n * PHP: Fix for legacy 5.2 logic.\n * PHP: Force 5.5 to use correct SQL drivers so its built-in will not be used.\n * PHP: Reduce duplicate rebuilds.\n * PHP: The --with-curlwrappers option has been removed in 5.5\n * Redis: Auto-Restart if socket is missing only when socket mode is enabled.\n * Redis: Exclude cache_form bin or it will break modules like ajax_comments.\n * Redis: Force clean restart daily, with long enough sleep time.\n * Redis: Restore pwd protection.\n * Redis: The cache_metatag bin needs aggressive flush mode -- see #2062379\n * Reduce system load during db backups with short delays between databases.\n * Remove collectd on major system upgrade even if /var/www/cgp doesn't exist.\n * Silence AIS (Adaptive Image Styles) module .htaccess requirements.\n * Sort and group cnf variables to bring some order into this chaos.\n * Symlink main drush wrapper to shared location outside of Master Instance.\n * Update for Redis bins exceptions logic.\n * Update system load check method in all scripts.\n * Use forced Jetty restart mode.\n * Use https in the welcome screen image src URL.\n * Use IPv4-strict hostname and IP checks only.\n\n\n# Known Issues on systems upgraded to BOA-2.2.0 release (all fixed)\n\n ==> Updated on Tue Apr 1 12:20:27 SGT 2014\n\n @=> Issues hot-fixed in stable (run 'barracuda up-stable system' to apply):\n\n * Compass Tools don't use correct paths to Ruby 2.1.1\n * Chive Authentication via SSH session doesn't work on some older instances.\n * PHP: Disabled 'create_function' may break some contrib modules or code.\n * PHP: Disabled 'assert' may cause warnings on features revert.\n * Cron for sites doesn't work on old instances without Nginx wildcard vhost.\n * The 'git pull' command is broken in limited shell.\n * FTPS (FTP over SSL) connections may experience TLS problems.\n * The 'rsync' command is broken in limited shell.\n * The drush dl foo can't be run outside of site directory.\n\n\n### Stable BOA-2.1.3 Release - Full Edition\n### Date: Thu Nov 21 17:55:47 SGT 2013\n### Includes Ægir 2.x-boa-custom version.\n\n# Release Notes:\n\n This release provides Drupal 7.24.1 and Pressflow 6.29.1 core security upgrade\n for all supported distributions. It also includes two updated platforms and\n several fixes for issues discovered since BOA-2.1.2 released 3 days ago, plus\n some clever improvements to help you automatically optimize all tables daily,\n or even automatically convert tables to-innodb or to-myisam, either per site\n or per platform, or per entire Octopus instance. There is also Purge Cruft\n Machine available to run some spring-cleaning daily with configurable TTL.\n\n Enjoy another super-fast and even more clever BOA Edition!\n\n# Updated Octopus platforms:\n\n ### Drupal 7.24.1\n\n Open Atrium 2.0.9 ------------ http://drupal.org/project/openatrium\n OpenScholar 3.9.3 ------------ http://openscholar.harvard.edu\n\n# New features and enhancements in this release:\n\n * Purge Cruft Machine moved to daily.sh agent and made configurable\n with _DEL_OLD_BACKUPS and _DEL_OLD_TMP per Octopus instance.\n\n If changed to any number greater than \"0\" it will automatically delete\n backups stored in the /data/disk/U/backups/ directory and in all hosted\n sites backup_migrate directories, during daily cleanup, if created more\n than X days ago, where X is a number of days defined in _DEL_OLD_BACKUPS.\n\n If \"0\" then this feature is disabled. It can't be configured via INI files,\n so you may need to submit support request if you want to customize this\n option set to 7 days by default on all hosted instances, as per our\n backups policy: https://omega8.cc/backups\n\n The same logic applies to _DEL_OLD_TMP which defines for how long the\n temporary files in all hosted sites files/tmp/ and private/temp/ directories\n are kept before deleting them during running daily maintenance.\n\n * Added sql_conversion_mode variable in the platform and site level INI\n to customize instance-wide mode optionally set via _SQL_CONVERT.\n\n This option allows to activate and/or customize DB tables conversion\n per site, per platform and via _SQL_CONVERT per Octopus instance.\n\n Supported values are: innodb and myisam (lowercase only!)\n Note that this conversion will run daily even if all tables have been\n already converted, so it will run OPTIMIZE on all tables, effectively.\n\n Related Issue #2126471 - Convert DB engine control files to ini format.\n\n# Changes in this release:\n\n * Allow to install unsupported distros only in head, not stable.\n * Contrib update: advagg-7.x-2.3\n * Map drush to drush6 on command line. You can still use drush4 and drush5.\n * New contrib: display_cache\n * New contrib: panels_content_cache\n * Nginx 1.5.7 -- security upgrade.\n * Use dev versions of CDN module with patch for AdvAgg 7 compatibility.\n * Use Drush 5 and 6 head until next release.\n\n# Fixes in this release:\n\n * Always cleanup temp downloads to avoid failed builds due to leftovers.\n * Always fix permissions on contrib on upgrade and in daily.sh agent.\n * Better auto-recovery when broken libcurl is detected.\n * Delete any tar/gz/zip files in modules|themes|libraries daily.\n * Delete dangerous local-allow.info file.\n * Display all active INI variables in HTTP headers on dev URLs.\n * Fix for cron auto-correction.\n * Fix for Feature Server broken due to incorrect context version downloaded.\n * Fix the logic for cURL install from sources.\n * Nginx: Add Access-Control-Allow-Origin header also for static .json\n * Nginx: Protect also .md files in modules|themes|libraries dirs.\n * Issue #2137583 - Permissions on the site directory are broken after running,\n how ironically, the Health Check task.\n * Issue #2138811 - Maintenance agent disables modules from its standard\n turn-off list, even if they are required by other modules, apps or features.\n\n# Known Issues on systems upgraded to initial BOA-2.1.3 release\n\n ==> Updated on Thu Nov 28 18:33:58 SGT 2013.\n\n @=> Issues which will trigger `barracuda up-stable system` if discovered:\n\n * PHP: Fix for broken cURL from sources install logic.\n * PHP: Fix for forced rebuild mode if lib curl is broken or updated.\n * PHP: Fix for legacy 5.2 rebuild required when broken libcurl is detected.\n * Use dummy variable instead of 'true' to avoid breaking the logic.\n\n @=> Issues which will NOT trigger `barracuda up-stable system` if discovered:\n\n * Add coder to the auto-disabled modules list -- see #2068771\n * Excessive and useless Drush internal cache clear in daily.sh\n * Issue #2141283 - Drush aliases like `drush dbup` no longer work properly.\n * Issue #8215957 - Invalid version type error in old Drush Make.\n * MariaDB 5.5.34 just released.\n * Redis: Incorrect permissions on the integration module directory.\n * Modules can be incorrectly whitelisted by installation profile and\n never disabled, while they should be.\n\n# HotFix for known post-upgrade issues\n\n Run the boa-fix-upgrade script when logged in as system root:\n\n $ cd;rm -f boa-fix-upgrade.sh.txt*\n $ wget -q -U iCab http://files.aegir.cc/update/boa-fix-upgrade.sh.txt\n $ bash boa-fix-upgrade.sh.txt\n\n This script is updated once there is any new regression or bug discovered,\n so it is safe and recommended to run it again if the list of known issues\n have been updated. Note that this script will detect and fix all Octopus\n instances on your system at once.\n\n\n### Stable BOA-2.1.2 Release - Full Edition\n### Date: Mon Nov 18 00:03:30 SGT 2013\n### Includes Ægir 2.x-boa-custom version.\n\n# Release Notes:\n\n This is primarily a bug-fix release and you should read release notes and\n also the changelog for both BOA-2.1.1 and BOA-2.1.0 for a context, especially\n if you are upgrading from BOA-2.0.9 or older release (we have tested upgrades\n from as old Editions as BOA-2.0.1, released on Dec 28 07:00:00 EST 2011).\n\n This Edition includes fixes for all Known Issues on systems already upgraded\n to initial BOA-2.1.1 release, plus some extra improvements and one updated\n platform (Managing News).\n\n Important new features include ability to use either legacy (default) or\n modern (highly recommended) version of Redis integration module.\n\n The reason we don't enable the modern version by default is that it may need\n some testing before using it on a complex Drupal sites. The modern version\n of Redis integration module comes with some great new features which allow\n you to configure flush mode per cache bin, with three modes available.\n\n Please refer to the module README for more information on all available\n advanced flush modes: http://bit.ly/1drmi35\n\n It also comes with super-fast lock backend, which can be enabled only when\n you are using the modern version, but still needs more improvements, so we\n auto-configure some exceptions on the fly, when it is used, to avoid known\n issues, as reported in the queue: https://drupal.org/node/2135545\n\n Please read also INI docs to understand how it works, and how to improve\n performance by enabling and tuning these settings: http://bit.ly/1bwfZZj\n\n Enjoy!\n\n# Updated Octopus platforms:\n\n ### Pressflow 6.28.3\n\n Managing News 1.2.4 ---------- http://drupal.org/project/managingnews\n\n# New features and enhancements in this release:\n\n * Redis: Modern integration module 7.x-2.5 with latest fixes from #2135545\n is available as an option with new INI variable: redis_use_modern\n\n * Redis: New option redis_flush_forced_mode to better control flush modes\n when redis_use_modern = TRUE\n\n * Add example for custom Speed Booster cache TTL configuration in the optional\n override.global.inc file. It can be used also in local.settings.php file.\n\n * Add detection and auto-config for the allow_private_file_downloads variable.\n * Issue #1978066 - Add _RESERVED_RAM variable for \"reserved\" memory.\n * Map all old_short_name profiles relations in the Ægir Provision directly.\n\n# Updated Ægir modules or extensions:\n\n * Newer aegir_custom_settings 6.x-2.3 with site clone added for client role.\n * Newer registry_rebuild 7.x-2.1 with fixed critical bug - see: #2130905\n\n# Changes in this release:\n\n * Auto-Disable views_cache_bully also when Ubercart is enabled.\n * Do not delete testing profile, we need it for acquia->testing upgrade path.\n * Do not map old_short_name on the Octopus level, it is moved to Provision.\n * Make ACTIVE INI files comments-free to never confuse them with templates.\n * Make the fix for known Feeds problem global, not just ManagingNews specific.\n * PHP: 5.4.22 and 5.5.6 as an option (for testing only).\n * PHP: Use latest (master) phpredis_new by default.\n * Redis: Default integration module version reverted to pre-7.x-2.0 release.\n * Redis: Force rebuild on system upgrade to update also Redis config.\n * Redis: Make redis_lock_enable available only when redis_use_modern = TRUE\n * Set opcache.revalidate_freq to 5 sec only on non-dev URLs by default.\n * Switch Ubercart 3 to use D7 Minimal instead if Standard to fix upgrade path.\n * Update prev release notes to explain importance of using latest Pressflow 6.\n\n# Fixes in this release:\n\n * Always fix permissions on contrib on upgrade and in daily.sh agent.\n * Avoid files checks for Drupal for Facebook and Domain Access by default.\n * Better auto-recovery when broken libcurl is detected.\n * Fix for cron auto-correction.\n * Fix for post-upgrade permissions issues affecting modules|themes|libraries.\n * Fix for too restrictive permissions in /data/all/000/*\n * Fix regression in the logic for dev URLs detection and auto-configuration.\n * Fix the forced contrib upgrade logic.\n * Fix the logic for cURL install from sources.\n * Improve procs monitoring agent with better whitelisting.\n * Improve sanitize_string() filtering to avoid issues with strong passwords.\n * Issue #1860706 - Native, unified support also for D6 lock backend.\n * Issue #2023895 - Do not kill java, only jetty and tomcat procs when needed.\n * Issue #2105477 - Allowed gem commands need custom aliases in lshell.\n * Issue #2134329 - Going from 2.0.9 to 2.1.1 does not update platforms.\n * Issue #2135545 - Lock Backend freezes the site on cache clear.\n * Issue #2136413 - Use -H to force correct HOME environment variable.\n * Issue #2136413 - Use sudo to avoid lshell protection in DB auto-conversion.\n * Make sure that /usr/local/bin is in the PATH.\n * Make the check_if_required test in daily.sh six (6) times faster.\n * Nginx: Fix too restrictive access policy for Ægir specific /hosting URI.\n * Redis: Add some debugging on dev URLs to make sure permissions are correct.\n * Redis: Added prefix support for lock backend.\n * Redis: Disable persistent mode to never use on-disk storage, see #2135545\n * Redis: Do not enable tcp-keepalive or weird things may happen, see #2135545\n * Redis: Exclude some bins to avoid issues with lock support, see #2135545\n * Redis: Missing default values on variable_get() calls causing D6 break.\n * Redis: Update docs and naming convention for modern integration module.\n * Silence cURL test in meta-installers.\n * Sync randpass with sanitize_string().\n * Set less restrictive permissions on civicrm.settings.php since\n provision_civicrm does not make the file writable temporarily as it should.\n\n# Known Issues on systems upgraded to initial BOA-2.1.2 release\n\n ==> Updated on Thu Nov 21 01:28:23 SGT 2013 with all fixes applied to stable.\n\n * Feature Server platform is broken since BOA-2.1.0 due to incorrect context\n module version downloaded via makefile. This bug affects only some instances\n upgraded to head and not stable, but since in the first 24 hours after\n BOA-2.1.2 release our static downloads were still out of sync on two of\n our mirrors, it is safe to assume that you should run the HotFix via\n boa-fix-upgrade.sh.txt anyway.\n\n * There is regression introduced in the maintenance agent logic, which\n results with dependency check effectively ignored. This may cause various\n disastrous effects, like disabling all modules chained via feature or\n via apps module, because apps module requires update module, which is\n normally disabled. While any feature which requires dblog or update module\n enabled is considered as a serious developer error and should be avoided,\n we have to respect all dependencies defined to never break any site by\n forcefully disabling modules.\n\n * Part of the Site Health Check task (the `drush6 status-report` command)\n breaks permissions on the site directory, which blocks any further tasks\n like Clone, Migrate and Backup. This regression was introduced in the\n BOA-2.1.0 release.\n\n# HotFix for known post-upgrade issues\n\n Run the boa-fix-upgrade script when logged in as system root:\n\n $ cd;rm -f boa-fix-upgrade.sh.txt*\n $ wget -q -U iCab http://files.aegir.cc/update/boa-fix-upgrade.sh.txt\n $ bash boa-fix-upgrade.sh.txt\n\n This script is updated once there is any new regression or bug discovered,\n so it is safe and recommended to run it again if the list of known issues\n have been updated. Note that this script will detect and fix all Octopus\n instances on your system at once.\n\n\n### Stable BOA-2.1.1 Release - Full Edition\n### Date: Sat Nov 9 17:00:00 EST 2013\n### Includes Ægir 2.x-boa-custom version.\n\n# Release Notes:\n\n There are some important bug fixes in this release, along with changes\n to the Auto-(En|Dis)able agent, explained in greater detail in embedded docs\n included in platform specific INI file template.\n\n Note that the system agent doesn't modify any existing and active INI file,\n so updated docs are included only in the updated each morning INI templates:\n default.boa_platform_control.ini and default.boa_site_control.ini\n\n You can find both INI templates also online at: https://omega8.cc/node/293\n\n We have also added some docs to help you if you experience any issues\n with cached, Views based pages and panels: https://omega8.cc/node/292\n\n Note also that since BOA-2.1.0 all D6 based sites are forced to use PHP 5.3.27\n on hosted and managed Ægir instances, even if they were previously configured\n to use deprecated, insecure, unstable and outdated PHP 5.2 for D6 based sites.\n\n This means that if you are using either too old D6 core (older than 6.28.x)\n some features will stop working, namely imagecache, /update.php and any\n feature which depends on contrib modules not yet compatible with PHP 5.3\n\n We have allowed to use PHP 5.2 for too long, to give enough time (in years)\n to upgrade to latest Pressflow 6.x version and we no longer can extend\n this allowance, for obvious security and systems stability reasons.\n\n Furthermore, sticking with PHP 5.2 would not allow us to use latest Ægir 2.x\n version (BOA still includes a bit older Ægir 2.x for backward compatibility),\n since newer Ægir versions need newer Drush (BOA still uses ancient Drush 4.6)\n and newer Drush requires newer PHP version.\n\n It is even more important because Drupal 8 will not run on older PHP nor Drush\n older than 7.x, so there is basically no choice other than make all your sites\n compatible with PHP 5.3, or you will miss all future BOA system upgrades.\n\n Now even PHP 5.3 is officially in the EOL (End-of-Live) phase, with only\n security fixes expected, but also only until July 2014 and then it will be\n completely deprecated, so we will have to switch to modern PHP 5.5, first\n introduced as an option, later this year.\n\n Upgrading to latest Pressflow 6.x is *very* easy. Just add all contrib modules\n you are using in your outdated 6.x platform to the latest Pressflow 6.x\n platform we provide by default, reverify the new platform, clone the site\n in the old platform, migrate the cloned copy to the new platform and if\n everything works fine, migrate also your live site. It will take less than\n 15 minutes and there is absolutely no excuse to not upgrade.\n\n If you experience issues with your site due to the old core used on now forced\n PHP 5.3, we can temporarily revert it to PHP 5.2 for the last time, but it is\n really a bad idea. Much better idea is to find those 15 minutes and upgrade\n your site, so we could continue to provide future upgrades and new amazing\n features also for your Ægir instance.\n\n Enjoy new, shiny BOA Edition!\n\n# Updated Octopus platforms:\n\n ### Drupal 7.23.3\n\n Open Atrium 2.0.4 ------------ http://drupal.org/project/openatrium\n Open Deals 1.31 -------------- http://drupal.org/project/opendeals\n OpenBlog 1.0-a3 -------------- http://drupal.org/project/openblog\n Recruiter 1.1.2 -------------- http://drupal.org/project/recruiter\n Spark 1.0-a10 ---------------- http://drupal.org/project/spark\n Totem 1.1.2 ------------------ http://drupal.org/project/totem\n\n ### Pressflow 6.28.3\n\n Commons 2.13.2 --------------- http://drupal.org/project/commons\n Open Atrium 1.7.2 ------------ http://drupal.org/project/openatrium\n\n# New features and enhancements in this release:\n\n * Document all system-level control files in docs/ctrl/system.ctrl\n * Fast Redis lock implementation is now enabled by default for D6 and D7.\n * Nginx: Add NAXSI (Nginx Anti XSS & SQL Injection) WAF as an option.\n * Use 100% static downloads in stable to remove dependency on github and d.o\n * Use extended connection check procedure before exit 1.\n * Use reliable Redis UP check via PING/PONG instead of pid file check.\n\n# Updated o_contrib modules:\n\n * Contrib update: httprl-6.x-1.13\n * Contrib update: httprl-7.x-1.13\n * Contrib update: redis-7.x-2.3\n * Contrib update: views_cache_bully-6.x-3.x\n * Contrib update: views_cache_bully-7.x-3.x\n * Contrib update: views_content_cache-7.x-3.0-alpha3\n\n# Changes in this release:\n\n * Introducing Pressflow 6.28.3 to include fix for #2130865\n * Updated INI docs for views_cache_bully and views_content_cache.\n * ProsePoint moved to unsupported.\n\n * Private files mode in D7 requires allow_private_file_downloads = TRUE in\n boa_site_control.ini or boa_platform_control.ini and is disabled by default.\n\n * Do not enable views_cache_bully and views_content_cache, unless special\n control files exist and related variables in the platform specific INI\n are not set to TRUE.\n\n * Auto-Disable views_cache_bully on sites with commerce module enabled, but\n allow to override it with ~/static/control/enable_views_cache_bully.info\n and views_cache_bully_dont_enable = FALSE\n\n# Fixes in this release:\n\n * All-in-One Site Health Check in Ægir not displayed for non-uid=1 users.\n * Always prepare shared D6 and D7 cores.\n * Always remove www. from the Redis cache key prefix.\n * Better check for not yet updated Octopus instances in a batch upgrade mode.\n * Check if ctools is enabled before attempting to enable views_content_cache.\n * Do not force HEAD on Precise.\n * Fix for /root/.upstart.cnf consistency.\n * Fix for PATH in aegir.sh\n * Fix still too aggressive procs monitoring.\n * Fix the check_if_required() logic in the Auto-Disable agent.\n * Improve all cURL based downloads with auto-continue mode.\n * Issue #1980250 - Fix for broken cache_page bin in Redis integration module.\n * Issue #2127237 - New Relic: Unable to initialize module on Debian Wheezy.\n * Issue #2128233 - Rsyslog is still installed and consumes all CPU on OpenVZ.\n * Issue #2128819 - Better exceptions in too aggressive process monitoring.\n * Make sure to never set any HTTP headers or redirects in the backend.\n * Nginx: Do not use separate location for /images/ URI shortcut.\n * Nginx: Fix for regression in \"Rewrite for legacy requests with /index.php\".\n * Nginx: Fix the logic for restricted access to /authorize.php and /update.php\n * Nginx: Map URI shortcuts early to avoid overrides in other locations.\n * Remove rsyslog on VZ, if installed.\n * Restore backward compatibility with IP and not wildcard based vhosts.\n * Use silent upgrade mode in _LENNY_TO_SQUEEZE and _SQUEEZE_TO_WHEEZY.\n * Issue #2127329 - AdvAgg (D6 version) presence in o_contrib should not\n auto-disable standard aggregation, unless the module is enabled.\n\n# Known Issues on systems upgraded to initial BOA-2.1.1 release\n\n ==> Updated on Tue Nov 12 14:44:16 EST 2013 with all fixes applied to stable.\n\n * Fast Redis lock may cause problems on node edit, with temporary error\n saying that the node was changed by \"another user\", because current\n implementation was not multisite-aware enough.\n\n * Views Cache Bully module, if enabled after upgrade to BOA-2.1.0, may break\n the cart and checkout on sites using Ubercart, and should be disabled\n automatically like it is done for Commerce based sites since BOA-2.1.1\n\n * The version of Redis integration module included: 7.x-2.3 causes warnings\n for D6 sites, visible either on dev URLs or on command line and may break\n some advanced Views configurations if custom caching is not yet enabled.\n It may also break menu updates due to not aggressive enough cache clear\n policy for cache_menu bin.\n\n * Permissions set daily on the civicrm.settings.php file are too restrictive\n and since provision_civicrm extension does not make this file writable\n before attempting to re-create it, as it should, all tasks on CiviCRM\n enabled sites fail.\n\n * Permissions on sites/all/{modules,theme,libraries} on newly added, empty\n platforms with no sites created yet, so not included in the running daily\n permissions fix, are initially not group writable, as they should be.\n\n * The check_if_required procedure in the running daily maintenance agent to\n detect if the module is required by any other module or feature or by\n installation profile, is 6 (six) slower than it should be and never disables\n devel module properly.\n\n * The running daily maintenance agent does not disable files checks for\n Drupal for Facebook (fb) and Domain Access modules as it should in the\n platform level INI file, unless those modules are detected.\n\n# HotFix for known post-upgrade issues\n\n Run the boa-fix-upgrade script when logged in as system root:\n\n $ cd;rm -f boa-fix-upgrade.sh.txt*\n $ wget -q -U iCab http://files.aegir.cc/update/boa-fix-upgrade.sh.txt\n $ bash boa-fix-upgrade.sh.txt\n\n This script is updated once there is any new regression or bug discovered,\n so it is safe and recommended to run it again if the list of known issues\n have been updated.\n\n You can also run another upgrade with \"barracuda up-stable system\" command,\n followed by \"octopus up-stable all both log\" since all fixes have been applied\n to current stable as well, but boa-fix-upgrade script is faster than running\n complete upgrade again.\n\n\n### Stable BOA-2.1.0 Release - Full Edition - Now NSA-proof\n### Date: Sat Nov 2 18:15:19 EDT 2013\n### Includes Ægir 2.x-boa-custom version.\n\n# Release Notes:\n\n There are some really important changes and improvements in this release\n you should be aware of before running your BOA system upgrade.\n\n Even if you are on a hosted BOA system with upgrades managed for you,\n it is very important to read at least this release notes.\n\n And if you are more curious, read also the giant changelog further below.\n\n Besides all changes, fixes and improvements, all currently supported\n Drupal distributions have been upgraded to use latest Drupal core versions.\n\n Plus, there are seven (7) NEW platforms included!\n\n#-### Control files to customize your BOA system per platform and per site\n\n Almost all control files are now replaced with two centralized,\n platform and site specific INI files, using standard PHP INI format.\n\n The platform specific INI file template with extensive documentation\n included, has filename default.boa_platform_control.ini and is located\n in the sites/all/modules directory.\n\n The site specific INI file template with extensive documentation\n included, has filename default.boa_site_control.ini and is located\n in the sites/foo.com/modules directory.\n\n Any existing control files, both on the platform and site level\n will be automatically converted into active INI files and then deleted\n to avoid confusion, also automatically, on the first run of the special\n maintenance script: /var/xdrago/daily.sh but defaults in the global.inc\n file will allow for smooth, fully automated transition.\n\n This change will improve customizing your BOA system maintainability\n and overall system performance/load thanks to minimized files checks.\n\n#-### Empty and not used platforms auto-cleanup\n\n BOA has finally the ability to auto-delete, during daily maintenance,\n which happens each morning (server time zone), all empty and not used\n platforms. While on all hosted instances the TTL (time-to-live) is set\n to 60 days (counted since last verify task date/time on the platform),\n it can be configured per instance in the /root/.USER.octopus.cnf file\n by changing value of _DEL_OLD_EMPTY_PLATFORMS variable to anything\n higher than 0 (days), which is default (and means the feature is OFF).\n\n Note that every Octopus instance upgrade re-verifies all existing platforms,\n so if you will configure the TTL to 90 days but you will run the upgrade\n every month or every two months, no platforms will ever be deleted.\n\n If you wish to have this TTL customized on the hosted instance, where\n it is set to 60 (days) by default, please open a support ticket via:\n https://omega8.cc/support\n\n Remotely managed BOA systems can have this feature enabled and configured\n upon request submitted via https://omega8.cc/support\n\n#-### All-in-One Site Health Check in your Ægir control panel\n\n You will notice a new Task available on every site page in your Ægir\n Control Panel, named \"Run health check\". This new task will run a few\n important tests on your site and will store all results in the Task Log,\n so you easily review all results by clicking on the \"View\" button to the\n right of the task, when it is complete. Make sure to check all details\n by clicking on the \"Expand\" links in the log.\n\n What are the tests included?\n\n 1. The \"drush clean-modules\" command will be run for you to make sure\n there is no module left in the system table as \"enabled\" while it\n no longer even exists on the system. This part will utilize (behind\n the scenes) extension: https://drupal.org/project/clean_missing_modules\n If it will find any such leftover, it will clean it up, automatically.\n\n 2. The \"drush6 pm-updatestatus\" command is a native Drush command which\n tells you if there are any waiting module/code updates in the site.\n Note: it will *not* upgrade anything, it is a check only.\n Of course there should be no updates waiting if you follow Ægir\n site upgrade best practices and your site's code is up to date.\n Yes, this check will automatically enable the \"update\" module for you,\n but it will not auto-disable it afterwards (to not break things in case\n it is required by some other module or feature).\n\n 3. The \"drush6 status-report\" command is a native Drush command\n which provides you a complete overview of your site status.\n Instead of logging into the site, you can review it easily here.\n\n 4. The \"drush6 updatedb-status\" command is a native Drush command\n which tells you if there are any waiting database updates in the site.\n Note: it will *not* apply these updates, it is a check only.\n Of course there should be no updates waiting if you follow Ægir\n site upgrade best practices, but who knows, hence the check.\n\n 5. The \"drush security-review\" command will run only on Drupal 7 based sites\n and provides some additional information by using (behind the scenes)\n this extension: https://drupal.org/project/security_review\n\n#-### PFS (Perfect Forward Secrecy) support in Nginx\n\n BOA now fully supports the most secure, yet still compatible with most\n used systems and browsers SSL configuration.\n\n All hosted BOA instances have been already upgraded automatically and\n you don't need to do anything to make it work -- it is already done\n for you -- both on any SSL enabled site with dedicated certificate\n and IP address and also on the standard, system-wide SSL proxy level,\n which is available for every hosted site -- just type HTTPS:// in the URL.\n\n On self-hosted instances it needs to be enabled by adding a line in your\n /root/.barracuda.cnf file: _NGINX_FORWARD_SECRECY=YES before the upgrade.\n Note that depending on the system used, it may auto-install some\n requirements like latest OpenSSL libraries and packages.\n\n Remotely managed BOA systems can have this feature enabled upon request\n submitted via https://omega8.cc/support\n\n#-### SPDY (new networking protocol) support in Nginx\n\n BOA now fully supports the advanced, new protocol which allows to run\n sites over HTTPS with much better performance than plain HTTP.\n\n While not all browsers support this protocol yet, it is already enabled\n by default on all hosted BOA instances (but obviously works only when you\n access the site via HTTPS:// in the URL).\n\n On self-hosted instances it needs to be enabled by adding a line in your\n /root/.barracuda.cnf file: _NGINX_SPDY=YES before the upgrade.\n Note that depending on the system used, it may auto-install some\n requirements like latest OpenSSL libraries and packages.\n\n Remotely managed BOA systems can have this feature enabled upon request\n submitted via https://omega8.cc/support\n\n#-### Zend OPcache replaced APC in PHP\n\n Newer versions of PHP already come with next generation opcode cache\n from Zend, which is now open-sourced and available also as an extension\n for older PHP versions, including 5.2 and 5.3\n\n BOA leverages this opportunity and now uses Zend OPcache instead of APC.\n\n This change is introduced automatically on all systems, both hosted\n and managed for you and also self-hosted.\n\n Only Debian Squeeze and Ubuntu Precise systems which are using PHP\n installed from packages and not from sources, so with _BUILD_FROM_SRC=NO\n set in the /root/.barracuda.cnf file, still use APC by default.\n You can install Zend OPcache by changing it to _BUILD_FROM_SRC=YES\n before running the upgrade.\n\n Note that Zend OPcache default configuration caches every script for\n 60 seconds, so any changes you will introduce, will be visible with\n up to 1 minute delay. However, if there is .dev. or .devel. in the site\n name, this delay is lowered automatically to just 1 second.\n\n You can change the default per site permanently by adding in the\n local.settings.php preferred value, for example, to set it to 10 seconds:\n ini_set('opcache.revalidate_freq', '10'); -- but remember that you will\n override default (1 second) for dev URLs using this method.\n\n Enjoy the most advanced, NSA-proof BOA Edition yet!\n\n\n# New Octopus platforms:\n\n ### Drupal 7.23.3\n\n Open Academy 1.0-rc3 --------- http://drupal.org/project/openacademy\n Open Atrium 2.0 -------------- http://drupal.org/project/openatrium\n OpenBlog 1.0-a2 -------------- http://drupal.org/project/openblog\n OpenScholar 3.8.1 ------------ http://openscholar.harvard.edu\n Recruiter 1.1 ---------------- http://drupal.org/project/recruiter\n Spark 1.0-a9 ----------------- http://drupal.org/project/spark\n Totem 1.1 -------------------- http://drupal.org/project/totem\n\n# Updated Octopus platforms:\n\n ### Drupal 7.23.3\n\n Commerce 1.20 ---------------- http://drupal.org/project/commerce_kickstart\n Commerce 2.9 ----------------- http://drupal.org/project/commerce_kickstart\n Commons 3.4 ------------------ http://drupal.org/project/commons\n Conference 1.0-a2 ------------ http://drupal.org/project/cod\n Drupal 7.23.3 ---------------- http://drupal.org/drupal-7.23\n Open Deals 1.27 -------------- http://drupal.org/project/opendeals\n Open Outreach 1.2 ------------ http://drupal.org/project/openoutreach\n OpenChurch 1.11-b14 ---------- http://drupal.org/project/openchurch\n Panopoly 1.0-rc5 ------------- http://drupal.org/project/panopoly\n Ubercart 3.5.1 --------------- http://drupal.org/project/ubercart\n\n ### Pressflow 6.28.2\n\n Commons 2.13 ----------------- http://drupal.org/project/commons\n Feature Server 1.2 ----------- http://bit.ly/fserver\n Managing News 1.2.3 ---------- http://drupal.org/project/managingnews\n Open Atrium 1.7.1 ------------ http://drupal.org/project/openatrium\n Pressflow 6.28.2 ------------- http://pressflow.org\n ProsePoint 0.46 -------------- http://prosepoint.org\n Ubercart 2.12.1 -------------- http://drupal.org/project/ubercart\n\n# New features and enhancements in this release:\n\n * Add a workaround for an edge case problem -- a missing /etc/resolv.conf\n * Add auto-config for AdvAgg on both Drupal 7 and Drupal 6.\n * Add command to check for available updates: `drushextra check updates`\n * Add gems for Omega 4 by default.\n * Add sass-globbing gem by default.\n * Allow to install latest OpenSSH from sources with _SSH_FROM_SOURCES\n * Allow to install latest OpenSSL from sources with _SSL_FROM_SOURCES\n * Anonymize lshell intro message.\n * Better code sharing with central core dirs for all built-in platforms.\n * BOA installer wrapper depends on curl instead of wget.\n * Do not stop/start cron if /root/.upstart.cnf control file exists.\n * Drush: Add embedded how-to for aliased commands.\n * Enable views_cache_bully and views_content_cache if views is enabled.\n * Firewall: Disable incoming ping/ICMP.\n * Firewall: Protect port 80 only with CONNLIMIT and remove it from PORTFLOOD.\n * Firewall: Update config template and enable port/syn flood protection\n * FTP: Allow to list/see up to 3000 files/subdirs in a directory.\n * Improve daily.sh performance.\n * Improve dist-upgrade procedure.\n * Improve docs/MODULES.txt\n * Improve meta-installers auto-update procedures.\n * Improve SQL limits auto-configuration.\n * Install pdnsd as a last service.\n * Issue #2000932 - Add also zen-grids.\n * Issue #2015553 - Fix the logic for protected registration of new accounts.\n * Issue #2044589 - SPDY Nginx support.\n * Issue #2052703 - Conversion from control files to ini includes.\n * Issue #2092599 - Switch to disable MySQL password reset on upgrades.\n * Issue #2105477 - Add support for bundler gem.\n * Issue #2116387 - Nginx and PHP: Improve system hardening.\n * Issue #2116395 - Nginx: Better protection and 404 instead of 403.\n * Issue #2118393 - Mark drush/cron as newrelic_background_job\n * Make Bazaar installation optional with BZR keyword required in _XTRAS_LIST\n * Nginx: Use forced HTTPS-only access for Chive and SQL Buddy.\n * PHP: Add experimental support for 5.4 and 5.5\n * PHP: Install Zend OPcache instead of deprecated APC by default.\n * PHP: Reload FPM hourly unless /root/.high_traffic.cnf exists.\n * Restart db server when backup is complete if /root/.my.optimize.cnf exists.\n * Restore support for Expire and Purge modules.\n * Shell: Add gunzip to allowed commands.\n * Shell: Disable mc on the fly unless /root/.allow.mc.cnf control file exists.\n * Shell: Use MySecureShell 1.31 for SFTP by default.\n * Try to download wrapper 4 times before it gives up.\n * Use MySQLTuner to better tune SQL configuration on install and upgrade.\n * Use sqlmagic to fix errors caused by duplicate keys in the db dump.\n * Use standard D7 profile for Ubercart 3 and update related contrib.\n * We no longer depend on drupal.org for any downloads.\n * Add optional, configurable per site, automated and smart (via sqlmagic tool)\n DB table format/engine conversion, enabled per instance with non-default\n _SQL_CONVERT=YES option.\n * Add support for _MODULES_SKIP variable and make the auto-disable agent\n much smarter to never disable any module defined as required by any other\n module or feature.\n * Improve auto-recovery from manual permissions/ownership big mistakes\n related to critical files and dirs.\n * Issue #2067193 - PFS (Perfect Forward Secrecy) support in Nginx with\n _NGINX_FORWARD_SECRECY=YES config option.\n * Use _DEL_OLD_EMPTY_PLATFORMS to enable and define auto-cleanup for old,\n empty platforms with no sites hosted, separately per Satellite instance\n (it does not affect Master instance).\n * Issue #2000932 - Add more Compass tools/extensions: (compass_radix,\n zurb-foundation) and make sure the gems are updated on upgrade.\n * Nginx: Add support for domain specific /robots.txt mapped to static\n files/$host.robots.txt to make it possible to manage it per domain\n also when Domain Access module is used.\n * Improve the logic for daily permissions fix (no longer enabled by default)\n and make it configurable via _PERMISSIONS_FIX variable.\n * Improve the logic for daily modules fix (still enabled by default)\n and make it configurable via _MODULES_FIX variable.\n * Generate static sites/foo.com/files/robots.txt file per site, which is\n mapped to /robots.txt\n\n# New and updated Ægir modules or extensions:\n\n * Add security_review extension\n * Use registry_rebuild 7.x-2.x\n\n# New o_contrib modules:\n\n * Add Advagg 6 and 7 to all platforms.\n * Add force_password_change to all platforms.\n * Add views_cache_bully to all platforms.\n\n# Changes in this release:\n\n * All D6 based sites are forced to use latest PHP 5.3.27 version.\n * Chive 1.3\n * cURL 7.33.0 as an option.\n * Drush 5.10.0 and 6.1.0 (available as drush5 and drush6)\n * Git 1.8.4.1\n * Lshell 0.9.16.4-om8\n * MariaDB 5.5.33a\n * Nginx 1.5.6\n * Nginx: ngx_cache_purge-2.1\n * OpenSSH 6.3p1 as an option.\n * Percona 5.5.33\n * PHP 5.4.21 and 5.5.5 as an option.\n * Redis 2.6.16\n * Vnstat 1.11\n * Deprecate CiviCRM as a separate platform.\n * Remove obsolete MartPlug distro.\n * Move OpenPublish to unsupported.\n * Move NodeStream to unsupported.\n * Do not include D6 core translations, never included also in D7 platforms.\n * Do not include notoriously buggy backup_migrate module.\n\n# Fixes in this release:\n\n * Add all extra, non-standard options in the barracuda.cnf docs template.\n * Add built-in support for Domain Access also for sites/all/modules/contrib\n * Add exception to support commerce_multicurrency module properly.\n * Add info about self-signed SSL certificate in the welcome email (again).\n * Add support for /usr/etc/sshd_config if exists.\n * Always force update_newrelic - even if there is no new PHP version.\n * Better check for GitHub partial downtime.\n * Better logic for clean resolvconf re-install when needed.\n * Contrib: Make the list readable.\n * Delete too old pid files if any exists.\n * Do not allow to break working DNS cache server with parent system overrides.\n * Do not allow to install OpenSSL and cURL from sources also on Precise.\n * Do not install rsyslog on VZ based VM.\n * Do not set session.cookie_secure on SSL requests for sites < D7\n * Enable dev mode also when HTTP_HOST begins with dev.\n * Firewall: Adjust some defaults to improve flood protection,\n * Firewall: Always upgrade, unless _CUSTOM_CONFIG_CSF is set to YES.\n * Firewall: Better support for auto-whitelisting multi-IP systems.\n * Firewall: Fix csf.uidignore file to whitelist important system uids.\n * Firewall: Fix for csf template on VZ.\n * Firewall: Improve some flood protection defaults.\n * Firewall: Improve whitelisted IPs msg.\n * Firewall: Remove deprecated monitoring for now closed port 25 (incoming).\n * Firewall: Update config template.\n * Firewall: VZ compatibility.\n * Fix for /etc/resolv.conf and curl requirement in the BOA Meta Installer.\n * Fix for cron tasks queue.\n * Fix for forced pdnsd and resolvconf upgrades.\n * Fix for incorrect nproc discovery results on some VM systems.\n * Fix for proper handling mysql connections leftovers.\n * Fix for selected packages hold status.\n * Fix for the auto-update logic -- now it is default.\n * Fix permissions for control files to avoid leftovers on delete task.\n * Fix permissions on default backup_migrate dirs.\n * Fix the auto-healing to avoid killing all php-fpm processes at midnight.\n * Fix the automatic generation of static robots.txt file per site.\n * Fix the daily enable/disable logic and use faster drush version.\n * Fix the logic for chained installs from sources on upgrade.\n * Fix the makefiles to avoid issues after d.o upgrade.\n * Fix the not really working auto-healing to properly restart mysqld.\n * Fix the not really working lshell logs monitor.\n * Force clean pdnsd and resolvconf reinstall when needed.\n * Force contrib update to include redis module stable release.\n * Force cURL and OpenSSH re-install from sources when OpenSSL is from src.\n * Force Git rebuild from sources if SSL/cURL was built from sources.\n * Force Lshell rebuild when OpenSSL is installed from sources.\n * Force MSS and FTP rebuild when OpenSSL is installed from sources.\n * Force Nginx, PHP and Pure-FTPd re-install when OpenSSL is from sources.\n * Force PHP-FPM restart if 9+ connections with 499 in the last 60 seconds.\n * Generate 2048 bit long DH parameters when _NGINX_FORWARD_SECRECY=YES\n * IDS monitor should use lower defaults after introducing last min checks.\n * Improve gem and bundler allowed/denied restrictions.\n * Improve procs monitoring and whitelist backend tasks properly.\n * Improvements for Ubercart 2 installation + contrib updates.\n * Install latest CGP, collectd 5 compatible.\n * Issue #1751916 - Add Spark 1.0-a9\n * Issue #1874786 - Fix for GNU Mailutils support.\n * Issue #1991312 - Fix support and auto-config for AdvAgg 7 and HTTPRL.\n * Issue #1991658 - Firewall: Close port 25 for incoming connections\n * Issue #1994346 - DoS protection for not cached URLs doesn't respect $scheme\n * Issue #1994346 - Fix the logic for SSESS/SESS prefix in the cookie name.\n * Issue #1995342 - X-Accel-Expires is never send when $expire_in_seconds == 0\n * Issue #2002678 - barracuda up-stable system adds annoying extra delay.\n * Issue #2005116 - 403 on every attempt to log in from Hostmaster homepage.\n * Issue #2015551 - Fix for broken dev mode support switch.\n * Issue #2015551 - Fix the keyword check used to trigger \"dev\" mode.\n * Issue #2020043 - Send PUT requests for *.json URI to Drupal.\n * Issue #2032379 - _AUTOPILOT=YES should be forced also for \"silent\" modes.\n * Issue #2083373 - drush dl foo --destination=/path/ should be restricted.\n * Issue #2101193 - Support Drupal for Facebook from sites/all/modules/contrib\n * Issue #2105259 - All Platforms Installation Fails with Permission Denied.\n * Issue #2116177 - Use phpredis 2.2.4\n * Lshell: Better settings for newer Drush versions.\n * Lshell: Fix for env_path\n * Lshell: version update and monitoring improvements.\n * Make sure o_contrib is updated also on head-to-head upgrades.\n * Make sure to rebuild PHP if cURL is installed from sources.\n * Make the upgrade email generic.\n * More compact code for downloads.\n * Move csf/lfd corrections after pdnsd install.\n * Move the giant modules list from README.txt to docs/MODULES.txt\n * Nginx: Add access protection for .txt files in the modules|themes|libraries.\n * Nginx: Add access protection with fast 404 also for authorize.php\n * Nginx: Add access protection with fast 404 for extra .php known URLs.\n * Nginx: Add example site specific config for legacy .php URIs 301 redirects.\n * Nginx: Better support for static and dynamic .json requests/URIs\n * Nginx: Deny spiders on glossary/* URI, as they are never allowed to crawl.\n * Nginx: Fix for dynamically generated PDFs.\n * Nginx: Fix for redirects for legacy URLs with asp/aspx extension.\n * Nginx: Improve auto-whitelisting in the access log monitor.\n * Nginx: Improve POST requests monitoring.\n * Nginx: Move AJAX and webform requests location after civicrm location.\n * Nginx: Normalize newlines and spacing when fixing proxy config files.\n * Nginx: Remove 'results' from the bots-protected URI regex.\n * Nginx: Remove deprecated conf.d directory, if exists.\n * Nginx: Replace legacy keyword gulag with neutral limreq everywhere.\n * Nginx: Replace the zone legacy name also in Provision.\n * Nginx: Rewrite legacy requests with /index.php to extension-free URL.\n * Nginx: The /admin* URI protection logic has been moved to global.inc\n * Nginx: Update gzip_types to list all expected mime.types\n * Nginx: Update headers for AdvAgg compatibility.\n * Nginx: Update mime.types\n * Nginx: Use more precise wildcard in paths for replacements.\n * PHP: 5.4 requires uploadprogress-1.0.3.1\n * PHP: Disable ionCube Loader for PHP 5.5\n * PHP: Do not force extensions re-install unless _PHP_FORCE_REINSTALL=YES\n * PHP: Fix config overrides for 5.4 and 5.5\n * PHP: Fix possible issues with legacy 5.2 support logic.\n * PHP: Fix unintended overrides in the ini files.\n * PHP: Force All Extensions Rebuild when _FROM_SOURCES=NO\n * PHP: Force APC instead of Zend OPcache on Squeeze/Precise on no-src install.\n * PHP: Force legacy version rebuild if exists.\n * PHP: Improve rebuild logic if SSL/cURL was built from sources.\n * PHP: Make sure that latest version of ionCube loader is installed.\n * PHP: Rebuild extensions also for 5.2, even if _PHP_MODERN_ONLY=YES\n * PHP: Set opcache.revalidate_freq to 1 second on dev alias/URL on the fly.\n * PHP: Start more FPM workers by default to avoid Nginx 499 and timeouts.\n * PHP: Use correct version of ioncube_loader for 5.4\n * PHP: Use pecl-jsmin-0.1.1 with newer PHP versions.\n * PHP: Zend OPcache is a zend_extension and needs full path in the php.ini\n * Redis: Make redis_client_password optional and none by default.\n * Reload PHP-FPM before auto-healing will force its restart after midnight.\n * Remove already deprecated platforms.\n * Remove insecure files from libraries/plupload/examples.\n * Remove lock files before adding new users.\n * Security updates for selected contrib on all affected D7 platforms.\n * Shell: Fix FTPS compatibility after switching to MySecureShell\n * Shell: Sync IdleTimeOut for MSS with SSH and FTPS default 15m.\n * Shorten some too long status messages.\n * Silent Mode Option: aegir == Only stock Ægir forced up-head upgrade.\n * Simplify vnstat setup.\n * Split usage monitor into two separate scripts.\n * SQL auto-healing should always stop-stop-start and not just restart it.\n * SQL: Allow the engine to manage correct innodb_thread_concurrency value.\n * SSH: Make sure that 'UseDNS no' is always set.\n * Sync $cookie_domain validation with Drupal 7 core.\n * Sync dates with BOA defaults.\n * Unify apt-get options order.\n * Update for Redis config template.\n * Update or create /etc/apt/sources.list early enough.\n * Update PHP and SQL config early enough to avoid issues during upgrade.\n * Use --force-yes option if apt-get -y is used.\n * Use correct version of /etc/apt/preferences\n * Use drush6 only when required.\n * Use extended GitHub tests on HEAD and non-stock build only.\n * Use forced symlinks mode if possible.\n * Use is_readable() check instead of file_exists() for all includes.\n * Use mirror downloads for all contrib and patches to make it faster.\n * Use more restrictive permissions on lshell log files.\n\n\n### Stable BOA-2.0.9 Release - Barracuda Edition\n### Date: Thu May 9 11:25:59 EDT 2013\n### Includes Ægir from BOA-2.0.8 Edition\n\n# This is the first Barracuda-only Edition, released to address important\n security issue with Nginx server and provide system level upgrades.\n\n This Edition will not upgrade Ægir Master nor Ægir Satellite Instances,\n because there was no new Drupal core released since BOA-2.0.8 Edition and\n there were not enough updates to built-in platforms or contrib accumulated.\n\n Releasing Barracuda-only Edition separately from full Edition allows us\n to address system/services security issues without any extra delay,\n while releasing Octopus-only Edition will allow us to provide Drupal core\n or Ægir version upgrades, without affecting system level services.\n\n There is also another reason why separate releases will be useful.\n BOA-2.0.9 is the last Edition where Ægir 2.x still uses old Drush 4.6\n in the backend. We need to sync BOA specific Ægir 2.x with upstream\n and finally switch to Drush 5, or even Drush 6, if possible.\n\n This change, however, may cause issues if you still host legacy Drupal 5\n or some old Drupal 6 sites, with either core or contrib not compatible\n with PHP 5.3, which is now used by default.\n\n That is why we plan to introduce ability to install older/previous\n Barracuda and/or Octopus release, if you need more time to upgrade.\n\n# New features and enhancements in this release:\n\n * Debian 7.0 Wheezy support.\n * Automated upgrade from Squeeze with _SQUEEZE_TO_WHEEZY=YES option.\n * Added config template with inline how-to in docs/cnf/barracuda.cnf\n * Added config template with inline how-to in docs/cnf/octopus.cnf\n * Added passwords encryption how-to in docs/BLOWFISH.txt\n * Added the list of symbols used on install in docs/PLATFORMS.txt\n * Forced mysql restart if there are too many high CPU mysqld processes.\n * Improved docs/NOTES.txt\n * Improved docs/README.txt\n * Install libpam-unix2 and libxcrypt1 by default.\n * Install s3cmd by default.\n * Issue #1974640 - Allow to use Midnight Commander for limited shell users.\n * Limited Shell Logs Monitor enabled by default.\n * Nginx: Check for Linux/Cdorked.A malware and delete if discovered.\n * Re-generate and sync Ægir passwords before and after instance upgrade.\n * The silent 'system' mode documented in docs/UPGRADE.txt\n * Allow to exclude platform from otherwise forced `drush en entitycache -y`\n if sites/all/modules/entitycache_dont_enable.info control file is present.\n\n# Changes in this release:\n\n * Nginx 1.5.0 - security upgrade for CVE-2013-2028\n * PHP 5.3.25\n * Redis 2.6.13\n * Do not disable update module in platforms known to include it as required.\n * Firewall: Open port 1129 for outgoing connections (some gateways need it).\n * Force syslog module as disabled by default and save some disk I/O.\n * Tune kernel to always use max RAM and not swap, if possible.\n\n# Fixes in this release:\n\n * Add outgoing port 25 SMTP to the list of requirements.\n * Firewall: Add truly permanent block for heavy abusers.\n * Fix for mytop support, available again on systems with MariaDB.\n * Fix permissions in the /data/all tree if required.\n * Fix the order of checks - they scan only the last (current) minute.\n * Force _STRONG_PASSWORDS=NO if locales still look broken on second check.\n * Improve detecting no longer running drush.php and/or cron PHP processes.\n * Improve fix_locales logic.\n * Improve global.inc symlinking on initial install and upgrade.\n * Improve messages displayed when fix_locales discovers broken locales.\n * Improve monitoring to avoid duplicate entries on low traffic systems.\n * Improve sanitize_string() filtering to avoid issues with strong passwords.\n * Improve syncpass tool - Update system user passwd and flush privileges.\n * Issue #1961226 - Warning: Could not change permissions of sites/all to 751.\n * Issue #1962458 - 403 for anonymous users on node/add.\n * Issue #1963044 - Force UTF-8 locales if not present/configured properly.\n * Issue #1974542 - Use /root/.home.no.wildcard.chmod.cnf control file.\n * Issue #1987936 - Restore ability to install PHP 5.2 for FPM and CLI.\n * Make sure that /dev/null is writable for everyone.\n * Make sure that all drushrc.php files are owned by Ægir system user.\n * Make sure that all expected sites/all/{modules,themes,libraries} dirs exist.\n * Make sure that DB server is restarted on upgrade after config tuning.\n * Make sure that pdnsd and resolvconf are properly installed.\n * Nginx: Remove duplicate Vary: Accept-Encoding headers.\n * Percona no longer supports older Ubuntu non-LTS releases.\n * PHP: Do not reload FPM every hour - it may cause error 502.\n * PHP: Fix paths depending on CLI version used.\n * PHP: Fix the extensions installation and upgrade logic.\n * PHP: Make sure that the FPM port is set correctly for D6 sites with 5.2\n * PHP: Properly uninstall all related packages when using source build.\n * PHP: Start more FPM workers on systems with enough RAM by default.\n * Purge bin logs before disabling them.\n * Run New Relic re-install early enough to avoid locking full-upgrade.\n * Sync the load limits for spiders and backend tasks.\n * The Java/Jetty monitor should use higher allowed limits by default.\n * Update apticron message to recommend system mode instead of full upgrade.\n * Update docs for _BUILD_FROM_SRC option.\n * Use aggressive enough Jetty restart procedure on nightly services reload.\n * Use correct status messages on install and upgrade.\n * Use installer and not Ægir version download on stable install/upgrade.\n\n\n### Stable Edition BOA-2.0.8\n### Date: Mon Apr 8 01:41:36 CEST 2013\n### Installs Ægir 2.x\n\n# Updated Octopus platforms:\n\n ### Drupal 7.22.1\n\n Commerce 2.6 ----------------- http://drupal.org/project/commerce_kickstart\n NodeStream 2.0-rc5 ----------- http://drupal.org/project/nodestream\n Open Deals 1.19 -------------- http://drupal.org/project/opendeals\n\n All other not listed above platforms are available with latest\n D6 or D7 core, even if there were no new distro version released.\n\n# Fixes:\n\n * Critical Issue #1962690 - Fix for broken Percona support.\n\n * Allow to use [a-z0-9] subdomains and not only [www] for IDN domain names.\n * Change the interval between platforms builds from 5 to 3 seconds.\n * Forced 1s Speed Booster TTL for vhosts behind local proxy is deprecated.\n * Move old firewall logs to backups to avoid crazy load after upgrade.\n * Nginx: Better exceptions handling in the Abuse Guard for js/shs modules.\n * PHP: CLI is at 5.3 since BOA-2.0.4, so symlink old 5.2 binary path to 5.3\n * Update _LENNY_TO_SQUEEZE major upgrade procedure.\n * Update contrib with login_security-7.x-1.2\n * Use static downloads for all distros in stable edition.\n\n\n### Stable Edition BOA-2.0.7\n### Date: Thu Apr 4 00:00:17 EDT 2013\n### Installs Ægir 2.x\n\n# Updated Octopus platforms:\n\n ### Drupal 7.22.1\n\n Commons 3.2 ------------------ http://drupal.org/project/commons\n\n All other not listed above platforms are available with latest\n D6 or D7 core, even if there were no new distro version released.\n\n# Fixes:\n\n * Create dot dirs and keys if not exist, plus known_hosts for system user.\n * Fix the sqlmagic regex to really convert only expected tables.\n * Issue #1958502 - Add missing symlinks to the new Drush extensions.\n * Issue #1960192 - Fix literal path replacement with sites/$new_url in D7.\n * Issues #1930670 #1958898 #1932616 - Fix for hosting_server_update_6200.\n * Taxonomy Edge update to 7.x-1.7 and 6.x-1.7\n * Update contrib in all D7 platforms to ctools-7.x-1.3 - security upgrade.\n\n\n### Stable Edition BOA-2.0.6\n### Date: Mon Apr 1 21:34:04 EDT 2013\n### Installs Ægir 2.x\n\n# New Octopus platforms:\n\n ### Drupal 7\n\n Commons 3.1 ------------------ http://drupal.org/project/commons\n\n# Updated Octopus platforms:\n\n ### Drupal 7\n\n CiviCRM 4.2.8 ---------------- http://civicrm.org\n Commerce 1.16 ---------------- http://drupal.org/project/commerce_kickstart\n Commerce 2.5 ----------------- http://drupal.org/project/commerce_kickstart\n Drupal 7.21.2 ---------------- http://drupal.org/drupal-7.21\n NodeStream 2.0-rc4 ----------- http://drupal.org/project/nodestream\n Open Deals 1.18 -------------- http://drupal.org/project/opendeals\n Open Outreach 1.0-rc10 ------- http://drupal.org/project/openoutreach\n OpenChurch 1.11-beta9 -------- http://drupal.org/project/openchurch\n Panopoly 1.0-rc4a ------------ http://drupal.org/project/panopoly\n Ubercart 3.4.1 --------------- http://drupal.org/project/ubercart\n\n ### Pressflow 6\n\n Acquia 6.28.1 ---------------- http://bit.ly/acquiadrupal\n Commons 2.12 ----------------- http://drupal.org/project/commons\n Feature Server 1.2 ----------- http://bit.ly/fserver\n Managing News 1.2.3 ---------- http://drupal.org/project/managingnews\n Open Atrium 1.7.1 ------------ http://drupal.org/project/openatrium\n Pressflow 6.28.1 ------------- http://pressflow.org\n ProsePoint 0.46 -------------- http://prosepoint.org\n Ubercart 2.11.1 -------------- http://drupal.org/project/ubercart\n\n All other not listed above platforms are available with latest\n D6 or D7 core, even if there were no new distro version released.\n\n# No longer supported Octopus platforms:\n\n The platforms listed below can be re-added when their maintainers\n will fix all critical issues and/or apply required updates:\n\n ELMS ------------------------- http://drupal.org/project/elms\n MartPlug --------------------- http://drupal.org/project/martplug\n Octopus Video ---------------- http://octopusvideo.org\n Open Academy ----------------- http://drupal.org/project/openacademy\n Open Enterprise -------------- http://drupal.org/project/openenterprise\n OpenPublic ------------------- http://drupal.org/project/openpublic\n OpenScholar ------------------ http://openscholar.harvard.edu\n Videola ---------------------- http://videola.tv\n\n# New features:\n\n * Add an option to allow cron based, unattended system-only upgrades.\n * Add randpass helper script.\n * Add support for wkhtmltoimage.\n * Add syncpass tool to repair broken instances after incomplete upgrade.\n * Allow to specify extra apt-get packages with _EXTRA_PACKAGES option.\n * Allow to tune PHP-CLI timeout in the BOND script with separate option.\n * Install auditd with aureport by default.\n * Issue #1479300 - Add optional LDAP support in Nginx.\n * Issue #1876418 - Support for High-performance JavaScript callback handler.\n * Issue #1916804 - Validated bypass of flood control based on tty.\n * Jetty: Make migration from Tomcat easy with _TOMCAT_TO_JETTY=YES\n * PHP: Allow to use _PHP_EXTRA_CONF for custom builds from src.\n * Redis: Add Lock Backend Support for Drupal 6 and Drupal 7.\n * Redis: Enable lock support if modules/redis_lock_enable.info exists.\n * Shell: Add extra Drush versions available as drush4, drush5 and drush6.\n * SOLR: Support for 1.x / Jetty 7, 3.x / Jetty 8 and 4.x / Jetty 9.\n * SOLR: Use Jetty 8 for Solr 4 on systems with Java 1.6 available.\n * SOLR: Use Jetty 9 for Solr 4 on systems with Java 1.7 available.\n * SQL: Add sqlmagic tool to fix SQL dumps and convert to/from InnoDB/MyISAM.\n * SQL: Make default_storage_engine configurable with _DB_ENGINE option.\n * Use Registry Rebuild with Fixed Redis Lock Support aware configuration.\n * Allow to force SERVER_NAME based $cookie_domain with special\n modules/cookie_domain.info control file per site.\n\n# New Ægir modules or extensions:\n\n * Add drush clean-modules command - clean_missing_modules extension.\n * Add drush_ecl extension - Drush Entity Cache Loader.\n * Add hosting_site_backup and provision_site_backup enabled by default.\n\n# Changes:\n\n * Git 1.8.2\n * MariaDB 5.5.30\n * Nginx 1.3.15\n * Percona 5.5.30\n * PHP 5.3.23\n * Redis 2.6.12\n * Deprecate CiviCRM 3.4.8 D6 - only available with _ALLOW_UNSUPPORTED=YES.\n * Do not force filefield_nginx_progress as enabled also for D7.\n * Drupal 8.0-dev-tested deprecated and moved to unsupported group.\n * ELMS 1.0-beta1 deprecated and moved to unsupported group.\n * Enable entitycache module by default.\n * Master Ægir: Re-create secure db password on every barracuda upgrade.\n * Master Ægir: Sync generating secure db password also on barracuda install.\n * Nginx: Set 24h Speed Booster cache TTL for spiders/bots by default.\n * NodeStream 1.5.1 deprecated and moved to unsupported group.\n * Open default MongoDB port 27017 for outgoing connections.\n * OpenScholar deprecated and moved to unsupported group.\n * PHP: Deprecate 5.2 also on upgrade.\n * PHP: Install MongoDB driver if MNG keyword is listed in _XTRAS_LIST.\n * PHP: Set _PHP_CLI_VERSION=5.3 by default.\n * PHP: Switch to forced CLI 5.3 and FPM 5.3 also in the custom config.\n * PHP: Switch to FPM 5.3 also for D6 sites by default.\n * Pressflow 5.23 deprecated and moved to unsupported group.\n * Redis: Re-create secure password on every barracuda upgrade.\n * Satellite Ægir: Re-create secure db password on every octopus upgrade.\n * SQL: Do not run DB OPTIMIZE unless /root/.my.optimize.cnf ctrl file exists.\n * SQL: Re-generate new secure mysql root password on every barracuda upgrade.\n * SQL: Use key_buffer = 2M by default.\n * SQL: Use more safe memory limits after introducing higher key_buffer_size\n * Use better names for various control files.\n * Watch crons running > 2 min and kill crons running > 3 min.\n * Split _XTRAS_LIST into two groups: included via ALL keyword and\n other which need to be listed explicitly.\n\n# Fixes:\n\n * Add Ksplice-aware kernel upgrade alert.\n * Add some delay to avoid race conditions when removing more zombies.\n * Allow higher system load before disabling access for spiders temporarily.\n * Always send upgrade log when running in the silent mode.\n * Avoid cron collisions and make sure all maintenance tasks run 0-6 AM.\n * Better and separate backup rotation on hostmaster upgrade.\n * Better check if Webmin GnuPG signing key has been added properly.\n * Better fix for $cookie_domain and DA compatibility.\n * Better protection for all ports usually targeted in brute force attacks.\n * Check if nproc is present and fall back to /proc/cpuinfo otherwise.\n * Clean swap on kernel tuning update.\n * Delete broken o_contrib symlinks before trying to recreate them.\n * Do not add and remove bind from /etc/sudoers since it is not supported.\n * Do not block @ in the limited shell - it breaks git foo git@bar etc.\n * Do not force _DEBUG_MODE=YES if not required.\n * Do not force _HTTP_WILDCARD=NO for stock install option.\n * Do not run extra IP checks for requests below $mininumber threshold.\n * Do not run initial apticron check in local install.\n * Do not run two mysql restarts in a row on mysql upgrade.\n * Downgrade to working wkhtmltopdf-0.10.0_rc2 and wkhtmltoimage-0.10.0_rc2\n * Drupal 7.x core with Field API memory optimization - see #1915646\n * Enable image_allow_insecure_derivatives to avoid issues with drupal-7.20\n * Fix apticron to suggest barracuda up-stable instead of apt-get upgrades.\n * Fix AWS system auto-discovery and auto-configuration.\n * Fix Drush 5.x and _USE_STOCK support.\n * Fix for Bazaar (bzr) 2.6b2 extensions build.\n * Fix for pdnsd install on Ubuntu Precise.\n * Fix the 32 long ALNUM password generation for lshell users.\n * Fix the hint to just display the uptrack command, not run it.\n * Force logrotate on demand if /var/log/syslog > 1GB\n * Force mysql tables check and upgrade before hostmaster upgrade.\n * Force proper pdnsd and resolvconf re-installation if needed.\n * Force proper resolvconf configuration to support and use pdnsd server.\n * FTPS on all modern systems requires lshell path added in /etc/shells.\n * Hostmaster/Octopus contrib modules are now added via Ægir makefile.\n * Improve autonomous IDS auto-cleaning and permanent block mgmt.\n * Improve compatibility testing with Drush 5 and Drush 6.\n * Improve kernel default tuning.\n * Improve Master Instance upgrade logic.\n * Improve mysqldump performance by default.\n * Improve the default strict configuration for $cookie_domain.\n * Improve Tomcat/Jetty self-healing to avoid stuck processes.\n * Install also hostmaster contrib when stock option is used.\n * Issue #1782034 - Use fixed version of the message_notify module.\n * Issue #1825018 - Disable binary logging and make it optional.\n * Issue #1871060 - CiviCRM 4.2.6 needs separate civicrml10n fix.\n * Issue #1873478 - Localhost install broken because getent test is used.\n * Issue #1875348 - Fix for Nginx 1.3.10 bug causing random segfaults.\n * Issue #1886920 - Fix the unrecognized option [service=system-auth] error.\n * Issue #1886920 - Pure-FTPd config broken because of deprecated pam_stack.so\n * Issue #1888380 - Deleted platform cache folder recreated automatically.\n * Issue #1889322 - Domain Access module breaks sites provisioning.\n * Issue #1897018 - Set Pin-Priority also in wrappers to fix also stable.\n * Issue #1897018 - Ubuntu Precise breaks install and upgrade.\n * Issue #1906760 - Incomplete access_log directive in the purge vhost.\n * Issue #1906900 - Nginx microcaching not disabled on prefixed admin URIs.\n * Issue #1909208 - Changed MariaDB GnuPG signing key hangs install/upgrade.\n * Issue #1913394 - Disable automatic CSF/LFD upgrade.\n * Issue #1913488 - Do not install GEOS PHP ext. unless explicitly listed.\n * Issue #1914294 - APC 3.1.14 disappeared from PECL - downgrade to 3.1.13\n * Issue #1918722 - Add diff command as allowed in the limited shell.\n * Issue #1920972 - Could not change permissions warnings on site verify.\n * Issue #1932388 - Use correct keyword PPY for Panopoly install.\n * Issue #1935388 - Use reliable check for Master Instance install path.\n * Issue #1947082 - Permissions are never fixed on the profile level.\n * Issue #1949740 - Make sure that cache_prefix for Redis is always set.\n * Issue #1952042 - Make strong passwords optional and not default.\n * Issue #1953248 - Extra Drush versions should be added properly.\n * Issue #1957762 - Upgrade to Bazaar (bzr) 2.6b2\n * Jetty: Tune memory limits automatically to avoid extra RAM requirements.\n * Keep all extra modules in the same profiles/hostmaster/modules directory.\n * Lshell: Allow ping command to help keep session active / auto-whitelist.\n * Make apticron aware of the BOA version currently running.\n * Make BOND aware of _CUSTOM_CONFIG_SQL if present.\n * Make Compass Tools available in the standard path, if installed.\n * Make sure that all removed zombies use unique dir names.\n * Make sure that all users home dirs are protected.\n * Make sure that now redundant hosting_backup_gc module is removed.\n * Make sure that SERVER_NAME is set to HTTP_HOST early enough, if required.\n * Make the errors monitor aware of system only upgrade mode.\n * Make URI filtering regex localization-aware in the global.inc\n * Nginx Security: BEAST attack protection and fix for PCI compliance.\n * Nginx: Another fix for broken imagecache paths in some imported sites.\n * Nginx: Better protection from DoS attempts on never cached uri.\n * Nginx: Do not block spiders on imagecache/styles URIs.\n * Nginx: Do not force use epoll - it is set on install properly.\n * Nginx: Do not force worker_connections. It will not work in the VM guest.\n * Nginx: Do not force worker_rlimit_nofile. It will not work in the VM guest.\n * Nginx: Force rebuild to include LDAP support if enabled via _NGINX_LDAP=YES\n * Nginx: Improve Abuse Guard to better protect from imagecache|styles flood.\n * Nginx: Improve no-cache exceptions for known AJAX and webform requests.\n * Nginx: Make json compatible with boost caching but dynamic for POST.\n * Nginx: Restore fast 404 for static json requests.\n * Nginx: Set workers number to available CPUs x2 with min/max defaults.\n * Nginx: Use default buffer=32k in the access_log for better performance.\n * Nginx: Use static /normal/ instead of dynamic /$device/ for Boost cache.\n * PHP: Enable more FPM workers by default for better performance.\n * PHP: Force php53-fpm restart if there is no master process running.\n * PHP: Many Drupal 7 based distros require 196M limit at minimum.\n * PHP: Never force php53-fpm restart when another script reloads it.\n * PHP: Use more safe limits on low memory systems.\n * Prevent turning the feature server site into a spam machine.\n * Protect also from not supported request types if Nginx server is busy.\n * Randomize tasks wait/start intervals better to avoid high system load.\n * Redis: Do not disable it on the fly when there is /nojs/ in the URI.\n * Redis: Double check if $cache_lock_path exists before using it.\n * Redis: No need to force exception for cache_menu bin.\n * Redis: Tune sysctl for better memory management by default.\n * Remove up to two last zombies on Master Instance upgrade.\n * Remove up to two last zombies on Satellite Instance upgrade.\n * Rename profiles to avoid confusion between Commons 2 and Commons 3.\n * Run drush @hostmaster hosting-dispatch during upgrade to sync things.\n * Send also OK report when running in the silent mode.\n * Set correct default DNS entry in /etc/hosts before running local install.\n * Shell: Fix for too restrictive Drush commands filtering.\n * Shell: Fix the broken Git support over SSH.\n * Shell: Fixed too restrictive permissions on the extra Drush directories.\n * SQL: Do not run the purge_binlogs script when binary logging is disabled.\n * SQL: Improve sqlmagic converter and allow it to use control files.\n * SQL: The sqlmagic_convert should not be available for extra lshell users.\n * SQL: Tune also key_buffer_size by default.\n * Sync generating secure passwords also for limited shell users.\n * Update csf.conf template.\n * Update self-healing for Tomcat/Jetty support.\n * Update welcome email template to better explain how to manage databases.\n * Use Boost with silenced false alarms.\n * Use Limited Shell branch with fixed tab completion.\n * Use public DNS during pdnsd (re)installation to avoid issues.\n * Whitelist /tmp/make_tmp.* in the csf.fignore to avoid false alarms.\n\n\n### Stable Edition BOA-2.0.5\n### Date: Sun Dec 23 15:35:46 EST 2012\n### Installs Ægir 2.0.5 compatible with Ægir 1.9\n\n# Updated Octopus platforms:\n\n Commerce 1.12.1 -------------- http://drupalcommerce.org\n Commerce 2.0 ----------------- http://drupalcommerce.org\n Commons 2.11 ----------------- http://acquia.com/drupalcommons\n Drupal 7.18.1 ---------------- http://drupal.org/drupal-7.18\n Open Deals 1.14 -------------- http://opendealsapp.com\n Open Outreach 1.0-rc7 -------- http://openoutreach.org\n OpenChurch 1.11-beta7 -------- http://openchurchsite.com\n Panopoly 1.0-rc3 ------------- http://drupal.org/project/panopoly\n Pressflow 6.27.1 ------------- http://pressflow.org\n ProsePoint 0.45 -------------- http://prosepoint.org\n Ubercart 2.11.1 -------------- http://ubercart.org\n Ubercart 3.3.1 --------------- http://ubercart.org\n\n All other not listed above platforms are available with latest\n D6 or D7 core, even if there were no new distro version released.\n\n# New Ægir modules or extensions:\n\n * Add drush clean-modules command - clean_missing_modules extension.\n\n# New o_contrib modules:\n\n * Add reroute_email module in both D6 and D7 contrib.\n\n# Changes:\n\n * Git 1.8.0.2\n * MariaDB 5.3.11 on Debian Lenny\n * MariaDB 5.5.28a\n * Nginx 1.3.9\n * PHP 5.3.20\n * Redis 2.6.7\n * Delete old tmp files in all sites daily.\n * Disable Expire and Purge modules by default - they are no longer needed.\n * Redis integration module updated to 7.x-2.0-beta2\n * There is no need to restart Redis and Tomcat hourly.\n * Use higher innodb_lock_wait_timeout by default - 120 instead of 50.\n * Use 1h instead of 30min default timeout for sql and php-cli to avoid\n breaking some extra long running backend tasks on some really big sites.\n\n# Fixes:\n\n * Allow more drush commands over SSH.\n * Always force drupal_http_request_fails to FALSE to avoid false alarm.\n * Better check for standalone vhosts firewall setup.\n * Better lshell forbidden list of keywords.\n * Better regex to deny wildcards with top-level or country level domains.\n * Check for existence of host_master and not host_master/001 directory.\n * Compass is not available on older OS versions.\n * Delete ltd-shell extra user/client if there is no site associated/owned.\n * Delete old symlinks in the client directory for no longer associated sites.\n * Fix broken usage.sh script - it does not enable/disable modules.\n * Fix date formatting also in the sqlcheck script.\n * Fix for some really old installs without .barracuda.cnf file.\n * Fix permissions for Boost cache directory with correct chmod.\n * Fix the hint - it should say to restart mysql.\n * Issue #1081266 - Avoid re-scanning modules directory.\n * Issue #1263602 - Force New Relic re-install on every upgrade, if used.\n * Issue #1460882 - Send .json requests to @drupal instead of =404.\n * Issue #1837418 - Fix permissions inside ~/.drush directory.\n * Issue #1837776 - Do not disable httprl module.\n * Issue #1837910 - Upload progress broken for all D6 sites.\n * Issue #1839122 - Disabling Redis on known AJAX calls breaks UI elements.\n * Issue #1839544 - Use language neutral checks for users, groups and hosts.\n * Issue #1841230 - BOA provides Apache Solr 1.4 with Tomcat 6.\n * Issue #1841246 - Fix csf.fignore file to whitelist /tmp/drush_*\n * Issue #1842554 - Replace broken links to Skitch screenshots.\n * Issue #1847682 - Fix extra Nginx config support in the Master Instance.\n * Issue #1850034 - Disable SYSLOG_CHECK in csf to avoid false alarms.\n * Issue #1857250 - Domain Access support is broken in the backend cli.\n * Issue #1857990 - Include reroute_email module in o_contrib by default.\n * Issue #1860100 - Use provision-backup-delete instead of backup_delete.\n * Issue #1865112 - Add drush clean-modules command.\n * Issue #1867264 - Too many Redis caching exceptions cause serious confusion.\n * Issue #1871060 - CiviCRM l10n should be moved to proper directory.\n * Lshell: Map drush mup to up instead of upc. Add new drush mupc map for upc.\n * Max supported version of Search API Solr search is 7.x-1.0-rc2\n * More complete permissions fix on install and upgrade.\n * More strict check for _LENNY_TO_SQUEEZE option.\n * Nginx: Better regex in the Nginx monitor.\n * Nginx: Exclude also files/progress path in the Nginx monitor.\n * Nginx: Fix rewrite rules in the CDN Far Future expiration support.\n * Nginx: Make sure that any older packages are uninstalled on upgrade.\n * Nginx: Make sure that default Nginx vhosts are deleted also on upgrade.\n * Nginx: Skip all logged media and download requests in the Nginx monitor.\n * PHP: Use high enough value for max_input_vars in PHP 5.3 by default.\n * Really fix the datestamp comparison logic on various systems.\n * Rebuild registry without --no-cache-clear option to avoid issues.\n * Redis: Check if Redis binary exists, not symlink.\n * Redis: Delete redis-server symlink to avoid failed Redis install.\n * Redis: Do not use all three extra exceptions on the hostmaster site.\n * Redis: Do not use sleep breaks during Redis full restart.\n * Redis: The cache_menu bin should be still excluded from Redis caching.\n * Redis: The hostmaster site needs exception for cache_class_cache bin.\n * Stop and Start CSF only if installed.\n * The locked auto-healing script needs to kill tomcat more aggressively.\n * Update csf.conf template.\n * Upgrade to ctools-6.x-1.10 in the hostmaster platform.\n * Use aliases in drush commands where possible.\n * Use better name for non-web New Relic app tracking.\n * You must remove remote_import extension from the source server.\n\n\n### Stable Edition BOA-2.0.4\n### Date: Thu Nov 8 18:31:01 EST 2012\n### Installs Ægir 2.0.4 compatible with Ægir 1.9\n\n# New Octopus platforms:\n\n Commerce 2.0-rc4 ------------- http://drupalcommerce.org\n\n# Updated Octopus platforms:\n\n CiviCRM 4.1.6-d6 ------------- http://civicrm.org\n CiviCRM 4.2.6-d7 ------------- http://civicrm.org\n Commerce 1.11.1 -------------- http://drupalcommerce.org\n Commons 2.10 ----------------- http://acquia.com/drupalcommons\n Conference 1.0-rc2 ----------- http://usecod.com\n Drupal 7.17.1 ---------------- http://drupal.org/drupal-7.17\n Drupal 8.0-dev-tested -------- http://bit.ly/drupal-eight\n ELMS 1.0-beta1 --------------- http://elms.psu.edu\n NodeStream 1.5.1 ------------- http://nodestream.org\n NodeStream 2.0-beta8 --------- http://nodestream.org\n Open Atrium 1.6.1 ------------ http://openatrium.com\n Open Deals 1.11 -------------- http://opendealsapp.com\n Open Outreach 1.0-rc6 -------- http://openoutreach.org\n OpenChurch 1.11-beta5 -------- http://openchurchsite.com\n OpenPublish 3.0-beta7 -------- http://openpublishapp.com\n OpenScholar 2.0-rc1 ---------- http://openscholar.harvard.edu\n Panopoly 1.0-rc2 ------------- http://drupal.org/project/panopoly\n Ubercart 2.10.1 -------------- http://ubercart.org\n Ubercart 3.2.1 --------------- http://ubercart.org\n\n* We plan to shorten BOA system release and upgrades cycle\n to 1-2 months max, so we have decided to remove support for some\n outdated distros. We have tried to manage both security and version\n updates for some abandoned or semi-abandoned distros, to keep them\n useful for you, but since it involves increasing amount of work\n because of cascades of no longer compatible patches and various\n dependencies, we have decided that it is time to stop doing it,\n if their original maintainers no longer care about their users.\n\n Here is a list of distros we no longer support:\n\n MartPlug ------------ http://drupal.org/project/martplug\n Octopus Video ------- http://octopusvideo.org\n Open Academy -------- http://drupal.org/project/openacademy\n Open Enterprise ----- http://drupal.org/project/openenterprise\n OpenPublic ---------- http://openpublicapp.com\n Videola ------------- http://videola.tv\n\n The platforms listed above can be re-added when their maintainers\n will fix all critical issues and/or apply required updates.\n\n# New features:\n\n * Add auto-healing support for Bind9.\n * Add LOCK/FROZEN check for PHP-FPM and Tomcat in the auto-healing.\n * Add option to force 15min Speed Booster cache TTL for anonymous visitors.\n * Add optional easy install of already supported Compass Tools.\n * Add support for aegir|platforms|both modes on octopus upgrade.\n * Allow for another one upgrade daily but only to add more platforms.\n * Allow to install unsupported distros with option _ALLOW_UNSUPPORTED=YES\n * Allow to install vanilla Ægir 2.x and Drush 5.7 with \"stock\" option.\n * Improved databases backup with added OPTIMIZE TABLE foo action per table.\n * New Relic PHP Agent version 3.0 compatibility.\n * Pseudo-streaming server-side support for Flash Video (FLV) and H.264/AAC.\n * Support for Wysiwyg Fields module.\n\n# New Ægir modules or extensions:\n\n * Add hosting_tasks_extra module and provision_tasks_extra extension.\n\n# New o_contrib modules:\n\n * Add login_security module in D7 contrib.\n * Add cdn module in both D6 and D7 contrib.\n\n# Changes:\n\n * Allow outgoing mysql connections by default.\n * APC 3.1.13\n * Chive 1.2\n * Do not bundle seckit module in o_contrib.\n * Do not enable Expire and Purge modules by default.\n * Enable Syslog module by default.\n * Git 1.8.0\n * MariaDB 5.3.9 on Debian Lenny\n * MariaDB 5.5.28\n * Nginx 1.3.8\n * Percona 5.5.28\n * PHP 5.3.18\n * Pure-FTPd 1.0.36\n * Redis 2.6.4\n * Remove not supported httprl module and disable if enabled.\n * The filefield_nginx_progress is forced-enabled in all D7 sites, again.\n * Use PHP-FPM 5.3 for Chive, Collectd and other non-Drupal sites.\n * Use php-cli 5.3 for drush on command line by default.\n You can still force 5.2 with --php=/usr/local/bin/php drush option.\n\n# Fixes:\n\n * Add cache_tax_image bin to no-redis-cache exceptions.\n * Add support for pdnsd in the VServer guest.\n * Allow all standard compass/sass commands in limited shell.\n * Auto-discover _NEWRELIC_KEY if not listed in .barracuda.cnf\n * Better auto-healing for php-fpm zombies edge case.\n * Better check for failed login attempts (when user exists).\n * Better permissions magic repair running daily.\n * Deny crawlers on search results pages - they may cause very high load.\n * Disable spinner if screen is used.\n * Do not force default Debian and Ubuntu mirrors even if _AUTOPILOT=YES.\n * Do not quote password in .my.cnf - it breaks mytop.\n * Do not use log/custom_cron for anything.\n * Do not use resolveip in the localhost mode.\n * Exclude cache_bootstrap and cache_pulled_tweets from Redis caching.\n * Fix for broken drush make edge case caused by leftovers.\n * Fix for broken Tika download URL.\n * Fix for civicrm_engage in D6.\n * Fix for Debian Lenny upgrade.\n * Fix for global.inc logic related to high traffic sites only.\n * Fix for NGX, PHP and SQL forced reinstall mode.\n * Fix for Pin-Priority in Squeeze.\n * Fix for sql abuse monitor.\n * Fix for the selectively forced upgrade mode.\n * Fix motd for Skynet fun.\n * Fix too restrictive lshell command filtering.\n * Force Pure-FTPd rebuild on every upgrade to avoid broken binary.\n * Force tomcat restart and reload php-fpm hourly.\n * Improve Domain module support.\n * Improve mysql crashed tables detection and repair in auto-healing.\n * Improve Nginx Abuse Guard by stopping those never cached POST DoS attacks.\n * Improve Nginx guard support for VServer guests.\n * Improved checkpoint info in Octopus.\n * Issue #1225380 - Do not truncate sessions table during db daily backup.\n * Issue #1472786 - SQL check ERROR and too many SQL check CLEAN notices.\n * Issue #1528726 - Fix for Redis support in all shared directories/code.\n * Issue #1540242 - Do not install conflicting libavcodec53 or libavcodec52.\n * Issue #1588060 - Make sure that /var/run is present in open_basedir.\n * Issue #1589052 - Incomplete PATH breaks standard tasks.\n * Issue #1590120 - Fix for java path changed in recent Ubuntu releases.\n * Issue #1591746 - Update GeoIP.dat file automatically.\n * Issue #1592646 - Enabled old cache backend integration module causes WSOD.\n * Issue #1592650 - Do not use Hide platforms with non-default profiles.\n * Issue #1592680 - Upload progress module breaks uploads on all D7 sites.\n * Issue #1593794 - New redis-only caching backend settings.\n * Issue #1593810 - Duplicate php-cli 5.3 binaries after upgrade.\n * Issue #1593980 - Remove invisible characters breaking localhost install.\n * Issue #1597580 - External/Aggressive caching in D6 breaks path_alias_cache.\n * Issue #1598676 - Collectd graphs broken.\n * Issue #1600426 - Cron is run every minute on all sites not yet defined.\n * Issue #1602142 - Do not use device specific keys for Redis cache entries.\n * Issue #1606146 - The manage_ltd_users.sh script locks important tasks.\n * Issue #1614162 - CRON Not Running on Octopus Satellites and Sites.\n * Issue #1643616 - APC is missing in the Ubuntu Precise based install.\n * Issue #1659452 - Add support for Ægir HTTPS header in the Speed Booster.\n * Issue #1663262 - Fix FMG install on Ubuntu Precise.\n * Issue #1679114 - New user name check in Octopus is too restrictive.\n * Issue #1689656 - Avoid caching /civicrm* and known webform requests.\n * Issue #1716004 - The zlib.output_compression should be disabled in 5.3\n * Issue #1728616 - Better CDN Far Future expiration support.\n * Issue #1777982 - Do not break wordpress_migrate module support.\n * Issue #1778712 - Better workaround for MariaDB 5.5.27 critical bug.\n * Issue #1784440 - Cannot stat scan_nginx when using BOND.sh.txt\n * Issue #1796420 - Do not break write access to the tcpdf cache directory.\n * Issue #1798288 - Provision-backup_delete could not be found.\n * Issue #1799116 - Standardize on installation vs. install profile.\n * Issue #1821866 - Force Nginx rebuild to include pseudo-streaming support.\n * Issue #1824888 - BOND.sh.txt breaks Nginx, SQL and PHP configuration.\n * Issue #1825298 - Redis: force rebuild from sources on version mismatch.\n * Issue #1825420 - Avoid the Use of undefined constant OctopusNoCacheID.\n * Issue #1825630 - Remove duplicate code causing false alarm.\n * Issue #1825992 - Redis cache is never cleared via php-cli.\n * Issue #1825998 - Improved auto-healing for Redis.\n * Issue #1835796 - Default cache headers break CloudFlare Always Online.\n * Make sure that path_alias_cache module takes precedence.\n * Make sure that PHP 5.2 is re-installed if required.\n * Monitor and kill too long running sites cron tasks.\n * Move away buagent init script if exists when Barracuda runs.\n * Nginx: Allow to include high level local configuration override.\n * Nginx: Better regex for exceptions in the abuse guard monitor.\n * Nginx: Block stupid spiders/downloaders with 403 error, not CSF.\n * Nginx: Deny known bots on some heavy URLs.\n * Nginx: FileField Nginx Progress 7.x-2.3 compatibility.\n * Nginx: Fix for broken images paths in civicrm.\n * Nginx: Fix for D6 upload progress support.\n * Nginx: Make the abuse monitor aware of possible lang code prefixes.\n * Nginx: Monitor and block if required also via-multi-proxy attacks.\n * Nginx: Remove packages on every upgrade to avoid duplicate re-installs.\n * Nginx: Remove redundant URL filtering.\n * Nginx: Send 403 for vbulletin URI to avoid Drupal heavy 404.\n * Nginx: Support for /contrib/ for wysiwyg helpers exceptions location.\n * Nginx: Use latest nginx-upload-progress-module v0.9.0\n * Nginx: Use ngx_cache_purge-1.6\n * PHP: Allow short_open_tag also in 5.3\n * PHP: Disable the original php5-fpm init script causing segfaults.\n * PHP: Fix for _FROM_SOURCES PHP-FPM 5.3 build.\n * PHP: Fix for the php53-fpm init script.\n * PHP: Force proper php53-fpm restart if required.\n * PHP: Install JSMin extension by default.\n * PHP: Install php-pear by default also in no-src based default install.\n * PHP: Load extensions in a safe, correct order.\n * PHP: Log killed php-fpm events.\n * PHP: Make sure that all builds use correct, fresh downloads.\n * PHP: Make sure that php53-fpm is disabled during apt-get based upgrade.\n * PHP: Make sure that suhosin.so is removed and jsmin.so added.\n * PHP: Remove duplicate and conflicting allow_call_time_pass_reference.\n * PHP: Remove php5-sasl extension causing segfaults.\n * PHP: Remove php5-suhosin from the stack - too many weird issues.\n * PHP: The realpath_cache_ttl should be as low for CLI as possible.\n * PHP: Use 2x higher limits in the tune_web_server_config logic.\n * Purge Redis cache hourly.\n * Randomize runner intervals.\n * Remove all control files on init to avoid aborted Octopus upgrades.\n * Remove any extra search directive from resolv.conf when pdnsd is installed.\n * Remove Dotdeb libmysqld-dev conflicting with Percona libmysqlclient-dev.\n * Remove not really working properly Boost separate mobile bins.\n * Remove not supported MTA only on initial install.\n * Remove old cache module from all old profiles.\n * Segfault monitor should not disable sites by default.\n * Serve .less files as static by default, no log.\n * Set hosting_advanced_cron_default_interval to 3 hours.\n * SQL: Use skip-name-resolve by default.\n * Support both HTTP_X_FORWARDED_PROTO and HTTPS.\n * The dev. should not disable Redis cache.\n * The missing /usr/bin/lshell entry may affect also Lucid.\n * There is no need to force Debian mirror.\n * Tune AdvAgg config - disable async mode and use JSMin by default.\n * Use autoselect for civicrm downloads.\n * Use DrupalDatabaseCache for some Redis bins to avoid confirmed issues.\n * Use higher default timeouts for php-cli and wait_timeout in mysql.\n * Use SERVER_NAME instead of HTTP_HOST header in the Redis cache key.\n * Use version specific directory for static downloads.\n * Yet another umask trick for shell and SFTP.\n\n\n### Stable Edition BOA-2.0.3\n### Date: Thu May 17 18:17:40 EST 2012\n### Installs Ægir 2.0.3 compatible with Ægir 1.9\n\n# There are major improvements and new features added in this BOA Edition.\n\n Here is the description of those most important/expected, while complete\n list of all changes, new features and fixes is available further below.\n\n * Caching backend has been simplified. We no longer use chained cache\n system with Memcached+Redis+database. New system uses only Redis cache\n and the same configuration for all Drupal 6 and Drupal 7 platforms.\n This new system doesn't require any extra module to be enabled in any site.\n Complete integration is already enabled by default for every platform/site\n installed by default and for every custom platform as before - the next\n day after first site on the custom platform has been created.\n You can disable this caching layer using the same modules/cache/NO.txt\n control file as before. While there is just one cache engine (Redis) used,\n there is also an automatic, instant failover to standard database caching,\n just in case Redis is not available for some reason. You can also disable\n Redis cache on the fly for debugging by adding ?noredis=1 to any URL.\n\n * We have added support for Drupal 8.x while still using modified\n Drush 4.6-dev version, so we can still support Drupal 5 on the same\n system, but on another Octopus instance.\n\n * You can choose different PHP version for PHP-FPM (web access)\n and PHP-CLI, for even greater control over compatibility with\n various Drupal major versions.\n\n * You can choose both PHP-FPM and PHP-CLI versions per Octopus instance,\n on the same system. And you can change those versions on upgrade.\n\n * Installing and upgrading BOA system has been greatly simplified.\n You can still configure and run both installers as before,\n but you can also use these new, shockingly simple command line tools\n to install Barracuda and Octopus at once, to install more Octopus\n instances, to run selective or batch upgrades of all Octopus instances etc.\n See docs/INSTALL.txt and docs/UPGRADE.txt for details.\n\n * We have added an 'easy install' configuration shortcuts for both\n standard (public) and localhost installs. You no longer need\n to read, understand and configure all options, unless you prefer\n to choose some non-default configuration options.\n\n * Default installs on Debian Squeeze and Ubuntu Precise use\n packages for PHP 5.3, so initial setup takes just 10-15 minutes.\n\n * You can easily grant limited shell and FTPS access for developers,\n simply by creating \"Clients\" in the Ægir control panel and define\n them as 'owners' of one or more sites. Their access will be limited\n to only sites they can manage, but only if you will send them their\n access credentials, which are independent of their Ægir control\n panel credentials and stored in the ~/users/ directory in your main account.\n You will find there files with passwords for every \"Client\" with at least\n one site attached. For example ~/users/o1.username file means that\n this Client's username for SSH and FTPS access is 'o1.username' while\n his password is stored in this file. This means that SSH/FTPS access\n is not granted automatically, but you can decide who should receive it.\n How to change any extra user's password? Simply delete his ~/users/o1.username\n file and wait up to 5 minutes - the system will re-create his account\n with new password. And how to delete the user completely? Simply\n delete this user \"Client\" account in the Ægir control panel and allow\n the system to delete also his SSH/FTPS access in the next 5 minutes.\n\n * We have added segfault monitor for php-fpm and nginx, enabled by default.\n It is pretty aggressive, because it disables vhost of any site causing\n segfault errors and sends email alert to the Octopus instance owner\n and server owner email addresses. Simple site re-verify in Ægir enables\n the site again - but until the next segfault only, so read the info\n included in the email alert message, if this will happen. If you prefer\n to not run this monitor: `rm -f /var/xdrago/monitor/check/segfault_alert`\n\n * Previously recommended site and platforms re-verify on Clone or Migrate\n is now fully automated. Ægir will run these extra tasks as a part\n of Clone or Migrate task, to make sure that there are no errors\n and that Ægir is using up-to-date information collected about\n platforms and sites. It also automatically fixes the known problem\n with domain aliases incorrectly written in the original and cloned sites,\n as reported in the Ægir queue: http://drupal.org/node/1004526\n\n * Apps are now fully supported. If the App is not downloaded yet, installing\n it via browser only requires write permissions, normally never available\n for the web server user, so you need to create an empty control file, either\n in sites/all/modules/apps-allow.info or sites/domain/modules/apps-allow.info\n and then run 'Reset password' task. It will open write access where required\n until the next site 'Verify' task will run . After installing the App,\n remember to re-Verify the site to restore default, safe permissions.\n\n * Custom local.settings.php file support uses similar logic with control file\n sites/domain/modules/local-allow.info and also 'Reset password' task.\n After running this task the local.settings.php file will be group writable,\n so you will be able to edit it also when logged in as limited shell user.\n Remember to run site Verify when done, to restore standard, safe permissions.\n Note that this file is created automatically, but is not open for write\n access by default.\n\n# Notes on new and updated platforms and new Drupal core:\n\n All 6.x and 7.x platforms have been updated with latest core,\n so they are all in fact new in this BOA Edition, but we list here\n only really new platforms or those with new version released\n since last BOA Edition, with one exception: we list also basic\n 6.26.2 and 7.14.2 platforms as new.\n\n NOTE: before you will try to upgrade any of your sites,\n please read our important how-to:\n\n http://omega8.cc/the-best-recipes-for-disaster-139\n http://omega8.cc/are-there-any-specific-good-habits-to-learn-116\n http://omega8.cc/managing-your-code-in-the-aegir-style-110\n\n REALLY, PLEASE READ IT TO AVOID SOME HEAVY HEADACHES!\n\n# New Octopus platforms:\n\n CiviCRM 4.1.2-d6 ------------- http://civicrm.org\n CiviCRM 4.1.2-d7 ------------- http://civicrm.org\n Drupal 7.14.2 ---------------- http://drupal.org/drupal-7.14\n Drupal 8.0-dev --------------- http://bit.ly/drupal-eight\n MartPlug 1.0-beta1b ---------- http://drupal.org/project/martplug\n Octopus Video 1.0-alpha6 ----- http://octopusvideo.org\n Panopoly 1.0-beta3 ----------- http://drupal.org/project/panopoly\n Pressflow 6.26.2 ------------- http://pressflow.org\n\n# Updated Octopus platforms:\n\n Acquia 6.26.2 ---------------- http://bit.ly/acquiadrupal\n CiviCRM 3.4.8-d6 ------------- http://civicrm.org\n CiviCRM 4.0.8-d7 ------------- http://civicrm.org\n Commerce 1.7.1 --------------- http://drupalcommerce.org\n Commons 2.6 ------------------ http://acquia.com/drupalcommons\n Feature Server 1.1 ----------- http://bit.ly/fserver\n Managing News 1.2.2 ---------- http://managingnews.com\n NodeStream 1.5 --------------- http://nodestream.org\n NodeStream 2.0-beta1 --------- http://nodestream.org\n Open Atrium 1.4.1 ------------ http://openatrium.com\n Open Deals 1.0-beta7e -------- http://opendealsapp.com\n Open Outreach 1.0-rc1 -------- http://openoutreach.org\n OpenChurch 1.10-alpha1 ------- http://openchurchsite.com\n OpenPublish 3.0-alpha8 ------- http://openpublishapp.com\n Ubercart 2.9.1 --------------- http://ubercart.org\n Ubercart 3.1.1 --------------- http://ubercart.org\n Videola 1.0-alpha3 ----------- http://videola.tv\n\n# New features:\n\n * Add Adaptive Image Styles support.\n * Add Compass compatibility in the limited shell (Compass is not installed by default).\n * Add ssh-copy-id and ssh-add commands as allowed over SSH.\n * Add X-Speed-Cache-Key header for Speed Booster debugging.\n * All Clone/Migrate forms in the Ægir control panel have useful inline help added.\n * Allow to easily re-start BOA failed install, just by running boa installer again.\n * Allow to install PHP 5.3 only with option _PHP_MODERN_ONLY=YES (default).\n * Deny HTTPS access on Nginx level for all known bots and crawlers.\n * Do not force HTTPS for Ægir if /data/conf/no-https-aegir.inc control file exists.\n * Fix system time hourly via auto-healing.\n * Install wkhtmltopdf by default - available at /usr/bin/wkhtmltopdf\n * Issue #1263602 - New Relic Server and Apps Monitor with per Site/Instance reporting.\n * Issue #1392498 - Use .barracuda.cnf to define YES/NO for some config overrides.\n * Issue #1428078 - Compatibility with resp_img module.\n * Issue #1436522 - Add option to set _PHP_CLI_VERSION.\n * Issue #1438906 - Add Imagick to PHP by default.\n * Issue #1463494 - Add support for radioactivity module.\n * Issue #1542712 - Automated wildcard DNS for easy localhost mode.\n * Lock temporarily almost all known crawlers on high load with error 503.\n * Make _NGINX_DOS_LIMIT configurable and allow higher load by default.\n * Make both 1 and 5 minute max allowed load configurable in the auto-healing.\n * Support for automatically managed extra SSH/FTPS accounts per Ægir Client.\n * The _LOAD_LIMIT used in the auto-healing system is now configurable.\n * The _SPEED_VALID_MAX used as a Speed Booster cache TTL is now configurable.\n * Ubuntu Precise 12.04 is fully supported.\n * Use nice default /root/.bashrc config.\n\n# New Ægir modules or extensions:\n\n * Add hosting_advanced_cron module - enabled by default.\n * Add hosting_civicrm_cron module - enabled by default.\n * Add hosting_task_gc module - enabled by default.\n * Add provision_cdn module and extension, by default not enabled.\n * Add remote_import and hosting_remote_import - not enabled by default.\n * Add revision_deletion module - automatically configured and enabled by default.\n * Registry Rebuild Drush extension - installed by default.\n\n# New o_contrib modules:\n\n * entitycache-7.x-1.x-dev\n * nocurrent_pass-7.x-1.0\n * speedy-7.x-1.0\n\n# Changes:\n\n * Acquia 7.x platform has been merged with Ubercart 3.\n * Always disable css_gzip, javascript_aggregator and performance modules.\n * Automate database server secure setup on initial install.\n * Disable /etc/cron.daily/mlocate by default.\n * Do not disable update module - it may break some features depending on it.\n * Do not enable filefield_nginx_progress module by default.\n * Do not remove Testing profile and use better naming convention for D7/D8.\n * Do not search for mirrors by default.\n * Drupal 8 compatible Drush 4.6-dev\n * GitHub availability is required also when another mirror is used by default.\n * Installing Git from sources is now optional.\n * Limited shell 0.9.15.1-sec-noreload\n * Lower default APC and Redis memory in VZ to 64MB to avoid/limit known VZ issues.\n * MariaDB and Percona 5.5\n * Modify Ubercart platform to include some contrib modules in the D6 version.\n * Nginx 1.3.0\n * Open Enterprise 1.0-beta3 is deprecated and not supported.\n * Plain FTP access disabled with FTPS-only mode available.\n * Pure-FTPd server install is now optional, but still default.\n * Send all known bots to $args free URLs.\n * Use _HTTP_WILDCARD=YES by default to match Ægir standard setup.\n\n# Fixes:\n\n * Abort all parent installers as soon as any sub-installer fails with fatal error.\n * Add $http_x_forwarded_proto to the cache key to never mix HTTP and HTTPS entries.\n * Add a list/chart in the readme for an easy overview of all included modules.\n * Add volatile updates to /etc/apt/sources.list for Squeeze.\n * All connection tests should be run after netcat is installed if not yet available.\n * Allow more than one IP to connect to the same FTPS account at the same time.\n * Allow some known php files also in profiles - a fix for Nginx config regression.\n * Always update nginx_speed_purge.conf file on upgrade.\n * Archive install and upgrade logs in /var/backups/\n * Avoid double dots in $cookie_domain.\n * Better detection of real visitor IP in the scan_nginx abuse guard.\n * Cache 403 response for 5s by default.\n * Count only valid requests in the scan_nginx abuse guard.\n * Disable caching in admin_menu module by default.\n * Disabled allow_url_fopen breaks drush dl.\n * Do not allow bots to create cache entries with long expire time.\n * Do not prompt for D6 or D7 vanilla platforms install if not defined in the config.\n * Explain in the email templates that plain FTP is no longer available.\n * Fix cart block issue in Ubercart.\n * Fix for Debian Lenny support - packages have been moved to archives.\n * Fix for slow networks/DNS in pdnsd cache default config.\n * Fix for VServer on _LENNY_TO_SQUEEZE upgrade.\n * Fix tune_memory_limits logic to really tune the config on low mem systems.\n * Follow some symlinks when running chmod/ownership repair daily.\n * Force global upgrade for Expire and Purge modules.\n * Force safe default settings for expire module.\n * Improved Lenny to Squeeze major upgrade support.\n * Increase allowed limit_conn for local purge requests.\n * Issue #1216420 - Incorrect lshell path in /etc/passwd breaks FTPS on Squeeze.\n * Issue #1317264 #1543118 - Uninstall Sendmail if exists to avoid breaking Postfix.\n * Issue #1377492 - Improve Install / Upgrade mode detection and move away any zombies.\n * Issue #1398050 - Use our mirror for all downloads on install and upgrade.\n * Issue #1436522 - Add missing php.ini for PHP-CLI 5.3\n * Issue #1440796 - Ægir support broken due to duplicate db update in Commons/OG.\n * Issue #1441366 - The _USE_SPEED_BOOSTER switch is deprecated.\n * Issue #1443284 - Early start of CSF may lockout the ssh user and break the install.\n * Issue #1445460 - Broken Git install on Ubuntu Lucid.\n * Issue #1451262 - Do not lock the access to phpinfo.\n * Issue #1472460 #1524738 - Nginx denies request methods: PUT, DELETE and OPTIONS.\n * Issue #1475416 - Unable to install Barracuda due to Ægir failed install.\n * Issue #1478984 - Add Access-Control-Allow-Origin header with wildcard where required.\n * Issue #1479188 - Octopus does not respect _DNS_SETUP_TEST setting on upgrade.\n * Issue #1505370 - Conflict between Mime Type and Document Type in Nginx.\n * Issue #1515762 - Nginx microcaching should skip all known AJAX requests.\n * Issue #1526382 - The _PHP_CLI_VERSION set in cnf file is not respected.\n * Issue #1527852 - Random WSOD on D7 sites with Redis enabled for anonymous visitors.\n * Issue #1528692 - Both cache_backport and redis modules are never added on upgrade.\n * Issue #1528726 - Redis caching backend should be unified across all instances.\n * Issue #1528996 - Nginx microcaching should use TTL 1s only for upstream errors.\n * Issue #1534306 - Duplicate directives break Dotdeb Nginx version.\n * Issue #1539512 - Keep custom Redis configuration during upgrade.\n * Issue #1540112 - HEAD install fails on Debian Squeeze 32bit.\n * Issue #1540242 - Add useful codecs to ffmpeg if enabled.\n * Issue #1541334 - Add kvm to supported virtualization systems.\n * Issue #1544144 - Use $server_name instead of $host in all sites/ paths.\n * Issue #1547878 - Port 11371 should be open for outgoing connections.\n * Issue #1553150 - Both php.ini and my.cnf config files get overridden upon upgrade.\n * Issue #1553166 - Disable incompatible mysql config options.\n * Issue #1554972 - PHP cli downgraded to 5.2 on upgrade with _PHP_MODERN_ONLY=YES\n * Issue #1556192 - Upgrade Entity API to head to fix issue with Drupal 7.14\n * Issue #1585348 - Disable openchurch_video_demo_content to avoid fatal error.\n * Kill nash-hotplug if running.\n * Lower some my.cnf defaults to better support low mem systems.\n * Make default myisam_sort_buffer_size big enough to run repair if required.\n * Make sure that /dev/null has correct permissions.\n * Pass some expected headers when using local proxy.\n * Remind people that they should use their own email address or exit early.\n * Remove deprecated Nginx config includes and use symlinks for backward compatibility.\n * Sanitize important variables early.\n * Save 330 seconds with 3x faster spinner.\n * Set hosting_queue_cron_frequency to 8888 weeks by default to really use schedule\n defined via hosting_advanced_cron module and never override it.\n * Share and symlink civicrm code.\n * Skip _AEGIR_LOGIN_URL in the debug mode - it is empty then.\n * Update mime.types for Nginx.\n * Use _FULL_FORCE_REINSTALL when recovering from broken/partial install automatically.\n * Use faster locations matching where possible in the Nginx config.\n * Use higher values for limit_conn in Nginx to avoid issues when required.\n * Use loglevel warning in Redis config.\n * Use safe placeholders to avoid issues on low-mem machines.\n\n\n### Stable Edition BOA-2.0.2\n### Date: Thu Feb 9 14:00:00 EST 2012\n### Installs Ægir 2.0.2\n\n# Note on new and updated platforms and new Drupal core:\n\n All 6.x and 7.x platforms have been updated with latest core,\n so they are all in fact new in this BOA Edition, but we list here\n only really new platforms or those with new version released\n since last BOA Edition, with one exception: we list also basic\n 6.24.1 and 7.12 platforms as new.\n\n Please note that instead of waiting for 6.25, we already\n included patches required to fix major issues with 6.24:\n\n http://drupal.org/node/1425868\n http://drupal.org/node/1425260\n\n Our Pressflow 6.24.1 +Extra version includes not only listed\n above patches, but also a few extra, performance related\n patches discussed here:\n\n http://groups.drupal.org/node/187209\n\n Note also that we renamed too basic Acquia 7.x platform to\n Ubercart 3.x platform. It is based on the same acquia install\n profile, but includes all contrib modules required for any\n basic Ubercart 3.x site.\n\n NOTE: before you will try to upgrade any of your sites,\n please read our important how-to:\n\n http://omega8.cc/the-best-recipes-for-disaster-139\n http://omega8.cc/are-there-any-specific-good-habits-to-learn-116\n http://omega8.cc/managing-your-code-in-the-aegir-style-110\n\n REALLY, PLEASE READ IT TO AVOID SOME HEAVY HEADACHES!\n\n# New Octopus platforms:\n\n Drupal 7.12 ------------------ http://drupal.org/drupal-7.12\n NodeStream 2.0-alpha6 -------- http://nodestream.org\n OpenPublish 3-alpha3 --------- http://openpublishapp.com\n Pressflow 6.24.1 ------------- http://pressflow.org\n Ubercart 3.0.1 --------------- http://ubercart.org\n\n# Updated Octopus platforms:\n\n Acquia Commons 2.4 ----------- http://acquia.com/drupalcommons\n Commerce Kickstart 1.3 ------- http://drupalcommerce.org\n ELMS 1.0-alpha6 -------------- http://elms.psu.edu\n Open Atrium 1.2.1 ------------ http://openatrium.com\n Open Deals 1.0-beta7 --------- http://opendealsapp.com\n Open Outreach 1.0-beta7a ----- http://openoutreach.org\n ProsePoint 0.43 -------------- http://prosepoint.org\n Videola 1.0-alpha2 ----------- http://videola.tv\n\n# New features:\n\n * Barracuda now supports Debian Lenny to Squeeze major upgrade.\n Of course you should create full backup image before running\n this major system upgrade, just in case, but all the rest\n is fully automated - it is enough to set advanced configuration\n option in Barracuda to _LENNY_TO_SQUEEZE=YES and run Barracuda\n as usual. It will upgrade your system to Squeeze and re-build\n everything, with almost no downtime during the upgrade.\n You will still need to reboot the server when it will complete\n all upgrades.\n\n Important: Debian Lenny reached EOL on February 6, 2012.\n Details: http://lists.debian.org/debian-announce/2012/msg00001.html\n\n * All new 7.x sites now run on latest PHP-FPM 5.3.10 by default.\n For existing sites it is enough to re-verify them in your\n Ægir control panel to get them on PHP-FPM 5.3.10 automatically.\n\n All existing and new 5.x sites run on the old PHP-FPM 5.2.17\n version by default and you can't change that.\n\n You can still choose between PHP-FPM 5.2.17 and 5.3.10 for\n all your 6.x sites - just let us know via http://omega8.cc/support\n that you wish to switch to 5.3.10 - but make sure first that all\n your 6.x sites are fully PHP 5.3 compatible. By default all\n 6.x sites still run on PHP-FPM 5.2.17.\n\n Of course you could choose 5.3.10 for 6.x sites on one Octopus\n instance and 5.2.17 on another - on the same server. Just one more\n reason to use Octopus built-in intelligence :)\n\n All of this works the same both for Ægir Master Instance\n and all Ægir Satellite Instances.\n\n * Both Speed Booster, Boost and Redis/Memcached supports separate\n caches per mobile device, so it is safe to use separate themes\n or content for mobile devices. We use simple logic to determine\n the kind of device and there are separate cache bins for\n mobile-tablet, mobile-smart and mobile-other.\n You can review it here: http://bit.ly/wYz6PG\n\n * Purge module is now enabled by default in all 6.x and also 7.x\n sites. Now Speed Booster works like a Boost - it expires\n immediately the cache for any node/page as soon as it has been\n edited or comment added. It also automatically expires the cache\n for the homepage and RSS feed at once. You no longer need to wait\n up to one hour for Speed Booster cache expiration. Plus, unlike\n in Boost, it purges all separate caches for all mobile devices\n along with non-mobile cache, at once. Now you have a good reason\n to disable Boost and use our crazy fast Speed Booster only.\n\n * You can use GeoIP data provided by your Nginx server\n in your custom code or modules with variables:\n $_SERVER['GEOIP_COUNTRY_CODE'] and $_SERVER['GEOIP_COUNTRY_NAME']\n to display content or block depending on the visitor's country.\n You can check/review it from your location also on command line\n with: 'curl -I http://your-domain' - you will see GeoIP headers.\n\n * You can safely manage Clients/Users attached to hosted sites\n in your Ægir interface. Make sure that all sites have its\n associated Client! Otherwise the site will be listed as available\n for all Clients/Users you have added. The site can lost its\n association with Client after Clone task if there is any\n non-alphanumeric value in the Client name, like &.\n\n * CloudFlare specific header 'CF-Connecting-IP' is now supported\n out of the box and available as standard $_SERVER['REMOTE_ADDR']\n in all 5.x, 6.x and 7.x platforms without any contrib module.\n\n * You can disable both Boost and Speed Booster on the fly\n by adding ?nocache=1 to any URL. Useful for debugging.\n\n * Speed Booster offers now also ESI microcaching, as explained\n in this article: http://groups.drupal.org/node/197478.\n This may enhance not only anonymous visitors, but also\n logged in users experience, since it allows you to separate\n microcache for ESI/SSI includes (valid for just 15 seconds)\n from both default Speed Booster cache for anonymous visitors\n (valid by default for 3 hours, unless purged on demand via\n recently introduced Purge/Expire modules) and also from\n Speed Booster cache per logged in user (valid for 60 seconds).\n The ESI module is included in all 6.x platforms but is not\n enabled and not configured automatically, so please consult\n its documentation for details on how to use it properly.\n\n Now you have three different levels of Speed Booster cache\n to leverage and deliver the 'live content' experience for\n all visitors, and still protect your server from DoS or\n simply high load caused by unexpected high traffic etc.\n\n * Automatic configuration of options required when Barracuda\n detects _VMFAMILY=AWS (Amazon EC2).\n\n * Both _NGINX_WORKERS and _PHP_FPM_WORKERS are now configurable.\n\n * You can avoid overwriting /etc/mysql/my.cnf with empty\n control file: $ touch /etc/mysql/custom.my.cnf\n\n * You can avoid overwriting /opt/php52/etc/php52.ini on upgrade\n with empty control file: $ touch /opt/etc/custom.php.ini\n\n * You can avoid overwriting /opt/php52/lib/php.ini on upgrade\n with empty control file: $ touch /opt/etc/custom.php.ini\n\n * You can avoid overwriting /opt/php53/etc/php53.ini on upgrade\n with empty control file: $ touch /opt/etc/custom.php53.ini\n\n * You can avoid overwriting /var/spool/cron/crontabs/root on upgrade\n by adding your extra/custom entries in the extra file:\n $ nano /var/xdrago/cron/custom.txt\n\n * You can avoid overwriting your CSF configuration on upgrade\n with empty control file: $ touch /var/log/custom.csf.log\n\n# New o_contrib modules:\n\n * taxonomy_edge-6.x-1.3 (with core patch)\n * taxonomy_edge-7.x-1.1 (with core patch)\n * purge-6.x-1.x\n * purge-7.x-1.x\n * expire-6.x-1.x\n * expire-7.x-1.x\n\n# Changes:\n\n * Nginx upgrade to 1.0.12\n * Lshell upgrade to 0.9.15-beta1\n * Percona upgrade to 5.5.19\n * Chive upgrade to 1.0.2\n * Git upgrade to 1.7.9\n * Suhosin upgrade to 0.9.33\n * Textile upgrade to 2.3\n * Mytop is now installed by default.\n * Drush based method for sites cron is more reliable and now set by default.\n * More compact naming for platforms in Octopus.\n * Speed Booster cache per logged in user now valid for only 60 seconds.\n * Speed Booster anonymous cache now valid for 3 hours, unless purged.\n * Extra $_COOKIE[OctopusCacheID] has been removed.\n * We use $cache_uid from parent map (Nginx) in fastcgi_cache_key.\n * Forced external caching only for Pressflow 6 core.\n * Octopus installs by default: D7P D7S D7D D6P D6S D6D OAM.\n * We no longer need to force Percona on Oneiric. MariaDB also works.\n * We no longer need to force MariaDB on Lenny and MariaDB Natty on Oneiric.\n * We no longer need to use Percona for Maverick on Natty and Oneiric.\n * We use _THIS_DB_HOST=localhost by default.\n * Secure/restricted access to manage users/clients is open by default\n in every Ægir Satellite Instance also for the extra non-uid=1 admin.\n * Users in every Ægir Satellite Instance are protected with userprotect\n and protect_critical_users modules.\n * Some default SQL limits have been increased.\n * The insecure D7 plugin manager is now forced as disabled by default.\n * The hosting_platform_pathauto module is now enabled in Ægir by default.\n * The provision_boost module is now added and enabled in Ægir by default.\n\n# Fixes:\n\n * Simplified Nginx config with 'modern', 'octopus' and 'legacy' templates.\n * Removed duplicate code and fixed caching logic for D5, D6 and D7.\n * Fixed logic for ESI microcache and Boost cache.\n * Removed imageinfo_cache module. It breaks platforms with imagecache module.\n * Disable deslash in globalredirect to avoid redirect loop.\n * Load IonCube also in php-cli.\n * Use core version in paths for all platforms.\n * Make sure that 301 redirects are only microcached - 5 seconds by default.\n * Do not run duplicate PHP-FPM rebuild on upgrade when there is\n no new DB server version installed/available.\n * Set boost_ignore_htaccess_warning to 1 by default.\n * Use provision_civicrm 6.x-1.x branch instead of outdated master.\n * Fix for broken regex on lshell.conf update per user.\n * All broken symlinks in the clients directory now deleted daily.\n * All broken symlinks in the lshell user home directory now deleted daily.\n * Avoid breaking Ægir upgrade because of high load.\n * Set correct loglevel for Redis to avoid useless I/O noise.\n * Add curl as allowed command to lshell default config.\n * Use faster download instead of git for Pressflow core.\n * Issue #1432668 - Octopus username should never start with a digit.\n * Issue #1408972 - Make nginx rewrites compatible with audio module.\n * Issue #1428990 - Load memcache in php-cli.\n * Issue #1408200 - AgrCache breaks aggregation and should be removed.\n * Issue #1420758 - Make sure that Nginx config includes are really used\n on initial Barracuda install.\n * Issue #1418608 - Add --with-xmlrpc in the PHP-FPM build by default.\n * Issue #1396204 - Add GeoIP support in Nginx by default\n * Issue #1394152 - Build PHP-FPM with --enable-calendar by default.\n * Issue #1392498 - Do not overwrite CSF configuration on Barracuda upgrade.\n\n# Recommendations:\n\n * Use _FORCE_GIT_MIRROR=github because it is 10x faster than others.\n\n\n### Stable Edition BOA-2.0.1\n### Date: Wed Dec 28 07:00:00 EST 2011\n### Installs Ægir 2.0.1\n\n# New Octopus platforms:\n\n ELMS 1.0-alpha5 -------------- http://elms.psu.edu\n Open Deals 1.0-alpha4 -------- http://opendealsapp.com\n Open Outreach 1.0-beta6 ------ http://openoutreach.org\n\n# Updated Octopus platforms:\n\n Acquia 7.10.10 --------------- http://bit.ly/acquiadrupal\n Acquia Commons 2.3 ----------- http://acquia.com/drupalcommons\n CiviCRM 3.4.8 ---------------- http://civicrm.org\n CiviCRM 4.0.8 ---------------- http://civicrm.org\n Commerce Kickstart 1.0-rc7 --- http://drupalcommerce.org\n Drupal 7.10 ------------------ http://drupal.org/drupal-7.0\n Managing News 1.2.1 ---------- http://managingnews.com\n NodeStream 1.1 --------------- http://nodestream.org\n Open Atrium 1.1.1 ------------ http://openatrium.com\n OpenChurch 1.22-a ------------ http://openchurchsite.com\n OpenScholar 2.0-beta13 ------- http://openscholar.harvard.edu\n ProsePoint 0.41 -------------- http://prosepoint.org\n\n# New features:\n\n * Speed Booster Purge Server for all Drupal 6.x based platforms\n with automatically configured support for all devices caching.\n * Enhanced Pressflow core for all bundled 6.22 based platforms,\n applied automatically also to already installed platforms:\n https://github.com/omega8cc/pressflow6\n * Added access to the \"clients\" directory with shortcuts/symlinks\n to all hosted sites per Ægir \"client\".\n\n# New o_contrib modules:\n\n * ESI for Nginx SSI - http://drupal.org/sandbox/mikeytown2/1328648\n * Purge for Speed Booster - http://drupal.org/project/purge\n * Expire for Speed Booster - http://drupal.org/project/expire\n\n# Changes:\n\n * Nginx upgrade to 1.0.11\n * MariaDB upgrade to 5.2.10\n * Percona upgrade to 5.5.18\n * Chive upgrade to 1.0.1\n * Pure-FTPd upgrade to 1.0.35\n * The syslog module is no longer enabled by default and added\n to the list of automatically disabled modules.\n\n# Fixes:\n\n * Mobile devices detection and caching improved.\n * Many fixes and enhancements for Speed Booster caching logic.\n * Many fixes and enhancements for Boost caching logic.\n * More reliable Nginx auto-healing.\n * Broken symlinks in the \"clients\" directory are now purged daily.\n * The preg_match for dev should check for dev. and devel. only.\n * Issue #1366564 - Use instance specific .octopus.cnf files.\n * Issue #1262988 - Use reliable test for upload progress availability.\n * Issue #1350028 - Make sure that all BOA pid files are removed on reboot.\n * Issue #1348906 - BOND script outdated _INSTALLER_VERSION variable fixed.\n * Issue #1321428 - Make sure that _SSH_PORT is written in /etc/ssh/sshd_config.\n\n\n### Stable Edition BOA-1.4S\n### Date: Mon, 24 October 2011 14:00:00 +0200\n### Installs Ægir stable 1.4S\n\n# Updated Octopus platforms:\n\n Acquia 7.8.7 ----------------- http://bit.ly/acquiadrupal\n Acquia Commons 2.2 ----------- http://acquia.com/drupalcommons\n CiviCRM 3.4.7 ---------------- http://civicrm.org\n CiviCRM 4.0.7 ---------------- http://civicrm.org\n Commerce Kickstart 1.0-rc4 --- http://drupalcommerce.org\n OpenPublic 1.0-beta3 --------- http://openpublicapp.com\n Ubercart 6.x-2.7 ------------- http://ubercart.org\n\n# New features:\n\n * Mobile devices detection for mobile-tablet, mobile-smart and mobile-other.\n * Mobile devices detection integrated with Redis/Memcached caches.\n * Mobile devices detection integrated with Boost cache.\n * Mobile devices detection integrated with Speed Booster cache.\n * Responsive Images 7.x module support.\n * New .barracuda.cnf and .octopus.cnf files for better configuration management.\n * Ubuntu Oneiric 11.10 is now fully supported.\n * Issue #1266912 - Support for Apache Solr Attachments - Tika.\n * Issue #1310082 - Disable XML Sitemap for dev automatically.\n * Support for fbconnect module.\n * Support testing->minimal->standard migrations for D7 out-of-the-box.\n * The Speed Booster $key_uri enhanced logic included in the default Nginx config.\n\n# Changes:\n\n * Nginx upgrade to 1.0.8\n * Create mobile cache separate subdirs for Boost by default.\n * _MODULES_ON and _MODULES_OFF now forced also for D7 sites.\n * Do not force hosting_ignore_default_profiles by default.\n * Some o_contrib modules received updates - use _O_CONTRIB_UP=YES to apply them.\n * Allow 'contrib' subdirectory in the modules path for allowed PHP files.\n * Issue #1309996 - Extended support for common modules locations/paths.\n * Issue #1305542 - Do not overwrite php.ini and my.cnf if control files exist.\n * Add collectd to the auto-healing monitor and automated restart.\n * Disable l10n_update module by default to avoid issues when d.o servers are down.\n * Updated docs/SOLR.txt to explain how to configure any core to support 7.x.\n * Duplicate parts of Nginx config moved to maps in the parent server.tpl.php file.\n * Add 'drush pmi' to the list of displayed/allowed commands.\n * Issue #1243068 - Allow to override in override.global.inc also Redis/Memcached etc.\n * Deny known crawlers on the HTTPS proxy level.\n\n# Fixes:\n\n * The wkhtmltopdf binary should be always executable if exists.\n * Issue #1238200 - Use custom _SSH_PORT only in TCP_IN.\n * Make sure the keys for MariaDB or Percona are added to avoid broken install.\n * Issue #1307664 - Test repo.percona.com and ftp.osuosl.org availability.\n * Issue #1262988 - Missing upload_progress_test.conf breaks upgrade for older installs.\n * Issue #1281896 - Add some missing video types to mime.types in the Nginx config.\n * Do not use path_alias_cache in the Hostmaster site to avoid broken URL aliases.\n * Issue #1270724 and #1263124 - really use /tmp directory during 'drush dl module'.\n * Do not break admin/reports/status/rebuild URL in D7.\n\n\n### Stable Edition 1.0-boa-T-8.10\n### Date: Mon, 5 September 2011 16:15:00 +0200.\n### Installs Ægir stable 1.3.1\n\n# New Octopus platforms:\n\n OpenChurch 1.21 -------------- http://openchurchsite.com\n\n# Updated Octopus platforms:\n\n Acquia 7.7.6 ----------------- http://bit.ly/acquiadrupal\n Acquia Commons 2.0 ----------- http://acquia.com/drupalcommons\n CiviCRM 3.4.5 ---------------- http://civicrm.org\n CiviCRM 4.0.5 ---------------- http://civicrm.org\n Conference 1.0-beta2 --------- http://usecod.com\n Drupal 7.8 ------------------- http://drupal.org/drupal-7.0\n Drupal Commerce 1.0 ---------- http://drupalcommerce.org\n OpenPublic 1.0-beta2 7.8 ----- http://openpublicapp.com\n Ubercart 2.6 6.22 ------------ http://ubercart.org\n\n# Changes:\n\n * Drush Make upgrade to 2.3\n * Drush upgrade to 4.5\n * Nginx upgrade to 1.0.6\n * MariaDB upgrade to 5.2.8\n * Higher limit_conn for AdvAgg to support high async connections rate.\n\n# Fixes:\n\n * Tomcat runs as a separate 'tomcat' user instead of root.\n * Issue #1250448 - Textile 7 requires Vars module.\n * Issue #1248432 - support for CNAME records in the DNS check.\n\n# New features:\n\n * HTTP/HTTPS redirects example in the override.global.inc file.\n * Enabled by default HTTPS and HTTP sessions/cookies for D7.\n * Issue #1243068 - Allow to override $cache_module_path.\n\n\n### Stable Edition 1.0-boa-T-8.9\n### Date: Sat, 30 July 2011 23:50:00 +0200.\n### Installs Ægir HEAD 1.2.1\n\n# Updated Octopus platforms:\n\n Drupal 7.7 ------------------- http://drupal.org/drupal-7.0\n Acquia 7.7.5 ----------------- http://bit.ly/acquiadrupal\n OpenPublic 1.0-beta1 7.7 ----- http://openpublicapp.com\n Drupal Commerce 1.0-rc1 ------ http://drupalcommerce.org\n Open Atrium 1.0 6.22 --------- http://openatrium.com\n ProsePoint 0.40 6.22 --------- http://prosepoint.org\n\n# Fixes:\n\n * Two critical cache related bugs fixed in Nginx 1.0.5.\n * Critical Issue #1222208 - broken web-based cron for sites.\n * Issue #1223506 - cloning a site looses client site ownership.\n * Missing jquery.ui symlink in Conference COD breaks install.\n * Issue #1230420 - do not purge /tmp too aggressively.\n * Issue #1234470 - SSL proxy didn't respect HTTP wildcard.\n * Boost's false alarm about permissions silenced.\n * Permissions for sites/domain/private/* also fixed daily.\n\n# Changes:\n\n * Nginx upgrade to 1.0.5\n * Chive upgrade to 0.5.1\n * Web-based method set by default for sites cron in Ægir.\n\n# New features:\n\n * Speed Booster Purge experimental backend can be installed,\n but is not used in production yet - see _PURGE_MODE flag\n and Issue #1048000.\n\n\n### Stable Edition 1.0-boa-T-8.8\n### Date: Thu, 15 July 2011 08:00:00 +0200\n### Installs Ægir stable 1.2\n\n# New Octopus platforms:\n\n Drupal 7.4 ------------------- http://drupal.org/drupal-7.0\n CiviCRM 3.4.4 ---------------- http://civicrm.org\n CiviCRM 4.0.4 ---------------- http://civicrm.org\n Videola 1.0-alpha1 ----------- http://videola.tv\n\n# Updated Octopus platforms:\n\n OpenPublic 1.0-beta1 7.4 ----- http://openpublicapp.com\n Drupal Commerce 1.0-beta4 ---- http://drupalcommerce.org\n Acquia Commons 1.7 ----------- http://acquia.com/drupalcommons\n Acquia 7.4.4 ----------------- http://bit.ly/acquiadrupal\n OpenScholar 2.0-beta11 ------- http://openscholar.harvard.edu\n Conference 1.0-beta1 --------- http://usecod.com\n\n# New features:\n\n * Speed Booster can be disabled per site or per platform.\n * Redis/Memcached can be disabled per site or per platform.\n * Redis/Memcached chained cache enabled also for anonymous visitors.\n * Support for private_upload module added.\n * Support for static sites/domain/files/robots.txt file per site #1173954.\n * New _HTTP_WILDCARD Barracuda option for Nginx configuration #1152316.\n * New _XTRAS_LIST Barracuda option to define extras to be used.\n * Scripts to add extra ftp or lshell standard or lshell master users.\n * New _PLATFORMS_LIST Octopus option to configure the list of platforms.\n * You can migrate sites between some installation profiles by default:\n Drupal/Pressflow -> Acquia\n Acquia -> Drupal/Pressflow\n Acquia -> CiviCRM 3\n Cocomore/CDC/DrupalCenter -> Pressflow\n * New _O_CONTRIB_UP Octopus option to upgrade last two contrib sets.\n\n# Changes:\n\n * Migration from commercedev to commerce_kickstart profile.\n * More system info stored in BOA logs to help with debugging.\n * Nginx config - deny access to /hosting/c/server_master.\n * Better how-to in the override.global.inc template.\n * Chive upgrade to 0.4.2\n * Nginx upgrade to 1.0.4\n\n# Fixes:\n\n * OpenPublic password policy issue fixed on site install.\n * OpenScholar missing libraries issue fixed.\n * Issue #1213094 - FServer platform missing module fixed.\n * Mollom problem when running via (SSL) proxy fixed.\n * Issue #1209150 - always use _MY_OWNIP when defined.\n * Issue #1208386 - fix for broken csf configuration template.\n * Boost cache write permissions after site migration fixed.\n * Nginx config - better support for CiviCRM.\n * Issue #1198572 - do not run SMTP check if _SMTP_RELAY_HOST is set.\n * Forced PHP-FPM rebuild on MariaDB 5.2.7 upgrade.\n * Issue #1196006 - fixed Nginx X-Accel-Redirect support.\n * Security Issue #1197172 - bypass access restrictions to protected files fixed.\n * Issue #1182680 - fixed support for backup_migrate module.\n * Issue #1182582 - fixed search paths for node.js, image.jpg etc.\n * Critical Issue #1183500 #1182660 - fall back to the wildcard * in Nginx.\n * Issue #962188 - Nginx version check in vhost.tpl.php now works.\n * Issue #1170498 - Extra config variable was missing in Nginx config templates.\n * Percona upgrade path fixed.\n * Broken dev version of the backup_migrate module replaced with stable.\n * Use correct platforms versions numbers in the ftp symlinks.\n\n\n### Stable Edition 1.0-boa-T-8.7\n### Date: Mon, 30 May 2011 11:40:00 +0200\n### Installs Ægir HEAD 1.1.2\n\n1. Fixed critical issue with MariaDB upgrade from 5.1 to 5.2\n2. Fixed critical issue with Nginx build.\n3. Fixed critical issue with Feature Server platform build.\n4. Added upgrade monitor.\n\n\n### Stable Edition 1.0-boa-T-8.6\n### Date: Sun, 29 May 2011 13:30:00 +0200\n### Installs Ægir HEAD 1.1.2\n\n----------------------------------------\n# Added or upgraded since January 2011\n----------------------------------------\n\n* Added support for install and upgrade to Percona Server 5.5\n* MariaDB server upgraded to version 5.2.6.\n* Nginx server upgraded to version Barracuda/1.0.2\n* Added support for Debian Squeeze and Ubunty Natty.\n* Open Atrium includes extra features:\n Atrium Folders: http://bit.ly/oafolders\n Ideation: http://bit.ly/oaideation\n\n* Hostmaster platform comes with ready to enable extra modules:\n http://drupal.org/project/hosting_backup_queue\n http://drupal.org/project/hosting_backup_gc\n http://drupal.org/project/hosting_upload\n\n* New Octopus platforms:\n\n OpenPublic 1.0-beta1 --------- http://openpublicapp.com\n NodeStream 1.0 --------------- http://nodestream.org\n Drupal Commons 1.6 ----------- http://acquia.com/drupalcommons\n OpenScholar 2.0-beta10-1 ----- http://openscholar.harvard.edu\n Conference 1.0-alpha3 -------- http://usecod.com\n Open Enterprise 1.0-beta3 ---- http://leveltendesign.com/enterprise\n Acquia 7.2.2 ----------------- http://bit.ly/acquiadrupal\n Drupal Commerce 1.0-beta3 ---- http://drupalcommerce.org\n\n* Basic Drupal 6 and Drupal 7 platforms now come in three instances,\n to make your standard workflow easier for: -dev, -stage and -prod,\n with correct suffix: D.00x, S.00x and P.00x in the platform name.\n\n* Speed Booster cache for 5.x, 6.x and 7.x Drupal platforms.\n This new feature adds super fast caching for anonymous visitors,\n and yes! - also for logged in users (cache per user) directly on\n the web server level - no Drupal module required.\n It works for all platforms, except of Ubercart, Commerce\n and any platform with ubercart in sites/all/modules/ubercart.\n\n* Support for secure ubercart keys location to use ../keys path.\n* The filefield_nginx_progress now also in every 7.x platform.\n* Drush upgraded to version 4.4\n* Drush Make upgraded to version 2.2\n* Redis cache server upgraded to version 2.0.5\n* PHP-FPM server upgraded to version 5.2.17\n* APC upgraded to version 3.1.9\n* Memcache extension replaced with memcached and libmemcached.\n* Chive database manager upgraded to version 0.4.1\n* Added support for robotstxt module in all new 6.x based platforms.\n* Drush gm / generate-makefile command added as allowed to lshell.\n* Git over ssh added as allowed to lshell.\n\n----------------------------------------\n# Improvements since January 2011\n----------------------------------------\n\n* Speed Booster now works also in the Ægir Master Instance.\n* Full Barracuda install takes only 30 minutes (tested on Linode).\n* Nginx abuse guard is now integrated with csf firewall.\n* Bots/crawlers are now denied on any \"dev\" type subdomain.\n* The pdnsd server install is now optional.\n* The csf/lfd firewall install is now optional.\n* Limited shell configuration is now updated on every upgrade.\n* Auto-tuning in Barracuda leaves more memory for MyISAM etc.\n* Ægir runs cron for D5 and D6 sites using Wget instead of Drush\n to leverage APC cache, while D7 can use built-in poormanscron.\n* Many improvements in the Speed Booster cache configuration.\n* Improved memcached/redis cache bins configuration.\n* The o_contrib modules now symlinked also in custom platforms.\n* Boost directories created automatically also in custom platforms.\n* Improved web server self-healing monitor.\n* PHP notices no longer displayed for dev subdomains, only errors.\n* Many improvements in the Nginx configuration - now it's faster.\n* Permissions on uploaded modules, themes and files are now\n automatically fixed every morning to help with post-import issues.\n* Almost all 6.x platforms now come with performance related\n modules already enabled and configured on site install by default.\n* Nginx config - now doesn't use php-fpm to serve fckeditor files.\n* Introduced possibility to add upgrade-safe custom Nginx rewrite\n rules to support transparent migration of legacy URLs/content.\n* Ægir Hostmaster control panel received extra caching and speed.\n* Better support for securepages 1.9 with forced secure cookies.\n* Better support for dynamically created base_url for http/https.\n* Too generic D7 profile names replaced with unique Drupal 7 names.\n* A few new commands have been added to your Ægir Drush Shell (SSH).\n* You can use git to manage the code and rsync to manage backups.\n* Useful new commands from Drush v.4 are now available.\n* Now it is possible to delete old sites backups created in Ægir.\n* You can access Ægir backups also via SSH or SFTP/FTPS.\n* You can cancel queued task in Ægir before it is started.\n* The \"dev\" anywhere in the subdomain enables all PHP errors.\n* You can use \"dev\" type alias for live site for easier debugging.\n* Added support for imagecache_external module.\n* It is possible to safely delete any not used platforms on request.\n* Access to static files allowed only for currently used domain.\n* Added crossdomain.xml in the root of every new platform.\n* New rewrite introduced to map /files to /sites/domain/files,\n /images to /sites/domain/files/images and\n /downloads to /sites/domain/files/downloads.\n* The standard /update.php works again, however using \"drush dbup\"\n command is recommended.\n* The \"drush mup\" command allows now to upgrade contributed modules.\n\n\n----------------------------------------\n# Fixes since January 2011\n----------------------------------------\n\n* Auto-healing no longer starts concurrent servers when InnoDB start\n takes more time on servers with big or many databases.\n* Hostname is no longer reverted to default on Linode and similar.\n* Barracuda supports now both old and new Mailx behavior.\n* All platforms paths and symlinks include core version numbers.\n* Fixed some memory issues with Virtuozzo family systems.\n* Fixed issue with broken site when non-lowercase domain was used\n on Migrate or Clone task.\n* Fixed upgrade path for Drupal 5\n* Fixed double slash in the images paths issue in the Pressflow core.\n* Speed Booster cookies shouldn't be sent for imagecache/styles\n and AdvAgg module dynamic requests.\n* Speed Booster shouldn't cache imagecache/styles and AdvAgg module\n dynamic requests on the Nginx level.\n* Nginx upgrade to 1.0.0 fixes known issue with random but very high\n CPU load on Nginx server configuration reload/restart.\n* Fix for critical bug causing sessions issues on older sites without\n $cookie_domain set in settings.php when speed booster is enabled.\n* The session.cookie_secure is no longer forced in D6 platforms.\n* Security issue #1098304 - domain aliases were not sanitized.\n* Nginx config - proper fix for broken wysiwyg pop-ups.\n* Fixed issue with Nginx configuration for private files access.\n* The authorize.php added to allowed php files - required in D7.\n* Known issue with paths to files not rewritten is now fixed.\n* Known issue with sites cron semaphore in Ægir now resolved.\n* Known issue with PHP notices breaking some Ægir tasks resolved.\n* Fixed web server rewrites to support \"ad\" module.\n* Fixed Ægir issue with .info and .pl domains extensions.\n* Drush make via SSH now works as expected.\n* Fixed Nginx issue with /system/ paths and static files or images.\n* Fixed issue with broken site when non-lowercase domain was used.\n\n\n----------------------------------------\n# Other changes\n----------------------------------------\n\n* Forced public downloads for all 6.x platforms, except of ubercart.\n* Boost crawler option is now denied for performance reasons.\n* Forced log-out on browser quit only for Ægir control panel.\n\n\n### Project and issue queue moved to Drupal.org\n### Date: Sat, 7 May 2011 14:00:00 +0200\n### http://drupal.org/project/barracuda\n### http://drupal.org/project/octopus\n\n### Stable Edition 1.0-boa-T-8.5\n### Date: Tue, 3 May 2011 14:30:00 +0200\n### Installs Ægir stable 1.1\n\n### Stable Edition 1.0-boa-T-8.4\n### Date: Sun, 1 May 2011 23:30:00 +0200\n### Installs Ægir stable 1.1\n\n### Stable Edition 1.0-boa-T-8.3\n### Date: Sat, 30 Apr 2011 20:15:00 +0200\n### Installs Ægir stable 1.1\n\n### Stable Edition 1.0-boa-T-8.2\n### Date: Tue, 26 Apr 2011 21:45:00 +0200\n### Installs Ægir stable 1.1\n\n### Stable Edition 1.0-boa-T-8.1\n### Date: Wed, 20 Apr 2011 19:30:00 +0200\n### Installs Ægir stable 1.1\n\n### Stable Edition 1.0-boa-T-8\n### Date: Mon, 18 Apr 2011 20:15:00 +0200\n### Installs Ægir stable 1.0\n\n### Stable Edition 1.0-boa-T-5\n### Date: Fri, 8 Apr 2011 19:15:00 +0200\n### Installs Ægir working HEAD after 1.0-rc6\n\n### Stable Edition 1.0-boa-T-2\n### Date: Wed, 6 Apr 2011 01:34:40 +0200\n### Installs Ægir working HEAD before 1.0-rc3\n\n### Stable Edition 1.0-boa-T\n### Date: Mon, 14 Mar 2011 02:43:15 +0100\n\n### Stable Edition 0.4-boa-C\n### Date: Thu, 10 Feb 2011 04:41:57 +0100\n\n###\nFor changes/improvements between 2010-09-24 and\n2010-12-31 please see comments in the commits history.\n###\n\n### Thu, 2010-09-23 17:30 - Edition 0.4-HEAD-A14.B\n\nAdded/Fixed: (upgrade for all pre-A14.A required)\n\n1. Introducing default SSL Wildcard Nginx Proxy.\n Works for all sites/hostmaster instances on\n the same server and can be used also for\n encrypted connections to Chive and Collectd.\n Doesn't interfere even with SSL enabled sites\n on the same IP (with separate certs).\n\n2. The redirects are now back and enhanced.\n Fully compatible with Nginx in any combination\n with aliases and SSL settings/modes.\n\n3. Barracuda and Octopus by default installs still\n Ægir HEAD, but the latest alpha14 also works.\n\n4. Octopus can define its separate IP address\n if available.\n\n5. Fixed issue with too aggressive Hot Sauce check,\n causing creating not shared copies of code\n for platforms on every install or upgrade.\n\n6. Barracuda and Octopus now allows to skip DNS\n test, to make it possible to install on any\n virtualbox with dynamic DNS/IP etc. There is\n no guarantee it will work, but another switch\n is now available, if someone needs it.\n\n7. Octopus can now turn off local Memcache and Redis\n caches and switch all sites to use defined remote\n caches.\n\n8. Forced /etc/apt/sources.list rewrite also before\n the Barracuda system upgrade.\n\n9. Fix for the already installed and possibly broken\n git-core.\n\n10. Fix for Ægir sites with .info domains, the path\n alias should now work without 403 error.\n\n\n### Fri, 2010-09-17 11:00 - Edition 0.4-HEAD-A14.A\n\nAdded/Fixed: (upgrade required)\n\n1. Barracuda and Octopus by default installs now\n Ægir HEAD to use the fix for critical issue\n on sites import. It will be included in alpha14,\n please don't use alpha13.\n\n2. Debian Lenny on 32bit systems works again.\n Fix for broken git-core after upgrade\n to version: 1:1.5.6.5-3+lenny3.1 on Lenny 32bit.\n\n3. Fix and better inline warnings/info about\n missing locales at Linode and RackSpaceCloud.\n\n4. More details in the installer log for better\n debugging and version tracking.\n\n5. E-mail address for alerts on database repair\n started by auto-healing now correctly replaced.\n\n6. Redis for Lenny now built from sources due to\n apt version moved already to Squeeze.\n\n7. Critical bugfix for failed platforms install\n when hostmaster is not upgraded.\n\n8. Introducing simple edition archive:\n http://omega8.cc/dev/bo-a14a.tar.gz\n\n9. Octopus now better supports using newer shared\n code for platforms and introduces new setting:\n _HOT_SAUCE to allow forced fresh/hot code.\n\n\n### Tue, 2010-09-12 21:50 - Edition 0.4-HEAD-A13.A\n\nAdded/Fixed: (upgrade recommended)\n\n1. Octopus now creates SSH/FTPS separate, non-aegir\n account for every Ægir Satellite Instance,\n with limited shell to avoid using commands\n like \"drush up\" since they should never be used\n on sites managed in the Ægir system.\n\n2. Octopus now by default sends a welcome email\n with some useful intro information and access\n details to the address defined as _CLIENT_EMAIL.\n\n3. When Octopus is used the first time to create\n an Ægir Satellite Instance, it doesn't allow\n to skip installing all platforms, since it is\n recommended to add all available platforms with\n initial install, for easier re-using the code\n by next Ægir Satellite Instances.\n\n4. The second and all future non-core Hostmaster\n installs allow to choose one or more platforms\n or to skip adding platforms at all.\n\n5. Octopus by default honors initial domain used\n for the Ægir Satellite Instance on every\n upgrade to avoid mistakes with using different\n copies of the script for different Ægir\n Satellite Instances upgrades.\n\n6. Also Barracuda will always honor initial\n domain used for the core Hostmaster to avoid\n mistakes on upgrade when you don't use\n the original version of the script.\n\n7. Better checks if the script is running as root.\n\n8. Removed memcache module since cache is used.\n\n9. SMTP connection test is now optional.\n\n10. Nginx version set to 0.8.50.\n\n11. By default Ægir 0.4-HEAD instead of alpha13\n is now installed to fix critical issues with\n importing sites.\n\n See also: http://drupal.org/node/907248\n\n12. Solr and Chive are now optional (Yes/no).\n\n13. Added optional install of Collectd monitor.\n\n14. Fixed issue with SSL mode.\n\n15. Better compatibility for upgrades from\n pre-Barracuda Nginx installs.\n\n16. Now it doesn't start cron before completing all\n install tasks to avoid breaking spinner.\n\n17. Both Barracuda and Octopus now can better\n support re-starting stopped install/upgrade.\n\n18. Octopus now refuses to run if defined domain\n doesn't resolve yet to the server IP address.\n\n19. Octopus now refuses to run on system not\n created initially by Barracuda installer.\n\n20. Custom FQDN hostname is now forced (if defined)\n in Barracuda before running DNS checks.\n\n21. Fix for some missing mime types in vanilla Nginx.\n\n22. Updated versions of Open Atrium, Drupal Commons\n and Cocomore Drupal distros installed by Octopus.\n\n23. Lowered memory defaults in the MariaDB configuration.\n\n\n### Tue, 2010-08-31 23:50 - Edition 0.4-HEAD-A12.D\n\nAdded/Fixed: (upgrade recommended because it works!)\n\n1. Upgrade of Ægir Master Instance by Barracuda\n and upgrade of Ægir Satellite Instances by Octopus\n finally works as expected.\n\n2. It is now possible to use Barracuda to install\n environment and Ægir Master Instance, to\n upgrade only environment, to upgrade only Ægir\n Master Instance, or both at the same time.\n\n3. Octopus now can separately install and/or upgrade\n any Ægir Satellite Instance or any platform\n on any instance, separately, using detailed prompt\n with version numbers and links to distributions\n home pages.\n\n4. New platform Cocomore Drupal added in Octopus:\n http://drupal.cocomore.com\n\n\n### Sat, 2010-08-28 20:15 - Edition 0.4-HEAD-A12.C\n\nAdded/Fixed: (upgrade recommended)\n\n1. By default Ægir 0.4-HEAD with Drush 3.3\n is now installed to fix critical issues with\n importing sites. The fix is also available\n as a patch for alpha12:\n http://drupal.org/node/882970#comment-3382542\n\n2. Both Barracuda and Octopus now allow to choose\n if the Ægir Hostmaster will be upgraded or not.\n\n3. Added versions numbers and links to all platforms\n Yes/no prompts.\n\n4. /tmp directory no longer used to avoid problems\n due to secure noexec mount.\n\n5. Improved readme and docs (in progress).\n\n6. Removed old, no longer supported installer.\n\n\n### Fri, 2010-08-27 04:15 - Edition 0.4-alpha12-A12.B\n\nAdded/Fixed: (upgrade optional)\n\n1. Octopus now allows to install or upgrade only Ægir\n Satellite Instance without any platforms added.\n\n2. Enabled again early exit on the first error to avoid\n confusing cascade of errors if something went wrong.\n\n3. Both Barracuda and Octopus runs now faster.\n\n\n### Thu, 2010-08-26 19:30 - Edition 0.4-alpha12-A12.A\n\nAdded/Fixed: (upgrade from previous versions recommended)\n\n1. Barracuda now includes multicore Apache Solr Search,\n Redis and Memcache.\n\n2. Barracuda now can upgrade packages selectively.\n Just run it again to upgrade the system and the\n Ægir Master Instance.\n\n3. Octopus can create many Ægir Satellite Instances\n on the same server, each with different set of platforms,\n but with ability to share the code between instances,\n so you can use this system even on the low end VPS.\n\n4. Chive database manager added by default with db.\n subdomain (may require dns entry or wildcard).\n\n\n### Thu, 2010-08-26 08:55 - Edition 0.4-alpha12-A12.A\n\nAdded/Fixed: (upgrade from previous versions recommended)\n\n1. By default Ægir 0.4-alpha12 with Drush 3.3\n is now installed.\n\n2. Introduced new Octopus and Barracuda installers.\n See README.txt for more information.\n Both are in pre-alpha debugging phase.\n\n3. All installers code and helpers now hosted on GitHub.\n\n\n### Thu, 2010-08-18 21:30 - Edition 0.4-HEAD-A11.B\n\nAdded/Fixed: (upgrade from previous versions recommended)\n\n1. By default Ægir 0.4-HEAD with Drush 3.3\n is now installed.\n\n2. Introduced support for Virtuozzo/OpenVZ IP address\n automatic discovery.\n\n\n### Thu, 2010-08-12 22:15 - Edition 0.4-alpha11-A11.A\n\nAdded/Fixed: (upgrade from previous versions recommended)\n\n1. By default Ægir 0.4-alpha11 with Drush 3.3\n is now installed.\n\n2. PHP-FPM version is now 5.2.14.\n\n3. Improved UX - only interesting status messages\n are now displayed.\n\n4. Hostmaster root directory now properly named using\n Ægir version: '-0.4-alpha11' or '-HEAD'.\n\n\n### Thu, 2010-08-12 06:10 - Edition 0.4-alpha10-A10.A\n\nAdded/Fixed: (upgrade from previous versions recommended)\n\n1. By default Ægir 0.4-alpha10 with Drush 3.3\n is now installed.\n\n2. Nginx version is now 0.8.49, MariaDB is 5.1.49\n and Drupal is 6.19.\n\n3. Fixed freezing request on the first /admin hit.\n\n4. Better tuned Nginx, PHP-FPM and MariaDB settings.\n\n5. Various small improvements in the code.\n\n\n### Thu, 2010-08-07 06:10 - Edition 0.4-alpha9-A9.F\n\nAdded/Fixed: (upgrade of existing installs not required)\n\n1. By default latest HEAD from git.aegirproject.org\n is now installed, due to critical bug found,\n see this for details: http://drupal.org/node/874716\n The default install will be reverted to 0.4-alpha10\n when it will be released. You can use 0.4-alpha9 with\n caution (just don't use remote servers new feature\n to stay safe).\n\n2. Fixed problem with setting up FQDN hostname on Linode\n based servers. The fix can help also with other\n providers probably.\n\n3. Installer now writes date and version used in file:\n /var/aegir/config/includes/installer_version.txt\n\n\n### Thu, 2010-08-05 22:00\n\nAdded/Fixed: (upgrade of existing installs not required)\n\n1. Fixed critical problem with Drush broken due to\n change of URL to the required php library:\n http://drupal.org/node/875196\n\n2. Ægir version is now configurable. By default latest\n 0.4-alpha9 will be installed, but it is also possible\n to install latest HEAD from git.aegirproject.org.\n\n3. Ægir front-end (sub)domain is now configurable and\n can be different than machine FQDN hostname.\n\n4. Machine FQDN hostname and IP is now configurable.\n\n5. Nginx version updated to 0.8.48.\n\n6. Fixed progress spinner on Ubuntu.\n\n7. Fixed problem with automatic ionCube loader\n discovery of required version 32/64 bit.\n\n\n### Mon, 2010-08-02 01:08\n\nAdded/Fixed:\n\n1. Added automatic, full support for Ubuntu Lucid and Karmic.\n\n2. If there is no FQDN hostname, we are trying to set it\n using reverse IP hostname, if exists.\n\n3. Now we are trying both `uname -n` and `hostname -f`\n to make sure if the FQDN hostname is already set,\n but not available with `uname -n` test.\n\n4. Added support for ionCube Loader with automatic\n discovery of required version 32/64 bit.\n\n\n### Sat, 2010-07-31 18:00\n\nAdded/Fixed:\n\n1. Simplified installer by removing unnecessary duplicate\n prompts in the original embedded install script.\n\n2. Check for SMTP outgoing port 25 now fully automated.\n\n3. Even more fun added :)\n\n\n### Fri, 2010-07-30 19:00\n\nAdded/Removed:\n\n1. New all-in-one installer for Debian 5.0 Lenny\n Ægir 0.4-alpha9 compatible.\n\n2. Removed deprecated scripts & how-to.\n\n\n### Sat, 2010-02-06 23:55\n\nAdded/Fixed:\n\n1. Missing --with-libevent=shared added in php-fpm-install.txt\n http://github.com/omega8cc/boa/issues/#issue/2\n\n2. Debian specific stuff added in php-fpm-install.txt to allow\n easy install on vanilla vps.\n\n3. Xcache replaced with APC and Memcache install added.\n\n\n### Wed, 2010-02-03 06:37\n\nAdded/Fixed:\n\n1. mkdir for required cache dirs added in nginx-install.txt\n http://github.com/omega8cc/boa/issues#issue/1\n\n\n### Fri, 2010-01-29 06:37\n\nAdded/Fixed:\n\n1. FCKeditor/CKEditor fix for .xml files.\n2. Security: deny direct access to backup_migrate directory.\n\n\n### Mon, 2010-01-11 01:46\n\n1. Added custom fix required only when using purl, spaces & og\n for modules: ajax_comments, watcher and fasttoggle.\n\n2. Simplified rewrite rules for location @drupal\n resolves also some problems with imagecache.\n\n3. Changed order of try_files for Boost\n to match newer version of dirs structure first.\n\n\n### Tue, 2009-12-01 16:19\n\nAdded/Fixed:\n\n1. Latest Boost compatibility for /cache/normal & /cache/perm.\n2. Json cache for Boost added.\n3. Fix for xml/feed Boost cache files with .html extension.\n4. Fix for xml/feed Boost cache correct mime type.\n" }, { "path": "DIFFERENT30Y.md", "content": "# 30 Years of Heritage\n\nWe are unique within the hosting industry for many important reasons. Our 15 years of Ægir-based hosting, plus earlier experience with Adgrafix (the first company to offer a control panel for website management in 1995), have helped shape what makes us different today.\n\nFun fact: Robert “Bo” Bennett, the founder of Adgrafix, started as a self-taught programmer and created the world's first web hosting control panel entirely in Perl. We continued to build on that fundation for almost ten years, adding shopping cart and marketing tools and the early BOA version -- everything in Perl. Why not in PHP? Because PHP was still in its infancy, since its early prototype 1.0 was released in June 1995 by Rasmus Lerdorf, while Perl 4 had been out since 1991 and was already a stable, mature, widely adopted language used both for server tools, websites backend and frontend.\n\n\"boa-on-excalibur\"\n\n## Why We’re Different\n\nWe avoid marketing noise. Think of us like your electricity provider — reliable, fast, essential. You know we’re there, running everything **silently and smoothly** in the background. No need for constant attention or distractions.\n\n## Focus, focus, focus — like no one else\n\nOur website has been running on GravCMS for years, but our hosting and associated service itself is 100% Drupal-focused — and has been for 15 years. Others have tried and failed to stay focused, adding WordPress and a dozen other platforms. That’s not how you become **best-in-class, fastest, and most trusted** by the open-source community.\n\n## Technological sovereignty\n\nWe take **Open Source seriously** — it’s not a buzzword for us. It’s about freedom from corporate control. Here's a short look back at our 15-year Ægir journey and 19 years with Drupal.\n\nOur BOA system is the most complete solution of its kind. It has been designed from the ground up to make Drupal hosting **faster, easier, safer, and more efficient** — especially for teams that don’t want to get lost in DevOps. It was always built on Debian OS, but we never accepted systemd, imposed by Red Hat. After years of battling, we switched fully to **Devuan** — the true Debian fork without systemd, built by Debian veterans.\n\nAt the same time, we stayed away from MariaDB, because it drifted away from MySQL compatibility and became vendor-focused. Instead, we adopted **Percona** — a truly open, compatible, and community-aligned database option. The same thing happened with Redis — the fast cache-in-memory server. As soon as Redis switched to a restrictive corporate license, we moved to the open-source **Valkey** fork.\n\nBottom line: BOA is **architected around technological freedom and independence**. We work for you — not for Oracle, Red Hat, investors or proprietary agendas. That matters, especially for universities, NGOs, and businesses who rely on no-compromise sovereignty. Make your high-traffic demanding Drupal sites **Lightning Fast and Secure** with our [**Pro Hosted Plans »**](https://omega8.cc/pro)\n\n\"Ægir-BOA\"\n\n## Support for legacy Drupal versions\n\nWhile Drupal 7 users were largely abandoned by core developers without an upgrade path to Drupal 8 and beyond, we still fully support Pressflow 6 and Drupal 7. We even maintain our own improved core forks, provide Drupal 7 LTS, and made Drupal 7 compatible with PHP 8.4 ages ago. Make your legacy Drupal sites **Fast and Secure** with our [**Basic Hosted Plans »**](https://omega8.cc/basic)\n\n## Support for Ægir 3 and Drupal 11+\n\nMany believed Ægir 3 would never support Drupal 9 — until we made it work. Same for Drupal 10. This year, we did it again and added Drupal 11 support to Ægir — a “mission impossible” at first glance. We recently took over the technical stewardship of Ægir 3 project, ensuring its future is bright. Make your modern Drupal sites **Blazing Fast and Secure** with our [**Advanced Hosted Plans »**](https://omega8.cc/advanced)\n\n## 90-day backups running every six hours\n\nYour site backups (files + database) are securely stored via Backblaze with a full 90-day retention period — taken automatically every six hours. Far better than the industry-standard daily or weekly backups. You can also configure your own automatic backups, using any of 8 supported storage providers. Because there is no such thing in the universe like \"too many backups\".\n\n## Drupal codebase upgrades powered by Jenkins\n\nWe’ve built highly tailored CI/CD pipelines for Drupal, including custom Composer-based setups and multi-environment workflows. If you’ve never used CI/CD, we understand — it can be complex. The good news is that you can use it without any learning — if you’re tired of constant updates, PHP compatibility issues, or security patching — we can help using Jenkins wizardry in the backend, including same-day updates — check our [**Managed Drupal Updates Plans »**](https://omega8.cc/managed)\n\n**We’d be happy to show you how it all works and talk through how it could fit with your projects** — [**Contact Us Today! »**](https://omega8.cc/contact) to discuss your needs.\n\n" }, { "path": "DUALLICENSE.md", "content": "# Dual License and BOA Branches Explained\n\n**BOA** remains a **Free/Libre Open Source Project**. While all of **BOA** code is **Free/Libre Open Source**, only the **BOA LTS** branch and **Ægir** are available without any cost or restrictions.\n\n- **LTS**: This public branch remains completely free to use without any commercial license, as it has been from the beginning (previously named HEAD or STABLE). This branch should be considered the **BOA Long Term Support** variant, with slow updates focused on security and bug fixes, and limited new features.\n\n- **DEV**: This public branch requires a commercial license for both installation and upgrades. It includes the latest features, security updates, bug fixes, and updated service versions. This branch should not be used in production without extensive testing.\n\n- **PRO**: This public branch requires a commercial license and is available only as an upgrade from either LTS or DEV (or previous HEAD/STABLE). It offers new releases once ready, closely following the tested DEV branch.\n\n- **OMM**: This private branch is managed separately, with some unused components removed and others added. It is generally simplified for easier maintenance and adheres to modern coding standards.\n\nYou can install only **BOA LTS** and then upgrade to **PRO** with a license from [Omega8.cc](https://omega8.cc/licenses).\n\n## **LTS** branch will enter a full code-freeze on December 31, 2025\n\nPlease note that **as of December 31, 2025, the LTS branch will enter a full code-freeze**. No further feature development or regular releases are planned for 2026. A possible re-evaluation may occur in 2027, but this should not be assumed.\n\nAfter the freeze, **only critical functional fixes within BOA itself will be considered**. There will be **no updates** for underlying components such as PHP, Percona, Nginx, Valkey, OpenSSL, OpenSSH, or related system libraries, although your barracuda will still be able to upgrade your system with newer Devuan packages.\n\nSeveral of the upcoming and most impactful features are planned **exclusively for BOA PRO**, as outlined in the [ROADMAP](https://github.com/omega8cc/boa/tree/5.x-dev/ROADMAP.md).\n\nFor continued access to new features, ongoing improvements, and a future-proof stack, [BOA PRO](https://omega8.cc/licenses) is the recommended upgrade path.\n\n## Practical Differences Between **LTS** and **PRO**\n\nOver time, **PRO** will be ahead of **LTS** as its name suggests.\n\nThe `BOA-5.9.1` release is the last parallel release including all features developed for **PRO**, so both **PRO** and **LTS** users will enjoy the same improvements, bug fixes, and new features.\n\nIn the future, new features will be regularly added to **PRO**, while **LTS** will receive only security updates and critical fixes for BOA itself. There may be exceptions, and some new features may find their way to **LTS**, but only as exceptions.\n\nThe **PRO** will be available in three main variants, and while all **BOA PRO** licenses will grant access to the same **BOA PRO** branch and features, they will differ in terms of available support levels.\n\n### **PRO** with **Basic Support**\n\nThis license is designed for **BOA** users familiar with managing and monitoring their own systems who don't need extended support, monitoring, or assistance in managing their **BOA** installation and updates. Our support is limited to the Issue Queue on GitHub without any kind of SLA or Best Effort guarantee.\n\nIdeal for: Small businesses or developers who need basic support and can handle issues independently or with community help.\n\n### **PRO** with **Advanced Support**\n\nThis license is designed for **BOA** users who are familiar with managing their own server but need assistance in handling their custom needs or fixing individual problems privately via our helpdesk at [Ægir Helpdesk](https://aegir.happyfox.com), without posting details on GitHub. There is no SLA guarantee, only a Best Effort guarantee. System local and remote uptime monitoring with Site24x7 is included.\n\nIdeal for: Medium to large businesses needing reliable support during business hours with quick response times for critical issues.\n\n### **PRO** with **Hands-Off Experience**\n\nThis license is for **BOA** users who prefer to delegate all the work needed to maintain their **BOA** server, including regular upgrades (both **BOA** and major OS upgrades), active monitoring, and responding to DoS incidents. It comes with a fully managed **BOA PRO** installation you can use without worrying about anything else, with our general SLA guarantee applied: [Omega8.cc SLA](https://omega8.cc/sla). System local and remote uptime monitoring with Site24x7 is included.\n\nIdeal for: Enterprises requiring comprehensive, around-the-clock support with quick response times for all issues.\n\nYou can obtain a **BOA PRO** license from [Omega8.cc](https://omega8.cc/licenses).\n\n## Upcoming **PRO-Only** Features\n\nCertain planned features are likely to be exclusive to **BOA PRO**. If these features are added to other **BOA** versions, it will be with a significant delay.\n\nCheck out the details in [ROADMAP](https://github.com/omega8cc/boa/tree/5.x-dev/ROADMAP.md)\n" }, { "path": "HTTP3.md", "content": "# Strap in, your sites are getting an F1 engine\n\nWe’re rolling out a meaningful upgrade across BOA/Omega8.cc nodes: HTTP/3 and KTLS support.\n\nIf you run Drupal sites that should feel fast and responsive (and stay that way during spikes), this is genuinely good news. It’s not a “new feature in the control panel” kind of update — it’s the kind that improves the *experience* visitors have without you touching a single line of code.\n\n\n## Why this is a big deal\n\nNearly everything on the web is encrypted now (HTTPS). That’s great for security, but it also means every visit involves extra work just to establish and maintain that secure connection.\n\nThe upgrades are all about making secure browsing feel lighter and faster.\n\n### What visitors should notice\n\n* Faster “start” to loading (especially for first-time or returning visits after a while)\n* Smoother browsing on mobile and Wi-Fi (fewer annoying stalls when the connection quality changes)\n* More consistent performance during traffic spikes (less overhead spent on transport/encryption, more resources left for actual Drupal work)\n\n### Why it matters for *your server* too\n\n* More efficient HTTPS handling can mean lower CPU pressure in the busiest parts of the request path.\n* That translates into more headroom for PHP-FPM, caches, and database work when it really counts.\n\nIn short: faster for users, more efficient for servers, and no application changes required.\n\n\"screenshot\n\n## What’s being enabled (friendly version)\n\n### HTTP/3\n\nHTTP/3 is the newest “dialect” browsers can use to talk to your site. It’s designed for today’s reality: phones, roaming, Wi-Fi, variable quality connections.\n\nWhen a visitor’s browser supports HTTP/3, it can:\n\n* connect more quickly,\n* recover better from “internet wobble,”\n* and keep page loads feeling responsive even when conditions aren’t perfect.\n\nAnd the best part: browsers choose it automatically. Nobody needs to configure anything on their device.\n\n### KTLS\n\nKTLS helps the operating system handle part of the secure connection workload more efficiently. The result is simpler to describe than the internals:\n\n* less overhead\n* more throughput\n* better stability under load\n\nIt’s one of those improvements that quietly makes a platform feel “stronger” and less stressed during peak times.\n\n\n## What you need to do (this is the important part)\n\nWe’ll make sure the server side is ready after the upgrades — but to actually *apply* the new capabilities cleanly across your BOA/Ægir-managed stack, you need to run Verify so configurations are regenerated with the updated features.\n\n### After the maintenance completes:\n\n1. Log in to your Ægir Control Panel\n2. Go to Platforms → run Verify on all platforms you use to host sites\n3. Go to Sites → run Verify on your hosted sites\n\n * If you host many sites: use the bulk actions on the Sites list so you don’t have to click site-by-site.\n\nThis ensures your platform and site configs are refreshed and the upgraded stack is applied consistently.\n\n\n## “Will anything break?” (No — it’s designed not to)\n\n* If a browser supports HTTP/3, it will use it automatically.\n* If it doesn’t, it will quietly fall back to HTTP/2 or HTTP/1.1.\n* Your Drupal code stays the same.\n* Your visitors don’t have to do anything.\n\n\n## Want more detail?\n\nWe’ll publish our own concise, friendly explainer that goes deeper into:\n\n* what HTTP/3 changes in real-life browsing,\n* why KTLS improves HTTPS efficiency,\n* and how to confirm your browser is using HTTP/3.\n\nMore details: *(link coming soon — we’ll share it as soon as it’s live)*\n\n\n## Quick checklist (save this)\n\nAfter the system upgrade:\n\n1. Ægir → Platforms → Verify (all platforms)\n2. Ægir → Sites → Verify (use bulk actions if you have many sites)\n\nThat’s it. Once Verify is done, you’re ready to benefit automatically — and your visitors get a faster, smoother ride. Enjoy!\n\n\n" }, { "path": "OCTOPUS.sh.txt", "content": "#!/bin/bash\n\n\n###----------------------------------------###\n###\n### Octopus Ægir Installer\n###\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n### This program is free software. You can\n### redistribute it and/or modify it under\n### the terms of the GNU GPL as published by\n### the Free Software Foundation, version 2\n### or later.\n###\n### This program is distributed in the hope\n### that it will be useful, but WITHOUT ANY\n### WARRANTY; without even the implied\n### warranty of MERCHANTABILITY or FITNESS\n### FOR A PARTICULAR PURPOSE. See the GNU GPL\n### for more details.\n###\n### You should have received a copy of the\n### GNU GPL along with this program.\n### If not, see http://www.gnu.org/licenses/\n###\n### Code: https://github.com/omega8cc/boa\n###\n###----------------------------------------###\n\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nexport SHELL=/bin/bash\n\n###\n### Default values for main Octopus instance variables\n###\n\n_USER=o1\n_MY_OCTO_EMAIL=\"noc@omega8.cc\"\n_CLIENT_EMAIL=\"notify@omega8.cc\"\n_CLIENT_OPTION=POWER\n_CLIENT_SUBSCR=M\n_CLIENT_CORES=1\n\n###\n### Required by AegirSetupA script, running in\n### the same env, to avoid chicken/egg race.\n###\nexport _USER=\"${_USER}\"\n\n###\n### Drush and Redis Variables\n###\n\nexport _DRUSH_VERSION=8.5.0.5\nexport _REDIS_C_VERSION=com-19-04-2021\nexport _REDIS_L_VERSION=7.x-3.19.1\nexport _REDIS_N_VERSION=com-19-04-2021\nexport _REDIS_T_VERSION=8.x-1.8.2\nexport _REDIS_E_VERSION=8.x-1.11.2\n\n###\n### Drupal Core Versions\n###\n\nexport _SMALLCORE10_0_V=10.0.11\nexport _SMALLCORE10_1_V=10.1.8\nexport _SMALLCORE10_2_V=10.2.12\nexport _SMALLCORE10_3_V=10.3.14\nexport _SMALLCORE10_4_V=10.4.9\nexport _SMALLCORE10_5_V=10.5.8\nexport _SMALLCORE10_6_V=10.6.3\nexport _SMALLCORE11_1_V=11.1.9\nexport _SMALLCORE11_2_V=11.2.10\nexport _SMALLCORE11_3_V=11.3.3\nexport _SMALLCORE6_V=6.60.1\nexport _SMALLCORE7_V=7.105.1\nexport _SMALLCORE9_V=9.5.11\n\n###\n### Drupal Core Variables\n###\n\nexport _DRUPAL10_0=\"drupal-${_SMALLCORE10_0_V}\"\nexport _DRUPAL10_1=\"drupal-${_SMALLCORE10_1_V}\"\nexport _DRUPAL10_2=\"drupal-${_SMALLCORE10_2_V}\"\nexport _DRUPAL10_3=\"drupal-${_SMALLCORE10_3_V}\"\nexport _DRUPAL10_4=\"drupal-${_SMALLCORE10_4_V}\"\nexport _DRUPAL10_5=\"drupal-${_SMALLCORE10_5_V}\"\nexport _DRUPAL10_6=\"drupal-${_SMALLCORE10_6_V}\"\nexport _DRUPAL11_1=\"drupal-${_SMALLCORE11_1_V}\"\nexport _DRUPAL11_2=\"drupal-${_SMALLCORE11_2_V}\"\nexport _DRUPAL11_3=\"drupal-${_SMALLCORE11_3_V}\"\nexport _DRUPAL6=\"pressflow-${_SMALLCORE6_V}\"\nexport _DRUPAL7=\"drupal-${_SMALLCORE7_V}\"\nexport _DRUPAL9=\"drupal-${_SMALLCORE9_V}\"\n\nexport _DRUPAL6_D=\"${_DRUPAL6}-dev\"\nexport _DRUPAL6_P=\"${_DRUPAL6}-prod\"\nexport _DRUPAL6_S=\"${_DRUPAL6}-stage\"\n\nexport _DRUPAL7_D=\"${_DRUPAL7}-dev\"\nexport _DRUPAL7_P=\"${_DRUPAL7}-prod\"\nexport _DRUPAL7_S=\"${_DRUPAL7}-stage\"\n\nexport _DRUPAL9_D=\"${_DRUPAL9}-dev\"\nexport _DRUPAL9_P=\"${_DRUPAL9}-prod\"\nexport _DRUPAL9_S=\"${_DRUPAL9}-stage\"\n\nexport _DRUPAL10_0_D=\"${_DRUPAL10_0}-dev\"\nexport _DRUPAL10_0_P=\"${_DRUPAL10_0}-prod\"\nexport _DRUPAL10_0_S=\"${_DRUPAL10_0}-stage\"\n\nexport _DRUPAL10_1_D=\"${_DRUPAL10_1}-dev\"\nexport _DRUPAL10_1_P=\"${_DRUPAL10_1}-prod\"\nexport _DRUPAL10_1_S=\"${_DRUPAL10_1}-stage\"\n\nexport _DRUPAL10_2_D=\"${_DRUPAL10_2}-dev\"\nexport _DRUPAL10_2_P=\"${_DRUPAL10_2}-prod\"\nexport _DRUPAL10_2_S=\"${_DRUPAL10_2}-stage\"\n\nexport _DRUPAL10_3_D=\"${_DRUPAL10_3}-dev\"\nexport _DRUPAL10_3_P=\"${_DRUPAL10_3}-prod\"\nexport _DRUPAL10_3_S=\"${_DRUPAL10_3}-stage\"\n\nexport _DRUPAL10_4_D=\"${_DRUPAL10_4}-dev\"\nexport _DRUPAL10_4_P=\"${_DRUPAL10_4}-prod\"\nexport _DRUPAL10_4_S=\"${_DRUPAL10_4}-stage\"\n\nexport _DRUPAL10_5_D=\"${_DRUPAL10_5}-dev\"\nexport _DRUPAL10_5_P=\"${_DRUPAL10_5}-prod\"\nexport _DRUPAL10_5_S=\"${_DRUPAL10_5}-stage\"\n\nexport _DRUPAL10_6_D=\"${_DRUPAL10_6}-dev\"\nexport _DRUPAL10_6_P=\"${_DRUPAL10_6}-prod\"\nexport _DRUPAL10_6_S=\"${_DRUPAL10_6}-stage\"\n\nexport _DRUPAL11_1_D=\"${_DRUPAL11_1}-dev\"\nexport _DRUPAL11_1_P=\"${_DRUPAL11_1}-prod\"\nexport _DRUPAL11_1_S=\"${_DRUPAL11_1}-stage\"\n\nexport _DRUPAL11_2_D=\"${_DRUPAL11_2}-dev\"\nexport _DRUPAL11_2_P=\"${_DRUPAL11_2}-prod\"\nexport _DRUPAL11_2_S=\"${_DRUPAL11_2}-stage\"\n\nexport _DRUPAL11_3_D=\"${_DRUPAL11_3}-dev\"\nexport _DRUPAL11_3_P=\"${_DRUPAL11_3}-prod\"\nexport _DRUPAL11_3_S=\"${_DRUPAL11_3}-stage\"\n\nexport _SPINNER=NO\nexport _T_BUILD=SRC\nexport _USRG=users\nexport _WEBG=www-data\n\nif [ -n \"${STY+x}\" ]; then\n export _SPINNER=NO\nfi\n\nexport _F_TIME=\"$(date)\"\n\n\n###\n### Instance specific variables\n###\nexport _WEB=\"${_USER}.web\"\nexport _DOMAIN=\"${_USER}.$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\nexport _ROOT=\"/data/disk/${_USER}\"\nexport _THIS_DB_PORT=3306\nexport _octCnf=\"/root/.${_USER}.octopus.cnf\"\nexport _octInc=\"${_ROOT}/config/includes\"\nexport _octTpl=\"${_ROOT}/.drush/sys/provision/http/Provision/Config/Nginx\"\nexport _octSetTpl=\"${_ROOT}/.drush/sys/provision/Provision/Config/Drupal\"\n\n\n###\n### Helper variables\n###\nexport _bldPth=\"/opt/tmp/boa\"\nexport _crlGet=\"-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab\"\nexport _wgetGet=\"--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'\"\nexport _filIncO=\"octopus.sh.cnf\"\nexport _gCb=\"git clone --branch\"\nexport _gitHub=\"https://github.com/omega8cc\"\nexport _gitLab=\"https://gitlab.com/omega8cc\"\nexport _libFnc=\"${_bldPth}/lib/functions\"\nexport _tocIncO=\"${_filIncO}.${_USER}\"\nexport _vBs=\"/var/backups\"\n\n\n###\n### Avoid too many questions\n###\nexport DEBIAN_FRONTEND=noninteractive\nexport APT_LISTCHANGES_FRONTEND=none\nif [ -z \"${TERM+x}\" ]; then\n export TERM=vt100\nfi\n\n\n###\n### Clean pid files on exit\n###\n_clean_pid_exit() {\n if [ -n \"${1}\" ]; then\n echo \"REASON ${1} on $(date)\" >> /root/.octopus.sh.exit.exceptions.log\n [ -e \"/opt/tmp/boa\" ] && rm -rf /opt/tmp/*\n fi\n [ -e \"/run/boa_wait.pid\" ] && rm -f /run/boa_wait.pid\n [ -e \"/run/boa_run.pid\" ] && rm -f /run/boa_run.pid\n service cron start &> /dev/null\n exit 1\n}\n\n\n###\n### Panic on missing include\n###\n_panic_exit() {\n echo\n echo \" EXIT: Required lib file not available?\"\n echo \" EXIT: $1\"\n echo \" EXIT: Cannot continue\"\n echo \" EXIT: Bye (0)\"\n echo\n _clean_pid_exit _panic_exit_a\n}\n\n\n###\n### Include default settings and basic functions\n###\nif [ -e \"${_vBs}/${_tocIncO}\" ]; then\n source \"${_vBs}/${_tocIncO}\"\n _tInc=\"${_vBs}/${_tocIncO}\"\nelif [ -e \"${_vBs}/${_filIncO}\" ]; then\n source \"${_vBs}/${_filIncO}\"\n _tInc=\"${_vBs}/${_filIncO}\"\nelse\n _panic_exit \"${_tInc}\"\nfi\n\n\n###\n### Download helpers and libs\n###\nif [ \"${_OS_CODE}\" = \"excalibur\" ]; then\n _DB_SERVER=Percona\nelse\n _DB_SERVER=Percona\nfi\nif [ \"$(boa info | grep -c ${_DB_SERVER})\" -lt 3 ] || [ ! -e \"/usr/sbin/csf\" ]; then\n if [ ! -e \"/opt/tmp/boa/aegir/helpers/apt.conf.noi.nrml\" ] \\\n || [ ! -e \"/opt/tmp/boa/aegir/helpers/apt.conf.noi.dist\" ]; then\n _download_helpers_libs\n fi\nelse\n _download_helpers_libs\nfi\n\n\n###\n### Include shared functions\n###\n_FL=\"helper dns satellite\"\nfor f in ${_FL}; do\n [ -r \"${_libFnc}/${f}.sh.inc\" ] || _panic_exit \"${f}\"\n source \"${_libFnc}/${f}.sh.inc\"\ndone\n\n\n###\n### Welcome msg\n###\necho \" \"\n_msg \"Skynet Agent v.${_X_VERSION} on $(dmidecode -s system-manufacturer 2>&1) welcomes you aboard!\"\necho \" \"\nsleep 3\n\n\n###\n### Turn Off AppArmor while running octopus\n###\n_turn_off_apparmor_in_octopus\n\n\n###\n### Unlock sendmail for allow-snail group\n###\n_unlock_sendmail_for_snail\n\n\n###\n### Switch to dash while running octopus\n###\n_switch_to_dash_in_octopus\n\n\n###\n### More local default variables\n###\n_LASTNUM=001\n_LAST_HMR=001\n_LAST_ALL=001\n_DISTRO=001\n_HM_DISTRO=001\n_ALL_DISTRO=001\n_STATUS=INIT\n\n\n###\n### Misc checks\n###\n_satellite_check_php_compatibility\n_satellite_check_octopus_vs_barracuda_ver\n_satellite_if_head_github_connection_test\n_satellite_if_sql_exception_test\n_satellite_if_running_as_root_octopus\n_satellite_check_sanitize_user_name\n_satellite_if_localhost_mode_magic\n_satellite_check_sanitize_domain_name\n_satellite_detect_vm_family\n_check_git_repos\n\n\n###\n### Main procedures\n###\n_satellite_cnf\n_satellite_if_init_or_upgrade\n_satellite_if_major_upgrade\n_satellite_if_check_dns\n_satellite_checkpoint\n_satellite_pre_cleanup\n_satellite_make\n_satellite_post_cleanup\nexit 0\n\n\n###----------------------------------------###\n###\n### Octopus Ægir Installer\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n###----------------------------------------###\n" }, { "path": "README.md", "content": "# Welcome to BOA!\n\nBOA stands for Barracuda, Octopus, and Ægir—a high-performance LEMP stack supporting Drupal from Pressflow 6 to the latest Drupal 11, as well as Backdrop CMS and Grav CMS (soon).\n\n## Strap in, your sites are getting an F1 engine\n\nWe’re rolling out a meaningful upgrade across BOA/Omega8.cc nodes: HTTP/3 and KTLS support. If you run Drupal sites that should feel fast and responsive (and stay that way during spikes), this is genuinely good news. Why this is a big deal? What visitors should notice? Why it matters for *your server* too [**Read the full story!**](https://github.com/omega8cc/boa/tree/5.x-dev/HTTP3.md)\n\n## 30 Years of Heritage\n\nWe are unique within the hosting industry for many important reasons. Our 15 years of Ægir-based hosting, plus earlier experience with Adgrafix (the first company to offer a control panel for website management in 1995), have helped shape what makes us different today. We take **Open Source seriously** — it’s not a buzzword for us. It’s about freedom from corporate control. Here's a short look back at our 15-year Ægir journey and 19 years with Drupal. [**Read the full story!**](https://github.com/omega8cc/boa/tree/5.x-dev/DIFFERENT30Y.md)\n\n## What is Ægir?\n\nÆgir, named after the Norse god of the sea, is an open-source hosting system for managing multiple Drupal sites. The name Ægir was chosen to reflect the relationship between Drupal's water drop logo, symbolizing individual sites, and Ægir's role as the god of the ocean, representing the hosting of many Drupal sites together. It automates tasks such as site installation, upgrades, and maintenance, making your life easier.\n\n**Announcement from Omega8.cc team**: [**The Future of Ægir 3 is Bryght!**](https://github.com/omega8cc/boa/tree/5.x-dev/ANNOUNCEMENT.md)\n\n### Key Features of Ægir:\n\n- **Site Management**: Manage multiple Drupal sites from a single interface.\n- **Automation**: Automate code deployment, database updates, and site backups.\n- **Scalability**: Easily scale your Drupal hosting infrastructure.\n- **Multitenancy**: Share a codebase across multiple sites with separate databases.\n- **Open-Source**: Customize and extend Ægir to fit your needs.\n- **Integration with Drush**: Use powerful command-line tools for site administration.\n\n\"Ægir-BOA\"\n\n## Why Barracuda?\n\nBarracuda is a specially tuned hosting environment for Ægir, designed to be lightning fast and agile, just like the barracuda fish known for its incredible speed and agility in the ocean.\n\n## Why Octopus?\n\nOctopus is a smart system designed to manage multiple Ægir instances within Barracuda. Just like the sea creature with eight limbs, Octopus allows you to create and manage many separate but connected Ægir instances, showcasing its intelligence and adaptability in efficiently handling complex hosting environments.\n\n## Dual License\n\n**BOA** remains a **Free/Libre Open Source Project**. While all of **BOA** code is **Free/Libre Open Source**, only the **BOA LTS** branch and **Ægir** are available without any cost or restrictions.\n\nCheck out the details in [**DUALLICENSE.md**](https://github.com/omega8cc/boa/tree/5.x-dev/DUALLICENSE.md).\n\n## BOA Priorities\n\n- **High Performance**: Ensure your sites run fast.\n- **Security**: Keep your sites and system secure.\n- **Automation**: Minimize daily maintenance with automated system and OS upgrades.\n\n## Multi-Ægir Hosting\n\nLeverage one Ægir Master Instance and multiple Satellite Instances. Use Satellite Instances to host your sites, as the Master holds the central Nginx configuration. Note: The 'Master' and 'Satellite' names in the Barracuda/Octopus context are not related to the multi-server Ægir features but to the multi-instance environment with virtual chroot/jail for each Ægir Satellite instance.\n\n## Installation Scripts\n\n- **BOA**: Runs Barracuda and Octopus to install complete BOA system.\n- **BARRACUDA**: Upgrades the system and the Ægir Master Instance.\n- **OCTOPUS**: Updates Ægir Instances + Drupal platforms.\n\n## Bug Reporting\n\nFollow the guidelines in [**docs/CONTRIBUTING.md**](https://github.com/omega8cc/boa/tree/5.x-dev/docs/CONTRIBUTING.md).\n\n## Requirements\n\n- Basic sysadmin skills and experience.\n- Willingness to accept BOA PI (paranoid idiosyncrasies).\n- Minimum 4 GB RAM and 2 CPUs (8 GB RAM and 4+ CPUs with Solr).\n- SSH (ed25519) keys for root are required by newer OpenSSH versions used in BOA.\n- Wget must be installed.\n- Open outgoing TCP ports: 25, 53, 80, 443.\n- Locales with UTF-8 support, otherwise en_US.UTF-8 (default) is forced.\n\n## Provided Services and Features\n\nCheck out the details in [**docs/PROVIDES.md**](https://github.com/omega8cc/boa/tree/5.x-dev/docs/PROVIDES.md).\n\n## Supported Virtualization Systems\n\n- Linux Containers (LXC)\n- Linux KVM guest\n- Microsoft Hyper-V\n- OpenVZ Containers\n- Parallels guest\n- Red Hat KVM guest\n- VirtualBox guest\n- VMware ESXi guest (but excluding vCloud Air)\n- VServer guest\n- Xen guest\n- Xen guest fully virtualized (HVM)\n- Xen paravirtualized guest domain\n\n## Supported Operating Systems\n\n\"boa-on-excalibur\"\n\n### Devuan (recommended)\n\n- Excalibur (supported, but only with Percona 8.4)\n- Daedalus (default, with Percona 5.7, 8.0 or 8.4)\n- Chimaera (supported but upgrade recommended)\n- Beowulf (supported for upgrades)\n\n### Debian (for migration)\n\n- Trixie (supported only as a base for migration to Devuan)\n- Bookworm (supported only as a base for migration to Devuan)\n- Bullseye (supported only as a base for migration to Devuan)\n- Buster (supported only as a base for migration to Devuan)\n- Stretch (deprecated but still works, please upgrade to Chimaera)\n- Jessie (deprecated but still works, please upgrade to Chimaera)\n\n## Project Roadmap\n\nCheck out the details in [**ROADMAP.md**](https://github.com/omega8cc/boa/tree/5.x-dev/ROADMAP.md)\n\n## Documentation and Templates\n\n- Installation Instructions: [docs/INSTALL.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/INSTALL.md)\n- Upgrade Instructions: [docs/UPGRADE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/UPGRADE.md)\n- Major-Upgrade Instructions: [docs/MAJORUPGRADE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/MAJORUPGRADE.md)\n- Importance of Keeping SKYNET Enabled in BOA: [docs/SKYNET.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SKYNET.md)\n- INI configuration per site: [docs/ini/site/INI.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/ini/site/INI.md)\n- INI configuration per platform: [docs/ini/platform/INI.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/ini/platform/INI.md)\n- Configuration Templates: [docs/cnf/barracuda.cnf](https://github.com/omega8cc/boa/tree/5.x-dev/docs/cnf/barracuda.cnf), [docs/cnf/octopus.cnf](https://github.com/omega8cc/boa/tree/5.x-dev/docs/cnf/octopus.cnf)\n- System Control Files Index: [docs/ctrl/system.ctrl](https://github.com/omega8cc/boa/tree/5.x-dev/docs/ctrl/system.ctrl)\n- How we build newer codebases for testing: [docs/BUILDTESTS.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BUILDTESTS.md)\n\n## Documentation for BOA PRO\n\n- New Backups for BOA SysAdmin [docs/BACKUP_ROOT.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BACKUP_ROOT.md)\n- New Backups for Octopus Lshell User [docs/BACKUP_USER.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BACKUP_USER.md)\n- New Backups Retention Policy Configuration [docs/BACKUP_RETENTION.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BACKUP_RETENTION.md)\n- Supported Regions and Bucket Creation Guidelines [docs/BACKUP_REGIONS.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BACKUP_REGIONS.md)\n\n## Additional Documentation\n\n- Composer How-To: [docs/COMPOSER.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/COMPOSER.md)\n- Dev-Mode Notes: [docs/DEVELOPMENT.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/DEVELOPMENT.md)\n- Drupal Contrib Modules: [docs/MODULES.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/MODULES.md)\n- Extra Comments: [docs/CAVEATS.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/CAVEATS.md)\n- FAQ: [docs/FAQ.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/FAQ.md)\n- Fast DB Operations: [docs/MYQUICK.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/MYQUICK.md)\n- Fast Migrate/Clone: [docs/FASTTRACK.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/FASTTRACK.md)\n- Included Platforms: [docs/PLATFORMS.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/PLATFORMS.md)\n- Let’s Encrypt: [docs/SSL.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SSL.md)\n- Live Disk Resize How-To: [docs/DISK_RESIZE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/DISK_RESIZE.md)\n- Migration (Octopus Instance): [docs/MIGRATE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/MIGRATE.md)\n- Migration (Single Site): [docs/REMOTE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/REMOTE.md)\n- New Relic How-To: [docs/NEWRELIC.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/NEWRELIC.md)\n- Nginx Custom Rewrites: [docs/REWRITES.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/REWRITES.md)\n- PHP-CLI and Drush Configuration How-To: [docs/DRUSH-CLI.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/DRUSH-CLI.md)\n- PHP-FPM Configuration How-To: [docs/PHP-FPM.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/PHP-FPM.md)\n- Remote S3 Backups: [docs/BACKUPS.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BACKUPS.md)\n- Ruby Gems and NPM: [docs/GEM.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/GEM.md)\n- Security Settings: [docs/SECURITY.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SECURITY.md)\n- Self-Upgrade How-To: [docs/SELFUPGRADE.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SELFUPGRADE.md)\n- SMTP SSL Error Debugging: [docs/SMTP_SSL_DEBUG.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SMTP_SSL_DEBUG.md)\n- Solr and Jetty How-To: [docs/SOLR.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/SOLR.md)\n- SSH Encryption: [docs/BLOWFISH.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/BLOWFISH.md)\n- VServer Cluster: [docs/CLUSTER.md](https://github.com/omega8cc/boa/tree/5.x-dev/docs/CLUSTER.md) (deprecated)\n\n## Useful Links\n\n- BOA User Handbook (legacy): [**Learn BOA**](https://learn.omega8.cc/library/good-to-know)\n- Ægir Docs (legacy): [**Ægir Project**](https://docs.aegirproject.org)\n\n## Maintainers\n\nBOA is maintained by [**Omega8.cc**](https://omega8.cc/about).\n\n## Credits\n\nThanks to the Ægir Project founders and developers. [**Ægir Team**](https://docs.aegirproject.org/community/core-team/).\n\n## Support\n\nSupport BOA development by purchasing a commercial license or using Omega8.cc hosted services. Check out [**Omega8.cc**](https://omega8.cc/compare) for more info.\n\nThank you for supporting BOA!\n" }, { "path": "ROADMAP.md", "content": "# BOA Roadmap & Progress\n\nDocumenting ongoing, upcoming and completed tasks. Some tasks are relatively simple, while others are major undertakings that take weeks or months. Therefore, we are working on many things simultaneously.\n\nThis document highlights the most complex or important tasks we are working on or planning to undertake. Routine tasks such as debugging, fixing issues, and implementing small improvements are usually documented in the commit history and changelog, which are updated with each new BOA release.\n\nSeveral of the upcoming and most impactful features are planned **exclusively for BOA PRO**, as outlined below.\n\nPlease also note that **as of December 31, 2025, the LTS branch will enter a full code-freeze**. No further feature development or regular releases are planned for 2026. A possible re-evaluation may occur in 2027, but this should not be assumed.\n\nAfter the freeze, **only critical functional fixes within BOA itself will be considered**. There will be **no updates** for underlying components such as PHP, Percona, Nginx, Valkey, OpenSSL, OpenSSH, or related system libraries.\n\nFor continued access to new features, ongoing improvements, and a future-proof stack, **BOA PRO is the recommended upgrade path**.\n\n## IN PROGRESS (PRO only)\n\n- **Import from Classic Ægir**: Extend xboa to import from remote classic Ægir servers using Nginx or Apache (PRO)\n- **Backdrop CMS Support**: Implement Backdrop CMS as a supported platform (PRO)\n- **Grav CMS Support**: Introduce support for Grav CMS (command line only) (PRO)\n- **Optional AppArmor Support**: Enhanced security and accounts privilege separation (PRO)\n- **Tar Pipelines on Clone**: Use Tar Pipelines to create separate symlinked copies during site clone tasks (PRO)\n- **Ægir Admin Interface**: Transition the Ægir admin interface to Backdrop CMS (PRO)\n- **BO4D**: Offer a *BOA For Docker* version tailored for local development (PRO)\n- **DDEV Integration**: Add support for BOA-compatible configurations within DDEV (PRO)\n- **Documentation Consolidation**: Convert legacy and built-in docs into a unified Grav CMS site. (PRO)\n\n## RELEASED IN BOA PRO only\n\n- **Amazon S3 Alternatives**: Integrate support for AWS S3 eight (8) alternatives in `multiback` and `mybackup` (PRO)\n\n## MAJOR NEW FEATURES RELEASED IN BOA LTS/PRO\n\n- **HTTP/3 on QUIC with KTLS Magic**: Strap in, your sites are getting an F1 engine (PRO/LTS)\n- **Drupal 11 with Ægir 3**: They Said It Couldn’t Be Done — We Did It Anyway (PRO/LTS)\n- **Debian Trixie and Devuan Excalibur**: Ensure compatibility for installation and automated upgrades (PRO/LTS)\n- **Debian Bookworm and Devuan Daedalus**: Ensure compatibility for installation and automated upgrades (PRO/LTS)\n- **Percona for MySQL 8.4**: Add support for Percona Server 8.4, the new Percona LTS (PRO/LTS)\n- **Original MySQL 8.4**: Add support for original MySQL Server 8.4 on Trixie/Excalibur (PRO/LTS)\n- **Percona for MySQL 8.0**: Add support for Percona Server 8.0, necessary for Drupal 11 (PRO/LTS)\n- **Super Fast System AutoInit**: Facilitate easy upgrades to the latest Devuan before BOA installation (PRO/LTS)\n- **Use OpenSSL 3 by default**: Maintain compatibility with OpenSSL 1.1.1 for legacy PHP versions (PRO/LTS)\n\n## OTHER NEW FEATURES RELEASED IN BOA LTS/PRO\n\n- **PHP 8.5 Support**: Enhancing performance and supporting twelve PHP versions (PRO/LTS)\n- **PHP 8.4 Support**: Enhancing performance and supporting eleven PHP versions (PRO/LTS)\n- **PHP 8.3 Support**: Required for Drupal 11, enhancing performance and supporting ten PHP versions (PRO/LTS)\n- **Add instant SQL fallback for Valkey/Redis**: zero downtime during upgrades/restarts/etc\n- **Symlink Site Files**: Automatically symlink all site files to expedite migration tasks and conserve disk space (PRO/LTS)\n- **Solr 9 Support**: Add latest Solr Server 9 as supported via BOA automation (PRO/LTS)\n- **Ruby Gems and Node/NPM Support 3x Faster**: From 15 to 5 minutes, with improved security (PRO/LTS)\n- **Ægir Task for SQL Backup**: Enable classic mysqldump backups for individual site downloads (PRO/LTS)\n- **Drush 12/13 in Ægir Tasks**: Dynamically Utilize Site-Local Drush for `updatedb` Operations on Drupal 10+ (PRO/LTS)\n- **Documentation Conversion to Markdown**: Update all BOA documentation from legacy TXT to Markdown.\n" }, { "path": "aegir/conf/apparmor/opt.php56.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php56) to essential operations only.\n\n#include \n\n/opt/php56/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php56/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php56/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php56.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php56) to essential operations only.\n\n#include \n\n/opt/php56/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php56/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php56/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php70.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php70) to essential operations only.\n\n#include \n\n/opt/php70/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php70/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php70/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php70.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php70) to essential operations only.\n\n#include \n\n/opt/php70/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php70/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php70/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php71.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php71) to essential operations only.\n\n#include \n\n/opt/php71/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php71/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php71/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php71.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php71) to essential operations only.\n\n#include \n\n/opt/php71/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php71/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php71/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php72.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php72) to essential operations only.\n\n#include \n\n/opt/php72/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php72/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php72/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php72.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php72) to essential operations only.\n\n#include \n\n/opt/php72/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php72/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php72/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php73.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php73) to essential operations only.\n\n#include \n\n/opt/php73/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php73/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php73/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php73.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php73) to essential operations only.\n\n#include \n\n/opt/php73/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php73/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php73/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php74.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php74) to essential operations only.\n\n#include \n\n/opt/php74/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php74/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php74/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php74.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php74) to essential operations only.\n\n#include \n\n/opt/php74/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php74/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php74/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php80.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php80) to essential operations only.\n\n#include \n\n/opt/php80/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php80/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php80/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php80.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php80) to essential operations only.\n\n#include \n\n/opt/php80/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php80/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php80/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php81.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php81) to essential operations only.\n\n#include \n\n/opt/php81/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php81/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php81/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php81.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php81) to essential operations only.\n\n#include \n\n/opt/php81/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php81/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php81/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php82.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php82) to essential operations only.\n\n#include \n\n/opt/php82/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php82/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php82/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php82.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php82) to essential operations only.\n\n#include \n\n/opt/php82/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php82/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php82/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php83.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php83) to essential operations only.\n\n#include \n\n/opt/php83/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php83/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php83/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php83.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php83) to essential operations only.\n\n#include \n\n/opt/php83/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php83/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php83/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php84.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php84) to essential operations only.\n\n#include \n\n/opt/php84/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php84/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php84/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php84.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php84) to essential operations only.\n\n#include \n\n/opt/php84/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php84/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php84/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php85.bin.php", "content": "# AppArmor profile for PHP-CLI\n# This profile restricts PHP-CLI (php85) to essential operations only.\n\n#include \n\n/opt/php85/bin/php flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by PHP-CLI\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability mknod,\n capability setgid,\n capability setuid,\n capability sys_ptrace,\n capability sys_resource,\n\n # Allow PHP-CLI to execute its own binary\n /opt/php85/bin/php mrix,\n\n # Allow PHP-CLI to signal/ptrace other processes\n ptrace (read) peer=/opt/php*/bin/php,\n signal (send) peer=unconfined,\n signal (send) peer=/usr/sbin/nginx,\n ptrace (read) peer=/opt/php*/sbin/php-fpm,\n ptrace (read) peer=/usr/bin/mysqld_safe,\n ptrace (read) peer=/usr/bin/redis-server,\n ptrace (read) peer=/usr/local/sbin/pure-ftpd,\n ptrace (read) peer=/usr/sbin/nginx,\n ptrace (read) peer=/usr/sbin/rsyslogd,\n ptrace (read) peer=/usr/sbin/unbound,\n ptrace (read) peer=unconfined,\n\n # Allow PHP-CLI to read required configuration files\n /data/disk/*/.subversion/ r,\n /data/disk/*/.subversion/* r,\n /etc/default/nginx r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/ldap/ldap.conf r,\n /etc/mailname r,\n /etc/mysql/conf.d/ r,\n /etc/mysql/conf.d/* r,\n /etc/mysql/my.cnf r,\n /etc/newrelic/upgrade_please.key r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/main.cf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /etc/subversion/ r,\n /etc/subversion/* r,\n /etc/wgetrc r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /usr/local/share/git-core/templates/ r,\n /usr/local/share/git-core/templates/* r,\n /usr/local/share/git-core/templates/** r,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /opt/php85/** r,\n\n # Allow PHP-CLI to read required user/access files\n /etc/login.defs r,\n /etc/pam.d/* r,\n /etc/passwd r,\n /etc/security/capability.conf r,\n /etc/security/limits.conf r,\n /etc/security/limits.d/ r,\n /etc/security/limits.d/* r,\n /etc/shadow r,\n /etc/sudo.conf r,\n /etc/sudoers r,\n /etc/sudoers.d/ r,\n /etc/sudoers.d/* r,\n /run/sudo/ts/ r,\n /run/sudo/ts/* r,\n\n # Allow PHP-CLI to execute some other binaries\n /usr/bin/symlinks mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/chown mrix,\n /bin/cp mrix,\n /bin/dash mrix,\n /bin/date mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/kmod mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/pidof mrix,\n /bin/rm mrix,\n /bin/run-parts mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /opt/local/bin/websh mrix,\n /data/disk/*/**/vendor/drush/drush/drush.php mrix,\n /etc/init.d/nginx mrix,\n /sbin/killall5 mrix,\n /sbin/unix_chkpwd mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/magick mrix,\n /usr/bin/mysql mrix,\n /usr/bin/patch mrix,\n /usr/bin/sudo mrix,\n /usr/bin/svn mrix,\n /usr/bin/tput mrix,\n /usr/bin/tr mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which mrix,\n /usr/bin/which.debianutils mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/fix-drupal-platform-ownership.sh mrix,\n /usr/local/bin/fix-drupal-platform-permissions.sh mrix,\n /usr/local/bin/fix-drupal-site-ownership.sh mrix,\n /usr/local/bin/fix-drupal-site-permissions.sh mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/lock-local-drush-permissions.sh mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/local/libexec/git-core/* mrix,\n /usr/local/libexec/git-core/** mrix,\n /usr/sbin/nginx mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-CLI to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty rw,\n /dev/urandom r,\n\n # Allow PHP-CLI to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-CLI to read and write its log files\n /var/log/php/** rw,\n /var/log/newrelic/php_agent.log rw,\n\n # Allow PHP-CLI to write to some other log/pid files\n /run/nginx.pid rw,\n /var/log/nginx/access.log rw,\n /var/log/nginx/error.log rw,\n\n # Allow PHP-CLI to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Allow PHP-CLI to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-CLI to access drush\n /data/disk/*/tools/drush/ r,\n /data/disk/*/tools/drush/* mrix,\n /data/disk/*/tools/drush/** r,\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n /var/aegir/drush/ r,\n /var/aegir/drush/* mrix,\n /var/aegir/drush/** r,\n\n # Allow PHP-CLI to access System Default Web Root\n\n /var/www/** r,\n owner /var/www/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Master Instance\n\n owner /var/aegir/.drush/ r,\n owner /var/aegir/.drush/* rw,\n owner /var/aegir/.drush/** rw,\n owner /var/aegir/.tmp/ r,\n owner /var/aegir/.tmp/* rw,\n owner /var/aegir/.tmp/** rw,\n owner /var/aegir/config/ r,\n owner /var/aegir/config/* rw,\n owner /var/aegir/config/** rw,\n owner /var/aegir/host_master-*/ r,\n owner /var/aegir/host_master-*/* rw,\n owner /var/aegir/host_master-*/** rw,\n owner /var/aegir/host_master/ r,\n owner /var/aegir/host_master/* rw,\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/ r,\n owner /var/aegir/platforms/* rw,\n owner /var/aegir/platforms/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Backend on Octopus Instances\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n /data/disk/*/.bashrc r,\n\n owner /data/disk/*/.cache/**/pack-* l,\n owner /data/disk/*/static/**/pack-* l,\n\n owner /data/disk/*/log/ r,\n owner /data/disk/*/log/* rw,\n owner /data/disk/*/.*.pass.php r,\n owner /data/disk/*/.rnd rw,\n\n owner /data/disk/*/backups/ rwl,\n owner /data/disk/*/backups/* rwl,\n owner /data/disk/*/backups/** rwl,\n\n owner /data/disk/*/backup-exports/ rwl,\n owner /data/disk/*/backup-exports/* rwl,\n owner /data/disk/*/backup-exports/** rwl,\n\n owner /data/disk/*/.config/ rwl,\n owner /data/disk/*/.config/* rwl,\n owner /data/disk/*/.config/** rwl,\n\n owner /data/disk/*/.cache/ rwl,\n owner /data/disk/*/.cache/* rwl,\n owner /data/disk/*/.cache/** rwl,\n\n owner /data/disk/*/.drush/ rwl,\n owner /data/disk/*/.drush/* rwl,\n owner /data/disk/*/.drush/** rwl,\n\n owner /data/disk/*/.tmp/ rwl,\n owner /data/disk/*/.tmp/* rwl,\n owner /data/disk/*/.tmp/** rwl,\n\n owner /data/disk/*/clients/ rw,\n owner /data/disk/*/clients/* rw,\n owner /data/disk/*/clients/** rw,\n\n owner /data/disk/*/config/ rw,\n owner /data/disk/*/config/* rw,\n owner /data/disk/*/config/** rw,\n\n owner /data/disk/*/tools/le/ rw,\n owner /data/disk/*/tools/le/* rw,\n owner /data/disk/*/tools/le/** rw,\n\n # Allow PHP-CLI to read/write in the Ægir Frontend on Octopus Instances\n\n owner /data/disk/*/aegir/ rw,\n owner /data/disk/*/aegir/* rw,\n owner /data/disk/*/aegir/** rw,\n\n # Allow PHP-CLI to read/write in the limited shell user home for Drush support\n\n owner /home/*/.drush/sites/ rw,\n owner /home/*/.drush/sites/* rw,\n owner /home/*/.drush/sites/** rw,\n\n owner /home/*/.drush/cache/ rw,\n owner /home/*/.drush/cache/* rw,\n owner /home/*/.drush/cache/** rw,\n\n owner /home/*/.tmp/ rw,\n owner /home/*/.tmp/* rw,\n owner /home/*/.tmp/** rw,\n\n # Allow PHP-CLI to read/write in the custom web root directories\n\n /data/disk/*/static/ rw,\n /data/disk/*/static/* rw,\n /data/disk/*/static/** rw,\n\n /data/disk/*/distro/ rw,\n /data/disk/*/distro/* rw,\n /data/disk/*/distro/** rw,\n\n /data/disk/*/platforms/ rw,\n /data/disk/*/platforms/* rw,\n /data/disk/*/platforms/** rw,\n\n # Allow PHP-CLI to read and write in the root tmp\n\n owner /root/.tmp/ rw,\n owner /root/.tmp/* rw,\n owner /root/.tmp/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/opt.php85.sbin.php-fpm", "content": "# AppArmor profile for PHP-FPM\n# This profile restricts the PHP-FPM (php85) to essential operations only.\n\n#include \n\n/opt/php85/sbin/php-fpm flags=(attach_disconnected) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by PHP-FPM\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability kill,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n # Allow PHP-FPM to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n network inet stream,\n network inet6 stream,\n\n # Allow PHP-FPM to execute its own binary\n /opt/php85/sbin/php-fpm mrix,\n\n # Allow PHP-FPM to read its configuration files\n /data/conf/ r,\n /data/conf/** r,\n /etc/ImageMagick-6/log.xml r,\n /etc/ImageMagick-6/policy.xml r,\n /etc/ld.so.cache r,\n /etc/mailname r,\n /etc/newrelic/upgrade_please.key r,\n /etc/postfix/dynamicmaps.cf r,\n /etc/postfix/dynamicmaps.cf.d/ r,\n /etc/postfix/dynamicmaps.cf.d/* r,\n /etc/postfix/main.cf r,\n /home/*/.drush/** r,\n /opt/etc/fpm/** r,\n /var/spool/postfix/maildrop/ r,\n /var/spool/postfix/maildrop/* rw,\n /opt/php85/** r,\n\n # Allow PHP-FPM to execute some other binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/advdef mrix,\n /usr/bin/advpng mrix,\n /usr/bin/chromium mrix,\n /usr/bin/convert mrix,\n /usr/bin/id mrix,\n /usr/bin/jpegoptim mrix,\n /usr/bin/jpegtran mrix,\n /usr/bin/magick mrix,\n /usr/bin/optipng mrix,\n /usr/bin/pngcrush mrix,\n /usr/bin/pngquant mrix,\n /usr/lib/postfix/sbin/smtpd mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/wkhtmltoimage mrix,\n /usr/local/bin/wkhtmltopdf mrix,\n /usr/sbin/postdrop mrix,\n /usr/sbin/sendmail mrix,\n\n # Allow PHP-FPM to access some /dev\n /dev/null rw,\n /dev/random r,\n /dev/tty wr,\n /dev/urandom r,\n\n # Allow PHP-FPM to access its run directory\n /run/** rw,\n\n # Allow PHP-FPM to use tmp files\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow PHP-FPM to read and write its log files\n /var/log/newrelic/php_agent.log rw,\n /var/log/php/** rw,\n\n # Allow PHP-FPM to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow PHP-FPM to use /dev/shm for temporary storage\n /dev/shm/ r,\n /dev/shm/** rw,\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow PHP-FPM to read and write in the custom web root directories\n\n /var/www/** r,\n\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n /data/all/ r,\n /data/all/* r,\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n /data/conf/** r,\n\n owner /var/aegir/host_master/** rw,\n owner /var/aegir/platforms/** rw,\n\n owner /data/disk/*/aegir/** rw,\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n owner /var/www/** rw,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/sbin.dhclient", "content": "# AppArmor profile for DHCP dhclient\n# This profile restricts DHCP dhclient (dhclient) to essential operations only.\n\n#include \n\n/{,usr/}sbin/dhclient flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n\n # Capabilities needed by DHCP dhclient\n capability net_bind_service,\n capability net_raw,\n capability dac_override,\n capability net_admin,\n\n network packet,\n network raw,\n\n @{PROC}/[0-9]*/net/ r,\n @{PROC}/[0-9]*/net/** r,\n\n # dhclient wants to update its threads with functional names\n owner @{PROC}/@{pid}/task/[0-9]*/comm rw,\n\n /{,usr/}sbin/dhclient mrix,\n /{,usr/}bin/bash mrix,\n\n /etc/dhclient.conf r,\n /etc/dhcp/ r,\n /etc/dhcp/** r,\n\n /var/lib/dhcp{,3}/dhclient* lrw,\n /{,var/}run/dhclient*.pid lrw,\n /{,var/}run/dhclient*.lease* lrw,\n\n # NetworkManager\n /{,var/}run/nm*conf r,\n /{,var/}run/sendsigs.omit.d/network-manager.dhclient*.pid lrw,\n /{,var/}run/NetworkManager/dhclient*.pid lrw,\n /var/lib/NetworkManager/dhclient*.conf lrw,\n /var/lib/NetworkManager/dhclient*.lease* lrw,\n signal (receive) peer=/usr/sbin/NetworkManager,\n ptrace (readby) peer=/usr/sbin/NetworkManager,\n\n # connman\n /{,var/}run/connman/dhclient*.pid lrw,\n /{,var/}run/connman/dhclient*.leases lrw,\n\n # synce-hal\n /usr/share/synce-hal/dhclient.conf r,\n\n # if there is a custom script, let it run unconfined\n /etc/dhcp/dhclient-script Uxr,\n\n # The dhclient-script shell script sources other shell scripts rather than\n # executing them, so we can't just use a separate profile for dhclient-script\n # with 'Uxr' on the hook scripts. However, for the long-running dhclient3\n # daemon to run arbitrary code via /sbin/dhclient-script, it would need to be\n # able to subvert dhclient-script or write to the hooks.d directories. As\n # such, if the dhclient3 daemon is subverted, this effectively limits it to\n # only being able to run the hooks scripts.\n /{,usr/}sbin/dhclient-script Uxr,\n\n # Run the ELF executables under their own unrestricted profiles\n /usr/lib/NetworkManager/nm-dhcp-client.action Pxrm,\n /usr/lib/connman/scripts/dhclient-script Pxrm,\n\n # Support the new executable helper from NetworkManager.\n /usr/lib/NetworkManager/nm-dhcp-helper Pxrm,\n signal (receive) peer=/usr/lib/NetworkManager/nm-dhcp-helper,\n}\n\n# Profile for NetworkManager action\n/usr/lib/NetworkManager/nm-dhcp-client.action flags=(complain) {\n include \n include \n /usr/lib/NetworkManager/nm-dhcp-client.action mrix,\n\n /var/lib/NetworkManager/*lease r,\n signal (receive) peer=/usr/sbin/NetworkManager,\n ptrace (readby) peer=/usr/sbin/NetworkManager,\n network inet dgram,\n network inet6 dgram,\n}\n\n# Profile for NetworkManager helper\n/usr/lib/NetworkManager/nm-dhcp-helper flags=(complain) {\n include \n include \n /usr/lib/NetworkManager/nm-dhcp-helper mrix,\n\n /run/NetworkManager/private-dhcp rw,\n signal (send) peer=/sbin/dhclient,\n\n /var/lib/NetworkManager/*lease r,\n signal (receive) peer=/usr/sbin/NetworkManager,\n ptrace (readby) peer=/usr/sbin/NetworkManager,\n network inet dgram,\n network inet6 dgram,\n}\n\n# Profile for connman script\n/usr/lib/connman/scripts/dhclient-script flags=(complain) {\n include \n include \n /usr/lib/connman/scripts/dhclient-script mrix,\n network inet dgram,\n network inet6 dgram,\n}\n\n\n" }, { "path": "aegir/conf/apparmor/usr.bin.chromium", "content": "# File: /etc/apparmor.d/usr.bin.chromium\n\n#include \n\n/usr/bin/chromium flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n\n # Deny capability sys_ptrace\n deny capability sys_ptrace,\n\n # System paths chromium needs to operate\n /usr/bin/chromium mrix,\n /usr/lib/chromium/** mrix,\n\n # Temp usage\n owner /tmp/** rwk,\n owner /dev/shm/** rwk,\n\n # Proc/sys reads\n /proc/** r,\n /sys/** r,\n\n # Devices commonly accessed\n /dev/null rw,\n /dev/urandom r,\n /dev/random r,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Fonts + fontconfig\n /etc/fonts/** r,\n /usr/share/fonts/** r,\n /var/cache/fontconfig/** r,\n\n # Allow to read and write in the web root directories\n /var/www/** r,\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n\n owner /data/disk/*/distro/** rwk,\n owner /data/disk/*/platforms/** rwk,\n owner /data/disk/*/static/** rwk,\n owner /var/www/** rwk,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n}\n" }, { "path": "aegir/conf/apparmor/usr.bin.freshclam", "content": "# AppArmor profile for Freshclam service\n# This profile restricts Freshclam service (freshclam) to essential operations only.\n\n#include \n\n/usr/bin/freshclam flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n\n # Capabilities needed by Freshclam service\n capability chown,\n capability dac_override,\n capability net_admin,\n capability net_bind_service,\n capability setgid,\n capability setuid,\n\n network inet stream,\n network inet dgram,\n network inet6 stream,\n network inet6 dgram,\n\n # Allow execution of necessary shells and the freshclam binary\n /bin/dash mrix,\n /bin/bash mrix,\n /bin/sh mrix,\n /usr/bin/freshclam mrix,\n\n # Allow access to /dev\n /dev/log w,\n /dev/null rw,\n /dev/random r,\n /dev/urandom r,\n\n # Allow access to /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow access to temporary directories\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Deny access to samba specific directories\n deny /{,var/}run/samba/{gencache,unexpected}.tdb mrwlk,\n\n # Allow read access to ClamAV configuration files\n /etc/clamav/clamd.conf r,\n /etc/clamav/freshclam.conf r,\n /etc/clamav/onerrorexecute.d/* mr,\n /etc/clamav/onupdateexecute.d/* mr,\n /etc/clamav/virusevent.d/* mr,\n\n # Allow read access to SSL libraries\n /usr/local/ssl3/lib64/libcrypto.so.* mr,\n /usr/local/ssl3/lib64/libssl.so.* mr,\n /usr/local/ssl3/openssl.cnf r,\n\n # Allow access to ClamAV directories and files\n /var/lib/clamav/ r,\n /var/lib/clamav/** rwk,\n /var/log/clamav/* rwk,\n /{,var/}run/clamav/clamd.ctl rw,\n /{,var/}run/clamav/freshclam.pid w,\n\n # Allow reading filesystems information\n @{PROC}/filesystems r,\n\n # Allow read/write access to ClamAV user directories\n owner /home/*/.clamtk/db/ r,\n owner /home/*/.clamtk/db/** rwk,\n owner /home/*/.klamav/database/ r,\n owner /home/*/.klamav/database/** rwk,\n owner @{PROC}/[0-9]*/status r,\n\n # Deny access to sensitive files and directories\n deny /etc/shadow* rwlx,\n deny /etc/passwd* rwlx,\n deny /root/** rwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/usr.bin.man", "content": "# AppArmor profile for Man service\n# This profile restricts Man service (man) to essential operations only.\n\n#include \n\n/usr/bin/man flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n\n # Use a special profile when man calls anything groff-related. We only\n # include the programs that actually parse input data in a non-trivial\n # way, not wrappers such as groff and nroff, since the latter would need a\n # broader profile.\n /usr/bin/eqn mrCx -> &man_groff,\n /usr/bin/grap mrCx -> &man_groff,\n /usr/bin/pic mrCx -> &man_groff,\n /usr/bin/preconv mrCx -> &man_groff,\n /usr/bin/refer mrCx -> &man_groff,\n /usr/bin/tbl mrCx -> &man_groff,\n /usr/bin/troff mrCx -> &man_groff,\n /usr/bin/vgrind mrCx -> &man_groff,\n\n # Similarly, use a special profile when man calls decompressors and other\n # simple filters.\n /{,usr/}bin/bzip2 mrCx -> &man_filter,\n /{,usr/}bin/gzip mrCx -> &man_filter,\n /usr/bin/col mrCx -> &man_filter,\n /usr/bin/compress mrCx -> &man_filter,\n /usr/bin/iconv mrCx -> &man_filter,\n /usr/bin/lzip.lzip mrCx -> &man_filter,\n /usr/bin/tr mrCx -> &man_filter,\n /usr/bin/xz mrCx -> &man_filter,\n\n # Allow basic filesystem access, subject to DAC\n /** mrixwlk,\n unix,\n\n # Capabilities needed by Man service\n capability setuid,\n capability setgid,\n\n # Ordinary permission checks sometimes involve checking whether the\n # process has this capability, which can produce audit log messages.\n # Silence them.\n deny capability dac_override,\n deny capability dac_read_search,\n\n signal peer=@{profile_name},\n signal peer=/usr/bin/man//&man_groff,\n signal peer=/usr/bin/man//&man_filter,\n}\n\nprofile man_groff flags=(complain) {\n include \n include \n\n /usr/bin/eqn mrix,\n /usr/bin/grap mrix,\n /usr/bin/pic mrix,\n /usr/bin/preconv mrix,\n /usr/bin/refer mrix,\n /usr/bin/tbl mrix,\n /usr/bin/troff mrix,\n /usr/bin/vgrind mrix,\n\n /etc/groff/** r,\n /etc/papersize r,\n /usr/lib/groff/site-tmac/** r,\n /usr/share/groff/** r,\n\n /tmp/groff* rw,\n\n signal peer=/usr/bin/man,\n signal peer=/usr/bin/man//&man_groff,\n}\n\nprofile man_filter flags=(complain) {\n include \n include \n\n /{,usr/}bin/bzip2 mrix,\n /{,usr/}bin/gzip mrix,\n /usr/bin/col mrix,\n /usr/bin/compress mrix,\n /usr/bin/iconv mrix,\n /usr/bin/lzip.lzip mrix,\n /usr/bin/tr mrix,\n /usr/bin/xz mrix,\n\n # Manual pages can be more or less anywhere, especially with \"man -l\", and\n # there's no harm in allowing wide read access here since the worst it can\n # do is feed data to the invoking man process.\n /** r,\n\n # Allow writing cat pages.\n /var/cache/man/** rw,\n\n signal peer=/usr/bin/man,\n signal peer=/usr/bin/man//&man_filter,\n}\n" }, { "path": "aegir/conf/apparmor/usr.bin.mysecureshell", "content": "# AppArmor profile for MySecureShell\n# This profile restricts MySecureShell (mysecureshell) to essential operations only.\n\n#include \n\n/usr/bin/mysecureshell flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n include \n include \n include \n\n # Read access to its own config and logs\n /etc/ssh/sftp_config r,\n /etc/lshell.conf r,\n /var/log/lsh/ r,\n /var/log/lsh/* rw,\n /opt/php*/lib/php.ini r,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow MySecureShell to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Read/write access to user home\n /home/*/ r,\n /home/*/** rw,\n\n # Read/write access to SSH client files\n /home/*/.ssh/ r,\n /home/*/.ssh/** rw,\n\n # Read-only access to Drush aliases and php.ini files\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n\n # Drush access\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n\n # Read-only access to Octopus directories\n /data/disk/*/.drush/ r,\n /data/disk/*/.drush/** r,\n /data/disk/*/backups/ r,\n /data/disk/*/backups/** r,\n /data/disk/*/clients/ r,\n /data/disk/*/clients/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/static/ r,\n /data/disk/*/static/** r,\n\n # Allow write access to Octopus user directories and files\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/static/ r,\n owner /data/disk/*/static/** rw,\n owner /opt/user/npm/*/** rw,\n owner /opt/user/gems/*/** rw,\n owner /opt/user/gems/*/bin/** k,\n\n # Read/write access to Drush cache\n /home/*/.drush/cache/ r,\n /home/*/.drush/cache/** rw,\n\n # Deny access to critical system files\n deny /etc/shadow* rwlx,\n\n # Allow read access to user information files\n /etc/passwd r,\n /etc/group r,\n /etc/nsswitch.conf r,\n /etc/hosts r,\n\n # Allow read-only access to resolv.conf for DNS resolution\n /etc/resolv.conf r,\n\n # Temporary files and directories\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n\n # Deny execution of any shell or command not explicitly allowed\n deny /bin/bash x,\n deny /usr/bin/perl x,\n\n # Allow execution of necessary binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/mysecureshell mrix,\n /usr/bin/python* mrix,\n /usr/local/bin/lshell mrix,\n\n # Additional binaries allowed in Limited Shell\n /bin/bzip2 mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/cp mrix,\n /bin/echo mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/gunzip mrix,\n /bin/gzip mrix,\n /bin/ls mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/nano mrix,\n /bin/ping mrix,\n /bin/pwd mrix,\n /bin/rm mrix,\n /bin/rmdir mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /bin/true mrix,\n /data/disk/*/tools/drush/drush.php mrix,\n /opt/local/bin/mybackup mrix,\n /opt/local/bin/sqlmagic mrix,\n /opt/php*/bin/php mrix,\n /usr/bin/diff mrix,\n /usr/bin/du mrix,\n /usr/bin/env mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/mysql mrix,\n /usr/bin/mysqldump mrix,\n /usr/bin/node mrix,\n /usr/bin/openssl mrix,\n /usr/bin/passwd mrix,\n /usr/bin/patch mrix,\n /usr/bin/rsync mrix,\n /usr/bin/rvim mrix,\n /usr/bin/tput mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which.debianutils mrix,\n /usr/bin/zstd mrix,\n /usr/lib/node_modules/npm/bin/** mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/gem mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/git-receive-pack mrix,\n /usr/local/bin/git-upload-archive mrix,\n /usr/local/bin/git-upload-pack mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/scp mrix,\n /usr/local/bin/sftp mrix,\n /usr/local/bin/ssh mrix,\n /usr/local/bin/ssh-keygen mrix,\n owner /opt/user/gems/*/** mrix,\n owner /opt/user/npm/*/** mrix,\n\n # Deny execution of any other binaries\n #deny /** rwklx,\n}\n" }, { "path": "aegir/conf/apparmor/usr.bin.mysql", "content": "# AppArmor profile for MySQL client\n# This profile restricts MySQL client (mysql) to essential operations only.\n\n#include \n\n/usr/bin/mysql flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by MySQL client\n capability net_bind_service,\n capability setgid,\n capability setuid,\n\n # Allow execution of the mysql binary\n /usr/bin/mysql mrix,\n\n # Allow execution of the mysqld binary\n /usr/sbin/mysqld mrix,\n\n # Allow execution of necessary utilities\n /bin/** mrix,\n /usr/bin/** mrix,\n /usr/sbin/** mrix,\n\n # Allow reading necessary directories\n /bin/ r,\n /usr/bin/ r,\n /usr/sbin/ r,\n /etc/inputrc r,\n\n # Allow MySQL to read its configuration files\n /etc/mysql/** r,\n /etc/mysql/conf.d/** r,\n /etc/mysql/mysql.conf.d/** r,\n\n # Allow MySQL to access its data directory\n /var/lib/mysql/ rwk,\n /var/lib/mysql/** rwk,\n\n # Allow MySQL to access its run directory\n /run/mysqld/ r,\n /run/mysqld/** rw,\n\n # Allow MySQL to access its tmp directory\n /tmp/ r,\n /tmp/** rw,\n\n # Allow MySQL to read system libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/mysql/plugin/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n /usr/share/mysql/** r,\n /usr/share/zoneinfo/** r,\n\n # Allow MySQL to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow MySQL to use /dev/shm for temporary storage\n /dev/shm/** rw,\n /dev/shm/ r,\n\n # Allow MySQL to read network-related configurations\n /etc/hosts.allow r,\n /etc/hosts.deny r,\n /etc/services r,\n\n # Disallow execution of binaries from /tmp and /var/tmp\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Deny access to various sensitive directories\n deny /boot/** mrwklx,\n\n # Deny access to various sensitive files\n deny /etc/shadow* rwlx,\n deny /etc/shadow- r,\n deny /etc/gshadow r,\n deny /etc/gshadow- r,\n\n # Allow reading the user's .my.cnf file\n /root/.my.cnf r,\n /home/*/.my.cnf r,\n\n # Allow writing to log files in user's home directory\n /home/*/.mysql_history rw,\n /root/.mysql_history rw,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/usr.bin.mysqld_safe", "content": "# AppArmor profile for MySQLd starter\n# This profile restricts MySQLd starter (mysqld_safe) to essential operations only.\n\n#include \n\n/usr/bin/mysqld_safe flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by MySQLd starter\n capability dac_override,\n capability dac_read_search,\n capability setgid,\n capability setuid,\n capability sys_resource,\n capability sys_nice,\n\n network inet stream,\n network inet6 stream,\n\n # Allow MySQLd to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n # Allow mysqld_safe to read its configuration files\n /etc/mysql/** r,\n /etc/mysql/conf.d/** r,\n /etc/mysql/mysql.conf.d/** r,\n /etc/hosts.deny r,\n /etc/hosts.allow r,\n\n # Allow mysqld_safe to access its data directory\n /var/lib/mysql/ rwk,\n /var/lib/mysql/** rwk,\n\n # Allow mysqld_safe to access its run directory\n /run/mysqld/ r,\n /run/mysqld/** rw,\n\n # Allow mysqld_safe to write to its log files\n /var/log/mysql/ r,\n /var/log/mysql/** rw,\n\n # Allow mysqld_safe to access tmp directories\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow mysqld_safe to read system libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/mysql/plugin/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n /usr/share/mysql/** r,\n /usr/share/zoneinfo/** r,\n\n # Allow mysqld_safe to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow mysqld_safe to use /dev/shm for temporary storage\n /dev/shm/** rw,\n /dev/shm/ r,\n\n # Allow execution of mysqld_safe\n /usr/bin/mysqld_safe mrix,\n\n # Allow execution of the mysql binary\n /usr/bin/mysql mrix,\n\n # Allow execution of the mysqld binary\n /usr/sbin/mysqld mrix,\n\n # Allow execution of necessary utilities\n /bin/** mrix,\n /usr/bin/** mrix,\n /usr/sbin/** mrix,\n\n # Allow reading necessary directories\n /bin/ r,\n /usr/bin/ r,\n /usr/sbin/ r,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/usr.bin.newrelic-daemon", "content": "# AppArmor profile for New Relic\n# This profile restricts the New Relic (newrelic-daemon) to essential operations only.\n\n#include \n\n/usr/bin/newrelic-daemon flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n\n # Capabilities needed by New Relic\n capability net_admin,\n capability setgid,\n capability setuid,\n\n network inet stream,\n network inet dgram,\n network inet6 stream,\n network inet6 dgram,\n\n # Allow execution of the newrelic-daemon binary\n /usr/bin/newrelic-daemon mrix,\n\n # Allow newrelic-daemon to read its configuration files\n /etc/newrelic/** r,\n\n # Allow newrelic-daemon to read system libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/lib64/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow newrelic-daemon to access /proc for necessary information\n /proc/** r,\n\n # Allow newrelic-daemon to access log files\n /var/log/newrelic/** rw,\n\n # Allow newrelic-daemon to use tmp files\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow newrelic-daemon to access run directory\n /run/newrelic/** rw,\n\n # Allow newrelic-daemon to access shared memory\n /dev/shm/** rw,\n /dev/shm/ r,\n\n # Disallow execution of binaries from /tmp and /var/tmp\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Deny access to various sensitive directories\n deny /boot/** mrwklx,\n deny /opt/** mrwklx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/usr.bin.node", "content": "# AppArmor profile for Node/NPM\n# This profile restricts Limited Shell (lshell) to essential operations only.\n\n#include \n\n/usr/bin/node flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n\n # Capability permissions\n capability ipc_lock,\n capability sys_resource,\n\n # Network access\n network inet,\n\n # Allow read access to necessary libraries\n /etc/ssl/openssl.cnf r,\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow reading of environment variables\n /proc/** r,\n /sys/** r,\n\n # Specific file permissions\n owner /home/*/.npmrc r,\n\n # Temporary files and directories\n owner /home/*/.tmp/ r,\n owner /home/*/.tmp/** rw,\n\n # Miscellaneous\n /dev/urandom rw,\n /dev/null rw,\n /dev/tty rw,\n\n # Deny execution of any shell or command not explicitly allowed\n deny /bin/bash x,\n deny /bin/dash x,\n deny /bin/websh x,\n deny /usr/bin/perl x,\n deny /usr/bin/python* x,\n deny /usr/local/bin/ruby x,\n\n # Deny certain capabilities\n deny capability sys_chroot, # Deny changing root\n deny capability sys_admin, # Deny various system admin privileges\n deny capability setuid, # Deny changing user IDs\n deny capability setgid, # Deny changing group IDs\n deny capability kill, # Deny sending signals to arbitrary processes\n\n # Deny execution of binaries from these directories\n deny /home/*/.tmp/** m,\n deny /home/*/** m,\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Allow execution of npm etc\n /usr/bin/node mrix,\n /usr/bin/npm mrix,\n /opt/user/npm/*/ r,\n /opt/user/npm/*/** mrix,\n\n # Allow to read and write in the custom web root directories\n\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/platforms/** rw,\n owner /data/disk/*/static/** rw,\n\n # Deny access to various sensitive directories and files\n deny /boot/** mrwklx,\n deny /root/** mrwklx,\n deny /etc/shadow* rwlx,\n deny /etc/passwd* rwlx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/usr.bin.redis-server", "content": "# AppArmor profile for Redis server\n# This profile restricts the Redis server (redis-server) to essential operations only.\n\n#include \n\n/usr/bin/redis-server flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n\n # Allow Redis to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n # Allow reading necessary kernel parameters\n /proc/sys/** r,\n /sys/devices/** r,\n /sys/kernel/** r,\n\n # Allow execution of redis-server binary\n /usr/bin/redis-server mrix,\n\n # Allow Redis to read its configuration file\n /etc/redis/redis.conf r,\n\n # Allow Redis to read and write its data files\n /var/lib/redis/** rwk,\n\n # Allow Redis to read and write its log files\n /var/log/redis/** rw,\n\n # Allow Redis to open TCP sockets on any address\n network inet stream,\n\n # Allow Redis to use syslog\n /dev/log w,\n /usr/bin/logger ixr,\n\n # Allow Redis to read system libraries\n /lib/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/local/sbin/* mrix,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow Redis to use /run for pid/sock files\n /run/redis/** rw,\n\n # Allow Redis to use tmp files\n /tmp/ r,\n /tmp/** rw,\n\n owner /proc/*/smaps r,\n owner /proc/*/stat r,\n owner /var/lib/redis/ r,\n owner /var/lib/redis/dump.rdb rw,\n owner /var/lib/redis/temp-*.rdb rw,\n owner /var/log/redis/redis-server.log rw,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n}\n" }, { "path": "aegir/conf/apparmor/usr.bin.valkey-server", "content": "# AppArmor profile for Valkey server\n# This profile restricts the Valkey server (valkey-server) to essential operations only.\n\n#include \n\n/usr/bin/valkey-server flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n\n # Allow Valkey to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n # Allow reading necessary kernel parameters\n /proc/sys/** r,\n /sys/devices/** r,\n /sys/kernel/** r,\n\n # Allow execution of valkey-server binary\n /usr/bin/valkey-server mrix,\n\n # Allow Valkey to read its configuration file\n /etc/valkey/valkey.conf r,\n\n # Allow Valkey to read and write its data files\n /var/lib/valkey/** rwk,\n\n # Allow Valkey to read and write its log files\n /var/log/valkey/** rw,\n\n # Allow Valkey to open TCP sockets on any address\n network inet stream,\n\n # Allow Valkey to use syslog\n /dev/log w,\n /usr/bin/logger ixr,\n\n # Allow Valkey to read system libraries\n /lib/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/local/sbin/* mrix,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow Valkey to use /run for pid/sock files\n /run/valkey/** rw,\n\n # Allow Valkey to use tmp files\n /tmp/ r,\n /tmp/** rw,\n\n owner /proc/*/smaps r,\n owner /proc/*/stat r,\n owner /var/lib/valkey/ r,\n owner /var/lib/valkey/dump.rdb rw,\n owner /var/lib/valkey/temp-*.rdb rw,\n owner /var/log/valkey/valkey-server.log rw,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n}\n" }, { "path": "aegir/conf/apparmor/usr.local.bin.lshell", "content": "# AppArmor profile for Limited Shell\n# This profile restricts Limited Shell (lshell) to essential operations only.\n\n#include \n\n/usr/local/bin/lshell flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n include \n include \n include \n\n # Read access to its own config and logs\n /etc/ssh/sftp_config r,\n /etc/lshell.conf r,\n /var/log/lsh/ r,\n /var/log/lsh/* rw,\n /opt/php*/lib/php.ini r,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /opt/php*/lib/php/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/ioncube/ioncube_loader_lin_*.so mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow Limited Shell to access /proc and /sys for necessary information\n /proc/ r,\n /proc/** r,\n /sys/ r,\n /sys/** r,\n\n # Read/write access to user home\n /home/*/ r,\n /home/*/** rw,\n\n # Read/write access to SSH client files\n /home/*/.ssh/ r,\n /home/*/.ssh/** rw,\n\n # Read-only access to Drush aliases and php.ini files\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n\n # Drush access\n /opt/tools/drush/** mrix,\n /usr/local/bin/cv.phar mrix,\n\n # Read-only access to Octopus directories\n /data/disk/*/.drush/ r,\n /data/disk/*/.drush/** r,\n /data/disk/*/backups/ r,\n /data/disk/*/backups/** r,\n /data/disk/*/clients/ r,\n /data/disk/*/clients/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/static/ r,\n /data/disk/*/static/** r,\n\n # Allow write access to Octopus user directories and files\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/static/ r,\n owner /data/disk/*/static/** rw,\n owner /opt/user/npm/*/** rw,\n owner /opt/user/gems/*/** rw,\n owner /opt/user/gems/*/bin/** k,\n\n # Read/write access to Drush cache\n /home/*/.drush/cache/ r,\n /home/*/.drush/cache/** rw,\n\n # Deny access to critical system files\n deny /etc/shadow* rwlx,\n\n # Allow read access to user information files\n /etc/passwd r,\n /etc/group r,\n /etc/nsswitch.conf r,\n /etc/hosts r,\n\n # Allow read-only access to resolv.conf for DNS resolution\n /etc/resolv.conf r,\n\n # Temporary files and directories\n /home/*/.tmp/ r,\n /home/*/.tmp/** rw,\n\n # Deny execution of any shell or command not explicitly allowed\n deny /bin/bash x,\n deny /usr/bin/perl x,\n\n # Allow execution of necessary binaries\n /bin/dash mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/mysecureshell mrix,\n /usr/bin/python* mrix,\n /usr/local/bin/lshell mrix,\n\n # Additional binaries allowed in Limited Shell\n /bin/bzip2 mrix,\n /bin/cat mrix,\n /bin/chmod mrix,\n /bin/cp mrix,\n /bin/echo mrix,\n /bin/egrep mrix,\n /bin/grep mrix,\n /bin/gunzip mrix,\n /bin/gzip mrix,\n /bin/ls mrix,\n /bin/mkdir mrix,\n /bin/mv mrix,\n /bin/nano mrix,\n /bin/ping mrix,\n /bin/pwd mrix,\n /bin/rm mrix,\n /bin/rmdir mrix,\n /bin/sed mrix,\n /bin/stty mrix,\n /bin/tar mrix,\n /bin/touch mrix,\n /bin/true mrix,\n /data/disk/*/tools/drush/drush.php mrix,\n /opt/local/bin/mybackup mrix,\n /opt/local/bin/sqlmagic mrix,\n /opt/php*/bin/php mrix,\n /usr/bin/diff mrix,\n /usr/bin/du mrix,\n /usr/bin/env mrix,\n /usr/bin/find mrix,\n /usr/bin/id mrix,\n /usr/bin/mysql mrix,\n /usr/bin/mysqldump mrix,\n /usr/bin/node mrix,\n /usr/bin/openssl mrix,\n /usr/bin/passwd mrix,\n /usr/bin/patch mrix,\n /usr/bin/rsync mrix,\n /usr/bin/rvim mrix,\n /usr/bin/tput mrix,\n /usr/bin/unzip mrix,\n /usr/bin/wget mrix,\n /usr/bin/which.debianutils mrix,\n /usr/bin/zstd mrix,\n /usr/lib/node_modules/npm/bin/** mrix,\n /usr/local/bin/composer mrix,\n /usr/local/bin/curl mrix,\n /usr/local/bin/gem mrix,\n /usr/local/bin/git mrix,\n /usr/local/bin/git-receive-pack mrix,\n /usr/local/bin/git-upload-archive mrix,\n /usr/local/bin/git-upload-pack mrix,\n /usr/local/bin/mydumper mrix,\n /usr/local/bin/myloader mrix,\n /usr/local/bin/scp mrix,\n /usr/local/bin/sftp mrix,\n /usr/local/bin/ssh mrix,\n /usr/local/bin/ssh-keygen mrix,\n owner /opt/user/gems/*/** mrix,\n owner /opt/user/npm/*/** mrix,\n\n # Deny execution of any other binaries\n #deny /** rwklx,\n}\n" }, { "path": "aegir/conf/apparmor/usr.local.bin.ssh", "content": "# AppArmor profile for SSH client\n# This profile restricts the SSH client (ssh) to essential operations only.\n\n#include \n\n/usr/local/bin/ssh flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n include \n include \n include \n\n # Allow execution of the ssh binary\n /usr/local/bin/ssh mrix,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Read access to SSH client configuration files\n /etc/ssh/ssh_config r,\n /etc/ssh/ssh_known_hosts r,\n /home/*/.ssh/** rw,\n\n # Allow network access for making outbound connections\n network inet stream,\n network inet6 stream,\n\n # Deny access to critical system files\n deny /etc/shadow* rwlx,\n\n # Allow read access to user information files\n /etc/passwd r,\n /etc/group r,\n /etc/nsswitch.conf r,\n /etc/hosts r,\n\n # Allow read-only access to resolv.conf for DNS resolution\n /etc/resolv.conf r,\n\n # Temporary files and directories\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow execution of necessary binaries\n /bin/dash mrix,\n /bin/sh mrix,\n /opt/local/bin/websh mrix,\n /usr/bin/id mrix,\n /usr/bin/mysecureshell mrix,\n /usr/local/bin/lshell mrix,\n /usr/local/bin/ssh-agent mrix,\n\n # Additional binaries used by SSH (e.g., scp, sftp)\n /usr/local/bin/scp mrix,\n /usr/local/bin/sftp mrix,\n\n # Deny execution of any other binaries\n #deny /** rwklx,\n}\n" }, { "path": "aegir/conf/apparmor/usr.local.bin.wkhtmltoimage", "content": "# File: /etc/apparmor.d/usr.local.bin.wkhtmltoimage\n# Template from https://wkhtmltopdf.org/apparmor.html\n\n#include \n\n/usr/local/bin/wkhtmltoimage flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n\n # Deny capability sys_ptrace\n deny capability sys_ptrace,\n\n # System paths wkhtmltoimage needs to operate\n /proc/*/maps r,\n /usr/local/bin/wkhtmltoimage mrix,\n /var/cache/fontconfig/* r,\n /tmp/** rwlk,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow to read and write in the web root directories\n /var/www/** r,\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n\n owner /data/disk/*/distro/** rwk,\n owner /data/disk/*/platforms/** rwk,\n owner /data/disk/*/static/** rwk,\n owner /var/www/** rwk,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n}\n" }, { "path": "aegir/conf/apparmor/usr.local.bin.wkhtmltopdf", "content": "# File: /etc/apparmor.d/usr.local.bin.wkhtmltopdf\n# Template from https://wkhtmltopdf.org/apparmor.html\n\n#include \n\n/usr/local/bin/wkhtmltopdf flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n\n # Deny capability sys_ptrace\n deny capability sys_ptrace,\n\n # System paths wkhtmltopdf needs to operate\n /proc/*/maps r,\n /usr/local/bin/wkhtmltopdf mrix,\n /var/cache/fontconfig/* r,\n /tmp/** rwlk,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow to read and write in the web root directories\n /var/www/** r,\n /data/disk/*/aegir/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n\n owner /data/disk/*/distro/** rwk,\n owner /data/disk/*/platforms/** rwk,\n owner /data/disk/*/static/** rwk,\n owner /var/www/** rwk,\n\n /home/*.web/.aws/ r,\n /home/*.web/.aws/* rw,\n /home/*.web/.drush/ r,\n /home/*.web/.drush/* r,\n /home/*.web/.tmp/ r,\n /home/*.web/.tmp/* rw,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n}\n" }, { "path": "aegir/conf/apparmor/usr.local.sbin.pure-ftpd", "content": "# AppArmor profile for Pure-FTPd server\n# This profile restricts Pure-FTPd server (pure-ftpd) to essential operations only.\n\n#include \n\n/usr/local/sbin/pure-ftpd flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by Pure-FTPd server\n capability net_bind_service,\n capability setgid,\n capability setuid,\n capability mknod,\n\n network inet stream,\n network inet6 stream,\n\n # Allow Pure-FTPd to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n # Allow execution of /bin/sh\n /bin/sh mrix,\n /opt/local/bin/websh mrix,\n\n # Allow access to /dev\n /dev/log w,\n /dev/urandom r,\n\n # Allow read access to system configuration and password files\n /etc/hostname r,\n /etc/hosts r,\n /etc/pure-ftpd.conf r,\n /etc/passwd r,\n /etc/group r,\n /etc/shadow r,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow read access to SSL certificates\n /etc/ssl/private/pure-ftpd.pem r,\n /etc/ssl/private/pure-ftpd-dhparams.pem r,\n\n # Allow reading necessary kernel parameters\n /proc/** r,\n /sys/** r,\n\n # Allow access to run directory\n /run/pure-ftpd.pid rw,\n /run/pure-ftpd/ r,\n /run/pure-ftpd/** rwk,\n\n # Allow access to temporary directories\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow write access to log files\n /var/log/pureftpd.log rw,\n\n # Allow execution of the pure-ftpd binary and configuration script\n /usr/local/sbin/pure-ftpd mrix,\n /usr/local/sbin/pure-config.pl mrix,\n\n # Allow read access to Octopus user directories and files\n /data/disk/*/.drush/ r,\n /data/disk/*/.drush/** r,\n /data/disk/*/backups/ r,\n /data/disk/*/backups/** r,\n /data/disk/*/clients/ r,\n /data/disk/*/clients/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/static/ r,\n /data/disk/*/static/** r,\n /home/*/.drush/ r,\n /home/*/.drush/** r,\n /opt/tools/drush/** r,\n\n # Allow write access to Octopus user directories and files\n owner /data/disk/*/distro/** rw,\n owner /data/disk/*/static/ r,\n owner /data/disk/*/static/** rw,\n owner /home/*/ r,\n owner /home/*/.drush/cache/ r,\n owner /home/*/.drush/cache/** rw,\n owner /home/*/** rw,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/usr.local.sbin.sshd", "content": "# AppArmor profile for SSHd daemon\n# This profile restricts the SSHd daemon (sshd) to essential operations only.\n\n#include \n\n/usr/local/sbin/sshd flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n include \n include \n include \n\n # Allow execution of the sshd binary\n /usr/local/sbin/sshd mrix,\n\n # Capabilities needed by SSHd daemon\n capability audit_control,\n capability audit_write,\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability fowner,\n capability fsetid,\n capability kill,\n capability net_bind_service,\n capability setgid,\n capability setuid,\n capability sys_admin,\n capability sys_chroot,\n capability sys_resource,\n capability sys_tty_config,\n\n network inet stream,\n network inet6 stream,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Read/Write access\n /dev/null rw,\n /dev/ptmx rw,\n /dev/pts/* rw,\n /dev/tty rw,\n /dev/urandom r,\n /proc/** rw,\n /run/** rwk,\n /sys/** r,\n /tmp/ r,\n /tmp/** rw,\n /var/** r,\n /var/lib/sshd/** rw,\n\n # Read/Write owner access\n owner /** rwk,\n owner /etc/group rw,\n owner /etc/motd rw,\n owner /etc/passwd rw,\n owner /etc/shadow rw,\n owner /etc/ssh/* rw,\n owner /proc/*/oom_score_adj rw,\n owner /root/** rw,\n owner /run/sshd.pid rw,\n\n # Exec access\n /{media,mnt,opt,srv}/** mrix,\n /bin/* mrix,\n /opt/local/bin/* mrix,\n /usr/bin/* mrix,\n /usr/local/bin/* mrix,\n /usr/local/sbin/* mrix,\n /usr/sbin/* mrix,\n\n # Read access to SSH daemon configuration files\n /etc/default/locale r,\n /etc/environment r,\n /etc/hosts.allow r,\n /etc/hosts.deny r,\n /etc/modules.conf r,\n /etc/security/** r,\n /etc/ssh/* r,\n /etc/ssl/openssl.cnf r,\n\n # Write access to the PID file\n /run/sshd.pid rw,\n\n # Allow network access for accepting inbound connections\n network inet stream,\n network inet6 stream,\n\n # Allow reading user home directories and authorized keys\n /home/*/*/ r,\n /home/*/*/.ssh/ r,\n /home/*/.ssh/authorized_keys{,2} r,\n\n # Temporary files and directories\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n /dev/pts/[0-9]* rw,\n /etc/ssh/moduli r,\n @{PROC}/@{pid}/mounts r,\n /etc/motd r,\n /{,var/}run/motd{,.new} rw,\n /tmp/ssh-*/agent.[0-9]* rwl,\n /tmp/ssh-*[0-9]*/ w,\n\n # Allow execution of various shells\n /bin/ash rUx,\n /bin/bash rUx,\n /bin/bash2 rUx,\n /bin/bsh rUx,\n /bin/csh rUx,\n /bin/dash rUx,\n /bin/ksh rUx,\n /bin/sh rUx,\n /bin/tcsh rUx,\n /bin/zsh rUx,\n /bin/zsh4 rUx,\n /sbin/nologin rUx,\n /usr/bin/mysecureshell rUx,\n /usr/local/bin/lshell rUx,\n\n # Allow ptrace read access for necessary binaries\n ptrace read peer=unconfined,\n ptrace read peer=/opt/php*/bin/php,\n ptrace read peer=/opt/php*/sbin/php-fpm,\n ptrace read peer=/usr/bin/newrelic-daemon,\n ptrace read peer=/sbin/dhclient,\n ptrace read peer=/usr/bin/mysqld_safe,\n ptrace read peer=/usr/bin/mysqld,\n ptrace read peer=/usr/bin/redis-server,\n ptrace read peer=/usr/lib/jvm/java-11-openjdk-amd64/bin/java,\n ptrace read peer=/usr/lib/jvm/java-17-openjdk-amd64/bin/java,\n ptrace read peer=/usr/lib/jvm/java-21-openjdk-amd64/bin/java,\n ptrace read peer=/usr/lib/postfix/sbin/master,\n ptrace read peer=/usr/lib/postfix/sbin/pickup,\n ptrace read peer=/usr/lib/postfix/sbin/qmgr,\n ptrace read peer=/usr/local/sbin/pure-ftpd,\n ptrace read peer=/usr/sbin/nginx,\n ptrace read peer=/usr/sbin/unbound,\n\n ^EXEC flags=(complain) {\n # Include base abstractions\n include \n\n /bin/ash Ux,\n /bin/bash Ux,\n /bin/bash2 Ux,\n /bin/bsh Ux,\n /bin/csh Ux,\n /bin/dash Ux,\n /bin/ksh Ux,\n /bin/sh Ux,\n /bin/tcsh Ux,\n /bin/zsh Ux,\n /bin/zsh4 Ux,\n /sbin/nologin Ux,\n /usr/bin/mysecureshell Ux,\n /usr/local/bin/lshell Ux,\n }\n\n ^PRIVSEP flags=(complain) {\n # Include base and nameservice abstractions\n include \n include \n\n capability sys_chroot,\n capability setuid,\n capability setgid,\n }\n\n ^PRIVSEP_MONITOR flags=(complain) {\n # Include authentication, base, nameservice, and wutmp abstractions\n include \n include \n include \n include \n\n capability setuid,\n capability setgid,\n capability chown,\n\n /home/*/.ssh/authorized_keys{,2} r,\n /dev/ptmx rw,\n /dev/pts/[0-9]* rw,\n /dev/urandom r,\n /etc/hosts.allow r,\n /etc/hosts.deny r,\n /etc/ssh/moduli r,\n @{PROC}/@{pid}/mounts r,\n }\n\n ^AUTHENTICATED flags=(complain) {\n # Include authentication, consoles, nameservice, and wutmp abstractions\n include \n include \n include \n include \n\n capability sys_tty_config,\n capability setgid,\n capability setuid,\n\n /dev/log w,\n /dev/ptmx rw,\n /etc/default/passwd r,\n /etc/localtime r,\n /etc/writable/localtime r,\n /etc/login.defs r,\n /etc/motd r,\n /{,var/}run/motd{,.new} rw,\n /tmp/ssh-*/agent.[0-9]* rwl,\n /tmp/ssh-*[0-9]*/ w,\n }\n}\n" }, { "path": "aegir/conf/apparmor/usr.sbin.clamd", "content": "# AppArmor profile for Clamd service\n# This profile restricts Clamd service (clamd) to essential operations only.\n\n#include \n\n/usr/sbin/clamd flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n\n # Capabilities needed by Clamd service\n capability chown,\n capability dac_override,\n capability dac_read_search,\n capability setgid,\n capability setuid,\n capability sys_resource,\n\n network inet stream,\n network inet6 stream,\n network inet dgram,\n network inet6 dgram,\n\n # Allow execution of necessary shells and the clamd binary\n /bin/dash mrix,\n /bin/bash mrix,\n /bin/sh mrix,\n /usr/sbin/clamd mrix,\n\n # Allow access to /dev\n /dev/log w,\n /dev/null rw,\n /dev/random r,\n /dev/urandom r,\n\n # Allow access to /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow access to temporary directories\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow access to ClamAV configuration and data\n /etc/clamav/clamd.conf r,\n /var/lib/amavis/tmp/** r,\n /var/lib/clamav/ r,\n /var/lib/clamav/** rwk,\n /var/log/clamav/* rwk,\n /var/spool/MIMEDefang/mdefang-*/Work/ r,\n /var/spool/MIMEDefang/mdefang-*/Work/** r,\n /var/spool/clamsmtp/* r,\n /var/spool/exim4/** r,\n /var/spool/havp/** r,\n /var/spool/p3scan/children/** r,\n /var/spool/qpsmtpd/* r,\n /{,var/}run/clamav/clamd.ctl w,\n /{,var/}run/clamav/clamd.pid w,\n\n # Allow read access to user directories\n /data/all/** r,\n /data/conf/* r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /home/*/ r,\n /home/*/** r,\n\n # Allow reading filesystems information\n @{PROC}/[0-9]*/status r,\n @{PROC}/filesystems r,\n\n # Deny access to sensitive files and directories\n deny /etc/shadow* rwlx,\n deny /etc/passwd* rwlx,\n deny /root/** rwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/usr.sbin.mysqld", "content": "# AppArmor profile for MySQLd server\n# This profile restricts MySQLd server (mysqld) to essential operations only.\n\n#include \n\n/usr/sbin/mysqld flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n\n # Capabilities needed by MySQLd server\n capability dac_override,\n capability dac_read_search,\n capability sys_resource,\n capability setgid,\n capability setuid,\n capability sys_nice,\n\n network inet stream,\n network inet6 stream,\n\n # Allow execution of mysqld_safe\n /usr/bin/mysqld_safe mrix,\n\n # Allow execution of the mysql binary\n /usr/bin/mysql mrix,\n\n # Allow execution of the mysqld binary\n /usr/sbin/mysqld mrix,\n\n # Allow execution of necessary utilities\n /bin/** mrix,\n /usr/bin/** mrix,\n /usr/sbin/** mrix,\n\n # Allow reading necessary directories\n /bin/ r,\n /usr/bin/ r,\n /usr/sbin/ r,\n\n # Allow MySQL to read its configuration files\n /etc/mysql/** r,\n /etc/mysql/conf.d/** r,\n /etc/mysql/mysql.conf.d/** r,\n\n # Allow MySQL to access its data directory\n /var/lib/mysql/ rwk,\n /var/lib/mysql/** rwk,\n\n # Allow MySQL to access its run directory\n /run/mysqld/ r,\n /run/mysqld/** rw,\n\n # Allow MySQL to write to its log files\n /var/log/mysql/ r,\n /var/log/mysql/** rw,\n\n # Allow MySQL to access its tmp directories\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Allow MySQL to read system libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/mysql/plugin/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n /usr/share/mysql/** r,\n /usr/share/zoneinfo/** r,\n\n # Allow MySQL to access /proc and /sys for necessary information\n /proc/** r,\n /sys/** r,\n\n # Allow MySQL to use /dev/shm for temporary storage\n /dev/shm/** rw,\n /dev/shm/ r,\n\n # Allow MySQL to read network-related configurations\n /etc/hosts.allow r,\n /etc/hosts.deny r,\n /etc/services r,\n\n # Disallow execution of binaries from /tmp and /var/tmp\n deny /tmp/** m,\n deny /var/tmp/** m,\n\n # Deny access to various sensitive directories\n deny /boot/** mrwklx,\n deny /root/** mrwklx,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n\n # Site-specific additions and overrides can be added below\n}\n" }, { "path": "aegir/conf/apparmor/usr.sbin.nginx", "content": "# AppArmor profile for Nginx server\n# This profile restricts Nginx server (nginx) to essential operations only.\n\n#include \n\n/usr/sbin/nginx flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n include \n include \n\n # Capabilities needed by Nginx server\n capability dac_override,\n capability dac_read_search,\n capability mknod,\n\n # Allow Nginx to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow execution of the nginx binary\n /usr/sbin/nginx mrix,\n\n # Allow read/write access to nginx specific directories and files\n /etc/default/nginx r,\n /etc/nginx/ r,\n /etc/nginx/** r,\n /etc/nginx/conf.d/ r,\n /etc/nginx/conf.d/** r,\n /etc/nginx/fastcgi_params r,\n /etc/nginx/mime.types r,\n /etc/nginx/nginx.conf r,\n /etc/ssl/private/ r,\n /etc/ssl/private/* r,\n /etc/ssl/private/nginx-wild-ssl.crt r,\n /etc/ssl/private/nginx-wild-ssl.dhp r,\n /etc/ssl/private/nginx-wild-ssl.key r,\n /var/www/ r,\n /var/www/** r,\n\n # Specific directories used by Ægir (if applicable)\n /var/aegir/.drush/ r,\n /var/aegir/.drush/** r,\n /var/aegir/config/ r,\n /var/aegir/config/** r,\n /var/aegir/host_master/** r,\n /var/aegir/platforms/** r,\n\n /data/disk/*/aegir/** r,\n /data/disk/*/config/** r,\n /data/disk/*/distro/** r,\n /data/disk/*/platforms/** r,\n /data/disk/*/static/** r,\n /data/disk/*/tools/le/** r,\n\n # Additional specific directories\n /data/all/** r,\n /data/conf/ r,\n /data/conf/* r,\n\n # Other required directories and files\n /proc/sys/** r,\n /run/nginx.pid rw,\n /run/nginx.pid.oldbin rw,\n /usr/fastcgi_temp/ r,\n /usr/fastcgi_temp/** rw,\n /usr/share/GeoIP/GeoIP.dat r,\n /usr/share/GeoIP/GeoIPv6.dat r,\n /usr/share/GeoIP/GeoLite2-ASN.mmdb r,\n /usr/share/GeoIP/GeoLite2-City.mmdb r,\n /usr/share/GeoIP/GeoLite2-Country.mmdb r,\n /var/lib/nginx/ r,\n /var/lib/nginx/** rw,\n /var/log/nginx/ r,\n /var/log/nginx/access.log w,\n /var/log/nginx/error.log w,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n}\n" }, { "path": "aegir/conf/apparmor/usr.sbin.rsyslogd", "content": "# AppArmor profile for Rsyslogd service\n# This profile restricts Rsyslogd service (rsyslogd) to essential operations only.\n\n#include \n\n/usr/sbin/rsyslogd flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n\n # Capabilities needed by Rsyslogd service\n capability syslog,\n\n # Allow Rsyslogd to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n # Allow execution of the rsyslogd binary\n /usr/sbin/rsyslogd mrix,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow read access to system configuration files\n /etc/rsyslog.conf r,\n /etc/rsyslog.d/ r,\n /etc/rsyslog.d/** r,\n /etc/localtime r,\n /etc/ssl/certs/** r,\n\n # Allow read and write access to the log directories and files\n /var/log/** rwk,\n /var/spool/rsyslog/** rw,\n /var/spool/postfix/** rw,\n\n # Allow network access\n network inet stream,\n network inet dgram,\n\n # Allow access to pid files\n /run/rsyslogd.pid rw,\n /run/rsyslogd.pid.tmp rw,\n\n # Capabilities needed by Rsyslogd service\n capability net_bind_service,\n capability setuid,\n capability setgid,\n capability chown,\n capability dac_override,\n\n # Allow reading necessary kernel parameters\n /proc/sys/kernel/random/uuid r,\n /proc/cpuinfo r,\n /proc/meminfo r,\n /proc/kmsg r,\n /proc/stat r,\n\n # Allow access to /dev for logging\n /dev/log w,\n /dev/kmsg w,\n\n # Catchall to deny everything else\n #deny /** rwklx,\n}\n" }, { "path": "aegir/conf/apparmor/usr.sbin.unbound", "content": "# AppArmor profile for Unbound server\n# This profile restricts Unbound server (unbound) to essential operations only.\n\n#include \n\n/usr/sbin/unbound flags=(complain) {\n\n # Include common AppArmor abstractions\n include \n include \n include \n include \n\n # Capabilities needed by Unbound server\n capability chown,\n capability fowner,\n capability fsetid,\n capability kill,\n capability net_bind_service,\n capability setgid,\n capability setuid,\n capability sys_chroot,\n capability sys_resource,\n capability net_admin,\n capability dac_override,\n\n # Allow to open TCP sockets on any address\n network inet stream,\n network inet6 stream,\n\n # Allow Unbound to accept signal from PHP-CLI processes\n signal (receive) peer=/opt/php*/bin/php,\n\n # Allow read access to necessary libraries\n /lib/** mr,\n /lib/x86_64-linux-gnu/** mr,\n /lib64/** mr,\n /usr/lib/** mr,\n /usr/lib/x86_64-linux-gnu/** mr,\n /usr/libexec/** mr,\n /usr/local/include/** mr,\n /usr/local/lib/** mr,\n /usr/local/ssl/** mr,\n /usr/local/ssl3/** mr,\n\n # Allow Unbound to access some /dev\n /dev/log w,\n /dev/random r,\n /dev/urandom r,\n\n # Allow Unbound to access tmp directories\n /tmp/ r,\n /tmp/** rw,\n /var/tmp/** rw,\n\n # Access root hints from dns-data-root\n /usr/share/dns/root.* r,\n\n # Unbound configuration paths\n /etc/unbound/ r,\n /etc/unbound/** r,\n /usr/etc/unbound/ r,\n /usr/etc/unbound/** r,\n /var/lib/unbound/ r,\n /var/lib/unbound/** r,\n\n # Unbound logs\n /var/log/unbound/ r,\n /var/log/unbound/** rw,\n\n # Unbound keys (if write access is needed)\n /usr/etc/unbound/keys/** rw,\n\n # Allow Unbound to execute its own binary\n /usr/sbin/unbound mrix,\n\n # Allow Unbound to access its pid and control socket\n /run/unbound.ctl rw,\n /run/unbound.pid rw,\n /run/unbound/ r,\n /run/unbound/** r,\n /run/unbound/unbound.ctl rw,\n /run/unbound/unbound.pid rw,\n}\n" }, { "path": "aegir/conf/dns/unbound", "content": "#!/bin/dash\n\n### BEGIN INIT INFO\n# Provides: unbound\n# Required-Start: $network $remote_fs $syslog\n# Required-Stop: $network $remote_fs $syslog\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: Validating, recursive, and caching DNS resolver\n### END INIT INFO\n\nNAME=\"unbound\"\nDESC=\"DNS server\"\nDAEMON=\"/usr/sbin/unbound\"\nPIDFILE=\"/run/unbound/unbound.pid\"\n\nHELPER=\"/usr/libexec/unbound-helper\"\n\ntest -x $DAEMON || exit 0\n\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\n\n. /lib/lsb/init-functions\n\n# Override this variable by editing or creating /etc/default/unbound.\nDAEMON_OPTS=\"\"\n\n[ -d /run/unbound ] || mkdir -p /run/unbound\n[ -d /run/unbound ] && chown -R unbound:unbound /run/unbound\n\nif [ -f /etc/default/unbound ]; then\n . /etc/default/unbound\nfi\n\n# --- BEGIN CI NoMail hook ---\napply_ci_nomail() {\n if [ \"${UNBOUND_CI_NOMAIL:-NO}\" = \"YES\" ] && [ -x /usr/local/sbin/unbound_ci_nomail.sh ]; then\n /usr/bin/env _LOCAL_ZONE_TYPE=\"${UNBOUND_CI_NOMAIL_TYPE:-always_nxdomain}\" \\\n /usr/local/sbin/unbound_ci_nomail.sh\n fi\n}\n# --- END CI NoMail hook ---\n\ncase \"$1\" in\n start)\n log_daemon_msg \"Starting $DESC\" \"$NAME\"\n $HELPER chroot_setup\n $HELPER root_trust_anchor_update 2>&1 | tee /dev/fd/2 | logger -p daemon.info -t unbound\n if start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --name $NAME --startas $DAEMON -- $DAEMON_OPTS; then\n $HELPER resolvconf_start\n apply_ci_nomail\n log_end_msg 0\n else\n log_end_msg 1\n fi\n ;;\n\n stop)\n log_daemon_msg \"Stopping $DESC\" \"$NAME\"\n if start-stop-daemon --stop --quiet --oknodo --remove-pidfile --pidfile $PIDFILE --name $NAME --retry 5; then\n $HELPER resolvconf_stop\n $HELPER chroot_teardown\n log_end_msg 0\n else\n log_end_msg 1\n fi\n ;;\n\n restart|force-reload)\n log_daemon_msg \"Restarting $DESC\" \"$NAME\"\n start-stop-daemon --stop --quiet --remove-pidfile --pidfile $PIDFILE --name $NAME --retry 5\n $HELPER resolvconf_stop\n if start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --name $NAME --startas $DAEMON -- $DAEMON_OPTS; then\n $HELPER chroot_setup\n $HELPER resolvconf_start\n apply_ci_nomail\n log_end_msg 0\n else\n log_end_msg 1\n fi\n ;;\n\n reload)\n log_daemon_msg \"Reloading $DESC\" \"$NAME\"\n if start-stop-daemon --stop --pidfile $PIDFILE --name $NAME --signal 1; then\n $HELPER chroot_setup\n apply_ci_nomail\n log_end_msg 0\n else\n log_end_msg 1\n fi\n ;;\n\n status)\n status_of_proc -p $PIDFILE $DAEMON $NAME && exit 0 || exit $?\n ;;\n\n *)\n N=/etc/init.d/$NAME\n echo \"Usage: $N {start|stop|restart|status|reload|force-reload}\" >&2\n exit 1\n ;;\nesac\n\nexit 0\n\n" }, { "path": "aegir/conf/dns/unbound-helper", "content": "#!/bin/dash -e\n\nUNBOUND_CONF=\"/etc/unbound/unbound.conf\"\nUNBOUND_BASE_DIR=\"${UNBOUND_CONF%/*}\"\nCHROOT_DIR=\"$(unbound-checkconf -o chroot)\"\n\nDNS_ROOT_KEY_FILE=\"/usr/share/dns/root.key\"\nROOT_TRUST_ANCHOR_FILE=\"/var/lib/unbound/root.key\"\n\n# Override these variables by editing or creating /etc/default/unbound.\nRESOLVCONF=true\nROOT_TRUST_ANCHOR_UPDATE=true\n\nif [ -f /etc/default/unbound ]; then\n . /etc/default/unbound\n\n case \"$RESOLVCONF\" in false|0|no)\n RESOLVCONF=false ;;\n esac\n\n case \"$ROOT_TRUST_ANCHOR_UPDATE\" in false|0|no)\n ROOT_TRUST_ANCHOR_UPDATE=false ;;\n esac\nfi\n\ndo_resolvconf_start() {\n [ false != \"$RESOLVCONF\" -a -x /sbin/resolvconf ] || return 0\n\n unbound-checkconf $CHROOT_DIR/$UNBOUND_CONF -o interface | {\n default=yes\n while read interface; do\n default=\n # XXXX here, only localhost and all-zero addresses are handled\n # in case some other IP is specified it will not work\n case \"$interface\" in\n ( 0.0.0.0 | 127.0.0.1 ) echo \"nameserver 127.0.0.1\" ;;\n ( ::0 | ::1 ) echo \"nameserver ::1\" ;;\n esac\n done\n [ -z \"$default\" ] ||\n # unbound defaults to listening on localhost\n echo \"nameserver 127.0.0.1\"\n } | /sbin/resolvconf -a lo.unbound\n}\n\ndo_resolvconf_stop() {\n [ false != \"$RESOLVCONF\" -a -x /sbin/resolvconf ] || return 0\n\n /sbin/resolvconf -d lo.unbound\n}\n\ndo_chroot_setup() {\n [ -n \"$CHROOT_DIR\" -a -d \"$CHROOT_DIR\" ] || return 0\n if [ \"$CHROOT_DIR\" != \"$UNBOUND_BASE_DIR\" ]; then\n # we probably should not do the force-recreate but just a refresh\n rm -rf \"$CHROOT_DIR/$UNBOUND_BASE_DIR\"\n mkdir -p \"$CHROOT_DIR/$UNBOUND_BASE_DIR\"\n tar -C \"$UNBOUND_BASE_DIR\" -c . |\n tar -C \"$CHROOT_DIR/$UNBOUND_BASE_DIR\" -x\n fi\n if [ -S \"/run/systemd/notify\" ]; then\n if [ ! -e \"$CHROOT_DIR/run/systemd/notify\" ]; then\n mkdir -p \"$CHROOT_DIR/run/systemd\"\n touch \"$CHROOT_DIR/run/systemd/notify\"\n fi\n if ! mountpoint -q \"$CHROOT_DIR/run/systemd/notify\"; then\n mount --bind \"/run/systemd/notify\" \"$CHROOT_DIR/run/systemd/notify\"\n fi\n fi\n}\n\ndo_chroot_teardown() {\n if [ -n \"$CHROOT_DIR\" -a -d \"$CHROOT_DIR\" ] &&\n mountpoint -q \"$CHROOT_DIR/run/systemd/notify\"; then\n umount \"$CHROOT_DIR/run/systemd/notify\"\n fi\n}\n\ndo_root_trust_anchor_update() {\n [ false != \"$ROOT_TRUST_ANCHOR_UPDATE\" -a \\\n -n \"$ROOT_TRUST_ANCHOR_FILE\" -a \\\n -r \"$DNS_ROOT_KEY_FILE\" ] || return\n\n if [ ! -e \"$ROOT_TRUST_ANCHOR_FILE\" ] ||\n # we do not want to copy if unbound's file is more recent\n [ \"$DNS_ROOT_KEY_FILE\" -nt \"$ROOT_TRUST_ANCHOR_FILE\" ]; then\n\n echo \"Updating $ROOT_TRUST_ANCHOR_FILE from $DNS_ROOT_KEY_FILE\"\n # Copy to temp first and do mv only when done to ensure the file is in\n # good condition. Can use install(1) here to set correct owner but need\n # mv anyway, and doing both as root in an untrusted dir seems risky.\n setpriv --reuid=unbound --regid=unbound --clear-groups \\\n sh -c \"\\\n cp --remove-destination --preserve \\\n \\\"$DNS_ROOT_KEY_FILE\\\" \\\"$ROOT_TRUST_ANCHOR_FILE.tmp\\\" && \\\n mv -f \\\"$ROOT_TRUST_ANCHOR_FILE.tmp\\\" \\\"$ROOT_TRUST_ANCHOR_FILE\\\"\"\n fi\n}\n\ncase \"$1\" in\n ( resolvconf_start \\\n | resolvconf_stop \\\n | chroot_setup \\\n | chroot_teardown \\\n | root_trust_anchor_update \\\n )\n do_$1\n ;;\n\n (*)\n echo \"Usage: $0 {resolvconf_start|resolvconf_stop|chroot_setup|chroot_teardown|root_trust_anchor_update}\" >&2\n exit 1\n ;;\nesac\n" }, { "path": "aegir/conf/dns/unbound.conf", "content": "###\n### /etc/unbound/unbound.conf.d/unbound.conf\n###\nserver:\n # Log\n use-syslog: no\n logfile: \"/var/log/unbound/unbound.log\"\n log-time-ascii: yes\n verbosity: 1\n\n # Pid\n pidfile: \"/run/unbound/unbound.pid\"\n\n # Listen\n interface: 127.0.0.1\n port: 53\n do-tcp: yes\n do-ip4: yes\n do-udp: yes\n do-ip6: no\n prefer-ip6: no\n\n # Performance settings\n num-threads: 2\n so-rcvbuf: 1m\n so-sndbuf: 1m\n\n # Access control\n access-control: 127.0.0.0/8 allow\n access-control: ::1 allow\n access-control: 192.168.1.0/24 allow\n\n # DNSSEC configuration\n val-log-level: 2\n val-permissive-mode: no\n val-clean-additional: yes\n harden-dnssec-stripped: yes\n harden-below-nxdomain: yes\n harden-glue: yes\n\n # Prevent DNS rebinding attacks\n private-address: 192.168.0.0/16\n private-address: 172.16.0.0/12\n private-address: 10.0.0.0/8\n private-address: fd00::/8\n private-address: fe80::/10\n\n # Prefetching and caching\n prefetch: yes\n prefetch-key: yes\n cache-max-ttl: 14400\n cache-min-ttl: 900\n edns-buffer-size: 1232\n\n # TLS and DNS-over-TLS configuration (if needed)\n tls-cert-bundle: \"/etc/ssl/certs/ca-certificates.crt\"\n tls-port: 853\n tls-service-key: \"/etc/unbound/unbound_server.key\"\n tls-service-pem: \"/etc/unbound/unbound_server.pem\"\n\n # Misc\n chroot: \"\"\n hide-identity: yes\n hide-version: yes\n minimal-responses: yes\n qname-minimisation: yes\n rrset-roundrobin: yes\n root-hints: \"/var/lib/unbound/root.hints\"\n auto-trust-anchor-file: \"/var/lib/unbound/root.key\"\n use-caps-for-id: no\n\nremote-control:\n # Enable the control interface\n control-enable: yes\n\n # Define control interface\n control-interface: /run/unbound/unbound.ctl\n\n # Specify server key and certificate\n server-key-file: \"/etc/unbound/unbound_control.key\"\n server-cert-file: \"/etc/unbound/unbound_control.pem\"\n\n # Specify control key and certificate\n control-key-file: \"/etc/unbound/unbound_control.key\"\n control-cert-file: \"/etc/unbound/unbound_control.pem\"\n\ninclude-toplevel: \"/usr/etc/unbound/unbound.conf.d/*.conf\"\n" }, { "path": "aegir/conf/droplet/droplet-agent", "content": "#!/usr/bin/env bash\n### BEGIN INIT INFO\n# Provides: droplet-agent\n# Required-Start: $remote_fs $syslog $network\n# Required-Stop: $remote_fs $syslog $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: DigitalOcean Droplet Agent\n### END INIT INFO\n\n_PATHS=\"/usr/bin/droplet-agent /usr/local/bin/droplet-agent /opt/digitalocean/bin/droplet-agent /opt/digitalocean/droplet-agent/droplet-agent\"\n_DAEMON=\"\"\n_NAME=\"droplet-agent\"\n_DESC=\"DigitalOcean Droplet Agent\"\n_PIDFILE=\"/run/${_NAME}.pid\"\n_USER=\"root\"\n_NICE=\"0\"\n\n_for_each_path() {\n for _P in ${_PATHS}; do\n if [ -x \"${_P}\" ]; then _DAEMON=\"${_P}\"; return 0; fi\n done\n return 1\n}\n\n_do_start() {\n if [ -z \"${_DAEMON}\" ] && ! _for_each_path; then\n echo \"${_DESC}: binary not found\"; return 1\n fi\n start-stop-daemon --start --quiet --background \\\n --make-pidfile --pidfile \"${_PIDFILE}\" \\\n --chuid \"${_USER}\" --nicelevel \"${_NICE}\" \\\n --exec \"${_DAEMON}\" -- || return 1\n return 0\n}\n\n_do_stop() {\n if [ -f \"${_PIDFILE}\" ]; then\n start-stop-daemon --stop --quiet --pidfile \"${_PIDFILE}\" --retry=TERM/15/KILL/5\n rm -f \"${_PIDFILE}\" 2>/dev/null || true\n return 0\n fi\n pkill -f \"${_NAME}\" 2>/dev/null || true\n return 0\n}\n\n_do_status() {\n if [ -f \"${_PIDFILE}\" ] && ps -p \"$(cat \"${_PIDFILE}\" 2>/dev/null)\" >/dev/null 2>&1; then\n echo \"${_DESC} is running (pid $(cat \"${_PIDFILE}\"))\"\n return 0\n fi\n pgrep -f \"${_NAME}\" >/dev/null 2>&1 && { echo \"${_DESC} seems running (no pidfile)\"; return 0; }\n echo \"${_DESC} is not running\"\n return 3\n}\n\ncase \"$1\" in\n start) _do_start ;;\n stop) _do_stop ;;\n restart) _do_stop; _do_start ;;\n status) _do_status ;;\n *) echo \"Usage: $0 {start|stop|restart|status}\"; exit 2 ;;\nesac\n" }, { "path": "aegir/conf/etc/etc-ImageMagick-6-policy.xml", "content": "\n\n \n \n \n]>\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n" }, { "path": "aegir/conf/ftpd/ftpusers", "content": "root\ndaemon\nbin\nsys\nsync\ngames\nman\nlp\nmail\nnews\nuucp\nnobody\n" }, { "path": "aegir/conf/ftpd/pure-config.pl.txt", "content": "#! /usr/bin/perl\n\n# (C) 2001-2009 Aristotle Pagaltzis\n# derived from code (C) 2001-2002 Frank Denis and Matthias Andree\n\nuse strict;\n\nmy ($conffile, @flg) = @ARGV;\n\nmy $PUREFTPD;\n-x && ($PUREFTPD=$_, last) for qw(\n\t${exec_prefix}/sbin/pure-ftpd\n\t/usr/local/pure-ftpd/sbin/pure-ftpd\n\t/usr/local/pureftpd/sbin/pure-ftpd\n\t/usr/local/sbin/pure-ftpd\n\t/usr/sbin/pure-ftpd\n\t/opt/sbin/pure-ftpd\n);\n\nmy %simple_switch_for = (\n\tIPV4Only\t\t\t=> \"-4\",\n\tIPV6Only\t\t\t=> \"-6\", \n\tChrootEveryone\t\t\t=> \"-A\",\n\tBrokenClientsCompatibility\t=> \"-b\",\n\tDaemonize\t\t\t=> \"-B\",\n\tVerboseLog\t\t\t=> \"-d\",\n\tDisplayDotFiles\t\t\t=> \"-D\",\n\tAnonymousOnly\t\t\t=> \"-e\",\n\tNoAnonymous\t\t\t=> \"-E\",\n\tDontResolve\t\t\t=> \"-H\",\n\tAnonymousCanCreateDirs\t\t=> \"-M\",\n\tNATmode\t\t\t\t=> \"-N\",\n\tCallUploadScript\t\t=> \"-o\",\n\tAntiWarez\t\t\t=> \"-s\",\n\tAllowUserFXP\t\t\t=> \"-w\",\n\tAllowAnonymousFXP\t\t=> \"-W\",\n\tProhibitDotFilesWrite\t\t=> \"-x\",\n\tProhibitDotFilesRead\t\t=> \"-X\",\n\tAllowDotFiles\t\t\t=> \"-z\",\n\tAutoRename\t\t\t=> \"-r\",\n\tAnonymousCantUpload\t\t=> \"-i\",\n\tLogPID\t\t\t\t=> \"-1\",\n\tNoChmod\t\t\t\t=> \"-R\",\n\tKeepAllFiles\t\t\t=> \"-K\",\n\tCreateHomeDir\t\t\t=> \"-j\",\n\tNoRename\t\t\t=> \"-G\",\n\tCustomerProof\t\t\t=> \"-Z\",\n\tNoTruncate\t\t\t=> \"-0\",\n);\n\nmy %string_switch_for = (\n \tFileSystemCharset\t=> \"-8\",\n\tClientCharset\t\t=> \"-9\",\n\tSyslogFacility\t\t=> \"-f\",\n\tFortunesFile\t\t=> \"-F\",\n\tForcePassiveIP\t\t=> \"-P\",\n\tBind\t\t\t=> \"-S\",\n\tAnonymousBandwidth\t=> \"-t\",\n\tUserBandwidth\t\t=> \"-T\",\n\tTrustedIP\t\t=> \"-V\",\n\tAltLog\t\t\t=> \"-O\",\n\tPIDFile\t\t\t=> \"-g\",\n);\n\nmy %numeric_switch_for = (\n\tMaxIdleTime\t\t=> \"-I\",\n\tMaxDiskUsage\t\t=> \"-k\",\n\tTrustedGID\t\t=> \"-a\",\n\tMaxClientsNumber\t=> \"-c\",\n\tMaxClientsPerIP\t\t=> \"-C\",\n\tMaxLoad\t\t\t=> \"-m\",\n\tMinUID\t\t\t=> \"-u\",\n\tTLS\t\t\t=> \"-Y\",\n);\n\nmy %numpairb_switch_for = (\n\tLimitRecursion\t\t=> \"-L\",\n\tPassivePortRange\t=> \"-p\",\n\tAnonymousRatio\t\t=> \"-q\",\n\tUserRatio\t\t=> \"-Q\",\n);\n\nmy %numpairc_switch_for = (\n\tUmask\t\t=> \"-U\",\n\tQuota\t\t=> \"-n\",\n\tPerUserLimits\t=> \"-y\",\n);\n\nmy %auth_method_for = (\n\tLDAPConfigFile\t\t=> \"ldap\",\n\tMySQLConfigFile\t\t=> \"mysql\",\n\tPGSQLConfigFile\t\t=> \"pgsql\",\n\tPureDB\t\t\t=> \"puredb\",\n\tExtAuth\t\t\t=> \"extauth\",\n);\n\nmy $simple_switch = qr/(@{[join \"|\", keys %simple_switch_for ]})\\s+yes/i;\nmy $string_switch = qr/(@{[join \"|\", keys %string_switch_for ]})\\s+(\\S+)/i;\nmy $numeric_switch = qr/(@{[join \"|\", keys %numeric_switch_for ]})\\s+(\\d+)/i;\nmy $numpairb_switch = qr/(@{[join \"|\", keys %numpairb_switch_for ]})\\s+(\\d+)\\s+(\\d+)/i;\nmy $numpairc_switch = qr/(@{[join \"|\", keys %numpairc_switch_for ]})\\s+(\\d+):(\\d+)/i;\nmy $auth_method = qr/(@{[join \"|\", keys %auth_method_for ]})\\s+(\\S+)/i;\n\ndie \"Usage: pure-config.pl [extra options]\\n\"\n\tunless defined $conffile;\n\nopen CONF, \"< $conffile\" or die \"Can't open $conffile: $!\\n\";\n\n!/^\\s*(?:$|#)/ and (chomp, push @flg,\n\t/$simple_switch/i\t\t? ($simple_switch_for{$1}) :\n\t/$string_switch/i\t\t? ($string_switch_for{$1} . $2) :\n\t/$numeric_switch/i\t\t? ($numeric_switch_for{$1} . $2) :\n\t/$numpairb_switch/i\t\t? ($numpairb_switch_for{$1} . \"$2:$3\") :\n\t/$numpairc_switch/i\t\t? ($numpairc_switch_for{$1} . \"$2:$3\") :\n\t/$auth_method/i\t\t\t? (\"-l\" . \"$auth_method_for{$1}:$2\") :\n\t/UnixAuthentication\\s+yes/i\t? (\"-l\" . \"unix\") :\n\t/PAMAuthentication\\s+yes/i\t? (\"-l\" . \"pam\") :\n\t()\n) while ;\n\nclose CONF;\n\nprint \"Running: $PUREFTPD \", join(\" \", @flg), \"\\n\";\nexec { $PUREFTPD } ($PUREFTPD, @flg) or die \"cannot exec $PUREFTPD: $!\";\n" }, { "path": "aegir/conf/ftpd/pure-ftpd.conf", "content": "\n############################################################\n# #\n# Configuration file for pure-ftpd #\n# #\n############################################################\n\n# If you want to run Pure-FTPd with this configuration\n# instead of command-line options, please run the\n# following command :\n#\n# ${exec_prefix}/sbin/sbin/pure-ftpd /etc/pure-ftpd.conf\n#\n# Online documentation:\n# https://www.pureftpd.org/project/pure-ftpd/doc\n\n\n# Restrict users to their home directory\n\nChrootEveryone yes\n\n\n\n# If the previous option is set to \"no\", members of the following group\n# won't be restricted. Others will be. If you don't want chroot()ing anyone,\n# just comment out ChrootEveryone and TrustedGID.\n\n# TrustedGID 100\n\n\n\n# Turn on compatibility hacks for broken clients\n\nBrokenClientsCompatibility yes\n\n\n\n# Maximum number of simultaneous users\n\nMaxClientsNumber 50\n\n\n\n# Run as a background process\n\nDaemonize yes\n\n\n\n# Maximum number of simultaneous clients with the same IP address\n\nMaxClientsPerIP 8\n\n\n\n# If you want to log all client commands, set this to \"yes\".\n# This directive can be specified twice to also log server responses.\n\nVerboseLog yes\n\n\n\n# List dot-files even when the client doesn't send \"-a\".\n\nDisplayDotFiles no\n\n\n\n# Disallow authenticated users - Act only as a public FTP server.\n\nAnonymousOnly no\n\n\n\n# Disallow anonymous connections. Only accept authenticated users.\n\nNoAnonymous yes\n\n\n\n# Syslog facility (auth, authpriv, daemon, ftp, security, user, local*)\n# The default facility is \"ftp\". \"none\" disables logging.\n\nSyslogFacility ftp\n\n\n\n# Display fortune cookies\n\n# FortunesFile /usr/share/fortune/zippy\n\n\n\n# Don't resolve host names in log files. Recommended unless you trust\n# reverse host names, and don't care about DNS resolution being possibly slow.\n\nDontResolve yes\n\n\n\n# Maximum idle time in minutes (default = 15 minutes)\n\nMaxIdleTime 15\n\n\n\n# LDAP configuration file (see README.LDAP)\n\n# LDAPConfigFile /etc/pureftpd-ldap.conf\n\n\n\n# MySQL configuration file (see README.MySQL)\n\n# MySQLConfigFile /etc/pureftpd-mysql.conf\n\n\n# PostgreSQL configuration file (see README.PGSQL)\n\n# PGSQLConfigFile /etc/pureftpd-pgsql.conf\n\n\n# PureDB user database (see README.Virtual-Users)\n\n# PureDB /etc/pureftpd.pdb\n\n\n# Path to pure-authd socket (see README.Authentication-Modules)\n\n# ExtAuth /run/ftpd.sock\n\n\n\n# If you want to enable PAM authentication, uncomment the following line\n\n# PAMAuthentication yes\n\n\n\n# If you want simple Unix (/etc/passwd) authentication, uncomment this\n\nUnixAuthentication yes\n\n\n\n# Please note that LDAPConfigFile, MySQLConfigFile, PAMAuthentication and\n# UnixAuthentication can be used specified once, but can be combined\n# together. For instance, if you use MySQLConfigFile, then UnixAuthentication,\n# the SQL server will be used first. If the SQL authentication fails because the\n# user wasn't found, a new attempt will be done using system authentication.\n# If the SQL authentication fails because the password didn't match, the\n# authentication chain stops here. Authentication methods are chained in\n# the order they are given.\n\n\n\n# 'ls' recursion limits. The first argument is the maximum number of\n# files to be displayed. The second one is the max subdirectories depth.\n\nLimitRecursion 10000 8\n\n\n\n# Are anonymous users allowed to create new directories?\n\nAnonymousCanCreateDirs no\n\n\n\n# If the system load is greater than the given value, anonymous users\n# aren't allowed to download.\n\nMaxLoad 4\n\n\n\n# Port range for passive connections - keep it as broad as possible.\n\nPassivePortRange 30000 50000\n\n\n\n# Force an IP address in PASV/EPSV/SPSV replies. - for NAT.\n# Symbolic host names are also accepted for gateways with dynamic IP\n# addresses.\n\n# ForcePassiveIP 192.168.0.1\n\n\n\n# Upload/download ratio for anonymous users.\n\n# AnonymousRatio 1 10\n\n\n\n# Upload/download ratio for all users.\n# This directive supersedes the previous one.\n\n# UserRatio 1 10\n\n\n\n# Disallow downloads of files owned by the \"ftp\" system user;\n# files that were uploaded but not validated by a local admin.\n\nAntiWarez yes\n\n\n\n# IP address/port to listen to (default=all IP addresses, port 21).\n\n# Bind 127.0.0.1,21\n\n\n\n# Maximum bandwidth for anonymous users in KB/s\n\n# AnonymousBandwidth 8\n\n\n\n# Maximum bandwidth for *all* users (including anonymous) in KB/s\n# Use AnonymousBandwidth *or* UserBandwidth, not both.\n\n# UserBandwidth 8\n\n\n\n# File creation mask. : .\n# 177:077 if you feel paranoid.\n\nUmask 113:002\n\n\n# Minimum UID for an authenticated user to log in.\n# For example, a value of 100 prevents all users whose user id is below\n# 100 from logging in. If you want \"root\" to be able to log in, use 0.\n\nMinUID 100\n\n\n\n# Allow FXP transfers for authenticated users.\n\nAllowUserFXP yes\n\n\n\n# Allow anonymous FXP for anonymous and non-anonymous users.\n\nAllowAnonymousFXP no\n\n\n\n# Users can't delete/write files starting with a dot ('.')\n# even if they own them. But if TrustedGID is enabled, that group\n# will exceptionally have access to dot-files.\n\nProhibitDotFilesWrite no\n\n\n\n# Prohibit *reading* of files starting with a dot (.history, .ssh...)\n\nProhibitDotFilesRead no\n\n\n\n# Don't overwrite files. When a file whose name already exist is uploaded,\n# it gets automatically renamed to file.1, file.2, file.3, ...\n\nAutoRename no\n\n\n\n# Prevent anonymous users from uploading new files (no = upload is allowed)\n\nAnonymousCantUpload yes\n\n\n\n# Only connections to this specific IP address are allowed to be\n# non-anonymous. You can use this directive to open several public IPs for\n# anonymous FTP, and keep a private firewalled IP for remote administration.\n# You can also only allow a non-routable local IP (such as 10.x.x.x) for\n# authenticated users, and run a public anon-only FTP server on another IP.\n\n# TrustedIP 10.1.1.1\n\n\n\n# To add the PID to log entries, uncomment the following line.\n\n# LogPID yes\n\n\n\n# Create an additional log file with transfers logged in a Apache-like format :\n# fw.c9x.org - jedi [13/Apr/2017:19:36:39] \"GET /ftp/linux.tar.bz2\" 200 21809338\n# This log file can then be processed by common HTTP traffic analyzers.\n\n# AltLog clf:/var/log/pureftpd.log\n\n\n\n# Create an additional log file with transfers logged in a format optimized\n# for statistic reports.\n\n# AltLog stats:/var/log/pureftpd.log\n\n\n\n# Create an additional log file with transfers logged in the standard W3C\n# format (compatible with many HTTP log analyzers)\n\nAltLog w3c:/var/log/pureftpd.log\n\n\n\n# Disallow the CHMOD command. Users cannot change perms of their own files.\n\n# NoChmod yes\n\n\n\n# Allow users to resume/upload files, but *NOT* to delete them.\n\n# KeepAllFiles yes\n\n\n\n# Automatically create home directories if they are missing\n\n# CreateHomeDir yes\n\n\n\n# Enable virtual quotas. The first value is the max number of files.\n# The second value is the maximum size, in megabytes.\n# So 1000:10 limits every user to 1000 files and 10 Mb.\n\n# Quota 1000:10\n\n\n\n# If your pure-ftpd has been compiled with standalone support, you can change\n# the location of the pid file. The default is /run/pure-ftpd.pid\n\nPIDFile /run/pure-ftpd.pid\n\n\n\n# If your pure-ftpd has been compiled with pure-uploadscript support,\n# this will make pure-ftpd write info about new uploads to\n# /run/pure-ftpd.upload.pipe so pure-uploadscript can read it and\n# spawn a script to handle the upload.\n# Don't enable this option if you don't actually use pure-uploadscript.\n\n# CallUploadScript yes\n\n\n\n# This option is useful on servers where anonymous upload is\n# allowed. When the partition is more that percententage full,\n# new uploads are disallowed.\n\nMaxDiskUsage 90\n\n\n\n# Set to 'yes' to prevent users from renaming files.\n\n# NoRename yes\n\n\n\n# Be 'customer proof': forbids common customer mistakes such as\n# 'chmod 0 public_html', that are valid, but can cause customers to\n# unintentionally shoot themselves in the foot.\n\nCustomerProof yes\n\n\n\n# Per-user concurrency limits. Will only work if the FTP server has\n# been compiled with --with-peruserlimits.\n# Format is: :\n# For example, 3:20 means that an authenticated user can have up to 3 active\n# sessions, and that up to 20 anonymous sessions are allowed.\n\n# PerUserLimits 3:20\n\n\n\n# When a file is uploaded and there was already a previous version of the file\n# with the same name, the old file will neither get removed nor truncated.\n# The file will be stored under a temporary name and once the upload is\n# complete, it will be atomically renamed. For example, when a large PHP\n# script is being uploaded, the web server will keep serving the old version and\n# later switch to the new one as soon as the full file will have been\n# transferred. This option is incompatible with virtual quotas.\n\n# NoTruncate yes\n\n\n\n# This option accepts three values:\n# 0: disable SSL/TLS encryption layer (default).\n# 1: accept both cleartext and encrypted sessions.\n# 2: refuse connections that don't use the TLS security mechanism,\n# including anonymous sessions.\n# Do _not_ uncomment this blindly. Double check that:\n# 1) The server has been compiled with TLS support (--with-tls),\n# 2) A valid certificate is in place,\n# 3) Only compatible clients will log in.\n\nTLS 2\n\n\n# Cipher suite for TLS sessions.\n# The default suite is secure and setting this property is usually\n# only required to *lower* the security to cope with legacy clients.\n# Prefix with -C: in order to require valid client certificates.\n# If -C: is used, make sure that clients' public keys are present on\n# the server.\n\n# TLSCipherSuite HIGH\n\n\n\n# Certificate file, for TLS\n# The certificate itself and the keys can be bundled into the same\n# file or split into two files.\n# CertFile is for a cert+key bundle, CertFileAndKey for separate files.\n# Use only one of these.\n\n# CertFile /etc/ssl/private/pure-ftpd.pem\n# CertFileAndKey \"/etc/pure-ftpd.pem\" \"/etc/pure-ftpd.key\"\n\n\n\n# Unix socket of the external certificate handler, for TLS\n\n# ExtCert /run/ftpd-certs.sock\n\n\n# Listen only to IPv4 addresses in standalone mode (ie. disable IPv6)\n# By default, both IPv4 and IPv6 are enabled.\n\n# IPV4Only yes\n\n\n\n# Listen only to IPv6 addresses in standalone mode (i.e. disable IPv4)\n# By default, both IPv4 and IPv6 are enabled.\n\n# IPV6Only yes\n\n" }, { "path": "aegir/conf/global/global-10.inc", "content": "= 8) {\n $config['automated_cron.settings']['interval'] = 0;\n $config['mail_safety.settings']['default_mail_address'] = '';\n $config['mail_safety.settings']['enabled'] = TRUE;\n $config['mail_safety.settings']['send_mail_to_dashboard'] = TRUE;\n $config['mail_safety.settings']['send_mail_to_default_mail'] = FALSE;\n $config['scheduler.settings']['lightweight_cron_access_key'] = '';\n $config['simple_cron.settings']['interval'] = 0;\n $config['system.cron']['key'] = '';\n $config['system.cron']['last'] = 0;\n $config['system.cron']['threshold']['auto'] = 0;\n $config['ultimate_cron.job.cron_queue']['status'] = FALSE;\n $config['ultimate_cron.settings']['scheduler'] = 'never';\n }\n else {\n $conf['mail_safety_enabled'] = TRUE;\n $conf['mail_safety_send_mail_to_dashboard'] = TRUE;\n }\n}\n\n/**\n * Use site specific composer_manager dir\n */\nif ($all_ini['set_composer_manager_vendor_dir'] && !$is_install) {\n if ($drupal_core >= 8) {\n $config['composer_manager.settings']['vendor_dir'] = 'sites/' . $_SERVER['SERVER_NAME'] . '/vendor';\n }\n else {\n $conf['composer_manager_vendor_dir'] = 'sites/' . $_SERVER['SERVER_NAME'] . '/vendor';\n }\n}\n\n/**\n * Domain Access Module Paths Detection\n */\nif ($all_ini['auto_detect_domain_access_integration']) {\n if (is_readable('sites/all/modules/domain/settings.inc')) {\n $da_inc = 'sites/all/modules/domain/settings.inc';\n }\n elseif (is_readable('sites/all/modules/contrib/domain/settings.inc')) {\n $da_inc = 'sites/all/modules/contrib/domain/settings.inc';\n }\n elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/domain/settings.inc')) {\n $da_inc = 'profiles/' . $conf['install_profile'] . '/modules/domain/settings.inc';\n }\n elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/contrib/domain/settings.inc')) {\n $da_inc = 'profiles/' . $conf['install_profile'] . '/modules/contrib/domain/settings.inc';\n }\n}\n\n/**\n * Domain Access Module inc should not be loaded during installation\n */\nif ($is_install) {\n $da_inc = FALSE;\n}\n\n/**\n * Domain Access Module inc loading\n */\nif (!$custom_da) {\n if ($da_inc) {\n require_once($da_inc);\n }\n}\n\n/**\n * Drupal for Facebook (fb)\n *\n * Important:\n * Facebook client libraries will not work properly if arg_separator.output is not &\n * The default value is &. Change this in settings.php. Make the value \"&\"\n * https://drupal.org/node/205476\n */\nif (!$custom_fb && $all_ini['auto_detect_facebook_integration']) {\n if (is_readable('sites/all/modules/fb/fb_settings.inc')) {\n ini_set('arg_separator.output', '&');\n require_once \"sites/all/modules/fb/fb_settings.inc\";\n $conf['fb_api_file'] = \"sites/all/modules/fb/facebook-platform/php/facebook.php\";\n }\n elseif (is_readable('sites/all/modules/contrib/fb/fb_settings.inc')) {\n ini_set('arg_separator.output', '&');\n require_once \"sites/all/modules/contrib/fb/fb_settings.inc\";\n $conf['fb_api_file'] = \"sites/all/modules/contrib/fb/facebook-platform/php/facebook.php\";\n }\n elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/fb/fb_settings.inc')) {\n ini_set('arg_separator.output', '&');\n require_once 'profiles/' . $conf['install_profile'] . '/modules/fb/fb_settings.inc';\n $conf['fb_api_file'] = 'profiles/' . $conf['install_profile'] . '/modules/fb/facebook-platform/php/facebook.php';\n }\n elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/contrib/fb/fb_settings.inc')) {\n ini_set('arg_separator.output', '&');\n require_once 'profiles/' . $conf['install_profile'] . '/modules/contrib/fb/fb_settings.inc';\n $conf['fb_api_file'] = 'profiles/' . $conf['install_profile'] . '/modules/contrib/fb/facebook-platform/php/facebook.php';\n }\n}\n\n/**\n * Unset config arrays on non-dev URLs\n */\nif (!$is_dev) {\n unset($boa_ini);\n unset($usr_plr_ini);\n unset($usr_loc_ini);\n unset($all_ini);\n}\n" }, { "path": "aegir/conf/global/global-front-end.inc", "content": "= 7) {\n ini_set('session.cookie_secure', TRUE);\n if ($is_dev) {\n header('X-Cookie-Sec: YES');\n }\n }\n }\n if ($is_dev) {\n header('X-Local-Proto: https');\n }\n }\n else {\n if ($site_subdir && $raw_host) {\n $base_url = 'http://' . $raw_host . '/' . $site_subdir;\n }\n else {\n $base_url = 'http://' . $_SERVER['HTTP_HOST'];\n }\n }\n }\n else {\n if ($site_subdir && $raw_host) {\n $base_url = 'http://' . $raw_host . '/' . $site_subdir;\n }\n else {\n $base_url = 'http://' . $_SERVER['HTTP_HOST'];\n }\n }\n\n if ($base_url && $is_dev) {\n header(\"X-Base-Url: \" . $base_url);\n }\n\n if ($site_subdir && $is_dev) {\n header(\"X-Site-Subdir: \" . $site_subdir);\n }\n\n if ($all_ini['server_name_cookie_domain']) {\n $domain = '.' . preg_replace('`^www\\.`', '', $_SERVER['SERVER_NAME']);\n }\n elseif ($site_subdir && isset($_SERVER['RAW_HOST'])) {\n $domain = '.' . preg_replace('`^www\\.`', '', $_SERVER['RAW_HOST']);\n }\n else {\n $domain = '.' . preg_replace('`^www\\.`', '', $_SERVER['HTTP_HOST']);\n }\n $domain = str_replace('..', '.', $domain);\n if (count(explode('.', $domain)) > 2 &&\n !is_numeric(str_replace('.', '', $domain))) {\n ini_set('session.cookie_domain', $domain);\n $cookie_domain = $domain;\n header(\"X-Cookie-Domain: \" . $cookie_domain);\n }\n\n $this_prefix = preg_replace('`^www\\.`', '', $_SERVER['SERVER_NAME']) . '_z_';\n if ($is_dev) {\n header(\"X-Valkey-Prefix: \" . $this_prefix);\n }\n\n if (isset($_SERVER['REQUEST_TIME']) &&\n isset($_SERVER['REMOTE_ADDR']) &&\n isset($_SERVER['HTTP_USER_AGENT']) &&\n !preg_match(\"/^\\/esi\\//\", $_SERVER['REQUEST_URI'])) {\n\n // Determine if the site is running on HTTPS\n $request_type = 'NONSSL';\n if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) || isset($_SERVER['HTTPS'])) {\n $request_type = ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' || $_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL';\n }\n if ($request_type == \"SSL\") {\n $is_https = TRUE;\n if ($is_dev) {\n header('X-Request-Type:' . $request_type);\n }\n }\n else {\n $is_https = FALSE;\n if ($is_dev) {\n header('X-Request-Type:' . $request_type);\n }\n }\n\n // Create a unique identifier for the request\n $identity = $_SERVER['REQUEST_TIME'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['SERVER_NAME'] . $_SERVER['HTTP_USER_AGENT'];\n $identity = 'BD' . md5($identity);\n if ($is_dev) {\n header('X-Identity:' . $identity);\n }\n\n if ($drupal_core >= 8) {\n // Check if the user is logged in by looking for the session cookie.\n // The session cookie name starts with \"SESS\" or \"SSESS\" followed by a hash.\n // This check is not site specific in Drupal 8+ like it is in Drupal 7\n // or Drupal 6, but should be sufficient for the intended use case below.\n $cookie_prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS';\n $is_logged_in = FALSE;\n foreach ($_COOKIE as $key => $value) {\n if (strpos($key, $cookie_prefix) == 0) {\n $is_logged_in = TRUE;\n break;\n }\n }\n if ($is_dev) {\n header('X-Cookie-Prefix-A:' . $cookie_prefix);\n header('X-Is-Logged-In-A:' . $is_logged_in);\n }\n }\n elseif ($drupal_core == 7) {\n // For Drupal 7 use sha256 hash and cookie prefix based on session.cookie_secure\n $cookie_prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS';\n $test_sess_name = $cookie_prefix . substr(hash('sha256', $cookie_domain), 0, 32);\n if ($is_dev) {\n header('X-Cookie-Prefix-B:' . $cookie_prefix);\n header('X-Test-Sess-Name-B:' . $test_sess_name);\n }\n }\n else {\n // For Drupal 6 use md5 hash and SESS prefix only\n $cookie_prefix = 'SESS';\n $test_sess_name = $cookie_prefix . md5($cookie_domain);\n if ($is_dev) {\n header('X-Cookie-Prefix-C:' . $cookie_prefix);\n header('X-Test-Sess-Name-C:' . $test_sess_name);\n }\n }\n\n // Check if the session cookie is present\n if (isset($_COOKIE[$test_sess_name]) || $is_logged_in) {\n $is_anon = 'LOGGED';\n }\n else {\n $is_anon = 'ANONYMOUS';\n }\n if ($is_dev) {\n header('X-Is-Anon:' . $is_anon);\n }\n\n // Redirect not logged in visitors to homepage to protect admin URLs from bots\n if ($is_anon == 'ANONYMOUS') {\n if (preg_match(\"/\\/(?:node\\/[0-9]+\\/edit|node\\/add)/\", $_SERVER['REQUEST_URI'])) {\n if (empty($all_ini['allow_anon_node_add'])) {\n header(\"Location: \" . $base_url . \"/\", true, 301);\n exit;\n }\n }\n if (preg_match(\"/^\\/(?:[a-z]{2}\\/)?(?:admin|logout|privatemsg|approve)/\", $_SERVER['REQUEST_URI'])) {\n if (empty($all_ini['disable_admin_dos_protection'])) {\n header(\"Location: \" . $base_url . \"/\", true, 301);\n exit;\n }\n }\n }\n\n // Additional logic for caching or other needs\n if ($is_anon == 'ANONYMOUS' && !empty($all_ini['speed_booster_anon_cache_ttl']) && preg_match(\"/^[0-9]{2,}$/\", $all_ini['speed_booster_anon_cache_ttl'])) {\n if ($all_ini['speed_booster_anon_cache_ttl'] > 10) {\n $expire_in_seconds = $all_ini['speed_booster_anon_cache_ttl'];\n header('X-Limit-Booster:' . $all_ini['speed_booster_anon_cache_ttl']);\n }\n }\n\n // Prevent turning the feature server site into a spam machine\n // Disable self-registration also on hostmaster\n if ($conf['install_profile'] == 'feature_server' ||\n $conf['install_profile'] == 'hostmaster') {\n $conf['user_register'] = 0; // Force \"Only site administrators can create new user accounts\"\n }\n if (!$is_bot && !$high_traffic) {\n if (preg_match(\"/^\\/(?:[a-z]{2}\\/)?(?:admin|cart|checkout|logout|privatemsg)/\", $_SERVER['REQUEST_URI']) ||\n preg_match(\"/\\/(?:node\\/[0-9]+\\/edit|node\\/add|comment\\/reply|approve|ajax_comments|commerce_currency_select)/\", $_SERVER['REQUEST_URI']) ||\n preg_match(\"/(?:^dev\\.|\\.dev\\.|\\.devel\\.)/\", $_SERVER['HTTP_HOST'])) {\n $expire_in_seconds = '1';\n header('X-Limit-Booster: 1');\n }\n if (isset($_SERVER['REQUEST_URI']) &&\n preg_match(\"/(?:x-progress-id|ahah|progress\\/|autocomplete|ajax|batch|js\\/.*)/i\", $_SERVER['REQUEST_URI'])) {\n $expire_in_seconds = '0';\n if ($is_dev) {\n header('X-Skip-Booster: AjaxRU');\n }\n }\n if (isset($_SERVER['QUERY_STRING']) &&\n preg_match(\"/(?:x-progress-id|ahah|progress\\/|autocomplete|ajax|batch|js\\/.*)/i\", $_SERVER['QUERY_STRING'])) {\n $expire_in_seconds = '0';\n if ($is_dev) {\n header('X-Skip-Booster: AjaxQS');\n }\n }\n if (isset($_SERVER['REQUEST_METHOD']) &&\n $_SERVER['REQUEST_METHOD'] == 'POST') {\n if (!isset($_COOKIE['NoCacheID'])) {\n $lifetime = '15';\n setcookie('NoCacheID', 'POST' . $identity, $_SERVER['REQUEST_TIME'] + $lifetime, '/', $cookie_domain);\n }\n $expire_in_seconds = '0';\n if ($is_dev) {\n header('X-Skip-Booster: PostRM');\n }\n }\n }\n if ($is_bot) {\n if (!preg_match(\"/Pingdom/i\", $_SERVER['HTTP_USER_AGENT']) &&\n !preg_match(\"/(?:rss|feed)/i\", $_SERVER['REQUEST_URI'])) {\n $expire_in_seconds = '3600';\n if ($is_dev) {\n header('X-Bot-Booster: 3600');\n }\n }\n }\n if ($conf['install_profile'] != 'hostmaster' && ($expire_in_seconds > -1)) {\n header(\"X-Accel-Expires: \" . $expire_in_seconds);\n if ($expire_in_seconds > -1 && $expire_in_seconds < 2) {\n $conf['cache'] = 0; // Disable page caching on the fly\n }\n }\n }\n}\n\n\n/**\n * Support files/styles with short URIs also for files not generated yet\n */\nif (preg_match(\"/^\\/files\\/styles\\//\", $_SERVER['REQUEST_URI'])) {\n header(\"Location: \" . $base_url . \"/sites/\" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'], true, 301);\n exit;\n}\n" }, { "path": "aegir/conf/global/global-if-redis.inc", "content": "= 6) {\n $use_valkey = TRUE;\n}\n\nif (isset($_SERVER['SERVER_NAME'])) {\n if ($all_ini['valkey_cache_disable'] || $all_ini['redis_cache_disable']) {\n $use_valkey = FALSE;\n }\n}\n\nif (!$is_bot && isset($_SERVER['REQUEST_URI'])) {\n if (preg_match(\"/noredis=1/\", $_SERVER['REQUEST_URI'])) {\n $use_valkey = FALSE;\n }\n}\n\n/* ---------------- Defaults -------------------------------------------- */\n$valkey_up = FALSE;\n\n/* ---------------- Connection targets ---------------------------------- */\n$valkey_socket_path = '/run/valkey/valkey.sock';\n$valkey_host = '127.0.0.1';\n$valkey_port = 6379;\n$valkey_pass_file = '/data/conf/valkey/pass.inc';\n\n/* ---------------- Timeouts & backoff ---------------------------------- */\n$connect_timeout_s = 0.2; // short and non-blocking feel\n$read_timeout_s = 0.2; // keep calls snappy\n$backoff_ttl_s = 60; // do not retry within this window after a failure\n$flag_dir_run = '/var/tmp/fpm';\n$flag_file_fallback = '/data/conf/arch/valkey.disabled.flag'; // fallback\n\n/* ---------------- Optional debug log ---------------------------------- */\n// Set to an absolute path to enable lightweight probe logging.\n// Example: '/var/tmp/fpm/valkey-fallback.log'\n$redis_debug_log = '';\n\n/* ---------------- Helpers (filesystem only) ---------------------------- */\nfunction _valkey_backoff_flag_path($flag_dir_run, $fallback) {\n $path = $fallback;\n if (is_dir($flag_dir_run)) {\n if (is_writable($flag_dir_run)) {\n $path = rtrim($flag_dir_run, '/').'/valkey.disabled.flag';\n }\n }\n return $path;\n}\n\nfunction _valkey_backoff_is_active($flag_path, $ttl) {\n $active = FALSE;\n if (is_file($flag_path)) {\n $age = time() - @filemtime($flag_path);\n if ($age >= 0 && $age < $ttl) {\n $active = TRUE;\n }\n }\n return $active;\n}\n\nfunction _valkey_backoff_touch($flag_path) {\n @touch($flag_path);\n}\n\nfunction _valkey_backoff_clear($flag_path) {\n if (is_file($flag_path)) {\n @unlink($flag_path);\n }\n}\n\nfunction _valkey_dbg_write($log_path, $line) {\n if (!empty($log_path)) {\n $msg = date('c').' '.$line.\"\\n\";\n @file_put_contents($log_path, $msg, FILE_APPEND);\n }\n}\n\n/* ------------------- Probe Valkey once with guard --------------------- */\n$flag_path = _valkey_backoff_flag_path($flag_dir_run, $flag_file_fallback);\n$skip_probe = _valkey_backoff_is_active($flag_path, $backoff_ttl_s);\n\nif ($use_valkey) {\n if (!$skip_probe) {\n if (class_exists('Redis')) {\n $r = new Redis();\n $connected = FALSE;\n $last_reason = 'init';\n\n // Try socket first.\n if (!empty($valkey_socket_path) && @is_readable($valkey_socket_path)) {\n try {\n $connected = $r->connect($valkey_socket_path);\n } catch (Exception $e) {\n $connected = FALSE;\n $last_reason = 'connect-socket-exception';\n }\n }\n\n // Fallback to TCP.\n if (!$connected) {\n try {\n $connected = $r->connect($valkey_host, $valkey_port, $connect_timeout_s);\n } catch (Exception $e) {\n $connected = FALSE;\n $last_reason = 'connect-tcp-exception';\n }\n }\n\n if ($connected) {\n if (defined('Redis::OPT_READ_TIMEOUT')) {\n $r->setOption(Redis::OPT_READ_TIMEOUT, $read_timeout_s);\n }\n\n // Authenticate if password file exists.\n $auth_pass = 'isfoobared';\n if (is_file($valkey_pass_file)) {\n $auth_pass = trim((string) @file_get_contents($valkey_pass_file));\n }\n if ($auth_pass !== '') {\n try {\n if (!$r->auth($auth_pass)) {\n $connected = FALSE;\n $last_reason = 'auth-failed';\n }\n } catch (Exception $e) {\n $connected = FALSE;\n $last_reason = 'auth-exception';\n }\n }\n\n // Verify ping.\n if ($connected) {\n try {\n $pong = $r->ping();\n if ((is_string($pong) && stripos($pong, 'PONG') !== FALSE) || $pong === TRUE) {\n $valkey_up = TRUE;\n } else {\n $valkey_up = FALSE;\n $last_reason = 'ping-not-ok';\n }\n } catch (Exception $e) {\n $valkey_up = FALSE;\n $last_reason = 'ping-exception';\n }\n }\n\n if ($valkey_up) {\n _valkey_backoff_clear($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY UP action=clear flag='.$flag_path.' reason=ok');\n } else {\n _valkey_backoff_touch($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason);\n }\n\n try {\n $r->close();\n } catch (Exception $e) {\n // ignore\n }\n } else {\n _valkey_backoff_touch($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason);\n }\n } else {\n // phpredis extension not available.\n $valkey_up = FALSE;\n _valkey_backoff_touch($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason=no-phpredis');\n }\n } else {\n $valkey_up = FALSE;\n _valkey_dbg_write($redis_debug_log, 'VALKEY SKIP reason=backoff-active flag='.$flag_path);\n }\n}\n\n/* ---------------- Diagnostics & final guard ---------------------------- */\nif (!empty($is_dev)) {\n if (empty($is_backend)) {\n if ($use_valkey && $valkey_up) {\n header('X-Allow-Valkey: YES');\n } else {\n header('X-Allow-Valkey: NO');\n }\n }\n}\n\nif (!empty($is_install)) {\n $use_valkey = FALSE;\n}\n" }, { "path": "aegir/conf/global/global-if-valkey.inc", "content": "= 6) {\n $use_valkey = TRUE;\n}\n\nif (isset($_SERVER['SERVER_NAME'])) {\n if ($all_ini['valkey_cache_disable'] || $all_ini['redis_cache_disable']) {\n $use_valkey = FALSE;\n }\n}\n\nif (!$is_bot && isset($_SERVER['REQUEST_URI'])) {\n if (preg_match(\"/noredis=1/\", $_SERVER['REQUEST_URI'])) {\n $use_valkey = FALSE;\n }\n}\n\n/* ---------------- Defaults -------------------------------------------- */\n$valkey_up = FALSE;\n\n/* ---------------- Connection targets ---------------------------------- */\n$valkey_socket_path = '/run/valkey/valkey.sock';\n$valkey_host = '127.0.0.1';\n$valkey_port = 6379;\n$valkey_pass_file = '/data/conf/valkey/pass.inc';\n\n/* ---------------- Timeouts & backoff ---------------------------------- */\n$connect_timeout_s = 0.2; // short and non-blocking feel\n$read_timeout_s = 0.2; // keep calls snappy\n$backoff_ttl_s = 60; // do not retry within this window after a failure\n$flag_dir_run = '/var/tmp/fpm';\n$flag_file_fallback = '/data/conf/arch/valkey.disabled.flag'; // fallback\n\n/* ---------------- Optional debug log ---------------------------------- */\n// Set to an absolute path to enable lightweight probe logging.\n// Example: '/var/tmp/fpm/valkey-fallback.log'\n$redis_debug_log = '';\n\n/* ---------------- Helpers (filesystem only) ---------------------------- */\nfunction _valkey_backoff_flag_path($flag_dir_run, $fallback) {\n $path = $fallback;\n if (is_dir($flag_dir_run)) {\n if (is_writable($flag_dir_run)) {\n $path = rtrim($flag_dir_run, '/').'/valkey.disabled.flag';\n }\n }\n return $path;\n}\n\nfunction _valkey_backoff_is_active($flag_path, $ttl) {\n $active = FALSE;\n if (is_file($flag_path)) {\n $age = time() - @filemtime($flag_path);\n if ($age >= 0 && $age < $ttl) {\n $active = TRUE;\n }\n }\n return $active;\n}\n\nfunction _valkey_backoff_touch($flag_path) {\n @touch($flag_path);\n}\n\nfunction _valkey_backoff_clear($flag_path) {\n if (is_file($flag_path)) {\n @unlink($flag_path);\n }\n}\n\nfunction _valkey_dbg_write($log_path, $line) {\n if (!empty($log_path)) {\n $msg = date('c').' '.$line.\"\\n\";\n @file_put_contents($log_path, $msg, FILE_APPEND);\n }\n}\n\n/* ------------------- Probe Valkey once with guard --------------------- */\n$flag_path = _valkey_backoff_flag_path($flag_dir_run, $flag_file_fallback);\n$skip_probe = _valkey_backoff_is_active($flag_path, $backoff_ttl_s);\n\nif ($use_valkey) {\n if (!$skip_probe) {\n if (class_exists('Redis')) {\n $r = new Redis();\n $connected = FALSE;\n $last_reason = 'init';\n\n // Try socket first.\n if (!empty($valkey_socket_path) && @is_readable($valkey_socket_path)) {\n try {\n $connected = $r->connect($valkey_socket_path);\n } catch (Exception $e) {\n $connected = FALSE;\n $last_reason = 'connect-socket-exception';\n }\n }\n\n // Fallback to TCP.\n if (!$connected) {\n try {\n $connected = $r->connect($valkey_host, $valkey_port, $connect_timeout_s);\n } catch (Exception $e) {\n $connected = FALSE;\n $last_reason = 'connect-tcp-exception';\n }\n }\n\n if ($connected) {\n if (defined('Redis::OPT_READ_TIMEOUT')) {\n $r->setOption(Redis::OPT_READ_TIMEOUT, $read_timeout_s);\n }\n\n // Authenticate if password file exists.\n $auth_pass = 'isfoobared';\n if (is_file($valkey_pass_file)) {\n $auth_pass = trim((string) @file_get_contents($valkey_pass_file));\n }\n if ($auth_pass !== '') {\n try {\n if (!$r->auth($auth_pass)) {\n $connected = FALSE;\n $last_reason = 'auth-failed';\n }\n } catch (Exception $e) {\n $connected = FALSE;\n $last_reason = 'auth-exception';\n }\n }\n\n // Verify ping.\n if ($connected) {\n try {\n $pong = $r->ping();\n if ((is_string($pong) && stripos($pong, 'PONG') !== FALSE) || $pong === TRUE) {\n $valkey_up = TRUE;\n } else {\n $valkey_up = FALSE;\n $last_reason = 'ping-not-ok';\n }\n } catch (Exception $e) {\n $valkey_up = FALSE;\n $last_reason = 'ping-exception';\n }\n }\n\n if ($valkey_up) {\n _valkey_backoff_clear($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY UP action=clear flag='.$flag_path.' reason=ok');\n } else {\n _valkey_backoff_touch($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason);\n }\n\n try {\n $r->close();\n } catch (Exception $e) {\n // ignore\n }\n } else {\n _valkey_backoff_touch($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason);\n }\n } else {\n // phpredis extension not available.\n $valkey_up = FALSE;\n _valkey_backoff_touch($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason=no-phpredis');\n }\n } else {\n $valkey_up = FALSE;\n _valkey_dbg_write($redis_debug_log, 'VALKEY SKIP reason=backoff-active flag='.$flag_path);\n }\n}\n\n/* ---------------- Diagnostics & final guard ---------------------------- */\nif (!empty($is_dev)) {\n if (empty($is_backend)) {\n if ($use_valkey && $valkey_up) {\n header('X-Allow-Valkey: YES');\n } else {\n header('X-Allow-Valkey: NO');\n }\n }\n}\n\nif (!empty($is_install)) {\n $use_valkey = FALSE;\n}\n" }, { "path": "aegir/conf/global/global-ini.inc", "content": " '86400',\n 'session_gc_eol' => '86400',\n 'redis_use_modern' => TRUE,\n 'redis_flush_forced_mode' => TRUE,\n 'redis_lock_enable' => TRUE,\n 'redis_path_enable' => TRUE,\n 'redis_scan_enable' => FALSE,\n 'redis_cache_disable' => FALSE,\n 'redis_old_nine_mode' => FALSE,\n 'redis_old_eight_mode' => FALSE,\n 'sql_conversion_mode' => FALSE,\n 'enable_strict_user_register_protection' => FALSE,\n 'entitycache_dont_enable' => FALSE,\n 'views_cache_bully_dont_enable' => FALSE,\n 'views_content_cache_dont_enable' => FALSE,\n 'autoslave_enable' => FALSE,\n 'cache_consistent_enable' => FALSE,\n 'redis_exclude_bins' => FALSE,\n 'speed_booster_anon_cache_ttl' => FALSE,\n 'allow_anon_node_add' => FALSE,\n 'enable_newrelic_integration' => FALSE,\n 'disable_admin_dos_protection' => FALSE,\n 'ignore_user_register_protection' => FALSE,\n 'allow_private_file_downloads' => FALSE,\n 'server_name_cookie_domain' => FALSE,\n 'auto_detect_facebook_integration' => TRUE, // For backward compatibility until next release, then FALSE\n 'auto_detect_domain_access_integration' => TRUE, // For backward compatibility until next release, then FALSE\n 'advagg_auto_configuration' => FALSE, // Will be set to TRUE in boa_site_control.ini if the module is enabled\n 'disable_drupal_page_cache' => FALSE, // FALSE for backward compatibility and max performance\n 'set_composer_manager_vendor_dir' => FALSE, // FALSE by default to not break site installation depending on custom value\n);\n\n" }, { "path": "aegir/conf/global/global-main.inc", "content": "= 8) {\n $settings['reverse_proxy'] = TRUE;\n $settings['reverse_proxy_header'] = $proxy_header;\n $settings['reverse_proxy_addresses'] = array($proxy_ip);\n }\n }\n}\n\n\n/**\n * The nodns protection\n */\nif ($no_dns) {\n if ($local_req) {\n // Allow local requests\n if (!$is_backend && isset($_SERVER['REMOTE_ADDR'])) {\n header(\"X-Local-Y: \" . $_SERVER['REMOTE_ADDR']);\n }\n }\n else {\n // Ignore remote requests\n header('X-Accel-Expires: 60');\n header('HTTP/1.0 404 Not Found');\n header(\"Connection: close\");\n exit;\n }\n}\n\n\n/**\n * The hidden uri protection\n */\nif ($hidden_uri) {\n if ($local_req) {\n // Allow local requests to hidden uri\n if (!$is_backend && isset($_SERVER['REMOTE_ADDR'])) {\n header(\"X-Local-URI-Y: \" . $_SERVER['REMOTE_ADDR']);\n }\n }\n else {\n // Ignore remote requests\n header('X-Accel-Expires: 60');\n header('HTTP/1.0 404 Not Found');\n header(\"Connection: close\");\n exit;\n }\n}\n\n\n/**\n * Use Ægir/BOA specific MAIN_SITE_NAME instead of possibly fake SERVER_NAME\n */\nif (isset($_SERVER['MAIN_SITE_NAME'])) {\n $_SERVER['SERVER_NAME'] = $_SERVER['MAIN_SITE_NAME'];\n}\n\n\n/**\n * Set MAIN_SITE_NAME to match SERVER_NAME, if MAIN_SITE_NAME is not set\n */\nif (!isset($_SERVER['MAIN_SITE_NAME']) && isset($_SERVER['SERVER_NAME'])) {\n $_SERVER['MAIN_SITE_NAME'] = $_SERVER['SERVER_NAME'];\n}\n\n\n/**\n * Required for proper Valkey/Redis support on command line / via Drush\n */\nif (isset($_SERVER['HTTP_HOST']) && !isset($_SERVER['SERVER_NAME'])) {\n $_SERVER['SERVER_NAME'] = $_SERVER['HTTP_HOST'];\n}\n\n\n/**\n * Force backward compatible SERVER_SOFTWARE\n */\nif (!$is_backend) {\n if (isset($_SERVER['SERVER_SOFTWARE']) &&\n !preg_match(\"/ApacheSolarisNginx/i\", $_SERVER['SERVER_SOFTWARE'])) {\n $_SERVER['SERVER_SOFTWARE'] = 'ApacheSolarisNginx/1.29.8';\n }\n}\n\n\n/**\n * Early bots redirect on protected URLs\n */\nif (!$is_backend) {\n if (isset($_SERVER['HTTP_HOST']) && $is_bot) {\n if (preg_match(\"/(?:^tmp\\.|\\.test\\.|\\.tmp\\.)/i\", $_SERVER['HTTP_HOST'])) {\n // Deny known search bots on ^(tmp|foo.(tmp|test)).domain subdomains\n header('X-Accel-Expires: 60');\n header(\"Location: http://www.aegirproject.org/\", true, 301);\n exit;\n }\n elseif (preg_match(\"/\\.(?:host8|boa|aegir|o8)\\.(?:biz|io|cc)$/i\", $_SERVER['HTTP_HOST'])) {\n // Deny known search bots on some protected CI subdomains\n header('X-Accel-Expires: 60');\n header(\"Location: https://omega8.cc/\", true, 301);\n exit;\n }\n }\n}\n\n\n/**\n * Disable reporting errors by default - enable later only for foo.dev.domain\n */\nerror_reporting(0);\n\n\n/**\n * Hostmaster specific settings\n */\nif ($conf['install_profile'] == 'hostmaster') {\n $conf['hosting_require_disable_before_delete'] = 0;\n $conf['hosting_task_refresh_timeout'] = 5555;\n $conf['theme_link'] = FALSE;\n $conf['cache'] = 0;\n if (!$is_backend && isset($_SERVER['HTTP_USER_AGENT'])) {\n $conf['environment_indicator_overwrite'] = TRUE;\n $conf['environment_indicator_overwritten_position'] = 'top';\n if (is_readable('/data/conf/development-env.ctrl')) {\n $conf['environment_indicator_overwritten_name'] = 'Development';\n $conf['environment_indicator_overwritten_color'] = '#00AA00'; // Green\n }\n elseif (is_readable('/data/conf/staging-env.ctrl')) {\n $conf['environment_indicator_overwritten_name'] = 'Staging';\n $conf['environment_indicator_overwritten_color'] = '#FFCC00'; // Yellow\n }\n elseif (is_readable('/data/conf/production-env.ctrl')) {\n $conf['environment_indicator_overwritten_name'] = 'Production';\n $conf['environment_indicator_overwritten_color'] = '#CC0000'; // Red\n }\n elseif (is_readable('/data/conf/testing-env.ctrl')) {\n $conf['environment_indicator_overwritten_name'] = 'Testing';\n $conf['environment_indicator_overwritten_color'] = '#FF69B4'; // Hot Pink\n //$conf['environment_indicator_overwritten_color'] = '#FFC0CB'; // Light Pink\n }\n else {\n $conf['environment_indicator_overwritten_name'] = 'Production';\n $conf['environment_indicator_overwritten_color'] = '#CC0000'; // Red\n }\n ini_set('session.cookie_lifetime', 0); // Force log-out on browser quit\n header('X-Accel-Expires: 1');\n if (!file_exists('/data/conf/no-https-aegir.inc')) {\n $request_type = ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' ||\n $_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL';\n if ($request_type != \"SSL\" &&\n !preg_match(\"/^\\/cron\\.php/\", $_SERVER['REQUEST_URI'])) { // we force secure connection here\n header('X-Accel-Expires: 5');\n header(\"Location: https://\" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], true, 301);\n exit;\n }\n }\n if (isset($_SERVER['HTTP_HOST']) &&\n preg_match(\"/\\.(?:host8|boa|aegir|o8)\\.(?:biz|io|cc)$/i\", $_SERVER['HTTP_HOST'])) {\n if (preg_match(\"/^\\/admin\\/user\\/user\\/create/\", $_SERVER['REQUEST_URI']) ||\n preg_match(\"/^\\/node\\/add\\/server/\", $_SERVER['REQUEST_URI']) ||\n preg_match(\"/^\\/node\\/(?:1|2|4|5|7|8|10)\\/(?:edit|delete)/\", $_SERVER['REQUEST_URI'])) {\n header('X-Accel-Expires: 5');\n header(\"Location: https://\" . $_SERVER['HTTP_HOST'] . \"/hosting/sites\", true, 301);\n exit;\n }\n }\n }\n}\n\n\n/**\n * Optional site and platform level settings defined in the ini files\n * Note: the site-level ini file takes precedence over platform level ini\n */\n$all_ini = $boa_ini;\nif (is_readable('sites/all/modules/boa_platform_control.ini')) {\n $ini_plr_src = 'sites/all/modules/boa_platform_control.ini';\n}\nif ($ini_plr_src) {\n $usr_plr_ini = array();\n $usr_plr_ini = parse_ini_file($ini_plr_src);\n}\nif (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/modules/boa_site_control.ini')) {\n $ini_loc_src = 'sites/' . $_SERVER['SERVER_NAME'] . '/modules/boa_site_control.ini';\n}\nif ($ini_loc_src) {\n $usr_loc_ini = array();\n $usr_loc_ini = parse_ini_file($ini_loc_src);\n}\nif (is_array($usr_plr_ini) && $usr_plr_ini) {\n $all_ini = array_merge($all_ini, $usr_plr_ini);\n}\nif (is_array($usr_loc_ini) && $usr_loc_ini) {\n $all_ini = array_merge($all_ini, $usr_loc_ini);\n}\n\n\n/**\n * Display All Active INI Values on .dev. URL\n */\nif (is_array($all_ini) && $is_dev && !$is_backend) {\n if ($ini_plr_src) {\n header(\"X-Ini-Plr-Src: \" . $ini_plr_src);\n }\n if ($ini_loc_src) {\n header(\"X-Ini-Loc-Src: \" . $ini_loc_src);\n }\n if (!$ini_plr_src && !$ini_loc_src) {\n header(\"X-Ini-Src: BOA-Default\");\n }\n header(\"X-Ini-Valkey-Use-Modern: \" . $all_ini['redis_use_modern']);\n header(\"X-Ini-Valkey-Flush-Forced-Mode: \" . $all_ini['redis_flush_forced_mode']);\n header(\"X-Ini-Valkey-Lock-Enable: \" . $all_ini['redis_lock_enable']);\n header(\"X-Ini-Valkey-Path-Enable: \" . $all_ini['redis_path_enable']);\n header(\"X-Ini-Valkey-Scan-Enable: \" . $all_ini['redis_scan_enable']);\n header(\"X-Ini-Valkey-Old-Nine-Mode: \" . $all_ini['redis_old_nine_mode']);\n header(\"X-Ini-Valkey-Old-Eight-Mode: \" . $all_ini['redis_old_eight_mode']);\n header(\"X-Ini-Valkey-Cache-Disable: \" . $all_ini['redis_cache_disable']);\n header(\"X-Ini-Valkey-Exclude-Bins: \" . $all_ini['redis_exclude_bins']);\n header(\"X-Ini-Speed-Booster-Anon-Cache-Ttl: \" . $all_ini['speed_booster_anon_cache_ttl']);\n header(\"X-Ini-Allow-Anon-Node-Add: \" . $all_ini['allow_anon_node_add']);\n header(\"X-Ini-Enable-NewRelic-Integration: \" . $all_ini['enable_newrelic_integration']);\n header(\"X-Ini-Disable-Admin-Dos-Protection: \" . $all_ini['disable_admin_dos_protection']);\n header(\"X-Ini-Allow-Private-File-Downloads: \" . $all_ini['allow_private_file_downloads']);\n header(\"X-Ini-Server-Name-Cookie-Domain: \" . $all_ini['server_name_cookie_domain']);\n header(\"X-Ini-Auto-Detect-Facebook-Integration: \" . $all_ini['auto_detect_facebook_integration']);\n header(\"X-Ini-Auto-Detect-Domain-Access-Integration: \" . $all_ini['auto_detect_domain_access_integration']);\n header(\"X-Ini-Advagg-Auto-Configuration: \" . $all_ini['advagg_auto_configuration']);\n header(\"X-Ini-Sql-Conversion-Mode: \" . $all_ini['sql_conversion_mode']);\n header(\"X-Ini-Enable-Strict-User-Register-Protection: \" . $all_ini['enable_strict_user_register_protection']);\n header(\"X-Ini-Entitycache-Dont-Enable: \" . $all_ini['entitycache_dont_enable']);\n header(\"X-Ini-Views-Cache-Bully-Dont-Enable: \" . $all_ini['views_cache_bully_dont_enable']);\n header(\"X-Ini-Views-Content-Cache-Dont-Enable: \" . $all_ini['views_content_cache_dont_enable']);\n header(\"X-Ini-Ignore-User-Register-Protection: \" . $all_ini['ignore_user_register_protection']);\n header(\"X-Ini-Session-Cookie-Ttl: \" . $all_ini['session_cookie_ttl']);\n header(\"X-Ini-Session-Gc-Eol: \" . $all_ini['session_gc_eol']);\n header(\"X-Ini-Disable-Drupal-Page-Cache: \" . $all_ini['disable_drupal_page_cache']);\n header(\"X-Ini-Set-Composer-Manager-Vendor-Dir: \" . $all_ini['set_composer_manager_vendor_dir']);\n header(\"X-Ini-AutoSlave-Enable: \" . $all_ini['autoslave_enable']);\n header(\"X-Ini-CacheConsistent-Enable: \" . $all_ini['cache_consistent_enable']);\n}\n" }, { "path": "aegir/conf/global/global-mode.inc", "content": "getSchemeAndHttpHost();\n }\n catch (\\Exception $e) {\n // Unable to determine URI; proceed without setting it\n }\n }\n }\n\n if ($uri) {\n // Clean the URI by removing the scheme\n $uri = str_replace(['http://', 'https://'], '', $uri);\n $this_instance = 'Drush Site: ' . $uri;\n\n // Set New Relic transaction name and parameters if command details are available\n if (isset($command['command']) && isset($command['arguments'])) {\n $drush_command = array_merge([$command['command']], $command['arguments']);\n $command_str = implode(' ', $drush_command);\n\n // Add custom parameters to New Relic\n newrelic_add_custom_parameter('Drush command', $command_str);\n newrelic_name_transaction($command_str);\n\n // Indicate that this is a background job\n newrelic_background_job(TRUE);\n }\n }\n }\n else {\n // Non-Drush (web request) context\n if (isset($_SERVER['SERVER_NAME'])) {\n $this_instance = 'Web Site: ' . $_SERVER['SERVER_NAME'];\n // Optionally, indicate this is not a background job\n // newrelic_background_job(FALSE);\n }\n }\n\n // Apply the New Relic app name if determined\n if ($this_instance) {\n ini_set('newrelic.appname', $this_instance);\n newrelic_set_appname($this_instance);\n }\n}\nelseif (extension_loaded('newrelic') && empty($all_ini['enable_newrelic_integration'])) {\n // Disable New Relic auto-RUM and ignore transactions if integration is disabled\n newrelic_disable_autorum();\n newrelic_ignore_apdex();\n newrelic_ignore_transaction();\n}\n" }, { "path": "aegir/conf/global/global-redis.inc", "content": "= 8) {\n $redis_comprs = TRUE;\n $redis_dirname = 'redis_eight';\n if (!$all_ini['redis_old_eight_mode']) {\n $redis_dirname = 'redis_compr';\n }\n if ($drupal_core == 10 || $drupal_core == 11) {\n $redis_new_dirname = 'redis_ten_eleven';\n $redis_legacy_dirname = 'redis_nine_ten';\n if (is_readable('modules/o_contrib_ten/' . $redis_new_dirname . '/redis.services.yml')) {\n $redis_dirname = $redis_new_dirname;\n }\n elseif (is_readable('modules/o_contrib_ten/' . $redis_legacy_dirname . '/redis.services.yml')) {\n $redis_dirname = $redis_legacy_dirname;\n }\n }\n elseif ($drupal_core == 9) {\n $redis_dirname = 'redis_nine_ten';\n if ($all_ini['redis_old_nine_mode']) {\n $redis_dirname = 'redis_compr';\n }\n }\n }\n else {\n $redis_dirname = 'redis_edge';\n }\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Version-Is: Modern\");\n header(\"X-Redis-Dir-Is: \" . $redis_dirname);\n }\n if ($all_ini['redis_flush_forced_mode']) {\n if ($drupal_core >= 8) {\n $settings['redis_perm_ttl'] = 86400; // 24 hours max\n $settings['redis_flush_mode'] = 1; // Redis default is 0\n $settings['redis_flush_mode_cache_page'] = 2; // Redis default is 1\n $settings['redis_flush_mode_cache_block'] = 2; // Redis default is 1\n $settings['redis_flush_mode_cache_menu'] = 2; // Redis default is 0\n $settings['redis_flush_mode_cache_metatag'] = 2; // Redis default is 0\n }\n else {\n $conf['redis_perm_ttl'] = 86400; // 24 hours max\n $conf['redis_flush_mode'] = 1; // Redis default is 0\n $conf['redis_flush_mode_cache_page'] = 2; // Redis default is 1\n $conf['redis_flush_mode_cache_block'] = 2; // Redis default is 1\n $conf['redis_flush_mode_cache_menu'] = 2; // Redis default is 0\n $conf['redis_flush_mode_cache_metatag'] = 2; // Redis default is 0\n }\n // See http://bit.ly/1drmi35 for more information\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Flush-Forced-Mode: Forced\");\n }\n }\n }\n else {\n $redis_dirname = 'redis';\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Version-Is: Legacy\");\n header(\"X-Redis-Dir-Is: \" . $redis_dirname);\n }\n }\n if ($drupal_core >= 8) {\n if (file_exists('sites/' . $_SERVER['SERVER_NAME'] . '/.redisLegacyOff')) {\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Off-Ctrl-Exists: .redisLegacyOff\");\n }\n }\n else {\n if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml')) {\n if ($is_dev && !$is_backend) {\n header(\"X-Dev-Services-Yml-Is-Readable: development.services.yml\");\n }\n }\n else {\n if (is_readable('modules/o_contrib_ten')) {\n if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_failover_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.failover.services.yml';\n $example_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_ten/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n }\n if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n elseif (is_readable('modules/o_contrib_eleven')) {\n if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_failover_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.failover.services.yml';\n $example_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n }\n if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n elseif (is_readable('modules/o_contrib_nine')) {\n if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_failover_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.failover.services.yml';\n $example_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_nine/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n }\n if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n elseif (is_readable('modules/o_contrib_eight')) {\n if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_eight/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n if ($is_dev && !$is_backend) {\n header(\"X-Example-Services-Is-Readable: \" . $example_services_path);\n }\n }\n if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n }\n }\n }\n elseif ($drupal_core == 7) {\n if (is_readable('modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc')) {\n $cache_valkey = TRUE;\n $cache_backport = FALSE;\n $cache_redis_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc';\n $cache_lock_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.lock.inc';\n $cache_path_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.path.inc';\n $cache_gzip_path = 'modules/o_contrib_seven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Autoload-Is-Readable: \" . $cache_redis_path);\n }\n }\n if ($all_ini['autoslave_enable']) {\n if (is_readable('modules/o_contrib_seven/autoslave/autoslave.cache.inc') &&\n is_readable('includes/database/autoslave/database.inc')) {\n $use_auto_se = TRUE;\n $gzip_mode = FALSE;\n $cache_backport = FALSE;\n $auto_se_path = 'modules/o_contrib_seven/autoslave/autoslave.cache.inc';\n if ($is_dev && !$is_backend) {\n header(\"X-AutoSlave-Cache-Is-Readable: \" . $auto_se_path);\n }\n }\n }\n if ($all_ini['cache_consistent_enable']) {\n if (is_readable('modules/o_contrib_seven/cache_consistent/cache_consistent.inc')) {\n $use_cache_ct = TRUE;\n $gzip_mode = FALSE;\n $cache_backport = FALSE;\n $cache_ct_path = 'modules/o_contrib_seven/cache_consistent/cache_consistent.inc';\n if ($is_dev && !$is_backend) {\n header(\"X-CacheConsistent-Is-Readable: \" . $cache_ct_path);\n }\n }\n }\n }\n elseif ($drupal_core == 6) {\n if (is_readable('modules/o_contrib/cache_backport/cache.inc')) {\n $cache_backport = TRUE;\n $cache_backport_path = 'modules/o_contrib/cache_backport/cache.inc';\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Cache-Backport-Is-Readable: \" . $cache_backport_path);\n }\n }\n if (is_readable('modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc')) {\n $cache_valkey = TRUE;\n $cache_redis_path = 'modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc';\n $cache_lock_path = 'modules/o_contrib/' . $redis_dirname . '/redis.lock.inc';\n $cache_path_path = 'modules/o_contrib/' . $redis_dirname . '/redis.path.inc';\n $cache_gzip_path = 'modules/o_contrib/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Autoload-Is-Readable: \" . $cache_redis_path);\n }\n }\n }\n if ($cache_valkey) {\n if ($drupal_core >= 8) {\n if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_eleven/' . $redis_dirname . '/src');\n }\n elseif (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_ten/' . $redis_dirname . '/src');\n }\n elseif (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_nine/' . $redis_dirname . '/src');\n }\n else {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_eight/' . $redis_dirname . '/src');\n }\n $settings['redis.connection']['interface'] = 'PhpRedis';\n $settings['redis.connection']['host'] = '127.0.0.1';\n $settings['redis.connection']['port'] = '6379';\n $settings['redis.connection']['password'] = 'isfoobared';\n $settings['redis.connection']['base'] = '8';\n $settings['cache_prefix'] = $this_prefix;\n $settings['cache']['default'] = 'cache.backend.redis';\n if (!is_readable('/data/conf/clstr.cnf')) {\n $settings['cache']['bins']['bootstrap'] = 'cache.backend.chainedfast';\n $settings['cache']['bins']['discovery'] = 'cache.backend.chainedfast';\n $settings['cache']['bins']['config'] = 'cache.backend.chainedfast';\n }\n if (is_readable($example_failover_path)) {\n $settings['container_yamls'][] = $example_failover_path;\n $settings['redis.failover'] = TRUE;\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Failover-Is-Readable: \" . $example_failover_path);\n }\n }\n elseif (is_readable($example_services_path)) {\n $settings['container_yamls'][] = $example_services_path;\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Example-Is-Readable: \" . $example_services_path);\n }\n }\n if (is_readable($redis_services_path)) {\n $settings['container_yamls'][] = $redis_services_path;\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n if ($drupal_core <= 10) {\n $settings['queue_default'] = 'queue.redis_reliable';\n }\n if ($redis_comprs) {\n $settings['redis_compress_length'] = 100;\n $settings['redis_compress_level'] = 5;\n }\n $settings['cache']['bins']['state'] = 'cache.backend.redis';\n $settings['state_cache'] = TRUE;\n $settings['bootstrap_container_definition'] = [\n 'parameters' => [],\n 'services' => [\n 'redis.factory' => [\n 'class' => 'Drupal\\redis\\ClientFactory',\n ],\n 'cache.backend.redis' => [\n 'class' => 'Drupal\\redis\\Cache\\CacheBackendFactory',\n 'arguments' => ['@redis.factory', '@cache_tags_provider.container', '@serialization.phpserialize'],\n ],\n 'cache.container' => [\n 'class' => '\\Drupal\\redis\\Cache\\PhpRedis',\n 'factory' => ['@cache.backend.redis', 'get'],\n 'arguments' => ['container'],\n ],\n 'cache_tags_provider.container' => [\n 'class' => 'Drupal\\redis\\Cache\\RedisCacheTagsChecksum',\n 'arguments' => ['@redis.factory'],\n ],\n 'serialization.phpserialize' => [\n 'class' => 'Drupal\\Component\\Serialization\\PhpSerialize',\n ],\n ],\n ];\n }\n else {\n if ($cache_backport) {\n $conf['cache_inc'] = $cache_backport_path;\n }\n if ($all_ini['redis_use_modern']) {\n if ($all_ini['redis_lock_enable']) {\n $redis_lock = TRUE;\n }\n if ($all_ini['redis_path_enable']) {\n $redis_path = TRUE;\n }\n }\n if (is_readable($cache_lock_path) && $redis_lock) {\n $conf['lock_inc'] = $cache_lock_path;\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Lock-Is-Readable: \" . $cache_lock_path);\n }\n }\n if (is_readable($cache_path_path) && $redis_path) {\n $conf['path_inc'] = $cache_path_path;\n $conf['path_alias_admin_blacklist'] = FALSE;\n if ($is_dev && !$is_backend) {\n header(\"X-Redis-Path-Is-Readable: \" . $cache_path_path);\n }\n }\n if ($all_ini['redis_scan_enable']) {\n $conf['redis_scan_delete'] = TRUE;\n $gzip_mode = FALSE;\n }\n else {\n if (is_readable($cache_gzip_path)) {\n $gzip_mode = TRUE;\n }\n else {\n $gzip_mode = FALSE;\n }\n }\n if ($gzip_mode) {\n $conf['cache_default_class'] = 'Redis_CacheCompressed';\n }\n else {\n $conf['cache_default_class'] = 'Redis_Cache';\n }\n $conf['cache_backends'][] = $cache_redis_path;\n if ($use_auto_se) {\n $conf['cache_backends'][] = $auto_se_path;\n $conf['cache_default_class'] = 'AutoslaveCache';\n $conf['autoslave_cache_default_class'] = 'Redis_Cache';\n }\n if ($use_cache_ct) {\n $conf['cache_backends'][] = $cache_ct_path;\n $conf['cache_default_class'] = 'ConsistentCache';\n if (!is_readable('/data/conf/clstr.cnf')) {\n $conf['cache_class_cache_form'] = 'DrupalDatabaseCache';\n $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache';\n }\n $conf['consistent_cache_default_class'] = 'Redis_Cache';\n $conf['consistent_cache_default_safe'] = TRUE;\n $conf['consistent_cache_buffer_mechanism'] = 'ConsistentCacheBuffer';\n $conf['consistent_cache_default_strict'] = FALSE;\n $conf['consistent_cache_strict_cache_bootstrap'] = TRUE;\n }\n if (!is_readable('/data/conf/clstr.cnf')) {\n $conf['cache_class_cache_form'] = 'DrupalDatabaseCache';\n $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache';\n }\n $conf['redis_client_interface'] = 'PhpRedis';\n $conf['redis_client_host'] = '127.0.0.1';\n $conf['redis_client_port'] = '6379';\n $conf['redis_client_password'] = 'isfoobared';\n $conf['redis_client_base'] = '8';\n $conf['cache_prefix'] = $this_prefix;\n $conf['page_cache_invoke_hooks'] = TRUE; // D7 == Do not use Aggressive Mode\n $conf['page_cache_without_database'] = FALSE; // D7 == Do not use Aggressive Mode\n $conf['page_cache_maximum_age'] = 0; // D7 == max-age in the Cache-Control header (ignored by Speed Booster)\n $conf['page_cache_max_age'] = 0; // D6 == max-age in the Cache-Control header (ignored by Speed Booster)\n $conf['cache_lifetime'] = 0; // D7 == BOA uses Speed Booster / Nginx micro-caching instead\n $conf['page_cache_lifetime'] = 0; // D6 == BOA uses Speed Booster / Nginx micro-caching instead\n }\n if ($all_ini['redis_exclude_bins'] && !is_readable('/data/conf/clstr.cnf')) {\n $excludes = array();\n $excludes = explode(\",\", $all_ini['redis_exclude_bins']);\n foreach ($excludes as $exclude) {\n $exclude = rtrim($exclude);\n $exclude = ltrim($exclude);\n if ($drupal_core >= 8) {\n $bin_exclude = $exclude;\n $settings['cache']['bins'][$bin_exclude] = 'cache.backend.database';\n }\n else {\n $bin_exclude = 'cache_class_' . $exclude;\n $conf[$bin_exclude] = 'DrupalDatabaseCache';\n }\n if ($is_dev && !$is_backend) {\n header(\"X-Ini-Redis-Exclude-Bin-\" . $exclude . \": \" . $bin_exclude);\n }\n }\n }\n }\n}\n" }, { "path": "aegir/conf/global/global-settings.inc", "content": "= 11) {\n // Drupal core Package Manager: prevent Status report \"error\" about early testing.\n $settings['testing_package_manager'] = TRUE;\n}\nif ($drupal_core >= 8) {\n //\n // Drupal 8 behaviour is confusing, because while it is possible\n // to force settings listed below, they will not be shown in the\n // site admin area. For example, CSS/JS aggregation checkboxes\n // will accept on/off changes on form submit, while being silently\n // overridden here.\n //\n $config['image.settings']['allow_insecure_derivatives'] = TRUE; // Not sure if it's a good idea in D8\n $config['image.settings']['suppress_itok_output'] = TRUE; // Not sure if it's a good idea in D8\n $config['system.cron']['threshold.autorun'] = FALSE; // Disable poormanscron (legacy)\n $config['system.cron']['threshold']['auto'] = 0; // Disable auto-cron (current)\n $config['system.logging']['error_level'] = 'hide'; // Disable errors on screen\n $config['system.performance']['css']['preprocess'] = TRUE; // Enable hardcoded CSS aggregation\n $config['system.performance']['js']['preprocess'] = TRUE; // Enable hardcoded JS aggregation\n $config['system.performance']['response.gzip'] = FALSE; // Nginx already compresses everything\n //$config['system.file']['default_scheme'] = 'public'; // Force public downloads by default\n}\nelse {\n if ($backdropcms) {\n $conf['css_gzip_compression'] = FALSE; // Nginx already compresses everything\n $conf['js_gzip_compression'] = FALSE; // Nginx already compresses everything\n $settings['backdrop_drupal_compatibility'] = TRUE; // Enable Drupal backwards compatibility\n }\n $conf['page_compression'] = 0; // Nginx already compresses everything\n $conf['boost_crawl_on_cron'] = 0; // Deny Boost crawler\n $conf['cron_safe_threshold'] = 0; // Disable poormanscron\n $conf['preprocess_css'] = 1; // Enable hardcoded CSS aggregation\n $conf['preprocess_js'] = 1; // Enable hardcoded JS aggregation\n $conf['file_downloads'] = 1; // Force public downloads by default in D6\n $conf['file_default_scheme'] = 'public'; // Force public downloads by default in D7\n $conf['error_level'] = 0; // Disable errors on screen\n $conf['statistics_enable_access_log'] = 0; // Disable access log stats\n $conf['allow_authorize_operations'] = FALSE; // Disable insecure plugin manager\n $conf['admin_menu_cache_client'] = FALSE; // Disable caching in admin_menu #442560\n $conf['boost_ignore_htaccess_warning'] = 1; // Silence false alarm in boost\n $conf['expire_flush_front'] = 1; // Default settings for expire module\n $conf['expire_flush_node_terms'] = 1; // Default settings for expire module\n $conf['expire_flush_menu_items'] = 0; // Default settings for expire module\n $conf['expire_flush_cck_references'] = 0; // Default settings for expire module\n $conf['expire_include_base_url'] = 1; // Default settings for expire module\n $conf['js_server_software'] = \"other\"; // Set JS Callback handler server software\n $conf['video_ffmpeg_instances'] = 1; // Force safe default for ffmpeg\n $conf['securepages_enable'] = 1; // Force to avoid issues with ssl proxy\n $conf['less_devel'] = FALSE; // Prevent CSS regeneration on every page load\n $conf['drupal_http_request_fails'] = FALSE; // Avoid false alarm\n $conf['image_allow_insecure_derivatives'] = TRUE; // Enable to avoid known issues: https://drupal.org/drupal-7.20-release-notes\n $conf['theme_cloudy_settings']['omega_rebuild_aggregates'] = FALSE; // Do not allow to turn it on by default\n $conf['theme_cloudy_settings']['omega_rebuild_theme_registry'] = FALSE; // Do not allow to turn it on by default\n $update_free_access = FALSE;\n $conf['webform_table'] = TRUE; // Workaround for SA-CONTRIB-2015-063 https://www.drupal.org/node/2445935\n $conf['features_rebuild_on_flush'] = FALSE; // https://michaelshadle.com/2015/04/21/speeding-up-drupal-cache-flushing\n $conf['entity_rebuild_on_flush'] = FALSE; // http://a-fro.com/speed-up-cache-clearing-on-drupal7\n $conf['redis_eval_enabled'] = TRUE;\n // Use EVAL commands to greatly speed up cache clearing\n // Enable when https://www.drupal.org/node/2487333 is fixed\n}\n\n\n/**\n * Logic for the front-end only\n */\nif (!$is_backend) {\n if ($is_dev) {\n // Dev mode switch\n error_reporting(E_ALL & ~E_NOTICE);\n ini_set('display_errors', TRUE);\n ini_set('display_startup_errors', TRUE);\n ini_set('opcache.revalidate_freq', '0');\n if (!$is_backend) {\n header(\"X-Opcache-Revalidate-Freq: 0\");\n }\n if ($drupal_core >= 8) {\n unset($config['system.logging']['error_level']); // Stop hardcoding no errors on screen\n unset($config['system.performance']['cache.page.max_age']); // Stop hardcoding internal page cache\n unset($config['system.performance']['css']['preprocess']); // Stop hardcoding CSS aggregation\n unset($config['system.performance']['js']['preprocess']); // Stop hardcoding JS aggregation\n if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml')) {\n //\n // This file, if exists, disables Redis on the fly!\n //\n $settings['container_yamls'][] = 'sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml';\n //\n // The two settings below make sense only if the development.services.yml file\n // located in the sites/domain/files/ dir contains at least these three lines:\n //\n // services:\n // cache.backend.null:\n // class: Drupal\\Core\\Cache\\NullBackendFactory\n //\n $settings['cache']['bins']['render'] = 'cache.backend.null';\n $settings['cache']['bins']['dynamic_page_cache'] = 'cache.backend.null';\n //\n // Warning: you must clear caches via Ægir interface or with Drush\n // before these lines will start working on .dev. alias without error 500\n // saying: You have requested a non-existent service \"cache.backend.null\"\n //\n // To enable Twig debugging add in the development.services.yml file also lines:\n //\n // parameters:\n // twig.config:\n // debug: true\n // auto_reload: true\n // cache: true\n //\n // Note that normally you should not disable Twig cache, since auto_reload\n // is enough for development and debugging, withot slowing down everything;\n // see also: https://www.drupal.org/node/1903374\n //\n }\n }\n else {\n $conf['xmlsitemap_submit'] = 0; // Disable XML Sitemap for foo.dev.domain\n $conf['xmlsitemap_update'] = 0; // Disable XML Sitemap for foo.dev.domain\n unset($conf['cache']); // Stop hardcoding internal page cache\n unset($conf['error_level']); // Stop hardcoding no errors on screen\n unset($conf['less_devel']); // Stop hardcoding CSS regeneration on every page load\n unset($conf['preprocess_css']); // Stop hardcoding CSS aggregation\n unset($conf['preprocess_js']); // Stop hardcoding JS aggregation\n unset($conf['theme_cloudy_settings']['omega_rebuild_aggregates']); // Do not force on dev URLs\n unset($conf['theme_cloudy_settings']['omega_rebuild_theme_registry']); // Do not force on dev URLs\n }\n }\n else {\n if (preg_match(\"/^\\/civicrm/\", $_SERVER['REQUEST_URI'])) {\n // Force custom opcache TTL for CiviCRM codebase\n ini_set('opcache.revalidate_freq', '180');\n if (!$is_backend) {\n header(\"X-Opcache-Revalidate-Freq: 180\");\n }\n }\n else {\n // Set sane default opcache TTL on non-dev sites\n ini_set('opcache.revalidate_freq', '60');\n if (!$is_backend) {\n header(\"X-Opcache-Revalidate-Freq: 60\");\n }\n }\n }\n}\n\n\n/**\n * Enable page caching if disable_drupal_page_cache is not set to TRUE,\n * but only on non-dev URLs and only for the front-end.\n */\nif (!$is_backend && !$is_dev) {\n if (!$is_bot && $all_ini['disable_drupal_page_cache']) {\n if ($drupal_core >= 8) {\n $config['system.performance']['cache.page.max_age'] = 0;\n }\n else {\n $conf['cache'] = 0;\n }\n }\n else {\n if ($drupal_core >= 8) {\n $config['system.performance']['cache.page.max_age'] = 60;\n }\n else {\n $conf['cache'] = 1;\n }\n }\n}\n\n\n/**\n * Disable page caching when Speed Booster is disabled on the fly\n */\nif (!$is_bot && isset($_SERVER['REQUEST_URI']) &&\n preg_match(\"/nocache=1/\", $_SERVER['REQUEST_URI'])) {\n if ($drupal_core >= 8) {\n $config['system.performance']['cache.page.max_age'] = 0;\n }\n else {\n $conf['cache'] = 0;\n }\n}\n\n\n/**\n * Session Cookie TTL settings\n *\n * Set session cookie lifetime (in seconds), i.e. the time from the session is\n * created to the cookie expires, i.e. when the browser is expected to discard\n * the cookie. The value 0 means \"until the browser is closed\".\n */\nif ($all_ini['session_cookie_ttl']) {\n ini_set('session.cookie_lifetime', $all_ini['session_cookie_ttl']);\n}\n\n\n/**\n * Session Garbage Collector EOL settings\n *\n * Set session lifetime (in seconds), i.e. the time from the user's last visit\n * to the active session may be deleted by the session garbage collector. When\n * a session is deleted, authenticated users are logged out, and the contents\n * of the user's $_SESSION variable is discarded.\n */\nif ($all_ini['session_gc_eol']) {\n ini_set('session.gc_maxlifetime', $all_ini['session_gc_eol']);\n}\n\n\n/**\n * Main section starts here\n */\nif (isset($_SERVER['SERVER_NAME']) &&\n $all_ini['allow_private_file_downloads']) {\n unset($conf['file_downloads']); // Disable hardcoded public downloads for D6\n unset($conf['file_default_scheme']); // Disable hardcoded public downloads for D7\n //unset($config['system.file']['default_scheme']); // Disable hardcoded public downloads for D8+\n if ($is_dev && !$is_backend) {\n header('X-Is-Cart: YES');\n }\n}\n\n\nif (isset($_SERVER['HTTP_USER_AGENT']) && isset($_SERVER['USER_DEVICE'])) {\n $this_device = $_SERVER['USER_DEVICE'];\n}\nelse {\n $this_device = 'normal';\n}\n\n\n/**\n * Logic for non-dev URLs only\n */\nif (!$is_dev) {\n if ($all_ini['advagg_auto_configuration']) {\n\n if ($drupal_core == 6) {\n if (is_readable('modules/o_contrib/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) {\n $conf['preprocess_css'] = 0; // CSS aggregation disabled\n $conf['preprocess_js'] = 0; // JS aggregation disabled\n $conf['advagg_aggregate_mode'] = 1;\n $conf['advagg_async_generation'] = 1;\n $conf['advagg_checksum_mode'] = \"md5\";\n $conf['advagg_closure'] = 1;\n $conf['advagg_css_compress_agg_files'] = 1;\n $conf['advagg_css_compress_compressor_level'] = \"sane\";\n $conf['advagg_css_compress_inline'] = 1;\n $conf['advagg_css_compressor'] = 2;\n $conf['advagg_debug'] = 0;\n $conf['advagg_dir_htaccess'] = 0;\n $conf['advagg_enabled'] = 1;\n $conf['advagg_gzip_compression'] = 1;\n $conf['advagg_js_compress_agg_files'] = 1;\n $conf['advagg_js_compress_callback'] = 1;\n $conf['advagg_js_compress_inline'] = 1;\n $conf['advagg_js_compress_packer_enable'] = 0;\n $conf['advagg_js_compressor'] = 1;\n $conf['advagg_page_cache_mode'] = 0;\n $conf['advagg_rebuild_on_flush'] = 0;\n $conf['advagg_server_addr'] = \"-1\";\n }\n }\n elseif ($drupal_core == 7) {\n if (is_readable('modules/o_contrib_seven/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) {\n $conf['advagg_bundler_active'] = 1;\n $conf['advagg_cache_level'] = 3;\n $conf['advagg_combine_css_media'] = 0;\n $conf['advagg_core_groups'] = 0;\n $conf['advagg_css_compressor'] = 2;\n $conf['advagg_css_compress_inline'] = 2;\n $conf['advagg_css_compress_inline_if_not_cacheable'] = 1;\n $conf['advagg_enabled'] = 1;\n $conf['advagg_gzip'] = 1;\n $conf['advagg_ie_css_selector_limiter'] = 1;\n $conf['advagg_js_compressor'] = 3;\n $conf['advagg_js_compress_packer'] = 0;\n $conf['advagg_js_compress_inline'] = 3;\n $conf['advagg_js_compress_inline_if_not_cacheable'] = 1;\n $conf['preprocess_css'] = 1;\n $conf['preprocess_js'] = 1;\n }\n }\n elseif ($drupal_core >= 8) {\n if (is_readable('modules/o_contrib_eight/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('modules/o_contrib_nine/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('modules/o_contrib_ten/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('modules/o_contrib_eleven/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('modules/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) {\n $config['advagg.settings']['css']['combine_media'] = false;\n $config['advagg.settings']['css']['ie']['limit_selectors'] = true;\n $config['advagg.settings']['cache_level'] = 3;\n $config['advagg.settings']['core_groups'] = false;\n $config['advagg.settings']['enabled'] = true;\n $config['advagg_bundler.settings']['active'] = true;\n $config['advagg_css_minify.settings']['minifier'] = 2;\n $config['advagg_js_minify.settings']['minifier'] = 3;\n $config['system.performance']['css']['preprocess'] = true;\n $config['system.performance']['js']['preprocess'] = true;\n }\n }\n\n if ($drupal_core == 6 || $drupal_core == 7) {\n if (is_readable('modules/o_contrib/httprl/httprl.module') ||\n is_readable('modules/o_contrib_seven/httprl/httprl.module')) {\n $conf['advagg_use_httprl'] = 1;\n $conf['httprl_background_callback'] = 1;\n $conf['httprl_connect_timeout'] = 3;\n $conf['httprl_dns_timeout'] = 3;\n $conf['httprl_global_timeout'] = \"60\";\n $conf['httprl_server_addr'] = \"-1\";\n $conf['httprl_timeout'] = \"10\";\n $conf['httprl_ttfb_timeout'] = \"5\";\n // $conf['drupal_http_request_function'] = \"httprl_override_core\";\n }\n }\n }\n}\n" }, { "path": "aegir/conf/global/global-valkey.inc", "content": "= 8) {\n $redis_comprs = TRUE;\n $redis_dirname = 'redis_eight';\n if (!$all_ini['redis_old_eight_mode']) {\n $redis_dirname = 'redis_compr';\n }\n if ($drupal_core == 10 || $drupal_core == 11) {\n $redis_new_dirname = 'redis_ten_eleven';\n $redis_legacy_dirname = 'redis_nine_ten';\n if (is_readable('modules/o_contrib_ten/' . $redis_new_dirname . '/redis.services.yml')) {\n $redis_dirname = $redis_new_dirname;\n }\n elseif (is_readable('modules/o_contrib_ten/' . $redis_legacy_dirname . '/redis.services.yml')) {\n $redis_dirname = $redis_legacy_dirname;\n }\n }\n elseif ($drupal_core == 9) {\n $redis_dirname = 'redis_nine_ten';\n if ($all_ini['redis_old_nine_mode']) {\n $redis_dirname = 'redis_compr';\n }\n }\n }\n else {\n $redis_dirname = 'redis_edge';\n }\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Version-Is: Modern\");\n header(\"X-Valkey-Dir-Is: \" . $redis_dirname);\n }\n if ($all_ini['redis_flush_forced_mode']) {\n if ($drupal_core >= 8) {\n $settings['redis_perm_ttl'] = 86400; // 24 hours max\n $settings['redis_flush_mode'] = 1; // Valkey default is 0\n $settings['redis_flush_mode_cache_page'] = 2; // Valkey default is 1\n $settings['redis_flush_mode_cache_block'] = 2; // Valkey default is 1\n $settings['redis_flush_mode_cache_menu'] = 2; // Valkey default is 0\n $settings['redis_flush_mode_cache_metatag'] = 2; // Valkey default is 0\n }\n else {\n $conf['redis_perm_ttl'] = 86400; // 24 hours max\n $conf['redis_flush_mode'] = 1; // Valkey default is 0\n $conf['redis_flush_mode_cache_page'] = 2; // Valkey default is 1\n $conf['redis_flush_mode_cache_block'] = 2; // Valkey default is 1\n $conf['redis_flush_mode_cache_menu'] = 2; // Valkey default is 0\n $conf['redis_flush_mode_cache_metatag'] = 2; // Valkey default is 0\n }\n // See http://bit.ly/1drmi35 for more information\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Flush-Forced-Mode: Forced\");\n }\n }\n }\n else {\n $redis_dirname = 'redis';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Version-Is: Legacy\");\n header(\"X-Valkey-Dir-Is: \" . $redis_dirname);\n }\n }\n if ($drupal_core >= 8) {\n if (file_exists('sites/' . $_SERVER['SERVER_NAME'] . '/.redisLegacyOff')) {\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Off-Ctrl-Exists: .redisLegacyOff\");\n }\n }\n else {\n if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml')) {\n if ($is_dev && !$is_backend) {\n header(\"X-Dev-Services-Yml-Is-Readable: development.services.yml\");\n }\n }\n else {\n if (is_readable('modules/o_contrib_ten')) {\n if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_failover_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.failover.services.yml';\n $example_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_ten/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n }\n if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n elseif (is_readable('modules/o_contrib_eleven')) {\n if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_failover_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.failover.services.yml';\n $example_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n }\n if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n elseif (is_readable('modules/o_contrib_nine')) {\n if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_failover_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.failover.services.yml';\n $example_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_nine/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n }\n if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n elseif (is_readable('modules/o_contrib_eight')) {\n if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_eight/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n if ($is_dev && !$is_backend) {\n header(\"X-Example-Services-Is-Readable: \" . $example_services_path);\n }\n }\n if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n }\n }\n }\n elseif ($drupal_core == 7) {\n if (is_readable('modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc')) {\n $cache_valkey = TRUE;\n $cache_backport = FALSE;\n $cache_redis_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc';\n $cache_lock_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.lock.inc';\n $cache_path_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.path.inc';\n $cache_gzip_path = 'modules/o_contrib_seven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Autoload-Is-Readable: \" . $cache_redis_path);\n }\n }\n if ($all_ini['autoslave_enable']) {\n if (is_readable('modules/o_contrib_seven/autoslave/autoslave.cache.inc') &&\n is_readable('includes/database/autoslave/database.inc')) {\n $use_auto_se = TRUE;\n $gzip_mode = FALSE;\n $cache_backport = FALSE;\n $auto_se_path = 'modules/o_contrib_seven/autoslave/autoslave.cache.inc';\n if ($is_dev && !$is_backend) {\n header(\"X-AutoSlave-Cache-Is-Readable: \" . $auto_se_path);\n }\n }\n }\n if ($all_ini['cache_consistent_enable']) {\n if (is_readable('modules/o_contrib_seven/cache_consistent/cache_consistent.inc')) {\n $use_cache_ct = TRUE;\n $gzip_mode = FALSE;\n $cache_backport = FALSE;\n $cache_ct_path = 'modules/o_contrib_seven/cache_consistent/cache_consistent.inc';\n if ($is_dev && !$is_backend) {\n header(\"X-CacheConsistent-Is-Readable: \" . $cache_ct_path);\n }\n }\n }\n }\n elseif ($drupal_core == 6) {\n if (is_readable('modules/o_contrib/cache_backport/cache.inc')) {\n $cache_backport = TRUE;\n $cache_backport_path = 'modules/o_contrib/cache_backport/cache.inc';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Cache-Backport-Is-Readable: \" . $cache_backport_path);\n }\n }\n if (is_readable('modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc')) {\n $cache_valkey = TRUE;\n $cache_redis_path = 'modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc';\n $cache_lock_path = 'modules/o_contrib/' . $redis_dirname . '/redis.lock.inc';\n $cache_path_path = 'modules/o_contrib/' . $redis_dirname . '/redis.path.inc';\n $cache_gzip_path = 'modules/o_contrib/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Autoload-Is-Readable: \" . $cache_redis_path);\n }\n }\n }\n if ($cache_valkey) {\n if ($drupal_core >= 8) {\n if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_eleven/' . $redis_dirname . '/src');\n }\n elseif (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_ten/' . $redis_dirname . '/src');\n }\n elseif (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_nine/' . $redis_dirname . '/src');\n }\n else {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_eight/' . $redis_dirname . '/src');\n }\n $settings['redis.connection']['interface'] = 'PhpRedis';\n $settings['redis.connection']['host'] = '127.0.0.1';\n $settings['redis.connection']['port'] = '6379';\n $settings['redis.connection']['password'] = 'isfoobared';\n $settings['redis.connection']['base'] = '8';\n $settings['cache_prefix'] = $this_prefix;\n $settings['cache']['default'] = 'cache.backend.redis';\n if (!is_readable('/data/conf/clstr.cnf')) {\n $settings['cache']['bins']['bootstrap'] = 'cache.backend.chainedfast';\n $settings['cache']['bins']['discovery'] = 'cache.backend.chainedfast';\n $settings['cache']['bins']['config'] = 'cache.backend.chainedfast';\n }\n if (is_readable($example_failover_path)) {\n $settings['container_yamls'][] = $example_failover_path;\n $settings['redis.failover'] = TRUE;\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Failover-Is-Readable: \" . $example_failover_path);\n }\n }\n elseif (is_readable($example_services_path)) {\n $settings['container_yamls'][] = $example_services_path;\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Example-Is-Readable: \" . $example_services_path);\n }\n }\n if (is_readable($redis_services_path)) {\n $settings['container_yamls'][] = $redis_services_path;\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n if ($drupal_core <= 10) {\n $settings['queue_default'] = 'queue.redis_reliable';\n }\n if ($redis_comprs) {\n $settings['redis_compress_length'] = 100;\n $settings['redis_compress_level'] = 5;\n }\n $settings['cache']['bins']['state'] = 'cache.backend.redis';\n $settings['state_cache'] = TRUE;\n $settings['bootstrap_container_definition'] = [\n 'parameters' => [],\n 'services' => [\n 'redis.factory' => [\n 'class' => 'Drupal\\redis\\ClientFactory',\n ],\n 'cache.backend.redis' => [\n 'class' => 'Drupal\\redis\\Cache\\CacheBackendFactory',\n 'arguments' => ['@redis.factory', '@cache_tags_provider.container', '@serialization.phpserialize'],\n ],\n 'cache.container' => [\n 'class' => '\\Drupal\\redis\\Cache\\PhpRedis',\n 'factory' => ['@cache.backend.redis', 'get'],\n 'arguments' => ['container'],\n ],\n 'cache_tags_provider.container' => [\n 'class' => 'Drupal\\redis\\Cache\\RedisCacheTagsChecksum',\n 'arguments' => ['@redis.factory'],\n ],\n 'serialization.phpserialize' => [\n 'class' => 'Drupal\\Component\\Serialization\\PhpSerialize',\n ],\n ],\n ];\n }\n else {\n if ($cache_backport) {\n $conf['cache_inc'] = $cache_backport_path;\n }\n if ($all_ini['redis_use_modern']) {\n if ($all_ini['redis_lock_enable']) {\n $redis_lock = TRUE;\n }\n if ($all_ini['redis_path_enable']) {\n $redis_path = TRUE;\n }\n }\n if (is_readable($cache_lock_path) && $redis_lock) {\n $conf['lock_inc'] = $cache_lock_path;\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Lock-Is-Readable: \" . $cache_lock_path);\n }\n }\n if (is_readable($cache_path_path) && $redis_path) {\n $conf['path_inc'] = $cache_path_path;\n $conf['path_alias_admin_blacklist'] = FALSE;\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Path-Is-Readable: \" . $cache_path_path);\n }\n }\n if ($all_ini['redis_scan_enable']) {\n $conf['redis_scan_delete'] = TRUE;\n $gzip_mode = FALSE;\n }\n else {\n if (is_readable($cache_gzip_path)) {\n $gzip_mode = TRUE;\n }\n else {\n $gzip_mode = FALSE;\n }\n }\n if ($gzip_mode) {\n $conf['cache_default_class'] = 'Redis_CacheCompressed';\n }\n else {\n $conf['cache_default_class'] = 'Redis_Cache';\n }\n $conf['cache_backends'][] = $cache_redis_path;\n if ($use_auto_se) {\n $conf['cache_backends'][] = $auto_se_path;\n $conf['cache_default_class'] = 'AutoslaveCache';\n $conf['autoslave_cache_default_class'] = 'Redis_Cache';\n }\n if ($use_cache_ct) {\n $conf['cache_backends'][] = $cache_ct_path;\n $conf['cache_default_class'] = 'ConsistentCache';\n if (!is_readable('/data/conf/clstr.cnf')) {\n $conf['cache_class_cache_form'] = 'DrupalDatabaseCache';\n $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache';\n }\n $conf['consistent_cache_default_class'] = 'Redis_Cache';\n $conf['consistent_cache_default_safe'] = TRUE;\n $conf['consistent_cache_buffer_mechanism'] = 'ConsistentCacheBuffer';\n $conf['consistent_cache_default_strict'] = FALSE;\n $conf['consistent_cache_strict_cache_bootstrap'] = TRUE;\n }\n if (!is_readable('/data/conf/clstr.cnf')) {\n $conf['cache_class_cache_form'] = 'DrupalDatabaseCache';\n $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache';\n }\n $conf['redis_client_interface'] = 'PhpRedis';\n $conf['redis_client_host'] = '127.0.0.1';\n $conf['redis_client_port'] = '6379';\n $conf['redis_client_password'] = 'isfoobared';\n $conf['redis_client_base'] = '8';\n $conf['cache_prefix'] = $this_prefix;\n $conf['page_cache_invoke_hooks'] = TRUE; // D7 == Do not use Aggressive Mode\n $conf['page_cache_without_database'] = FALSE; // D7 == Do not use Aggressive Mode\n $conf['page_cache_maximum_age'] = 0; // D7 == max-age in the Cache-Control header (ignored by Speed Booster)\n $conf['page_cache_max_age'] = 0; // D6 == max-age in the Cache-Control header (ignored by Speed Booster)\n $conf['cache_lifetime'] = 0; // D7 == BOA uses Speed Booster / Nginx micro-caching instead\n $conf['page_cache_lifetime'] = 0; // D6 == BOA uses Speed Booster / Nginx micro-caching instead\n }\n if ($all_ini['redis_exclude_bins'] && !is_readable('/data/conf/clstr.cnf')) {\n $excludes = array();\n $excludes = explode(\",\", $all_ini['redis_exclude_bins']);\n foreach ($excludes as $exclude) {\n $exclude = rtrim($exclude);\n $exclude = ltrim($exclude);\n if ($drupal_core >= 8) {\n $bin_exclude = $exclude;\n $settings['cache']['bins'][$bin_exclude] = 'cache.backend.database';\n }\n else {\n $bin_exclude = 'cache_class_' . $exclude;\n $conf[$bin_exclude] = 'DrupalDatabaseCache';\n }\n if ($is_dev && !$is_backend) {\n header(\"X-Ini-Valkey-Exclude-Bin-\" . $exclude . \": \" . $bin_exclude);\n }\n }\n }\n }\n}\n" }, { "path": "aegir/conf/global/global.inc", "content": "= 8) {\n $settings['reverse_proxy'] = TRUE;\n $settings['reverse_proxy_header'] = $proxy_header;\n $settings['reverse_proxy_addresses'] = array($proxy_ip);\n }\n }\n}\n\n\n/**\n * The nodns mode detection\n */\nif (isset($_SERVER['HTTP_HOST']) &&\n (preg_match(\"/(?:^nodns\\.|\\.nodns\\.)/i\", $_SERVER['HTTP_HOST']))) {\n $no_dns = TRUE;\n}\n\n\n/**\n * Local nodns request detection\n */\nif (isset($_SERVER['REMOTE_ADDR']) &&\n (preg_match(\"/(^127\\.0\\.0\\.1)$/i\", $_SERVER['REMOTE_ADDR']) ||\n preg_match(\"/(^127\\.0\\.0\\.1\\, 127\\.0\\.0\\.1)$/i\", $_SERVER['REMOTE_ADDR']))) {\n $local_req = TRUE;\n}\n\n\n/**\n * Local path request check\n */\nif (preg_match(\"/\\/api\\/hidden\\//\", $_SERVER['REQUEST_URI'])) {\n $hidden_uri = TRUE;\n}\n\n\n/**\n * The nodns protection\n */\nif ($no_dns) {\n if ($local_req) {\n // Allow local requests\n if (!$is_backend && isset($_SERVER['REMOTE_ADDR'])) {\n header(\"X-Local-Y: \" . $_SERVER['REMOTE_ADDR']);\n }\n }\n else {\n // Ignore remote requests\n header('X-Accel-Expires: 60');\n header('HTTP/1.0 404 Not Found');\n header(\"Connection: close\");\n exit;\n }\n}\n\n\n/**\n * The hidden uri protection\n */\nif ($hidden_uri) {\n if ($local_req) {\n // Allow local requests to hidden uri\n if (!$is_backend && isset($_SERVER['REMOTE_ADDR'])) {\n header(\"X-Local-URI-Y: \" . $_SERVER['REMOTE_ADDR']);\n }\n }\n else {\n // Ignore remote requests\n header('X-Accel-Expires: 60');\n header('HTTP/1.0 404 Not Found');\n header(\"Connection: close\");\n exit;\n }\n}\n\n\n/**\n * Bots protection for all tmp/dev sites - works also for aliases\n */\nif ($is_bot) {\n if ($is_tmp) {\n // Ignore known bots\n header('X-Accel-Expires: 300');\n header('HTTP/1.0 404 Not Found');\n header(\"Connection: close\");\n exit;\n }\n}\n\n\n/**\n * Site cron protection - cron works only for live sites\n */\nif (preg_match(\"/^\\/cron\\.php/\", $_SERVER['REQUEST_URI']) ||\n preg_match(\"/^\\/cron\\//\", $_SERVER['REQUEST_URI'])) {\n if (($is_tmp) || (file_exists('/data/conf/sites-cron-off.ctrl'))) {\n // Ignore cron requests\n header('X-Accel-Expires: 300');\n header('HTTP/1.0 404 Not Found');\n header(\"Connection: close\");\n exit;\n }\n}\n\n\n/**\n * Required for proper Valkey support on command line / via Drush\n */\nif (isset($_SERVER['HTTP_HOST']) && !isset($_SERVER['SERVER_NAME'])) {\n $_SERVER['SERVER_NAME'] = $_SERVER['HTTP_HOST'];\n}\n\n\n/**\n * BOA INI defaults\n */\n$boa_ini = array(\n 'session_cookie_ttl' => '86400',\n 'session_gc_eol' => '86400',\n 'redis_use_modern' => TRUE,\n 'redis_flush_forced_mode' => TRUE,\n 'redis_lock_enable' => TRUE,\n 'redis_path_enable' => TRUE,\n 'redis_scan_enable' => FALSE,\n 'redis_cache_disable' => FALSE,\n 'redis_old_nine_mode' => FALSE,\n 'redis_old_eight_mode' => FALSE,\n 'sql_conversion_mode' => FALSE,\n 'enable_strict_user_register_protection' => FALSE,\n 'entitycache_dont_enable' => FALSE,\n 'views_cache_bully_dont_enable' => FALSE,\n 'views_content_cache_dont_enable' => FALSE,\n 'autoslave_enable' => FALSE,\n 'cache_consistent_enable' => FALSE,\n 'redis_exclude_bins' => FALSE,\n 'speed_booster_anon_cache_ttl' => FALSE,\n 'allow_anon_node_add' => FALSE,\n 'enable_newrelic_integration' => FALSE,\n 'disable_admin_dos_protection' => FALSE,\n 'ignore_user_register_protection' => FALSE,\n 'allow_private_file_downloads' => FALSE,\n 'server_name_cookie_domain' => FALSE,\n 'auto_detect_facebook_integration' => TRUE, // For backward compatibility until next release, then FALSE\n 'auto_detect_domain_access_integration' => TRUE, // For backward compatibility until next release, then FALSE\n 'advagg_auto_configuration' => FALSE, // Will be set to TRUE in boa_site_control.ini if the module is enabled\n 'disable_drupal_page_cache' => FALSE, // FALSE for backward compatibility and max performance\n 'set_composer_manager_vendor_dir' => FALSE, // FALSE by default to not break site installation depending on custom value\n);\n\n\n/**\n * Optional system level early overrides\n */\nif (is_readable('/data/conf/settings.global.inc')) {\n require_once \"/data/conf/settings.global.inc\";\n}\n\n\n/**\n * Optional site and platform level settings defined in the ini files\n * Note: the site-level ini file takes precedence over platform level ini\n */\n$all_ini = $boa_ini;\nif (is_readable('sites/all/modules/boa_platform_control.ini')) {\n $ini_plr_src = 'sites/all/modules/boa_platform_control.ini';\n}\nif ($ini_plr_src) {\n $usr_plr_ini = array();\n $usr_plr_ini = parse_ini_file($ini_plr_src);\n}\nif (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/modules/boa_site_control.ini')) {\n $ini_loc_src = 'sites/' . $_SERVER['SERVER_NAME'] . '/modules/boa_site_control.ini';\n}\nif ($ini_loc_src) {\n $usr_loc_ini = array();\n $usr_loc_ini = parse_ini_file($ini_loc_src);\n}\nif (is_array($usr_plr_ini) && $usr_plr_ini) {\n $all_ini = array_merge($all_ini, $usr_plr_ini);\n}\nif (is_array($usr_loc_ini) && $usr_loc_ini) {\n $all_ini = array_merge($all_ini, $usr_loc_ini);\n}\nif (is_array($all_ini) && $is_dev && !$is_backend) {\n if ($ini_plr_src) {\n header(\"X-Ini-Plr-Src: \" . $ini_plr_src);\n }\n if ($ini_loc_src) {\n header(\"X-Ini-Loc-Src: \" . $ini_loc_src);\n }\n if (!$ini_plr_src && !$ini_loc_src) {\n header(\"X-Ini-Src: BOA-Default\");\n }\n header(\"X-Ini-Valkey-Use-Modern: \" . $all_ini['redis_use_modern']);\n header(\"X-Ini-Valkey-Flush-Forced-Mode: \" . $all_ini['redis_flush_forced_mode']);\n header(\"X-Ini-Valkey-Lock-Enable: \" . $all_ini['redis_lock_enable']);\n header(\"X-Ini-Valkey-Path-Enable: \" . $all_ini['redis_path_enable']);\n header(\"X-Ini-Valkey-Scan-Enable: \" . $all_ini['redis_scan_enable']);\n header(\"X-Ini-Valkey-Old-Nine-Mode: \" . $all_ini['redis_old_nine_mode']);\n header(\"X-Ini-Valkey-Old-Eight-Mode: \" . $all_ini['redis_old_eight_mode']);\n header(\"X-Ini-Valkey-Cache-Disable: \" . $all_ini['redis_cache_disable']);\n header(\"X-Ini-Valkey-Exclude-Bins: \" . $all_ini['redis_exclude_bins']);\n header(\"X-Ini-Speed-Booster-Anon-Cache-Ttl: \" . $all_ini['speed_booster_anon_cache_ttl']);\n header(\"X-Ini-Allow-Anon-Node-Add: \" . $all_ini['allow_anon_node_add']);\n header(\"X-Ini-Enable-NewRelic-Integration: \" . $all_ini['enable_newrelic_integration']);\n header(\"X-Ini-Disable-Admin-Dos-Protection: \" . $all_ini['disable_admin_dos_protection']);\n header(\"X-Ini-Allow-Private-File-Downloads: \" . $all_ini['allow_private_file_downloads']);\n header(\"X-Ini-Server-Name-Cookie-Domain: \" . $all_ini['server_name_cookie_domain']);\n header(\"X-Ini-Auto-Detect-Facebook-Integration: \" . $all_ini['auto_detect_facebook_integration']);\n header(\"X-Ini-Auto-Detect-Domain-Access-Integration: \" . $all_ini['auto_detect_domain_access_integration']);\n header(\"X-Ini-Advagg-Auto-Configuration: \" . $all_ini['advagg_auto_configuration']);\n header(\"X-Ini-Sql-Conversion-Mode: \" . $all_ini['sql_conversion_mode']);\n header(\"X-Ini-Enable-Strict-User-Register-Protection: \" . $all_ini['enable_strict_user_register_protection']);\n header(\"X-Ini-Entitycache-Dont-Enable: \" . $all_ini['entitycache_dont_enable']);\n header(\"X-Ini-Views-Cache-Bully-Dont-Enable: \" . $all_ini['views_cache_bully_dont_enable']);\n header(\"X-Ini-Views-Content-Cache-Dont-Enable: \" . $all_ini['views_content_cache_dont_enable']);\n header(\"X-Ini-Ignore-User-Register-Protection: \" . $all_ini['ignore_user_register_protection']);\n header(\"X-Ini-Session-Cookie-Ttl: \" . $all_ini['session_cookie_ttl']);\n header(\"X-Ini-Session-Gc-Eol: \" . $all_ini['session_gc_eol']);\n header(\"X-Ini-Disable-Drupal-Page-Cache: \" . $all_ini['disable_drupal_page_cache']);\n header(\"X-Ini-Set-Composer-Manager-Vendor-Dir: \" . $all_ini['set_composer_manager_vendor_dir']);\n header(\"X-Ini-AutoSlave-Enable: \" . $all_ini['autoslave_enable']);\n header(\"X-Ini-CacheConsistent-Enable: \" . $all_ini['cache_consistent_enable']);\n}\n\n\n/**\n * Disable reporting errors by default - enable later only for foo.dev.domain\n */\nerror_reporting(0);\n\n\n/**\n * Forced default settings\n */\nif ($drupal_core >= 11) {\n // Drupal core Package Manager: prevent Status report \"error\" about early testing.\n $settings['testing_package_manager'] = TRUE;\n}\nif ($drupal_core >= 8) {\n //\n // Drupal 8 behaviour is confusing, because while it is possible\n // to force settings listed below, they will not be shown in the\n // site admin area. For example, CSS/JS aggregation checkboxes\n // will accept on/off changes on form submit, while being silently\n // overridden here.\n //\n $config['image.settings']['allow_insecure_derivatives'] = TRUE; // Not sure if it's a good idea in D8\n $config['image.settings']['suppress_itok_output'] = TRUE; // Not sure if it's a good idea in D8\n $config['system.cron']['threshold.autorun'] = FALSE; // Disable poormanscron (legacy)\n $config['system.cron']['threshold']['auto'] = 0; // Disable auto-cron (current)\n $config['system.logging']['error_level'] = 'hide'; // Disable errors on screen\n $config['system.performance']['css']['preprocess'] = TRUE; // Enable hardcoded CSS aggregation\n $config['system.performance']['js']['preprocess'] = TRUE; // Enable hardcoded JS aggregation\n $config['system.performance']['response.gzip'] = FALSE; // Nginx already compresses everything\n //$config['system.file']['default_scheme'] = 'public'; // Force public downloads by default\n}\nelse {\n if ($backdropcms) {\n $conf['css_gzip_compression'] = FALSE; // Nginx already compresses everything\n $conf['js_gzip_compression'] = FALSE; // Nginx already compresses everything\n $settings['backdrop_drupal_compatibility'] = TRUE; // Enable Drupal backwards compatibility\n }\n $conf['page_compression'] = 0; // Nginx already compresses everything\n $conf['boost_crawl_on_cron'] = 0; // Deny Boost crawler\n $conf['cron_safe_threshold'] = 0; // Disable poormanscron\n $conf['preprocess_css'] = 1; // Enable hardcoded CSS aggregation\n $conf['preprocess_js'] = 1; // Enable hardcoded JS aggregation\n $conf['file_downloads'] = 1; // Force public downloads by default in D6\n $conf['file_default_scheme'] = 'public'; // Force public downloads by default in D7\n $conf['error_level'] = 0; // Disable errors on screen\n $conf['statistics_enable_access_log'] = 0; // Disable access log stats\n $conf['allow_authorize_operations'] = FALSE; // Disable insecure plugin manager\n $conf['admin_menu_cache_client'] = FALSE; // Disable caching in admin_menu #442560\n $conf['boost_ignore_htaccess_warning'] = 1; // Silence false alarm in boost\n $conf['expire_flush_front'] = 1; // Default settings for expire module\n $conf['expire_flush_node_terms'] = 1; // Default settings for expire module\n $conf['expire_flush_menu_items'] = 0; // Default settings for expire module\n $conf['expire_flush_cck_references'] = 0; // Default settings for expire module\n $conf['expire_include_base_url'] = 1; // Default settings for expire module\n $conf['js_server_software'] = \"other\"; // Set JS Callback handler server software\n $conf['video_ffmpeg_instances'] = 1; // Force safe default for ffmpeg\n $conf['securepages_enable'] = 1; // Force to avoid issues with ssl proxy\n $conf['less_devel'] = FALSE; // Prevent CSS regeneration on every page load\n $conf['drupal_http_request_fails'] = FALSE; // Avoid false alarm\n $conf['image_allow_insecure_derivatives'] = TRUE; // Enable to avoid known issues: https://drupal.org/drupal-7.20-release-notes\n $conf['theme_cloudy_settings']['omega_rebuild_aggregates'] = FALSE; // Do not allow to turn it on by default\n $conf['theme_cloudy_settings']['omega_rebuild_theme_registry'] = FALSE; // Do not allow to turn it on by default\n $update_free_access = FALSE;\n $conf['webform_table'] = TRUE; // Workaround for SA-CONTRIB-2015-063 https://www.drupal.org/node/2445935\n $conf['features_rebuild_on_flush'] = FALSE; // https://michaelshadle.com/2015/04/21/speeding-up-drupal-cache-flushing\n $conf['entity_rebuild_on_flush'] = FALSE; // http://a-fro.com/speed-up-cache-clearing-on-drupal7\n $conf['redis_eval_enabled'] = TRUE;\n // Use EVAL commands to greatly speed up cache clearing\n // Enable when https://www.drupal.org/node/2487333 is fixed\n}\n\n\n/**\n * Logic for the front-end only\n */\nif (!$is_backend) {\n if (isset($_SERVER['HTTP_HOST']) && $is_bot) {\n if (preg_match(\"/(?:^tmp\\.|\\.test\\.|\\.tmp\\.)/i\", $_SERVER['HTTP_HOST'])) {\n // Deny known search bots on ^(tmp|foo.(tmp|test)).domain subdomains\n header('X-Accel-Expires: 60');\n header(\"Location: http://www.aegirproject.org/\", true, 301);\n exit;\n }\n elseif (preg_match(\"/\\.(?:host8|boa|aegir|o8)\\.(?:biz|io|cc)$/i\", $_SERVER['HTTP_HOST'])) {\n // Deny known search bots on some protected CI subdomains\n header('X-Accel-Expires: 60');\n header(\"Location: https://omega8.cc/\", true, 301);\n exit;\n }\n }\n\n if ($is_dev) {\n // Dev mode switch\n error_reporting(E_ALL & ~E_NOTICE);\n ini_set('display_errors', TRUE);\n ini_set('display_startup_errors', TRUE);\n ini_set('opcache.revalidate_freq', '0');\n if (!$is_backend) {\n header(\"X-Opcache-Revalidate-Freq: 0\");\n }\n if ($drupal_core >= 8) {\n unset($config['system.logging']['error_level']); // Stop hardcoding no errors on screen\n unset($config['system.performance']['cache.page.max_age']); // Stop hardcoding internal page cache\n unset($config['system.performance']['css']['preprocess']); // Stop hardcoding CSS aggregation\n unset($config['system.performance']['js']['preprocess']); // Stop hardcoding JS aggregation\n if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml')) {\n //\n // This file, if exists, disables Valkey on the fly!\n //\n $settings['container_yamls'][] = 'sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml';\n //\n // The two settings below make sense only if the development.services.yml file\n // located in the sites/domain/files/ dir contains at least these three lines:\n //\n // services:\n // cache.backend.null:\n // class: Drupal\\Core\\Cache\\NullBackendFactory\n //\n $settings['cache']['bins']['render'] = 'cache.backend.null';\n $settings['cache']['bins']['dynamic_page_cache'] = 'cache.backend.null';\n //\n // Warning: you must clear caches via Ægir interface or with Drush\n // before these lines will start working on .dev. alias without error 500\n // saying: You have requested a non-existent service \"cache.backend.null\"\n //\n // To enable Twig debugging add in the development.services.yml file also lines:\n //\n // parameters:\n // twig.config:\n // debug: true\n // auto_reload: true\n // cache: true\n //\n // Note that normally you should not disable Twig cache, since auto_reload\n // is enough for development and debugging, withot slowing down everything;\n // see also: https://www.drupal.org/node/1903374\n //\n }\n }\n else {\n $conf['xmlsitemap_submit'] = 0; // Disable XML Sitemap for foo.dev.domain\n $conf['xmlsitemap_update'] = 0; // Disable XML Sitemap for foo.dev.domain\n unset($conf['cache']); // Stop hardcoding internal page cache\n unset($conf['error_level']); // Stop hardcoding no errors on screen\n unset($conf['less_devel']); // Stop hardcoding CSS regeneration on every page load\n unset($conf['preprocess_css']); // Stop hardcoding CSS aggregation\n unset($conf['preprocess_js']); // Stop hardcoding JS aggregation\n unset($conf['theme_cloudy_settings']['omega_rebuild_aggregates']); // Do not force on dev URLs\n unset($conf['theme_cloudy_settings']['omega_rebuild_theme_registry']); // Do not force on dev URLs\n }\n }\n else {\n if (preg_match(\"/^\\/civicrm/\", $_SERVER['REQUEST_URI'])) {\n // Force custom opcache TTL for CiviCRM codebase\n ini_set('opcache.revalidate_freq', '180');\n if (!$is_backend) {\n header(\"X-Opcache-Revalidate-Freq: 180\");\n }\n }\n else {\n // Set sane default opcache TTL on non-dev sites\n ini_set('opcache.revalidate_freq', '60');\n if (!$is_backend) {\n header(\"X-Opcache-Revalidate-Freq: 60\");\n }\n }\n }\n}\n\n\n/**\n * Enable page caching if disable_drupal_page_cache is not set to TRUE,\n * but only on non-dev URLs and only for the front-end.\n */\nif (!$is_backend && !$is_dev) {\n if (!$is_bot && $all_ini['disable_drupal_page_cache']) {\n if ($drupal_core >= 8) {\n $config['system.performance']['cache.page.max_age'] = 0;\n }\n else {\n $conf['cache'] = 0;\n }\n }\n else {\n if ($drupal_core >= 8) {\n $config['system.performance']['cache.page.max_age'] = 60;\n }\n else {\n $conf['cache'] = 1;\n }\n }\n}\n\n\n/**\n * Disable page caching when Speed Booster is disabled on the fly\n */\nif (!$is_bot && isset($_SERVER['REQUEST_URI']) &&\n preg_match(\"/nocache=1/\", $_SERVER['REQUEST_URI'])) {\n if ($drupal_core >= 8) {\n $config['system.performance']['cache.page.max_age'] = 0;\n }\n else {\n $conf['cache'] = 0;\n }\n}\n\n\n/**\n * Session Cookie TTL settings\n *\n * Set session cookie lifetime (in seconds), i.e. the time from the session is\n * created to the cookie expires, i.e. when the browser is expected to discard\n * the cookie. The value 0 means \"until the browser is closed\".\n */\nini_set('session.cookie_lifetime', $all_ini['session_cookie_ttl']);\n\n\n/**\n * Session Garbage Collector EOL settings\n *\n * Set session lifetime (in seconds), i.e. the time from the user's last visit\n * to the active session may be deleted by the session garbage collector. When\n * a session is deleted, authenticated users are logged out, and the contents\n * of the user's $_SESSION variable is discarded.\n */\nini_set('session.gc_maxlifetime', $all_ini['session_gc_eol']);\n\n\n/**\n * Hostmaster specific settings\n */\nif ($conf['install_profile'] == 'hostmaster') {\n $conf['hosting_require_disable_before_delete'] = 0;\n $conf['hosting_task_refresh_timeout'] = 5555;\n $conf['theme_link'] = FALSE;\n $conf['cache'] = 0;\n if (!$is_backend && isset($_SERVER['HTTP_USER_AGENT'])) {\n $conf['environment_indicator_overwrite'] = TRUE;\n $conf['environment_indicator_overwritten_position'] = 'top';\n if (is_readable('/data/conf/development-env.ctrl')) {\n $conf['environment_indicator_overwritten_name'] = 'Development';\n $conf['environment_indicator_overwritten_color'] = '#00AA00'; // Green\n }\n elseif (is_readable('/data/conf/staging-env.ctrl')) {\n $conf['environment_indicator_overwritten_name'] = 'Staging';\n $conf['environment_indicator_overwritten_color'] = '#FFCC00'; // Yellow\n }\n elseif (is_readable('/data/conf/production-env.ctrl')) {\n $conf['environment_indicator_overwritten_name'] = 'Production';\n $conf['environment_indicator_overwritten_color'] = '#CC0000'; // Red\n }\n elseif (is_readable('/data/conf/testing-env.ctrl')) {\n $conf['environment_indicator_overwritten_name'] = 'Testing';\n $conf['environment_indicator_overwritten_color'] = '#FF69B4'; // Hot Pink\n //$conf['environment_indicator_overwritten_color'] = '#FFC0CB'; // Light Pink\n }\n else {\n $conf['environment_indicator_overwritten_name'] = 'Production';\n $conf['environment_indicator_overwritten_color'] = '#CC0000'; // Red\n }\n ini_set('session.cookie_lifetime', 0); // Force log-out on browser quit\n header('X-Accel-Expires: 1');\n if (!file_exists('/data/conf/no-https-aegir.inc')) {\n $request_type = ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' ||\n $_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL';\n if ($request_type != \"SSL\" &&\n !preg_match(\"/^\\/cron\\.php/\", $_SERVER['REQUEST_URI'])) { // we force secure connection here\n header('X-Accel-Expires: 5');\n header(\"Location: https://\" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], true, 301);\n exit;\n }\n }\n if (isset($_SERVER['HTTP_HOST']) &&\n preg_match(\"/\\.(?:host8|boa|aegir|o8)\\.(?:biz|io|cc)$/i\", $_SERVER['HTTP_HOST'])) {\n if (preg_match(\"/^\\/admin\\/user\\/user\\/create/\", $_SERVER['REQUEST_URI']) ||\n preg_match(\"/^\\/node\\/add\\/server/\", $_SERVER['REQUEST_URI']) ||\n preg_match(\"/^\\/node\\/(?:1|2|4|5|7|8|10)\\/(?:edit|delete)/\", $_SERVER['REQUEST_URI'])) {\n header('X-Accel-Expires: 5');\n header(\"Location: https://\" . $_SERVER['HTTP_HOST'] . \"/hosting/sites\", true, 301);\n exit;\n }\n }\n }\n else {\n $use_valkey = TRUE;\n }\n}\n\n\n/**\n * Main section starts here\n */\nif (isset($_SERVER['SERVER_NAME']) &&\n $all_ini['allow_private_file_downloads']) {\n unset($conf['file_downloads']); // Disable hardcoded public downloads for D6\n unset($conf['file_default_scheme']); // Disable hardcoded public downloads for D7\n //unset($config['system.file']['default_scheme']); // Disable hardcoded public downloads for D8+\n if ($is_dev && !$is_backend) {\n header('X-Is-Cart: YES');\n }\n}\n\n/* ---------------- Feature switch -------------------------------------- */\nif ($drupal_core >= 6) {\n $use_valkey = TRUE;\n}\n\nif (isset($_SERVER['SERVER_NAME'])) {\n if ($all_ini['valkey_cache_disable'] || $all_ini['redis_cache_disable']) {\n $use_valkey = FALSE;\n }\n}\n\nif (!$is_bot && isset($_SERVER['REQUEST_URI'])) {\n if (preg_match(\"/noredis=1/\", $_SERVER['REQUEST_URI'])) {\n $use_valkey = FALSE;\n }\n}\n\n/* ---------------- Defaults -------------------------------------------- */\n$valkey_up = FALSE;\n\n/* ---------------- Connection targets ---------------------------------- */\n$valkey_socket_path = '/run/valkey/valkey.sock';\n$valkey_host = '127.0.0.1';\n$valkey_port = 6379;\n$valkey_pass_file = '/data/conf/valkey/pass.inc';\n\n/* ---------------- Timeouts & backoff ---------------------------------- */\n$connect_timeout_s = 0.2; // short and non-blocking feel\n$read_timeout_s = 0.2; // keep calls snappy\n$backoff_ttl_s = 60; // do not retry within this window after a failure\n$flag_dir_run = '/var/tmp/fpm';\n$flag_file_fallback = '/data/conf/arch/valkey.disabled.flag'; // fallback\n\n/* ---------------- Optional debug log ---------------------------------- */\n// Set to an absolute path to enable lightweight probe logging.\n// Example: '/var/tmp/fpm/valkey-fallback.log'\n$redis_debug_log = '';\n\n/* ---------------- Helpers (filesystem only) ---------------------------- */\nfunction _valkey_backoff_flag_path($flag_dir_run, $fallback) {\n $path = $fallback;\n if (is_dir($flag_dir_run)) {\n if (is_writable($flag_dir_run)) {\n $path = rtrim($flag_dir_run, '/').'/valkey.disabled.flag';\n }\n }\n return $path;\n}\n\nfunction _valkey_backoff_is_active($flag_path, $ttl) {\n $active = FALSE;\n if (is_file($flag_path)) {\n $age = time() - @filemtime($flag_path);\n if ($age >= 0 && $age < $ttl) {\n $active = TRUE;\n }\n }\n return $active;\n}\n\nfunction _valkey_backoff_touch($flag_path) {\n @touch($flag_path);\n}\n\nfunction _valkey_backoff_clear($flag_path) {\n if (is_file($flag_path)) {\n @unlink($flag_path);\n }\n}\n\nfunction _valkey_dbg_write($log_path, $line) {\n if (!empty($log_path)) {\n $msg = date('c').' '.$line.\"\\n\";\n @file_put_contents($log_path, $msg, FILE_APPEND);\n }\n}\n\n/* ------------------- Probe Valkey once with guard --------------------- */\n$flag_path = _valkey_backoff_flag_path($flag_dir_run, $flag_file_fallback);\n$skip_probe = _valkey_backoff_is_active($flag_path, $backoff_ttl_s);\n\nif ($use_valkey) {\n if (!$skip_probe) {\n if (class_exists('Redis')) {\n $r = new Redis();\n $connected = FALSE;\n $last_reason = 'init';\n\n // Try socket first.\n if (!empty($valkey_socket_path) && @is_readable($valkey_socket_path)) {\n try {\n $connected = $r->connect($valkey_socket_path);\n } catch (Exception $e) {\n $connected = FALSE;\n $last_reason = 'connect-socket-exception';\n }\n }\n\n // Fallback to TCP.\n if (!$connected) {\n try {\n $connected = $r->connect($valkey_host, $valkey_port, $connect_timeout_s);\n } catch (Exception $e) {\n $connected = FALSE;\n $last_reason = 'connect-tcp-exception';\n }\n }\n\n if ($connected) {\n if (defined('Redis::OPT_READ_TIMEOUT')) {\n $r->setOption(Redis::OPT_READ_TIMEOUT, $read_timeout_s);\n }\n\n // Authenticate if password file exists.\n $auth_pass = 'isfoobared';\n if (is_file($valkey_pass_file)) {\n $auth_pass = trim((string) @file_get_contents($valkey_pass_file));\n }\n if ($auth_pass !== '') {\n try {\n if (!$r->auth($auth_pass)) {\n $connected = FALSE;\n $last_reason = 'auth-failed';\n }\n } catch (Exception $e) {\n $connected = FALSE;\n $last_reason = 'auth-exception';\n }\n }\n\n // Verify ping.\n if ($connected) {\n try {\n $pong = $r->ping();\n if ((is_string($pong) && stripos($pong, 'PONG') !== FALSE) || $pong === TRUE) {\n $valkey_up = TRUE;\n } else {\n $valkey_up = FALSE;\n $last_reason = 'ping-not-ok';\n }\n } catch (Exception $e) {\n $valkey_up = FALSE;\n $last_reason = 'ping-exception';\n }\n }\n\n if ($valkey_up) {\n _valkey_backoff_clear($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY UP action=clear flag='.$flag_path.' reason=ok');\n } else {\n _valkey_backoff_touch($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason);\n }\n\n try {\n $r->close();\n } catch (Exception $e) {\n // ignore\n }\n } else {\n _valkey_backoff_touch($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason='.(string) $last_reason);\n }\n } else {\n // phpredis extension not available.\n $valkey_up = FALSE;\n _valkey_backoff_touch($flag_path);\n _valkey_dbg_write($redis_debug_log, 'VALKEY DOWN action=touch flag='.$flag_path.' reason=no-phpredis');\n }\n } else {\n $valkey_up = FALSE;\n _valkey_dbg_write($redis_debug_log, 'VALKEY SKIP reason=backoff-active flag='.$flag_path);\n }\n}\n\n/* ---------------- Diagnostics & final guard ---------------------------- */\nif (!empty($is_dev)) {\n if (empty($is_backend)) {\n if ($use_valkey && $valkey_up) {\n header('X-Allow-Valkey: YES');\n } else {\n header('X-Allow-Valkey: NO');\n }\n }\n}\n\nif (!empty($is_install)) {\n $use_valkey = FALSE;\n}\n\nif ($all_ini['auto_detect_domain_access_integration']) {\n if (is_readable('sites/all/modules/domain/settings.inc')) {\n $da_inc = 'sites/all/modules/domain/settings.inc';\n }\n elseif (is_readable('sites/all/modules/contrib/domain/settings.inc')) {\n $da_inc = 'sites/all/modules/contrib/domain/settings.inc';\n }\n elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/domain/settings.inc')) {\n $da_inc = 'profiles/' . $conf['install_profile'] . '/modules/domain/settings.inc';\n }\n elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/contrib/domain/settings.inc')) {\n $da_inc = 'profiles/' . $conf['install_profile'] . '/modules/contrib/domain/settings.inc';\n }\n}\n\n/**\n * Activate mail_safety for sites-cron-off on the fly\n */\nif (is_readable('/data/conf/sites-cron-off.ctrl')) {\n if ($drupal_core >= 8) {\n $config['automated_cron.settings']['interval'] = 0;\n $config['mail_safety.settings']['default_mail_address'] = '';\n $config['mail_safety.settings']['enabled'] = TRUE;\n $config['mail_safety.settings']['send_mail_to_dashboard'] = TRUE;\n $config['mail_safety.settings']['send_mail_to_default_mail'] = FALSE;\n $config['scheduler.settings']['lightweight_cron_access_key'] = '';\n $config['simple_cron.settings']['interval'] = 0;\n $config['system.cron']['key'] = '';\n $config['system.cron']['last'] = 0;\n $config['system.cron']['threshold']['auto'] = 0;\n $config['ultimate_cron.job.cron_queue']['status'] = FALSE;\n $config['ultimate_cron.settings']['scheduler'] = 'never';\n }\n else {\n $conf['mail_safety_enabled'] = TRUE;\n $conf['mail_safety_send_mail_to_dashboard'] = TRUE;\n }\n}\n\n/**\n * Use site specific composer_manager dir\n */\nif ($all_ini['set_composer_manager_vendor_dir'] && !$is_install) {\n if ($drupal_core >= 8) {\n $config['composer_manager.settings']['vendor_dir'] = 'sites/' . $_SERVER['SERVER_NAME'] . '/vendor';\n }\n else {\n $conf['composer_manager_vendor_dir'] = 'sites/' . $_SERVER['SERVER_NAME'] . '/vendor';\n }\n}\n\nif (!empty($is_install)) {\n $da_inc = FALSE;\n}\n\nif (isset($_SERVER['HTTP_USER_AGENT']) && isset($_SERVER['USER_DEVICE'])) {\n $this_device = $_SERVER['USER_DEVICE'];\n}\nelse {\n $this_device = 'normal';\n}\n\n\n/**\n * Logic for non-dev URLs only\n */\nif (!$is_dev) {\n if ($all_ini['advagg_auto_configuration']) {\n\n if ($drupal_core == 6) {\n if (is_readable('modules/o_contrib/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) {\n $conf['preprocess_css'] = 0; // CSS aggregation disabled\n $conf['preprocess_js'] = 0; // JS aggregation disabled\n $conf['advagg_aggregate_mode'] = 1;\n $conf['advagg_async_generation'] = 1;\n $conf['advagg_checksum_mode'] = \"md5\";\n $conf['advagg_closure'] = 1;\n $conf['advagg_css_compress_agg_files'] = 1;\n $conf['advagg_css_compress_compressor_level'] = \"sane\";\n $conf['advagg_css_compress_inline'] = 1;\n $conf['advagg_css_compressor'] = 2;\n $conf['advagg_debug'] = 0;\n $conf['advagg_dir_htaccess'] = 0;\n $conf['advagg_enabled'] = 1;\n $conf['advagg_gzip_compression'] = 1;\n $conf['advagg_js_compress_agg_files'] = 1;\n $conf['advagg_js_compress_callback'] = 1;\n $conf['advagg_js_compress_inline'] = 1;\n $conf['advagg_js_compress_packer_enable'] = 0;\n $conf['advagg_js_compressor'] = 1;\n $conf['advagg_page_cache_mode'] = 0;\n $conf['advagg_rebuild_on_flush'] = 0;\n $conf['advagg_server_addr'] = \"-1\";\n }\n }\n elseif ($drupal_core == 7) {\n if (is_readable('modules/o_contrib_seven/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) {\n $conf['advagg_bundler_active'] = 1;\n $conf['advagg_cache_level'] = 3;\n $conf['advagg_combine_css_media'] = 0;\n $conf['advagg_core_groups'] = 0;\n $conf['advagg_css_compressor'] = 2;\n $conf['advagg_css_compress_inline'] = 2;\n $conf['advagg_css_compress_inline_if_not_cacheable'] = 1;\n $conf['advagg_enabled'] = 1;\n $conf['advagg_gzip'] = 1;\n $conf['advagg_ie_css_selector_limiter'] = 1;\n $conf['advagg_js_compressor'] = 3;\n $conf['advagg_js_compress_packer'] = 0;\n $conf['advagg_js_compress_inline'] = 3;\n $conf['advagg_js_compress_inline_if_not_cacheable'] = 1;\n $conf['preprocess_css'] = 1;\n $conf['preprocess_js'] = 1;\n }\n }\n elseif ($drupal_core >= 8) {\n if (is_readable('modules/o_contrib_eight/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('modules/o_contrib_nine/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('modules/o_contrib_ten/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('modules/o_contrib_eleven/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('modules/advagg/advagg_bundler/advagg_bundler.module') ||\n is_readable('sites/all/modules/advagg/advagg_bundler/advagg_bundler.module')) {\n $config['advagg.settings']['css']['combine_media'] = false;\n $config['advagg.settings']['css']['ie']['limit_selectors'] = true;\n $config['advagg.settings']['cache_level'] = 3;\n $config['advagg.settings']['core_groups'] = false;\n $config['advagg.settings']['enabled'] = true;\n $config['advagg_bundler.settings']['active'] = true;\n $config['advagg_css_minify.settings']['minifier'] = 2;\n $config['advagg_js_minify.settings']['minifier'] = 3;\n $config['system.performance']['css']['preprocess'] = true;\n $config['system.performance']['js']['preprocess'] = true;\n }\n }\n\n if ($drupal_core == 6 || $drupal_core == 7) {\n if (is_readable('modules/o_contrib/httprl/httprl.module') ||\n is_readable('modules/o_contrib_seven/httprl/httprl.module')) {\n $conf['advagg_use_httprl'] = 1;\n $conf['httprl_background_callback'] = 1;\n $conf['httprl_connect_timeout'] = 3;\n $conf['httprl_dns_timeout'] = 3;\n $conf['httprl_global_timeout'] = \"60\";\n $conf['httprl_server_addr'] = \"-1\";\n $conf['httprl_timeout'] = \"10\";\n $conf['httprl_ttfb_timeout'] = \"5\";\n // $conf['drupal_http_request_function'] = \"httprl_override_core\";\n }\n }\n }\n}\n\n\n/**\n * More logic for the front-end only\n */\nif (!$is_backend && isset($_SERVER['HTTP_HOST']) &&\n isset($_SERVER['SERVER_NAME'])) {\n if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) || isset($_SERVER['HTTPS'])) {\n $conf['https'] = TRUE;\n $request_type = ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' || $_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL';\n if ($request_type == \"SSL\") { // we check for secure connection to set correct base_url\n $base_url = 'https://' . $_SERVER['HTTP_HOST'];\n if ($conf['install_profile'] != 'hostmaster') {\n $_SERVER['HTTPS'] = 'on';\n if ($drupal_core >= 7) {\n ini_set('session.cookie_secure', TRUE);\n if ($is_dev) {\n header('X-Cookie-Sec: YES');\n }\n }\n }\n if ($is_dev) {\n header('X-Local-Proto: https');\n }\n }\n else {\n if ($site_subdir && $raw_host) {\n $base_url = 'http://' . $raw_host . '/' . $site_subdir;\n }\n else {\n $base_url = 'http://' . $_SERVER['HTTP_HOST'];\n }\n }\n }\n else {\n if ($site_subdir && $raw_host) {\n $base_url = 'http://' . $raw_host . '/' . $site_subdir;\n }\n else {\n $base_url = 'http://' . $_SERVER['HTTP_HOST'];\n }\n }\n\n if ($base_url && $is_dev) {\n header(\"X-Base-Url: \" . $base_url);\n }\n\n if ($site_subdir && $is_dev) {\n header(\"X-Site-Subdir: \" . $site_subdir);\n }\n\n if ($all_ini['server_name_cookie_domain']) {\n $domain = '.' . preg_replace('`^www\\.`', '', $_SERVER['SERVER_NAME']);\n }\n elseif ($site_subdir && isset($_SERVER['RAW_HOST'])) {\n $domain = '.' . preg_replace('`^www\\.`', '', $_SERVER['RAW_HOST']);\n }\n else {\n $domain = '.' . preg_replace('`^www\\.`', '', $_SERVER['HTTP_HOST']);\n }\n $domain = str_replace('..', '.', $domain);\n if (count(explode('.', $domain)) > 2 &&\n !is_numeric(str_replace('.', '', $domain))) {\n ini_set('session.cookie_domain', $domain);\n $cookie_domain = $domain;\n header(\"X-Cookie-Domain: \" . $cookie_domain);\n }\n\n $this_prefix = preg_replace('`^www\\.`', '', $_SERVER['SERVER_NAME']) . '_z_';\n if ($is_dev) {\n header(\"X-Valkey-Prefix: \" . $this_prefix);\n }\n\n if (isset($_SERVER['REQUEST_TIME']) &&\n isset($_SERVER['REMOTE_ADDR']) &&\n isset($_SERVER['HTTP_USER_AGENT']) &&\n !preg_match(\"/^\\/esi\\//\", $_SERVER['REQUEST_URI'])) {\n\n // Determine if the site is running on HTTPS\n $request_type = 'NONSSL';\n if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) || isset($_SERVER['HTTPS'])) {\n $request_type = ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' || $_SERVER['HTTPS'] == 'on') ? 'SSL' : 'NONSSL';\n }\n if ($request_type == \"SSL\") {\n $is_https = TRUE;\n if ($is_dev) {\n header('X-Request-Type:' . $request_type);\n }\n }\n else {\n $is_https = FALSE;\n if ($is_dev) {\n header('X-Request-Type:' . $request_type);\n }\n }\n\n // Create a unique identifier for the request\n $identity = $_SERVER['REQUEST_TIME'] . $_SERVER['REMOTE_ADDR'] . $_SERVER['SERVER_NAME'] . $_SERVER['HTTP_USER_AGENT'];\n $identity = 'BD' . md5($identity);\n if ($is_dev) {\n header('X-Identity:' . $identity);\n }\n\n if ($drupal_core >= 8) {\n // Check if the user is logged in by looking for the session cookie.\n // The session cookie name starts with \"SESS\" or \"SSESS\" followed by a hash.\n // This check is not site specific in Drupal 8+ like it is in Drupal 7\n // or Drupal 6, but should be sufficient for the intended use case below.\n $cookie_prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS';\n $is_logged_in = FALSE;\n foreach ($_COOKIE as $key => $value) {\n if (strpos($key, $cookie_prefix) == 0) {\n $is_logged_in = TRUE;\n break;\n }\n }\n if ($is_dev) {\n header('X-Cookie-Prefix-A:' . $cookie_prefix);\n header('X-Is-Logged-In-A:' . $is_logged_in);\n }\n }\n elseif ($drupal_core == 7) {\n // For Drupal 7 use sha256 hash and cookie prefix based on session.cookie_secure\n $cookie_prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS';\n $test_sess_name = $cookie_prefix . substr(hash('sha256', $cookie_domain), 0, 32);\n if ($is_dev) {\n header('X-Cookie-Prefix-B:' . $cookie_prefix);\n header('X-Test-Sess-Name-B:' . $test_sess_name);\n }\n }\n else {\n // For Drupal 6 use md5 hash and SESS prefix only\n $cookie_prefix = 'SESS';\n $test_sess_name = $cookie_prefix . md5($cookie_domain);\n if ($is_dev) {\n header('X-Cookie-Prefix-C:' . $cookie_prefix);\n header('X-Test-Sess-Name-C:' . $test_sess_name);\n }\n }\n\n // Check if the session cookie is present\n if (isset($_COOKIE[$test_sess_name]) || $is_logged_in) {\n $is_anon = 'LOGGED';\n }\n else {\n $is_anon = 'ANONYMOUS';\n }\n if ($is_dev) {\n header('X-Is-Anon:' . $is_anon);\n }\n\n // Redirect not logged in visitors to homepage to protect admin URLs from bots\n if ($is_anon == 'ANONYMOUS') {\n if (preg_match(\"/\\/(?:node\\/[0-9]+\\/edit|node\\/add)/\", $_SERVER['REQUEST_URI'])) {\n if (empty($all_ini['allow_anon_node_add'])) {\n header(\"Location: \" . $base_url . \"/\", true, 301);\n exit;\n }\n }\n if (preg_match(\"/^\\/(?:[a-z]{2}\\/)?(?:admin|logout|privatemsg|approve)/\", $_SERVER['REQUEST_URI'])) {\n if (empty($all_ini['disable_admin_dos_protection'])) {\n header(\"Location: \" . $base_url . \"/\", true, 301);\n exit;\n }\n }\n }\n\n // Additional logic for caching or other needs\n if ($is_anon == 'ANONYMOUS' && !empty($all_ini['speed_booster_anon_cache_ttl']) && preg_match(\"/^[0-9]{2,}$/\", $all_ini['speed_booster_anon_cache_ttl'])) {\n if ($all_ini['speed_booster_anon_cache_ttl'] > 10) {\n $expire_in_seconds = $all_ini['speed_booster_anon_cache_ttl'];\n header('X-Limit-Booster:' . $all_ini['speed_booster_anon_cache_ttl']);\n }\n }\n\n // Prevent turning the feature server site into a spam machine\n // Disable self-registration also on hostmaster\n if ($conf['install_profile'] == 'feature_server' ||\n $conf['install_profile'] == 'hostmaster') {\n $conf['user_register'] = 0; // Force \"Only site administrators can create new user accounts\"\n }\n if (!$is_bot && !$high_traffic) {\n if (preg_match(\"/^\\/(?:[a-z]{2}\\/)?(?:admin|cart|checkout|logout|privatemsg)/\", $_SERVER['REQUEST_URI']) ||\n preg_match(\"/\\/(?:node\\/[0-9]+\\/edit|node\\/add|comment\\/reply|approve|ajax_comments|commerce_currency_select)/\", $_SERVER['REQUEST_URI']) ||\n preg_match(\"/(?:^dev\\.|\\.dev\\.|\\.devel\\.)/\", $_SERVER['HTTP_HOST'])) {\n $expire_in_seconds = '1';\n header('X-Limit-Booster: 1');\n }\n if (isset($_SERVER['REQUEST_URI']) &&\n preg_match(\"/(?:x-progress-id|ahah|progress\\/|autocomplete|ajax|batch|js\\/.*)/i\", $_SERVER['REQUEST_URI'])) {\n $expire_in_seconds = '0';\n if ($is_dev) {\n header('X-Skip-Booster: AjaxRU');\n }\n }\n if (isset($_SERVER['QUERY_STRING']) &&\n preg_match(\"/(?:x-progress-id|ahah|progress\\/|autocomplete|ajax|batch|js\\/.*)/i\", $_SERVER['QUERY_STRING'])) {\n $expire_in_seconds = '0';\n if ($is_dev) {\n header('X-Skip-Booster: AjaxQS');\n }\n }\n if (isset($_SERVER['REQUEST_METHOD']) &&\n $_SERVER['REQUEST_METHOD'] == 'POST') {\n if (!isset($_COOKIE['NoCacheID'])) {\n $lifetime = '15';\n setcookie('NoCacheID', 'POST' . $identity, $_SERVER['REQUEST_TIME'] + $lifetime, '/', $cookie_domain);\n }\n $expire_in_seconds = '0';\n if ($is_dev) {\n header('X-Skip-Booster: PostRM');\n }\n }\n }\n if ($is_bot) {\n if (!preg_match(\"/Pingdom/i\", $_SERVER['HTTP_USER_AGENT']) &&\n !preg_match(\"/(?:rss|feed)/i\", $_SERVER['REQUEST_URI'])) {\n $expire_in_seconds = '3600';\n if ($is_dev) {\n header('X-Bot-Booster: 3600');\n }\n }\n }\n if ($conf['install_profile'] != 'hostmaster' && ($expire_in_seconds > -1)) {\n header(\"X-Accel-Expires: \" . $expire_in_seconds);\n if ($expire_in_seconds > -1 && $expire_in_seconds < 2) {\n $conf['cache'] = 0; // Disable page caching on the fly\n }\n }\n }\n}\n\n\n/**\n * Support files/styles with short URIs also for files not generated yet\n */\nif (preg_match(\"/^\\/files\\/styles\\//\", $_SERVER['REQUEST_URI'])) {\n header(\"Location: \" . $base_url . \"/sites/\" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'], true, 301);\n exit;\n}\n\n\n/**\n * Optional system level overrides\n */\nif (is_readable('/data/conf/override.global.inc')) {\n require_once \"/data/conf/override.global.inc\";\n}\n\n/**\n * Use Redis caching and lock support only for d6 and d7 profiles\n */\nif ($valkey_up && $use_valkey && !$custom_cache) {\n $cache_backport = FALSE;\n $cache_valkey = FALSE;\n $all_ini['redis_use_modern'] = TRUE;\n if ($all_ini['redis_use_modern']) {\n if ($drupal_core >= 8) {\n $redis_comprs = TRUE;\n $redis_dirname = 'redis_eight';\n if (!$all_ini['redis_old_eight_mode']) {\n $redis_dirname = 'redis_compr';\n }\n if ($drupal_core == 10 || $drupal_core == 11) {\n $redis_new_dirname = 'redis_ten_eleven';\n $redis_legacy_dirname = 'redis_nine_ten';\n if (is_readable('modules/o_contrib_ten/' . $redis_new_dirname . '/redis.services.yml')) {\n $redis_dirname = $redis_new_dirname;\n }\n elseif (is_readable('modules/o_contrib_ten/' . $redis_legacy_dirname . '/redis.services.yml')) {\n $redis_dirname = $redis_legacy_dirname;\n }\n }\n elseif ($drupal_core == 9) {\n $redis_dirname = 'redis_nine_ten';\n if ($all_ini['redis_old_nine_mode']) {\n $redis_dirname = 'redis_compr';\n }\n }\n }\n else {\n $redis_dirname = 'redis_edge';\n }\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Version-Is: Modern\");\n header(\"X-Valkey-Dir-Is: \" . $redis_dirname);\n }\n if ($all_ini['redis_flush_forced_mode']) {\n if ($drupal_core >= 8) {\n $settings['redis_perm_ttl'] = 86400; // 24 hours max\n $settings['redis_flush_mode'] = 1; // Valkey default is 0\n $settings['redis_flush_mode_cache_page'] = 2; // Valkey default is 1\n $settings['redis_flush_mode_cache_block'] = 2; // Valkey default is 1\n $settings['redis_flush_mode_cache_menu'] = 2; // Valkey default is 0\n $settings['redis_flush_mode_cache_metatag'] = 2; // Valkey default is 0\n }\n else {\n $conf['redis_perm_ttl'] = 86400; // 24 hours max\n $conf['redis_flush_mode'] = 1; // Valkey default is 0\n $conf['redis_flush_mode_cache_page'] = 2; // Valkey default is 1\n $conf['redis_flush_mode_cache_block'] = 2; // Valkey default is 1\n $conf['redis_flush_mode_cache_menu'] = 2; // Valkey default is 0\n $conf['redis_flush_mode_cache_metatag'] = 2; // Valkey default is 0\n }\n // See http://bit.ly/1drmi35 for more information\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Flush-Forced-Mode: Forced\");\n }\n }\n }\n else {\n $redis_dirname = 'redis';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Version-Is: Legacy\");\n header(\"X-Valkey-Dir-Is: \" . $redis_dirname);\n }\n }\n if ($drupal_core >= 8) {\n if (file_exists('sites/' . $_SERVER['SERVER_NAME'] . '/.redisLegacyOff')) {\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Off-Ctrl-Exists: .redisLegacyOff\");\n }\n }\n else {\n if (is_readable('sites/' . $_SERVER['SERVER_NAME'] . '/files/development.services.yml')) {\n if ($is_dev && !$is_backend) {\n header(\"X-Dev-Services-Yml-Is-Readable: development.services.yml\");\n }\n }\n else {\n if (is_readable('modules/o_contrib_ten')) {\n if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_failover_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.failover.services.yml';\n $example_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_ten/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n }\n if (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n elseif (is_readable('modules/o_contrib_eleven')) {\n if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_failover_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.failover.services.yml';\n $example_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n }\n if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n elseif (is_readable('modules/o_contrib_nine')) {\n if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_failover_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.failover.services.yml';\n $example_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_nine/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n }\n if (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n elseif (is_readable('modules/o_contrib_eight')) {\n if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml')) {\n $cache_valkey = TRUE;\n $example_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/example.services.yml';\n $cache_gzip_path = 'modules/o_contrib_eight/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n if ($is_dev && !$is_backend) {\n header(\"X-Example-Services-Is-Readable: \" . $example_services_path);\n }\n }\n if (is_readable('modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml')) {\n $cache_valkey = TRUE;\n $redis_services_path = 'modules/o_contrib_eight/' . $redis_dirname . '/redis.services.yml';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Services-Is-Readable: \" . $redis_services_path);\n }\n }\n }\n }\n }\n }\n elseif ($drupal_core == 7) {\n if (is_readable('modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc')) {\n $cache_valkey = TRUE;\n $cache_backport = FALSE;\n $cache_redis_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.autoload.inc';\n $cache_lock_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.lock.inc';\n $cache_path_path = 'modules/o_contrib_seven/' . $redis_dirname . '/redis.path.inc';\n $cache_gzip_path = 'modules/o_contrib_seven/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Autoload-Is-Readable: \" . $cache_redis_path);\n }\n }\n if ($all_ini['autoslave_enable']) {\n if (is_readable('modules/o_contrib_seven/autoslave/autoslave.cache.inc') &&\n is_readable('includes/database/autoslave/database.inc')) {\n $use_auto_se = TRUE;\n $gzip_mode = FALSE;\n $cache_backport = FALSE;\n $auto_se_path = 'modules/o_contrib_seven/autoslave/autoslave.cache.inc';\n if ($is_dev && !$is_backend) {\n header(\"X-AutoSlave-Cache-Is-Readable: \" . $auto_se_path);\n }\n }\n }\n if ($all_ini['cache_consistent_enable']) {\n if (is_readable('modules/o_contrib_seven/cache_consistent/cache_consistent.inc')) {\n $use_cache_ct = TRUE;\n $gzip_mode = FALSE;\n $cache_backport = FALSE;\n $cache_ct_path = 'modules/o_contrib_seven/cache_consistent/cache_consistent.inc';\n if ($is_dev && !$is_backend) {\n header(\"X-CacheConsistent-Is-Readable: \" . $cache_ct_path);\n }\n }\n }\n }\n elseif ($drupal_core == 6) {\n if (is_readable('modules/o_contrib/cache_backport/cache.inc')) {\n $cache_backport = TRUE;\n $cache_backport_path = 'modules/o_contrib/cache_backport/cache.inc';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Cache-Backport-Is-Readable: \" . $cache_backport_path);\n }\n }\n if (is_readable('modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc')) {\n $cache_valkey = TRUE;\n $cache_redis_path = 'modules/o_contrib/' . $redis_dirname . '/redis.autoload.inc';\n $cache_lock_path = 'modules/o_contrib/' . $redis_dirname . '/redis.lock.inc';\n $cache_path_path = 'modules/o_contrib/' . $redis_dirname . '/redis.path.inc';\n $cache_gzip_path = 'modules/o_contrib/' . $redis_dirname . '/lib/Redis/CacheCompressed.php';\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Autoload-Is-Readable: \" . $cache_redis_path);\n }\n }\n }\n if ($cache_valkey) {\n if ($drupal_core >= 8) {\n if (is_readable('modules/o_contrib_eleven/' . $redis_dirname . '/redis.services.yml')) {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_eleven/' . $redis_dirname . '/src');\n }\n elseif (is_readable('modules/o_contrib_ten/' . $redis_dirname . '/redis.services.yml')) {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_ten/' . $redis_dirname . '/src');\n }\n elseif (is_readable('modules/o_contrib_nine/' . $redis_dirname . '/redis.services.yml')) {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_nine/' . $redis_dirname . '/src');\n }\n else {\n $class_loader->addPsr4('Drupal\\\\redis\\\\', 'modules/o_contrib_eight/' . $redis_dirname . '/src');\n }\n $settings['redis.connection']['interface'] = 'PhpRedis';\n $settings['redis.connection']['host'] = '127.0.0.1';\n $settings['redis.connection']['port'] = '6379';\n $settings['redis.connection']['password'] = 'isfoobared';\n $settings['redis.connection']['base'] = '8';\n $settings['cache_prefix'] = $this_prefix;\n $settings['cache']['default'] = 'cache.backend.redis';\n if (!is_readable('/data/conf/clstr.cnf')) {\n $settings['cache']['bins']['bootstrap'] = 'cache.backend.chainedfast';\n $settings['cache']['bins']['discovery'] = 'cache.backend.chainedfast';\n $settings['cache']['bins']['config'] = 'cache.backend.chainedfast';\n }\n $settings['container_yamls'][] = $example_services_path;\n $settings['container_yamls'][] = $redis_services_path;\n if ($drupal_core <= 10) {\n $settings['queue_default'] = 'queue.redis_reliable';\n }\n if ($redis_comprs) {\n $settings['redis_compress_length'] = 100;\n $settings['redis_compress_level'] = 5;\n }\n $settings['cache']['bins']['state'] = 'cache.backend.redis';\n $settings['state_cache'] = TRUE;\n $settings['bootstrap_container_definition'] = [\n 'parameters' => [],\n 'services' => [\n 'redis.factory' => [\n 'class' => 'Drupal\\redis\\ClientFactory',\n ],\n 'cache.backend.redis' => [\n 'class' => 'Drupal\\redis\\Cache\\CacheBackendFactory',\n 'arguments' => ['@redis.factory', '@cache_tags_provider.container', '@serialization.phpserialize'],\n ],\n 'cache.container' => [\n 'class' => '\\Drupal\\redis\\Cache\\PhpRedis',\n 'factory' => ['@cache.backend.redis', 'get'],\n 'arguments' => ['container'],\n ],\n 'cache_tags_provider.container' => [\n 'class' => 'Drupal\\redis\\Cache\\RedisCacheTagsChecksum',\n 'arguments' => ['@redis.factory'],\n ],\n 'serialization.phpserialize' => [\n 'class' => 'Drupal\\Component\\Serialization\\PhpSerialize',\n ],\n ],\n ];\n }\n else {\n if ($cache_backport) {\n $conf['cache_inc'] = $cache_backport_path;\n }\n if ($all_ini['redis_use_modern']) {\n if ($all_ini['redis_lock_enable']) {\n $redis_lock = TRUE;\n }\n if ($all_ini['redis_path_enable']) {\n $redis_path = TRUE;\n }\n }\n if (is_readable($cache_lock_path) && $redis_lock) {\n $conf['lock_inc'] = $cache_lock_path;\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Lock-Is-Readable: \" . $cache_lock_path);\n }\n }\n if (is_readable($cache_path_path) && $redis_path) {\n $conf['path_inc'] = $cache_path_path;\n $conf['path_alias_admin_blacklist'] = FALSE;\n if ($is_dev && !$is_backend) {\n header(\"X-Valkey-Path-Is-Readable: \" . $cache_path_path);\n }\n }\n if ($all_ini['redis_scan_enable']) {\n $conf['redis_scan_delete'] = TRUE;\n $gzip_mode = FALSE;\n }\n else {\n if (is_readable($cache_gzip_path)) {\n $gzip_mode = TRUE;\n }\n else {\n $gzip_mode = FALSE;\n }\n }\n if ($gzip_mode) {\n $conf['cache_default_class'] = 'Redis_CacheCompressed';\n }\n else {\n $conf['cache_default_class'] = 'Redis_Cache';\n }\n $conf['cache_backends'][] = $cache_redis_path;\n if ($use_auto_se) {\n $conf['cache_backends'][] = $auto_se_path;\n $conf['cache_default_class'] = 'AutoslaveCache';\n $conf['autoslave_cache_default_class'] = 'Redis_Cache';\n }\n if ($use_cache_ct) {\n $conf['cache_backends'][] = $cache_ct_path;\n $conf['cache_default_class'] = 'ConsistentCache';\n if (!is_readable('/data/conf/clstr.cnf')) {\n $conf['cache_class_cache_form'] = 'DrupalDatabaseCache';\n $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache';\n }\n $conf['consistent_cache_default_class'] = 'Redis_Cache';\n $conf['consistent_cache_default_safe'] = TRUE;\n $conf['consistent_cache_buffer_mechanism'] = 'ConsistentCacheBuffer';\n $conf['consistent_cache_default_strict'] = FALSE;\n $conf['consistent_cache_strict_cache_bootstrap'] = TRUE;\n }\n if (!is_readable('/data/conf/clstr.cnf')) {\n $conf['cache_class_cache_form'] = 'DrupalDatabaseCache';\n $conf['cache_class_cache_bootstrap'] = 'DrupalDatabaseCache';\n }\n $conf['redis_client_interface'] = 'PhpRedis';\n $conf['redis_client_host'] = '127.0.0.1';\n $conf['redis_client_port'] = '6379';\n $conf['redis_client_password'] = 'isfoobared';\n $conf['redis_client_base'] = '8';\n $conf['cache_prefix'] = $this_prefix;\n $conf['page_cache_invoke_hooks'] = TRUE; // D7 == Do not use Aggressive Mode\n $conf['page_cache_without_database'] = FALSE; // D7 == Do not use Aggressive Mode\n $conf['page_cache_maximum_age'] = 0; // D7 == max-age in the Cache-Control header (ignored by Speed Booster)\n $conf['page_cache_max_age'] = 0; // D6 == max-age in the Cache-Control header (ignored by Speed Booster)\n $conf['cache_lifetime'] = 0; // D7 == BOA uses Speed Booster / Nginx micro-caching instead\n $conf['page_cache_lifetime'] = 0; // D6 == BOA uses Speed Booster / Nginx micro-caching instead\n }\n if ($all_ini['redis_exclude_bins'] && !is_readable('/data/conf/clstr.cnf')) {\n $excludes = array();\n $excludes = explode(\",\", $all_ini['redis_exclude_bins']);\n foreach ($excludes as $exclude) {\n $exclude = rtrim($exclude);\n $exclude = ltrim($exclude);\n if ($drupal_core >= 8) {\n $bin_exclude = $exclude;\n $settings['cache']['bins'][$bin_exclude] = 'cache.backend.database';\n }\n else {\n $bin_exclude = 'cache_class_' . $exclude;\n $conf[$bin_exclude] = 'DrupalDatabaseCache';\n }\n if ($is_dev && !$is_backend) {\n header(\"X-Ini-Valkey-Exclude-Bin-\" . $exclude . \": \" . $bin_exclude);\n }\n }\n }\n }\n}\n\n\n/**\n * Drupal for Facebook (fb)\n *\n * Important:\n * Facebook client libraries will not work properly if arg_separator.output is not &\n * The default value is &. Change this in settings.php. Make the value \"&\"\n * https://drupal.org/node/205476\n */\nif (!$custom_fb && $all_ini['auto_detect_facebook_integration']) {\n if (is_readable('sites/all/modules/fb/fb_settings.inc')) {\n ini_set('arg_separator.output', '&');\n require_once \"sites/all/modules/fb/fb_settings.inc\";\n $conf['fb_api_file'] = \"sites/all/modules/fb/facebook-platform/php/facebook.php\";\n }\n elseif (is_readable('sites/all/modules/contrib/fb/fb_settings.inc')) {\n ini_set('arg_separator.output', '&');\n require_once \"sites/all/modules/contrib/fb/fb_settings.inc\";\n $conf['fb_api_file'] = \"sites/all/modules/contrib/fb/facebook-platform/php/facebook.php\";\n }\n elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/fb/fb_settings.inc')) {\n ini_set('arg_separator.output', '&');\n require_once 'profiles/' . $conf['install_profile'] . '/modules/fb/fb_settings.inc';\n $conf['fb_api_file'] = 'profiles/' . $conf['install_profile'] . '/modules/fb/facebook-platform/php/facebook.php';\n }\n elseif (is_readable('profiles/' . $conf['install_profile'] . '/modules/contrib/fb/fb_settings.inc')) {\n ini_set('arg_separator.output', '&');\n require_once 'profiles/' . $conf['install_profile'] . '/modules/contrib/fb/fb_settings.inc';\n $conf['fb_api_file'] = 'profiles/' . $conf['install_profile'] . '/modules/contrib/fb/facebook-platform/php/facebook.php';\n }\n}\n\n\n/**\n * Domain module\n */\nif (!$custom_da) {\n if ($da_inc) {\n require_once($da_inc);\n }\n}\n\n\n/**\n * New Relic Integration for Drupal with Drush Compatibility (8, 12, 13)\n *\n * Supports background jobs and sets appropriate New Relic parameters.\n */\nif (extension_loaded('newrelic') && !empty($all_ini['enable_newrelic_integration'])) {\n $this_instance = FALSE;\n\n if ($is_backend) {\n $uri = FALSE;\n\n // Check if drush_get_context exists (Drush 8)\n if (function_exists('drush_get_context')) {\n // Drush 8 context retrieval\n $context = drush_get_context();\n if (isset($context['DRUSH_URI'])) {\n $uri = $context['DRUSH_URI'];\n }\n elseif (isset($context['DRUSH_DRUPAL_SITE'])) {\n $uri = $context['DRUSH_DRUPAL_SITE'];\n }\n }\n else {\n // Drush 9+ context retrieval\n // Attempt to retrieve URI from environment variables or Drush services\n // Drush commands can pass the URI as an environment variable or argument\n\n // Example: Using environment variable (you might need to set this in Drush commands)\n if (isset($_SERVER['DRUSH_URI'])) {\n $uri = $_SERVER['DRUSH_URI'];\n }\n elseif (isset($_SERVER['DRUPAL_SITE_URI'])) {\n $uri = $_SERVER['DRUPAL_SITE_URI'];\n }\n else {\n // Fallback: Attempt to determine URI using Drupal APIs\n // Note: In Drush context, some Drupal services might not be fully bootstrapped\n try {\n $request = \\Drupal::request();\n $uri = $request->getSchemeAndHttpHost();\n }\n catch (\\Exception $e) {\n // Unable to determine URI; proceed without setting it\n }\n }\n }\n\n if ($uri) {\n // Clean the URI by removing the scheme\n $uri = str_replace(['http://', 'https://'], '', $uri);\n $this_instance = 'Drush Site: ' . $uri;\n\n // Set New Relic transaction name and parameters if command details are available\n if (isset($command['command']) && isset($command['arguments'])) {\n $drush_command = array_merge([$command['command']], $command['arguments']);\n $command_str = implode(' ', $drush_command);\n\n // Add custom parameters to New Relic\n newrelic_add_custom_parameter('Drush command', $command_str);\n newrelic_name_transaction($command_str);\n\n // Indicate that this is a background job\n newrelic_background_job(TRUE);\n }\n }\n }\n else {\n // Non-Drush (web request) context\n if (isset($_SERVER['SERVER_NAME'])) {\n $this_instance = 'Web Site: ' . $_SERVER['SERVER_NAME'];\n // Optionally, indicate this is not a background job\n // newrelic_background_job(FALSE);\n }\n }\n\n // Apply the New Relic app name if determined\n if ($this_instance) {\n ini_set('newrelic.appname', $this_instance);\n newrelic_set_appname($this_instance);\n }\n}\nelseif (extension_loaded('newrelic') && empty($all_ini['enable_newrelic_integration'])) {\n // Disable New Relic auto-RUM and ignore transactions if integration is disabled\n newrelic_disable_autorum();\n newrelic_ignore_apdex();\n newrelic_ignore_transaction();\n}\n\n\n/**\n * Unset config arrays on non-dev URLs\n */\nif (!$is_dev) {\n unset($boa_ini);\n unset($usr_plr_ini);\n unset($usr_loc_ini);\n unset($all_ini);\n}\n" }, { "path": "aegir/conf/global/override.global.inc", "content": " \"$IFSTATE\" ; then\n\t log_failure_msg \"can't initialise $IFSTATE\"\n\t exit 1\n\tfi\n fi\n}\n\ncheck_network_file_systems() {\n [ -e /proc/mounts ] || return 0\n\n if [ -e /etc/iscsi/iscsi.initramfs ]; then\n\tlog_warning_msg \"not deconfiguring network interfaces: iSCSI root is mounted.\"\n\texit 0\n fi\n\n while read DEV MTPT FSTYPE REST; do\n\tcase $DEV in\n\t/dev/nbd*|/dev/nd[a-z]*|/dev/etherd/e*|curlftpfs*)\n\t log_warning_msg \"not deconfiguring network interfaces: network devices still mounted.\"\n\t exit 0\n\t ;;\n\tesac\n\tcase $FSTYPE in\n\tnfs|nfs4|smbfs|ncp|ncpfs|cifs|coda|ocfs2|gfs|pvfs|pvfs2|fuse.httpfs|fuse.curlftpfs)\n\t log_warning_msg \"not deconfiguring network interfaces: network file systems still mounted.\"\n\t exit 0\n\t ;;\n\tesac\n done < /proc/mounts\n}\n\ncheck_network_swap() {\n [ -e /proc/swaps ] || return 0\n\n while read DEV MTPT FSTYPE REST; do\n\tcase $DEV in\n\t/dev/nbd*|/dev/nd[a-z]*|/dev/etherd/e*)\n\t log_warning_msg \"not deconfiguring network interfaces: network swap still mounted.\"\n\t exit 0\n\t ;;\n\tesac\n done < /proc/swaps\n}\n\nifup_hotplug () {\n if [ -d /sys/class/net ]\n then\n\t ifaces=$(for iface in $(ifquery --list --allow=hotplug)\n\t\t\t do\n\t\t\t\t link=${iface%%:*}\n\t\t\t\t link=${link%%.*}\n\t\t\t\t if [ -e \"/sys/class/net/$link\" ] && ! ifquery --state \"$iface\" >/dev/null\n\t\t\t\t then\n\t\t\t\t\techo \"$iface\"\n\t\t\t\t fi\n\t\t\t done)\n\t if [ -n \"$ifaces\" ]\n\t then\n\t\tifup $ifaces \"$@\" || true\n\t fi\n fi\n}\n\ncase \"$1\" in\nstart)\n\tprocess_options\n\tcheck_ifstate\n\n\tif [ \"$CONFIGURE_INTERFACES\" = no ]\n\tthen\n\t log_action_msg \"Not configuring network interfaces, see /etc/default/networking\"\n\t exit 0\n\tfi\n\tset -f\n\texclusions=$(process_exclusions)\n\tlog_action_begin_msg \"Configuring network interfaces\"\n\tif [ -x \"$(command -v udevadm)\" ]; then\n\t\tif [ -n \"$(ifquery --list --exclude=lo)\" ] || [ -n \"$(ifquery --list --allow=hotplug)\" ]; then\n\t\t\tudevadm settle || true\n\t\tfi\n\tfi\n\tif ifup -a $exclusions $verbose && ifup_hotplug $exclusions $verbose\n\tthen\n\t log_action_end_msg $?\n\telse\n\t log_action_end_msg $?\n\tfi\n\t;;\n\nstop)\n\tcheck_network_file_systems\n\tcheck_network_swap\n\n\tlog_action_begin_msg \"Deconfiguring network interfaces\"\n\tif ifdown -a --exclude=lo $verbose; then\n\t log_action_end_msg $?\n\telse\n\t log_action_end_msg $?\n\tfi\n\t;;\n\nreload)\n\tprocess_options\n\n\tlog_action_begin_msg \"Reloading network interfaces configuration\"\n\tstate=$(ifquery --state)\n\tifdown -a --exclude=lo $verbose || true\n\tif ifup --exclude=lo $state $verbose ; then\n\t log_action_end_msg $?\n\telse\n\t log_action_end_msg $?\n\tfi\n\t;;\n\nforce-reload|restart)\n\tprocess_options\n\n\tlog_warning_msg \"Running $0 $1 is deprecated because it may not re-enable some interfaces\"\n\tlog_action_begin_msg \"Reconfiguring network interfaces\"\n\tifdown -a --exclude=lo $verbose || true\n\tset -f\n\texclusions=$(process_exclusions)\n\tif ifup -a --exclude=lo $exclusions $verbose && ifup_hotplug $exclusions $verbose\n\tthen\n\t log_action_end_msg $?\n\telse\n\t log_action_end_msg $?\n\tfi\n\t;;\n\n*)\n\techo \"Usage: /etc/init.d/networking {start|stop|reload|restart|force-reload}\"\n\texit 1\n\t;;\nesac\n\nexit 0\n\n# vim: noet ts=8\n" }, { "path": "aegir/conf/nginx/fastcgi_params.txt", "content": "fastcgi_param QUERY_STRING $query_string;\nfastcgi_param REQUEST_METHOD $request_method;\nfastcgi_param CONTENT_TYPE $content_type;\nfastcgi_param CONTENT_LENGTH $content_length;\n\nfastcgi_param SCRIPT_FILENAME $request_filename;\nfastcgi_param SCRIPT_NAME $fastcgi_script_name;\nfastcgi_param REQUEST_URI $request_uri;\nfastcgi_param DOCUMENT_URI $document_uri;\nfastcgi_param DOCUMENT_ROOT $document_root;\nfastcgi_param SERVER_PROTOCOL $server_protocol;\n\nfastcgi_param GATEWAY_INTERFACE CGI/1.1;\nfastcgi_param SERVER_SOFTWARE ApacheSolarisNginx/$nginx_version;\n\nfastcgi_param REMOTE_ADDR $remote_addr;\nfastcgi_param REMOTE_PORT $remote_port;\nfastcgi_param SERVER_ADDR $server_addr;\nfastcgi_param SERVER_PORT $server_port;\nfastcgi_param SERVER_NAME $server_name;\n\n# BOA specific\nfastcgi_param USER_DEVICE $device;\nfastcgi_param GEOIP_COUNTRY_CODE $geoip_country_code;\nfastcgi_param GEOIP_COUNTRY_CODE3 $geoip_country_code3;\nfastcgi_param GEOIP_COUNTRY_NAME $geoip_country_name;\n\nfastcgi_param HTTPS $https;\n\n# PHP only, required if PHP was built with --enable-force-cgi-redirect\nfastcgi_param REDIRECT_STATUS 200;\n\n# Block https://httpoxy.org/ attacks.\nfastcgi_param HTTP_PROXY \"\";\n" }, { "path": "aegir/conf/nginx/mime.types", "content": "types {\n application/atom+xml atom;\n application/iphone pxl ipa;\n application/java-archive jar war ear;\n application/javascript js;\n application/json json;\n application/mac-binhex40 hqx;\n application/msword doc;\n application/octet-stream bin exe dll;\n application/octet-stream deb;\n application/octet-stream dmg;\n application/octet-stream iso img;\n application/octet-stream msi msp msm;\n application/octet-stream safariextz;\n application/ogg ogx;\n application/pdf pdf;\n application/postscript ps eps ai;\n application/rss+xml rss;\n application/rtf rtf;\n application/vnd.android.package-archive apk;\n application/vnd.google-earth.kml+xml kml;\n application/vnd.google-earth.kmz kmz;\n application/vnd.ms-excel xls;\n application/vnd.ms-fontobject eot;\n application/vnd.ms-powerpoint ppt;\n application/vnd.oasis.opendocument.chart odc;\n application/vnd.oasis.opendocument.chart-template otc;\n application/vnd.oasis.opendocument.database odb;\n application/vnd.oasis.opendocument.formula odf;\n application/vnd.oasis.opendocument.formula-template odft;\n application/vnd.oasis.opendocument.graphics odg;\n application/vnd.oasis.opendocument.graphics-template otg;\n application/vnd.oasis.opendocument.image odi;\n application/vnd.oasis.opendocument.image-template oti;\n application/vnd.oasis.opendocument.presentation odp;\n application/vnd.oasis.opendocument.presentation-template otp;\n application/vnd.oasis.opendocument.spreadsheet ods;\n application/vnd.oasis.opendocument.spreadsheet-template ots;\n application/vnd.oasis.opendocument.text odt;\n application/vnd.oasis.opendocument.text-master otm;\n application/vnd.oasis.opendocument.text-template ott;\n application/vnd.oasis.opendocument.text-web oth;\n application/vnd.openofficeorg.extension oxt;\n application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;\n application/vnd.openxmlformats-officedocument.presentationml.slide sldx;\n application/vnd.openxmlformats-officedocument.presentationml.slideshow ppsx;\n application/vnd.openxmlformats-officedocument.presentationml.template potx;\n application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;\n application/vnd.openxmlformats-officedocument.spreadsheetml.template xltx;\n application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;\n application/vnd.openxmlformats-officedocument.wordprocessingml.template dotx;\n application/vnd.sun.xml.calc sxc;\n application/vnd.sun.xml.calc.template stc;\n application/vnd.sun.xml.draw sxd;\n application/vnd.sun.xml.draw.template std;\n application/vnd.sun.xml.impress sxi;\n application/vnd.sun.xml.impress.template sti;\n application/vnd.sun.xml.math sxm;\n application/vnd.sun.xml.writer sxw;\n application/vnd.sun.xml.writer.global sxg;\n application/vnd.sun.xml.writer.template stw;\n application/vnd.wap.wmlc wmlc;\n application/x-7z-compressed 7z;\n application/x-bittorrent torrent;\n application/x-chrome-extension crx;\n application/x-cocoa cco;\n application/x-font-ttf ttc ttf;\n application/x-h5p h5p;\n application/x-java-archive-diff jardiff;\n application/x-java-jnlp-file jnlp;\n application/x-makeself run;\n application/x-opera-extension oex;\n application/x-perl pl pm;\n application/x-pilot prc pdb;\n application/x-rar-compressed rar;\n application/x-redhat-package-manager rpm;\n application/x-sea sea;\n application/x-shockwave-flash swf;\n application/x-stuffit sit;\n application/x-tcl tcl tk;\n application/x-web-app-manifest+json webapp;\n application/x-x509-ca-cert der pem crt;\n application/x-xpinstall xpi;\n application/xhtml+xml xhtml;\n application/xml rdf;\n application/zip zip;\n audio/midi mid midi kar;\n audio/mp4 aac f4a f4b m4a;\n audio/mpeg mp3;\n audio/ogg oga ogg;\n audio/x-realaudio ra;\n audio/x-wav wav;\n font/opentype otf;\n font/woff woff;\n font/woff2 woff2;\n image/bmp bmp;\n image/gif gif;\n image/jpeg jpeg jpg;\n image/png png;\n image/svg+xml svg svgz;\n image/tiff tif tiff;\n image/vnd.wap.wbmp wbmp;\n image/webp webp;\n image/x-icon ico;\n image/x-jng jng;\n text/cache-manifest manifest appcache;\n text/css css;\n text/html html htm shtml;\n text/mathml mml;\n text/plain txt;\n text/vnd.sun.j2me.app-descriptor jad;\n text/vnd.wap.wml wml;\n text/vtt vtt;\n text/x-component htc;\n text/x-vcard vcf;\n text/xml xml;\n video/3gpp 3gpp 3gp;\n video/mp4 mp4 m4v f4v f4p;\n video/mpeg mpeg mpg;\n video/ogg ogv;\n video/quicktime mov;\n video/webm webm;\n video/x-flv flv;\n video/x-mng mng;\n video/x-ms-asf asx asf;\n video/x-ms-wmv wmv;\n video/x-msvideo avi;\n}\n" }, { "path": "aegir/conf/nginx/nginx", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: nginx\n# Required-Start: $remote_fs $syslog\n# Required-Stop: $remote_fs $syslog\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: nginx init.d dash script for Debian or other *nix.\n# Description: nginx init.d dash script for Debian or other *nix.\n### END INIT INFO\n#------------------------------------------------------------------------------\n# nginx - this Debian Almquist shell (dash) script, starts and stops the nginx\n# daemon for Ubuntu and other *nix releases.\n#\n# description: Nginx is an HTTP(S) server, HTTP(S) reverse \\\n# proxy and IMAP/POP3 proxy server. This \\\n# script will manage the initiation of the \\\n# server and it's process state.\n#\n# processname: nginx\n# config: /etc/nginx/nginx.conf\n# pidfile: /run/nginx.pid\n# Provides: nginx\n#\n# Author: Jason Giedymin\n# .\n#\n# Version: 3.5.1 11-NOV-2013 jason.giedymin AT gmail.com\n# Notes: nginx init.d dash script for Ubuntu.\n# Tested with: Ubuntu 13.10, nginx-1.4.3\n#\n# This script's project home is:\n# http://github.com/JasonGiedymin/nginx-init-ubuntu\n#\n# Modified by: Barracuda Team \n#\n#------------------------------------------------------------------------------\n# MIT X11 License\n#------------------------------------------------------------------------------\n#\n# Copyright (c) 2008-2013 Jason Giedymin, http://jasongiedymin.com\n#\n# Permission is hereby granted, free of charge, to any person obtaining\n# a copy of this software and associated documentation files (the\n# \"Software\"), to deal in the Software without restriction, including\n# without limitation the rights to use, copy, modify, merge, publish,\n# distribute, sublicense, and/or sell copies of the Software, and to\n# permit persons to whom the Software is furnished to do so, subject to\n# the following conditions:\n#\n# The above copyright notice and this permission notice shall be\n# included in all copies or substantial portions of the Software.\n#\n# THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\n# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\n# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\n# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE\n# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION\n# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n#------------------------------------------------------------------------------\n\n#------------------------------------------------------------------------------\n# Functions\n#------------------------------------------------------------------------------\nLSB_FUNC=/lib/lsb/init-functions\n\n# Test that init functions exists\ntest -r $LSB_FUNC || {\n echo \"$0: Cannot find $LSB_FUNC! Script exiting.\" 1>&2\n exit 5\n}\n\n. $LSB_FUNC\n\n#------------------------------------------------------------------------------\n# Consts\n#------------------------------------------------------------------------------\nPATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nDAEMON=/usr/sbin/nginx\n\nPS=\"nginx\"\nPIDNAME=\"nginx\" #lets you do $PS-slave\nPIDFILE=$PIDNAME.pid #pid file\nPIDSPATH=/run #default pid location, you should change it\n\nDESCRIPTION=\"Nginx Server...\"\n\nRUNAS=root #user to run as\n\nSCRIPT_OK=0 #ala error codes\nSCRIPT_ERROR=1 #ala error codes\nTRUE=1 #boolean\nFALSE=0 #boolean\n\nlockfile=/var/lock/subsys/nginx\nNGINX_CONF_FILE=\"/etc/nginx/nginx.conf\"\n\n#------------------------------------------------------------------------------\n# Simple Tests\n#------------------------------------------------------------------------------\n\n# Test if nginx is a file and executable\ntest -x $DAEMON || {\n echo \"$0: You don't have permissions to execute nginx.\" 1>&2\n exit 4\n}\n\n# Include nginx defaults if available\nif [ -f /etc/default/nginx ]; then\n . /etc/default/nginx\nfi\n\n#------------------------------------------------------------------------------\n# Functions\n#------------------------------------------------------------------------------\n\n\n# Load kTLS module only if it is not already loaded\n_load_ktls_module() {\n if ! lsmod 2>/dev/null | awk '{print $1}' | grep -qx \"tls\"; then\n if [ -e \"/lib/modules/$(uname -r)/kernel/net/tls/tls.ko\" ] \\\n || modinfo tls >/dev/null 2>&1; then\n modprobe -q tls >/dev/null 2>&1 || true\n grep -qxF \"tls\" /etc/modules 2>/dev/null || printf '%s\\n' \"tls\" >> /etc/modules\n fi\n fi\n}\n\nsetFilePerms(){\n if [ -f $PIDSPATH/$PIDFILE ]; then\n chmod 400 $PIDSPATH/$PIDFILE\n fi\n}\n\nconfigtest() {\n $DAEMON -t -c $NGINX_CONF_FILE\n}\n\ngetPSCount() {\n return `pgrep -f $PS | wc -l`\n}\n\nisRunning() {\n if [ $1 ]; then\n pidof_daemon $1\n PID=$?\n\n if [ $PID -gt 0 ]; then\n return 1\n else\n return 0\n fi\n else\n pidof_daemon\n PID=$?\n\n if [ $PID -gt 0 ]; then\n return 1\n else\n return 0\n fi\n fi\n}\n\n#courtesy of php-fpm\nwait_for_pid() {\n try=0\n\n while test $try -lt 35; do\n case \"$1\" in\n 'created')\n if [ -f \"$2\" ]; then\n try=''\n break\n fi\n ;;\n\n 'removed')\n if [ ! -f \"$2\" ]; then\n try=''\n break\n fi\n ;;\n esac\n\n try=`expr $try + 1`\n sleep 1\n done\n}\n\nstatus(){\n isRunning\n isAlive=$?\n\n if [ \"${isAlive}\" -eq $TRUE ]; then\n log_warning_msg \"$DESCRIPTION found running with processes: `pidof $PS`\"\n rc=0\n else\n log_warning_msg \"$DESCRIPTION is NOT running.\"\n rc=3\n fi\n\n return\n}\n\nremovePIDFile(){\n if [ $1 ]; then\n if [ -f $1 ]; then\n rm -f $1\n fi\n else\n #Do default removal\n if [ -f $PIDSPATH/$PIDFILE ]; then\n rm -f $PIDSPATH/$PIDFILE\n fi\n fi\n}\n\nstart() {\n log_daemon_msg \"Starting $DESCRIPTION\"\n\n _load_ktls_module\n\n isRunning\n isAlive=$?\n\n if [ \"${isAlive}\" -eq $TRUE ]; then\n log_end_msg $SCRIPT_ERROR\n rc=0\n else\n # Check if the ULIMIT is set in /etc/default/nginx\n if [ -n \"$ULIMIT\" ]; then\n # Set the ulimits\n ulimit $ULIMIT\n fi\n start-stop-daemon --start --quiet --chuid \\\n $RUNAS --pidfile $PIDSPATH/$PIDFILE --exec $DAEMON \\\n -- -c $NGINX_CONF_FILE\n setFilePerms\n log_end_msg $SCRIPT_OK\n rc=0\n fi\n\n return\n}\n\nstop() {\n log_daemon_msg \"Stopping $DESCRIPTION\"\n\n isRunning\n isAlive=$?\n\n if [ \"${isAlive}\" -eq $TRUE ]; then\n start-stop-daemon --stop --quiet --pidfile $PIDSPATH/$PIDFILE\n\n wait_for_pid 'removed' $PIDSPATH/$PIDFILE\n\n if [ -n \"$try\" ]; then\n log_end_msg $SCRIPT_ERROR\n rc=0 # lsb states 1, but under status it is 2 (which is more prescriptive). Deferring to standard.\n else\n removePIDFile\n log_end_msg $SCRIPT_OK\n rc=0\n fi\n else\n log_end_msg $SCRIPT_ERROR\n rc=7\n fi\n\n return\n}\n\nreload() {\n configtest || return $?\n\n log_daemon_msg \"Reloading (via HUP) $DESCRIPTION\"\n\n isRunning\n\n if [ $? -eq $TRUE ]; then\n kill -HUP `cat $PIDSPATH/$PIDFILE`\n log_end_msg $SCRIPT_OK\n rc=0\n else\n log_end_msg $SCRIPT_ERROR\n rc=7\n fi\n\n return\n}\n\nquietupgrade() {\n log_daemon_msg \"Performing Quiet Upgrade $DESCRIPTION\"\n\n isRunning\n isAlive=$?\n\n if [ \"${isAlive}\" -eq $TRUE ]; then\n kill -USR2 `cat $PIDSPATH/$PIDFILE`\n kill -WINCH `cat $PIDSPATH/$PIDFILE.oldbin`\n\n isRunning\n isAlive=$?\n\n if [ \"${isAlive}\" -eq $TRUE ]; then\n kill -QUIT `cat $PIDSPATH/$PIDFILE.oldbin`\n wait_for_pid 'removed' $PIDSPATH/$PIDFILE.oldbin\n removePIDFile $PIDSPATH/$PIDFILE.oldbin\n\n log_end_msg $SCRIPT_OK\n rc=0\n else\n log_end_msg $SCRIPT_ERROR\n\n log_daemon_msg \"ERROR! Reverting back to original $DESCRIPTION\"\n\n kill -HUP `cat $PIDSPATH/$PIDFILE`\n kill -TERM `cat $PIDSPATH/$PIDFILE.oldbin`\n kill -QUIT `cat $PIDSPATH/$PIDFILE.oldbin`\n\n wait_for_pid 'removed' $PIDSPATH/$PIDFILE.oldbin\n removePIDFile $PIDSPATH/$PIDFILE.oldbin\n\n log_end_msg $SCRIPT_OK\n rc=0\n fi\n else\n log_end_msg $SCRIPT_ERROR\n rc=7\n fi\n\n return\n}\n\nterminate() {\n log_daemon_msg \"Force terminating (via KILL) $DESCRIPTION\"\n\n PIDS=`pidof $PS` || true\n\n [ -e $PIDSPATH/$PIDFILE ] && PIDS2=`cat $PIDSPATH/$PIDFILE`\n\n for i in $PIDS; do\n if [ \"$i\" = \"$PIDS2\" ]; then\n kill $i\n wait_for_pid 'removed' $PIDSPATH/$PIDFILE\n removePIDFile\n fi\n done\n\n log_end_msg $SCRIPT_OK\n rc=0\n}\n\ndestroy() {\n log_daemon_msg \"Force terminating and may include self (via KILLALL) $DESCRIPTION\"\n killall $PS -q >> /dev/null 2>&1\n log_end_msg $SCRIPT_OK\n rc=0\n}\n\npidof_daemon() {\n PIDS=`pidof $PS` || true\n\n [ -e $PIDSPATH/$PIDFILE ] && PIDS2=`cat $PIDSPATH/$PIDFILE`\n\n for i in $PIDS; do\n if [ \"$i\" = \"$PIDS2\" ]; then\n return 1\n fi\n done\n\n return 0\n}\n\naction=\"$1\"\ncase \"$1\" in\n start)\n start\n ;;\n stop)\n stop\n ;;\n restart|force-reload)\n stop\n # if [ $rc -ne 0 ]; then\n # script_exit\n # fi\n sleep 1\n start\n ;;\n reload)\n $1\n ;;\n status)\n status\n ;;\n configtest)\n $1\n ;;\n quietupgrade)\n $1\n ;;\n terminate)\n $1\n ;;\n destroy)\n $1\n ;;\n *)\n FULLPATH=/etc/init.d/$PS\n echo \"Usage: $FULLPATH {start|stop|restart|force-reload|status|configtest|quietupgrade|terminate|destroy}\"\n echo \" The 'destroy' command should only be used as a last resort.\"\n exit 3\n ;;\nesac\n\nexit $rc\n" }, { "path": "aegir/conf/nginx/nginx-squeeze-init", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: nginx\n# Required-Start: $local_fs $remote_fs $network $syslog\n# Required-Stop: $local_fs $remote_fs $network $syslog\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts the nginx web server\n# Description: starts nginx using start-stop-daemon\n### END INIT INFO\n\nPATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nDAEMON=/usr/sbin/nginx\nNAME=nginx\nDESC=nginx\n\n# Include nginx defaults if available\nif [ -f /etc/default/nginx ]; then\n\t. /etc/default/nginx\nfi\n\ntest -x $DAEMON || exit 0\n\n. /lib/lsb/init-functions\n\ntest_nginx_config() {\n\tif $DAEMON -t $DAEMON_OPTS >/dev/null 2>&1; then\n\t\treturn 0\n\telse\n\t\t$DAEMON -t $DAEMON_OPTS\n\t\treturn $?\n\tfi\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting $DESC: \"\n\t\ttest_nginx_config\n\t\t# Check if the ULIMIT is set in /etc/default/nginx\n\t\tif [ -n \"$ULIMIT\" ]; then\n\t\t\t# Set the ulimits\n\t\t\tulimit $ULIMIT\n\t\tfi\n\t\tstart-stop-daemon --start --quiet --pidfile /run/$NAME.pid \\\n\t\t --exec $DAEMON -- $DAEMON_OPTS || true\n\t\techo \"$NAME.\"\n\t\t;;\n\n\tstop)\n\t\techo -n \"Stopping $DESC: \"\n\t\tstart-stop-daemon --stop --quiet --pidfile /run/$NAME.pid \\\n\t\t --exec $DAEMON || true\n\t\techo \"$NAME.\"\n\t\t;;\n\n\trestart|force-reload)\n\t\techo -n \"Restarting $DESC: \"\n\t\tstart-stop-daemon --stop --quiet --pidfile \\\n\t\t /run/$NAME.pid --exec $DAEMON || true\n\t\tsleep 1\n\t\ttest_nginx_config\n\t\tstart-stop-daemon --start --quiet --pidfile \\\n\t\t /run/$NAME.pid --exec $DAEMON -- $DAEMON_OPTS || true\n\t\techo \"$NAME.\"\n\t\t;;\n\n\treload)\n\t\techo -n \"Reloading $DESC configuration: \"\n\t\ttest_nginx_config\n\t\tstart-stop-daemon --stop --signal HUP --quiet --pidfile /run/$NAME.pid \\\n\t\t --exec $DAEMON || true\n\t\techo \"$NAME.\"\n\t\t;;\n\n\tconfigtest|testconfig)\n\t\techo -n \"Testing $DESC configuration: \"\n\t\tif test_nginx_config; then\n\t\t\techo \"$NAME.\"\n\t\telse\n\t\t\texit $?\n\t\tfi\n\t\t;;\n\n\tstatus)\n\t\tstatus_of_proc -p /run/$NAME.pid \"$DAEMON\" nginx && exit 0 || exit $?\n\t\t;;\n\t*)\n\t\techo \"Usage: $NAME {start|stop|restart|reload|force-reload|status|configtest}\" >&2\n\t\texit 1\n\t\t;;\nesac\n\nexit 0\n" }, { "path": "aegir/conf/nginx/nginx.conf", "content": "# Nginx web server main configuration file: /etc/nginx/nginx.conf\n#\nuser www-data;\nworker_processes auto;\npid /run/nginx.pid;\n\nevents {\n multi_accept on;\n worker_connections 20000;\n}\n\nhttp {\n default_type application/octet-stream;\n gzip on;\n gzip_disable \"msie6\";\n keepalive_timeout 70;\n sendfile on;\n tcp_nodelay on;\n tcp_nopush on;\n keepalive_requests 99999;\n types_hash_max_size 8192;\n include /etc/nginx/mime.types;\n include /etc/nginx/conf.d/*.conf;\n include /etc/nginx/sites-enabled/*;\n}\n" }, { "path": "aegir/conf/nginx/nginx_compact_include.conf", "content": "#######################################################\n### nginx compact basic configuration start\n#######################################################\n\n###\n### Deny crawlers.\n###\nif ($is_crawler) {\n return 444;\n}\n\n###\n### Include high load protection config if exists.\n###\ninclude /data/conf/nginx_high_load.c*;\n\n###\n### Catch all unspecified requests.\n###\nlocation / {\n try_files $uri @dynamic;\n}\n\n###\n### Send all not cached requests to php-fpm with clean URLs support.\n###\nlocation @dynamic {\n rewrite ^/(.*)$ /index.php last;\n}\n\n###\n### Send all non-static requests to php-fpm.\n###\nlocation ~ \\.php$ {\n try_files $uri =404; ### check for existence of php file first\n fastcgi_pass 127.0.0.1:9090;\n}\n\n###\n### Serve & no-log static files & images directly.\n###\nlocation ~* ^.+\\.(?:css|js|htc|xml|jpe?g|gif|png|ico|webp|bmp|svg|swf|pdf|docx?|xlsx?|tiff?|txt|rtf|vcard|vcf|cgi|bat|pl|dll|aspx?|class|otf|ttf|woff2?|eot|less)$ {\n access_log off;\n log_not_found off;\n expires 30d;\n try_files $uri =404;\n}\n\n###\n### Serve & log bigger media/static/archive files directly.\n###\nlocation ~* ^.+\\.(?:avi|mpe?g|mov|wmv|mp3|ogg|ogv|wav|midi|zip|tar|t?gz|rar|dmg|exe|apk|pxl|ipa)$ {\n expires 30d;\n try_files $uri =404;\n}\n\n###\n### Pseudo-streaming server-side support for Flash Video (FLV) files.\n###\nlocation ~* ^.+\\.flv$ {\n flv;\n expires 30d;\n try_files $uri =404;\n}\n\n###\n### Pseudo-streaming server-side support for H.264/AAC files.\n###\nlocation ~* ^.+\\.(?:mp4|m4a)$ {\n mp4;\n mp4_buffer_size 1m;\n mp4_max_buffer_size 5m;\n expires 30d;\n try_files $uri =404;\n}\n\n#######################################################\n### nginx compact basic configuration end\n#######################################################\n" }, { "path": "aegir/conf/nginx/nginx_high_load_off.conf", "content": "###\n### Only allowed crawlers under high load.\n###\nif ($deny_on_high_load) {\n return 503;\n}\n" }, { "path": "aegir/conf/nginx/nginx_speed_purge.conf", "content": "###\n### Support for https://drupal.org/project/purge module.\n###\nserver {\n listen 127.0.0.1:8888;\n server_name _;\n limit_conn limreq 8888;\n access_log /var/log/nginx/speed_purge.log main buffer=32k;\n allow 127.0.0.1;\n deny all;\n root /var/www/nginx-default;\n index index.html index.htm;\n server_name_in_redirect off;\n location / {\n try_files $uri =404;\n }\n location ~ /purge-([a-z\\-]*)(/.*) {\n fastcgi_cache_purge speed $1$host$request_method$2;\n log_not_found off;\n }\n}\n" }, { "path": "aegir/conf/nginx/nginx_sql_adminer.conf", "content": "###\n### Adminer SQL Manager Redirect to HTTPS.\n###\nserver {\n listen 127.0.0.1:80;\n server_name adminer_name;\n # Disable access logs for this server block\n access_log off;\n log_not_found off;\n return 301 https://$host$request_uri;\n}\n\n###\n### Adminer SQL Manager HTTPS Only.\n###\nserver {\n include fastcgi_params;\n fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;\n fastcgi_param HTTPS on;\n limit_conn limreq 555;\n listen 127.0.0.1:443 ssl;\n http2 on;\n server_name adminer_name;\n root /var/www/adminer;\n index index.php index.html;\n ssl_dhparam /etc/ssl/private/nginx-wild-ssl.dhp;\n ssl_certificate /etc/ssl/private/nginx-wild-ssl.crt;\n ssl_certificate_key /etc/ssl/private/nginx-wild-ssl.key;\n ssl_session_timeout 5m;\n if ($is_crawler) {\n return 444;\n }\n include /var/aegir/config/includes/ip_access/sqladmin*;\n include /var/aegir/config/includes/nginx_compact_include.conf;\n}\n" }, { "path": "aegir/conf/nginx/nginx_sql_buddy.conf", "content": "###\n### SQL Buddy Manager Redirect to HTTPS.\n###\nserver {\n listen 127.0.0.1:80;\n server_name buddy_name;\n # Disable access logs for this server block\n access_log off;\n log_not_found off;\n return 301 https://$host$request_uri;\n}\n\n###\n### SQL Buddy Manager HTTPS Only.\n###\nserver {\n include fastcgi_params;\n fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;\n fastcgi_param HTTPS on;\n limit_conn limreq 555;\n listen 127.0.0.1:443 ssl;\n http2 on;\n server_name buddy_name;\n root /var/www/sqlbuddy;\n index index.php index.html;\n ssl_dhparam /etc/ssl/private/nginx-wild-ssl.dhp;\n ssl_certificate /etc/ssl/private/nginx-wild-ssl.crt;\n ssl_certificate_key /etc/ssl/private/nginx-wild-ssl.key;\n ssl_session_timeout 5m;\n if ($is_crawler) {\n return 444;\n }\n include /var/aegir/config/includes/ip_access/sqladmin*;\n include /var/aegir/config/includes/nginx_compact_include.conf;\n}\n" }, { "path": "aegir/conf/nginx/nginx_sql_cgp.conf", "content": "###\n### Collectd Graph Panel Redirect to HTTPS.\n###\nserver {\n listen 127.0.0.1:80;\n server_name cgp_name;\n # Disable access logs for this server block\n access_log off;\n log_not_found off;\n return 301 https://$host$request_uri;\n}\n\n###\n### Collectd Graph Panel HTTPS Only.\n###\nserver {\n include fastcgi_params;\n fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;\n fastcgi_param HTTPS on;\n limit_conn limreq 555;\n listen 127.0.0.1:443 ssl;\n http2 on;\n server_name cgp_name;\n root /var/www/cgp;\n index index.php index.html;\n ssl_dhparam /etc/ssl/private/nginx-wild-ssl.dhp;\n ssl_certificate /etc/ssl/private/nginx-wild-ssl.crt;\n ssl_certificate_key /etc/ssl/private/nginx-wild-ssl.key;\n ssl_session_timeout 5m;\n if ($is_crawler) {\n return 444;\n }\n include /var/aegir/config/includes/ip_access/sqladmin*;\n include /var/aegir/config/includes/nginx_compact_include.conf;\n}\n" }, { "path": "aegir/conf/nginx/nginx_sql_chive.conf", "content": "###\n### Chive SQL Manager Redirect to HTTPS.\n###\nserver {\n listen 127.0.0.1:80;\n server_name chive_name;\n # Disable access logs for this server block\n access_log off;\n log_not_found off;\n return 301 https://$host$request_uri;\n}\n\n###\n### Chive SQL Manager HTTPS Only.\n###\nserver {\n include fastcgi_params;\n fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;\n fastcgi_param HTTPS on;\n limit_conn limreq 555;\n listen 127.0.0.1:443 ssl;\n http2 on;\n server_name chive_name;\n root /var/www/chive;\n index index.php index.html;\n ssl_dhparam /etc/ssl/private/nginx-wild-ssl.dhp;\n ssl_certificate /etc/ssl/private/nginx-wild-ssl.crt;\n ssl_certificate_key /etc/ssl/private/nginx-wild-ssl.key;\n ssl_session_timeout 5m;\n if ($is_crawler) {\n return 444;\n }\n include /var/aegir/config/includes/ip_access/sqladmin*;\n include /var/aegir/config/includes/nginx_compact_include.conf;\n}\n" }, { "path": "aegir/conf/nginx/nginx_wild_ssl.conf", "content": "\n### /var/aegir/config/server_master/nginx/pre.d/nginx_wild_ssl.conf\n\nupstream nginx_http {\n server 127.0.0.1:80;\n}\n\nserver {\n listen 127.0.0.1:443 ssl;\n listen 127.0.0.1:443 quic reuseport;\n http2 on;\n http3 on;\n http3_hq on;\n server_name _;\n ssl_dhparam /etc/ssl/private/nginx-wild-ssl.dhp;\n ssl_certificate /etc/ssl/private/nginx-wild-ssl.crt;\n ssl_certificate_key /etc/ssl/private/nginx-wild-ssl.key;\n ssl_session_timeout 5m;\n ssl_conf_command Options KTLS;\n access_log off;\n log_not_found off;\n ###\n ### Deny known crawlers.\n ###\n if ($is_crawler) {\n return 444;\n }\n location / {\n proxy_pass http://nginx_http;\n proxy_redirect off;\n gzip_vary off;\n proxy_buffering off;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-By $server_addr:$server_port;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Local-Proxy $scheme;\n proxy_set_header X-Forwarded-Proto $scheme;\n proxy_pass_header Set-Cookie;\n proxy_pass_header Cookie;\n proxy_pass_header X-Accel-Expires;\n proxy_pass_header X-Accel-Redirect;\n proxy_pass_header X-This-Proto;\n proxy_connect_timeout 180;\n proxy_send_timeout 180;\n proxy_read_timeout 180;\n }\n}\n" }, { "path": "aegir/conf/php/fpm-pool-common-legacy.conf", "content": "\ngroup = www-data\nlisten.owner = www-data\nlisten.group = www-data\nlisten.mode = 0660\nlisten.allowed_clients = 127.0.0.1\n\npm = ondemand\npm.process_idle_timeout = 10s\npm.max_requests = 5000\npm.status_path = /fpm-status\nping.path = /fpm-ping\nping.response = pong\nslowlog = /var/log/php/fpm-$pool-slow.log\nrequest_slowlog_timeout = 90s\nlisten.backlog = 65535\n\nenv[HOSTNAME] = $HOSTNAME\nenv[PATH] = /usr/local/bin:/usr/bin:/bin\n\nphp_admin_value[default_socket_timeout] = 180\nphp_admin_value[max_execution_time] = 180\nphp_admin_value[max_input_time] = 180\nphp_admin_value[memory_limit] = 395M\n\nphp_admin_value[opcache.error_log] = /var/log/php/opcache-$pool-error.log\nphp_admin_value[opcache.log_verbosity_level] = 1\n\nphp_admin_flag[apc.enabled] = on\n\n" }, { "path": "aegir/conf/php/fpm-pool-common-modern.conf", "content": "\ngroup = www-data\nlisten.owner = www-data\nlisten.group = www-data\nlisten.mode = 0660\nlisten.allowed_clients = 127.0.0.1\n\npm = ondemand\npm.process_idle_timeout = 10s\npm.max_requests = 5000\npm.status_path = /fpm-status\nping.path = /fpm-ping\nping.response = pong\nslowlog = /var/log/php/fpm-$pool-slow.log\nrequest_slowlog_timeout = 90s\nlisten.backlog = 65535\n\nenv[HOSTNAME] = $HOSTNAME\nenv[PATH] = /usr/local/bin:/usr/bin:/bin\n\nphp_admin_value[default_socket_timeout] = 180\nphp_admin_value[max_execution_time] = 180\nphp_admin_value[max_input_time] = 180\nphp_admin_value[memory_limit] = 395M\n\nphp_admin_value[opcache.error_log] = /var/log/php/opcache-$pool-error.log\nphp_admin_value[opcache.log_verbosity_level] = 1\n\nphp_admin_flag[apc.enabled] = on\n\n" }, { "path": "aegir/conf/php/fpm-pool-common.conf", "content": "\ngroup = www-data\nlisten.owner = www-data\nlisten.group = www-data\nlisten.mode = 0660\nlisten.allowed_clients = 127.0.0.1\n\npm = ondemand\npm.process_idle_timeout = 10s\npm.max_requests = 5000\npm.status_path = /fpm-status\nping.path = /fpm-ping\nping.response = pong\nslowlog = /var/log/php/fpm-$pool-slow.log\nrequest_slowlog_timeout = 90s\nlisten.backlog = 65535\n\nenv[HOSTNAME] = $HOSTNAME\nenv[PATH] = /usr/local/bin:/usr/bin:/bin\n\nphp_admin_value[default_socket_timeout] = 180\nphp_admin_value[max_execution_time] = 180\nphp_admin_value[max_input_time] = 180\nphp_admin_value[memory_limit] = 395M\n\nphp_admin_value[opcache.error_log] = /var/log/php/opcache-$pool-error.log\nphp_admin_value[opcache.log_verbosity_level] = 1\n\nphp_admin_flag[apc.enabled] = on\n\n" }, { "path": "aegir/conf/php/fpm-pool-foo-multi.conf", "content": "[THISPOOL]\n\nprefix = /data/disk/foo\nuser = $pool.web\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/home/foo.web/.tmp\"\nphp_admin_value[upload_tmp_dir] = \"/home/foo.web/.tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/home/foo.web/.tmp\"\nphp_admin_value[session.save_path] = \"/home/foo.web/.tmp\"\nphp_admin_value[uploadprogress.file.contents_template] = \"/home/foo.web/.tmp/upload_contents_%s\"\nphp_admin_value[uploadprogress.file.filename_template] = \"/home/foo.web/.tmp/upt_%s.txt\"\n\nenv[TMP] = /home/foo.web/.tmp\nenv[TMPDIR] = /home/foo.web/.tmp\nenv[TEMP] = /home/foo.web/.tmp\n\nphp_admin_value[open_basedir] = \".:/data/disk/foo/distro:/data/disk/foo/static:/data/disk/foo/aegir:/data/disk/foo/platforms:/data/disk/foo/backup-exports:/home/foo.web/.tmp:/home/foo.web/.aws:/data/all:/data/disk/all:/data/conf:/var/second/foo:/mnt:/srv:/hdd:/usr/bin:/usr/local/bin:/opt/tika:/opt/tika7:/opt/tika8:/opt/tika9:/opt/php56:/opt/php70:/opt/php71:/opt/php72:/opt/php73:/opt/php74:/opt/php80:/opt/php81:/opt/php82:/opt/php83:/opt/php84:/opt/php85:/dev/urandom:/var/tmp/fpm:/var/www/phpcache/foo\"\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm-pool-foo.conf", "content": "[foo]\n\nprefix = /data/disk/foo\nuser = $pool.web\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/home/foo.web/.tmp\"\nphp_admin_value[upload_tmp_dir] = \"/home/foo.web/.tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/home/foo.web/.tmp\"\nphp_admin_value[session.save_path] = \"/home/foo.web/.tmp\"\nphp_admin_value[uploadprogress.file.contents_template] = \"/home/foo.web/.tmp/upload_contents_%s\"\nphp_admin_value[uploadprogress.file.filename_template] = \"/home/foo.web/.tmp/upt_%s.txt\"\n\nenv[TMP] = /home/foo.web/.tmp\nenv[TMPDIR] = /home/foo.web/.tmp\nenv[TEMP] = /home/foo.web/.tmp\n\nphp_admin_value[open_basedir] = \".:/data/disk/foo/distro:/data/disk/foo/static:/data/disk/foo/aegir:/data/disk/foo/platforms:/data/disk/foo/backup-exports:/home/foo.web/.tmp:/home/foo.web/.aws:/data/all:/data/disk/all:/data/conf:/var/second/foo:/mnt:/srv:/hdd:/usr/bin:/usr/local/bin:/opt/tika:/opt/tika7:/opt/tika8:/opt/tika9:/opt/php56:/opt/php70:/opt/php71:/opt/php72:/opt/php73:/opt/php74:/opt/php80:/opt/php81:/opt/php82:/opt/php83:/opt/php84:/opt/php85:/dev/urandom:/var/tmp/fpm:/var/www/phpcache/foo\"\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm56-pool-www.conf", "content": "[www56]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common-legacy.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n" }, { "path": "aegir/conf/php/fpm70-pool-www.conf", "content": "[www70]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common-legacy.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm71-pool-www.conf", "content": "[www71]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common-legacy.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm72-pool-www.conf", "content": "[www72]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common-legacy.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm73-pool-www.conf", "content": "[www73]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common-legacy.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm74-pool-www.conf", "content": "[www74]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common-legacy.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm80-pool-www.conf", "content": "[www80]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm81-pool-www.conf", "content": "[www81]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm82-pool-www.conf", "content": "[www82]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm83-pool-www.conf", "content": "[www83]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm84-pool-www.conf", "content": "[www84]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/fpm85-pool-www.conf", "content": "[www85]\n\nprefix = /var/www/$pool\nuser = $pool\nlisten = /run/$pool.fpm.socket\n\ninclude = /opt/etc/fpm/fpm-pool-common.conf\n\npm.max_children = 8\nrequest_terminate_timeout = 180s\n\nphp_admin_value[sys_temp_dir] = \"/tmp\"\nphp_admin_value[upload_tmp_dir] = \"/tmp\"\nphp_admin_value[soap.wsdl_cache_dir] = \"/tmp\"\nphp_admin_value[session.save_path] = \"/tmp\"\n\nenv[TMP] = /tmp\nenv[TMPDIR] = /tmp\nenv[TEMP] = /tmp\n\nphp_admin_value[disable_functions] = \"passthru,disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\nphp_admin_value[newrelic.license] = \"\"\nphp_admin_value[newrelic.enabled] = \"false\"\n" }, { "path": "aegir/conf/php/newrelic.ini", "content": "\n; New Relic\nextension=newrelic.so\n[newrelic]\nnewrelic.enabled=true\nnewrelic.license = \"REPLACE_WITH_REAL_KEY\"\nnewrelic.logfile = \"/var/log/newrelic/php_agent.log\"\nnewrelic.loglevel = \"error\"\nnewrelic.appname = \"Other Tasks\"\nnewrelic.daemon.logfile = \"/var/log/newrelic/newrelic-daemon.log\"\nnewrelic.daemon.loglevel = \"error\"\nnewrelic.daemon.pidfile = \"/run/newrelic-daemon.pid\"\nnewrelic.daemon.dont_launch = 3\n" }, { "path": "aegir/conf/php/php56-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (C:\\windows or C:\\winnt)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; html_errors\n; Default Value: On\n; Development Value: On\n; Production value: On\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.hash_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; track_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; url_rewriter.tags\n; Default Value: \"a=href,area=href,frame=src,form=,fieldset=\"\n; Development Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; Production Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the tags.\n; http://php.net/asp-tags\nasp_tags = Off\n\n; The number of significant digits displayed in floating point numbers.\n; http://php.net/precision\nprecision = 14\n\n; Output buffering is a mechanism for controlling how much output data\n; (excluding headers and cookies) PHP should keep internally before pushing that\n; data to the client. If your application's output exceeds this setting, PHP\n; will send that data in chunks of roughly the size you specify.\n; Turning on this setting and managing its maximum buffer size can yield some\n; interesting side-effects depending on your application and web server.\n; You may be able to send headers and cookies after you've already sent output\n; through print or echo. You also may see performance benefits if your server is\n; emitting less packets due to buffered output versus PHP streaming the output\n; as it gets it. On production servers, 4096 bytes is a good setting for performance\n; reasons.\n; Note: Output buffering can also be controlled via Output Buffering Control\n; functions.\n; Possible Values:\n; On = Enabled and buffer is unlimited. (Use with caution)\n; Off = Disabled\n; Integer = Enables the buffer and sets its maximum size in bytes.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n; http://php.net/output-buffering\noutput_buffering = 4096\n\n; You can redirect all of the output of your scripts to a function. For\n; example, if you set output_handler to \"mb_output_handler\", character\n; encoding will be transparently converted to the specified encoding.\n; Setting any output handler automatically turns on output buffering.\n; Note: People who wrote portable scripts should not depend on this ini\n; directive. Instead, explicitly set the output handler using ob_start().\n; Using this ini directive may cause problems unless you know what script\n; is doing.\n; Note: You cannot use both \"mb_output_handler\" with \"ob_iconv_handler\"\n; and you cannot use both \"ob_gzhandler\" and \"zlib.output_compression\".\n; Note: output_handler must be empty if this is set 'On' !!!!\n; Instead you must use zlib.output_handler.\n; http://php.net/output-handler\n;output_handler =\n\n; Transparent output compression using the zlib library\n; Valid values for this option are 'off', 'on', or a specific buffer size\n; to be used for compression (default is 4KB)\n; Note: Resulting chunk size may vary due to nature of compression. PHP\n; outputs chunks that are few hundreds bytes each as a result of\n; compression. If you prefer a larger chunk size for better\n; performance, enable output_buffering in addition.\n; Note: You need to use zlib.output_handler instead of the standard\n; output_handler, or otherwise the output will be corrupted.\n; http://php.net/zlib.output-compression\nzlib.output_compression = Off\n\n; http://php.net/zlib.output-compression-level\n;zlib.output_compression_level = -1\n\n; You cannot specify additional output handlers if zlib.output_compression\n; is activated here. This setting does the same as output_handler but in\n; a different order.\n; http://php.net/zlib.output-handler\n;zlib.output_handler =\n\n; Implicit flush tells PHP to tell the output layer to flush itself\n; automatically after every output block. This is equivalent to calling the\n; PHP function flush() after each and every call to print() or echo() and each\n; and every HTML block. Turning this option on has serious performance\n; implications and is generally recommended for debugging purposes only.\n; http://php.net/implicit-flush\n; Note: This directive is hardcoded to On for the CLI SAPI\nimplicit_flush = Off\n\n; The unserialize callback function will be called (with the undefined class'\n; name as parameter), if the unserializer finds an undefined class\n; which should be instantiated. A warning appears if the specified function is\n; not defined, or if the function doesn't include/implement the missing class.\n; So only set this entry, if you really want to implement such a\n; callback-function.\nunserialize_callback_func =\n\n; When floats & doubles are serialized store serialize_precision significant\n; digits after the floating point. The default value ensures that when floats\n; are decoded with unserialize, the data will remain the same.\nserialize_precision = 17\n\n; open_basedir, if set, limits all file operations to the defined directory\n; and below. This directive makes most sense if used in a per-directory\n; or per-virtualhost web server configuration file.\n; http://php.net/open-basedir\n;open_basedir =\n\n; This directive allows you to disable certain functions for security reasons.\n; It receives a comma-delimited list of function names.\n; http://php.net/disable-functions\ndisable_functions =\n\n; This directive allows you to disable certain classes for security reasons.\n; It receives a comma-delimited list of class names.\n; http://php.net/disable-classes\ndisable_classes =\n\n; Colors for Syntax Highlighting mode. Anything that's acceptable in\n; would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume (128MB)\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This has only effect in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/track-errors\ntrack_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: On\n; Development Value: On\n; Production value: On\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_56\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any affect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a character encoding using\n; the Content-type: header. To disable sending of the charset, simply\n; set it to be empty.\n;\n; PHP's built-in default is text/html\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; mbstring or iconv output handler is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n; Always populate the $HTTP_RAW_POST_DATA variable. PHP's default behavior is\n; to disable this feature and it will be removed in a future version.\n; If post reading is disabled through enable_post_data_reading,\n; $HTTP_RAW_POST_DATA is *NOT* populated.\n; http://php.net/always-populate-raw-post-data\nalways_populate_raw_post_data = -1\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php56/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n; extension_dir = \"./\"\n; On windows:\n; extension_dir = \"ext\"\nextension_dir = \"/opt/php56/lib/php/extensions/no-debug-non-zts-20131226/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename.extension\n;\n; For example, on Windows:\n;\n; extension=msql.dll\n;\n; ... or under UNIX:\n;\n; extension=msql.so\n;\n; ... or with a path:\n;\n; extension=/path/to/extension/msql.so\n;\n; If you only provide the name of the extension, PHP will look for it in its\n; default extension directory.\n;\n; Windows Extensions\n; Note that ODBC support is built in, so no dll is needed for it.\n; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5)\n; extension folders as well as the separate PECL DLL download (PHP 5).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=php_bz2.dll\n;extension=php_curl.dll\n;extension=php_fileinfo.dll\n;extension=php_gd2.dll\n;extension=php_gettext.dll\n;extension=php_gmp.dll\n;extension=php_intl.dll\n;extension=php_imap.dll\n;extension=php_interbase.dll\n;extension=php_ldap.dll\n;extension=php_mbstring.dll\n;extension=php_exif.dll ; Must be after mbstring as it depends on it\n;extension=php_mysql.dll\n;extension=php_mysqli.dll\n;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client\n;extension=php_openssl.dll\n;extension=php_pdo_firebird.dll\n;extension=php_pdo_mysql.dll\n;extension=php_pdo_oci.dll\n;extension=php_pdo_odbc.dll\n;extension=php_pdo_pgsql.dll\n;extension=php_pdo_sqlite.dll\n;extension=php_pgsql.dll\n;extension=php_pspell.dll\n;extension=php_shmop.dll\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=php_snmp.dll\n\n;extension=php_soap.dll\n;extension=php_sockets.dll\n;extension=php_sqlite3.dll\n;extension=php_sybase_ct.dll\n;extension=php_tidy.dll\n;extension=php_xmlrpc.dll\n;extension=php_xsl.dll\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < intput_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n\n[sqlite]\n; http://php.net/sqlite.assoc-case\n;sqlite.assoc_case = 0\n\n[sqlite3]\n;sqlite3.extension_dir =\n\n[Pcre]\n;PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n;PCRE library recursion limit.\n;Please note that if you set this value to a high number you may consume all\n;the available process stack and eventually crash PHP (due to reaching the\n;stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/pdo_mysql.cache_size\npdo_mysql.cache_size = 2000\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/pdo_mysql.default-socket\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[SQL]\n; http://php.net/sql.safe-mode\nsql.safe_mode = Off\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n;birdstep.max_links = -1\n\n[Interbase]\n; Allow or prevent persistent links.\nibase.allow_persistent = 1\n\n; Maximum number of persistent links. -1 means no limit.\nibase.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\nibase.max_links = -1\n\n; Default database name for ibase_connect().\n;ibase.default_db =\n\n; Default username for ibase_connect().\n;ibase.default_user =\n\n; Default password for ibase_connect().\n;ibase.default_password =\n\n; Default charset for ibase_connect().\n;ibase.default_charset =\n\n; Default timestamp format.\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\n\n; Default date format.\nibase.dateformat = \"%Y-%m-%d\"\n\n; Default time format.\nibase.timeformat = \"%H:%M:%S\"\n\n[MySQL]\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysql.allow_local_infile\nmysql.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysql.allow-persistent\nmysql.allow_persistent = On\n\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/mysql.cache_size\nmysql.cache_size = 2000\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysql.max-persistent\nmysql.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/mysql.max-links\nmysql.max_links = -1\n\n; Default port number for mysql_connect(). If unset, mysql_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysql.default-port\nmysql.default_port =\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysql.default-socket\nmysql.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysql.default-host\nmysql.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysql.default-user\nmysql.default_user =\n\n; Default password for mysql_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysql.default_password\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysql.default-password\nmysql.default_password =\n\n; Maximum time (in seconds) for connect timeout. -1 means no limit\n; http://php.net/mysql.connect-timeout\nmysql.connect_timeout = 60\n\n; Trace mode. When trace_mode is active (=On), warnings for table/index scans and\n; SQL-Errors will be displayed.\n; http://php.net/mysql.trace-mode\nmysql.trace_mode = Off\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/mysqli.cache_size\nmysqli.cache_size = 2000\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_statistics\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_memory_statistics\nmysqlnd.collect_memory_statistics = 0\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\n; http://php.net/mysqlnd.net_cmd_buffer_size\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\n; http://php.net/mysqlnd.net_read_buffer_size\nmysqlnd.net_read_buffer_size = 131072\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[Sybase-CT]\n; Allow or prevent persistent links.\n; http://php.net/sybct.allow-persistent\nsybct.allow_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/sybct.max-persistent\nsybct.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/sybct.max-links\nsybct.max_links = -1\n\n; Minimum server message severity to display.\n; http://php.net/sybct.min-server-severity\nsybct.min_server_severity = 10\n\n; Minimum client message severity to display.\n; http://php.net/sybct.min-client-severity\nsybct.min_client_severity = 10\n\n; Set per-context timeout\n; http://php.net/sybct.timeout\n;sybct.timeout=\n\n;sybct.packet_size\n\n; The maximum time in seconds to wait for a connection attempt to succeed before returning failure.\n; Default: one minute\n;sybct.login_timeout=\n\n; The name of the host you claim to be connecting from, for display by sp_who.\n; Default: none\n;sybct.hostname=\n\n; Allows you to define how often deadlocks are to be retried. -1 means \"forever\".\n; Default: 0\n;sybct.deadlock_retry_count=\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept uninitialized session ID and regenerate\n; session ID if browser sends uninitialized session ID. Strict mode protects\n; applications from session fixation via session adoption vulnerability. It is\n; disabled by default for maximum compatibility, but enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started\n; on every session initialization. The probability is calculated by using\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator\n; and gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using the following equation:\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator and\n; session.gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request. Increasing this value to 1000 will give you\n; a 0.1% chance the gc will run on any give request. For high volume production servers,\n; this is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script would is the equivalent of\n; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; How many bytes to read from the file.\n; http://php.net/session.entropy-length\nsession.entropy_length = 32\n\n; Specified here to create the session id.\n; http://php.net/session.entropy-file\n; Defaults to /dev/urandom\n; On systems that don't have /dev/urandom but do have /dev/arandom, this will default to /dev/arandom\n; If neither are found at compile time, the default is no entropy file.\n; On windows, setting the entropy_length setting will activate the\n; Windows random source (using the CryptoAPI)\nsession.entropy_file = /dev/urandom\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Select a hash function for use in generating session ids.\n; Possible Values\n; 0 (MD5 128 bits)\n; 1 (SHA-1 160 bits)\n; This option may also be set to the name of any hash function supported by\n; the hash extension. A list of available hashes is returned by the hash_algos()\n; function.\n; http://php.net/session.hash-function\nsession.hash_function = 0\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.hash_bits_per_character = 5\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; form/fieldset are special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. If you want XHTML conformity, remove the form entry.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=,fieldset=\"\n; Development Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; Production Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; http://php.net/url-rewriter.tags\nurl_rewriter.tags = \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n[MSSQL]\n; Allow or prevent persistent links.\nmssql.allow_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\nmssql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\nmssql.max_links = -1\n\n; Minimum error severity to display.\nmssql.min_error_severity = 10\n\n; Minimum message severity to display.\nmssql.min_message_severity = 10\n\n; Compatibility mode with old versions of PHP 3.0.\nmssql.compatibility_mode = Off\n\n; Connect timeout\n;mssql.connect_timeout = 5\n\n; Query timeout\n;mssql.timeout = 60\n\n; Valid range 0 - 2147483647. Default = 4096.\n;mssql.textlimit = 4096\n\n; Valid range 0 - 2147483647. Default = 4096.\n;mssql.textsize = 4096\n\n; Limits the number of records in each batch. 0 = all records in one batch.\n;mssql.batchsize = 0\n\n; Specify how datetime and datetim4 columns are returned\n; On => Returns data converted to SQL server settings\n; Off => Returns values as YYYY-MM-DD hh:mm:ss\n;mssql.datetimeconvert = On\n\n; Use NT authentication when connecting to the server\nmssql.secure_connection = Off\n\n; Specify max number of processes. -1 = library default\n; msdlib defaults to 25\n; FreeTDS defaults to 4096\n;mssql.max_procs = -1\n\n; Specify client character set.\n; If empty or not set the client charset from freetds.conf is used\n; This is only used when compiled with FreeTDS\n;mssql.charset = \"ISO-8859-1\"\n\n[Assertion]\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Issue a PHP warning for each failed assertion.\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a components typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstrig.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_traslation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < intput_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 0\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[mcrypt]\n; For more information about mcrypt settings see http://php.net/mcrypt-module-open\n\n; Directory where to load mcrypt algorithms\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.algorithms_dir=\n\n; Directory where to load mcrypt modes\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.modes_dir=\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=0\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=64\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=4\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 100000 are allowed.\n;opcache.max_accelerated_files=2000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If disabled, PHPDoc comments are not loaded from SHM, so \"Doc Comments\"\n; may be always stored (save_comments=1), but not loaded by applications\n; that don't need them anyway.\n;opcache.load_comments=1\n\n; If enabled, a fast shutdown sequence is used for the accelerated code\n;opcache.fast_shutdown=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0xffffffff\n\n;opcache.inherited_hack=1\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_5.6.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n\n" }, { "path": "aegir/conf/php/php56-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php56-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php56-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php56\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php56/sbin/php-fpm\nphp_fpm_CONF=/opt/php56/etc/php56-fpm.conf\nphp_fpm_PID=/run/php56-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php56/etc/php56.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php56-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php56-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php56-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php56-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php56-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php56-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php56-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php56-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php56-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php56-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php56-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php56). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php56 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php56/var\n; Default Value: none\npid = /run/php56-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php56/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php56-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php56-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php56/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php56.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (C:\\windows or C:\\winnt)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; html_errors\n; Default Value: On\n; Development Value: On\n; Production value: On\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.hash_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; track_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; url_rewriter.tags\n; Default Value: \"a=href,area=href,frame=src,form=,fieldset=\"\n; Development Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; Production Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the tags.\n; http://php.net/asp-tags\nasp_tags = Off\n\n; The number of significant digits displayed in floating point numbers.\n; http://php.net/precision\nprecision = 14\n\n; Output buffering is a mechanism for controlling how much output data\n; (excluding headers and cookies) PHP should keep internally before pushing that\n; data to the client. If your application's output exceeds this setting, PHP\n; will send that data in chunks of roughly the size you specify.\n; Turning on this setting and managing its maximum buffer size can yield some\n; interesting side-effects depending on your application and web server.\n; You may be able to send headers and cookies after you've already sent output\n; through print or echo. You also may see performance benefits if your server is\n; emitting less packets due to buffered output versus PHP streaming the output\n; as it gets it. On production servers, 4096 bytes is a good setting for performance\n; reasons.\n; Note: Output buffering can also be controlled via Output Buffering Control\n; functions.\n; Possible Values:\n; On = Enabled and buffer is unlimited. (Use with caution)\n; Off = Disabled\n; Integer = Enables the buffer and sets its maximum size in bytes.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n; http://php.net/output-buffering\noutput_buffering = 4096\n\n; You can redirect all of the output of your scripts to a function. For\n; example, if you set output_handler to \"mb_output_handler\", character\n; encoding will be transparently converted to the specified encoding.\n; Setting any output handler automatically turns on output buffering.\n; Note: People who wrote portable scripts should not depend on this ini\n; directive. Instead, explicitly set the output handler using ob_start().\n; Using this ini directive may cause problems unless you know what script\n; is doing.\n; Note: You cannot use both \"mb_output_handler\" with \"ob_iconv_handler\"\n; and you cannot use both \"ob_gzhandler\" and \"zlib.output_compression\".\n; Note: output_handler must be empty if this is set 'On' !!!!\n; Instead you must use zlib.output_handler.\n; http://php.net/output-handler\n;output_handler =\n\n; Transparent output compression using the zlib library\n; Valid values for this option are 'off', 'on', or a specific buffer size\n; to be used for compression (default is 4KB)\n; Note: Resulting chunk size may vary due to nature of compression. PHP\n; outputs chunks that are few hundreds bytes each as a result of\n; compression. If you prefer a larger chunk size for better\n; performance, enable output_buffering in addition.\n; Note: You need to use zlib.output_handler instead of the standard\n; output_handler, or otherwise the output will be corrupted.\n; http://php.net/zlib.output-compression\nzlib.output_compression = Off\n\n; http://php.net/zlib.output-compression-level\n;zlib.output_compression_level = -1\n\n; You cannot specify additional output handlers if zlib.output_compression\n; is activated here. This setting does the same as output_handler but in\n; a different order.\n; http://php.net/zlib.output-handler\n;zlib.output_handler =\n\n; Implicit flush tells PHP to tell the output layer to flush itself\n; automatically after every output block. This is equivalent to calling the\n; PHP function flush() after each and every call to print() or echo() and each\n; and every HTML block. Turning this option on has serious performance\n; implications and is generally recommended for debugging purposes only.\n; http://php.net/implicit-flush\n; Note: This directive is hardcoded to On for the CLI SAPI\nimplicit_flush = Off\n\n; The unserialize callback function will be called (with the undefined class'\n; name as parameter), if the unserializer finds an undefined class\n; which should be instantiated. A warning appears if the specified function is\n; not defined, or if the function doesn't include/implement the missing class.\n; So only set this entry, if you really want to implement such a\n; callback-function.\nunserialize_callback_func =\n\n; When floats & doubles are serialized store serialize_precision significant\n; digits after the floating point. The default value ensures that when floats\n; are decoded with unserialize, the data will remain the same.\nserialize_precision = 17\n\n; open_basedir, if set, limits all file operations to the defined directory\n; and below. This directive makes most sense if used in a per-directory\n; or per-virtualhost web server configuration file.\n; http://php.net/open-basedir\nopen_basedir = \".:/data:/mnt:/srv:/hdd:/opt/tmp:/tmp:/usr:/var/aegir:/var/lib/collectd:/var/lib/nginx:/var/www:/var/second:/usr/bin:/usr/local/bin:/opt/tika:/opt/tika7:/opt/tika8:/opt/tika9:/opt/php56:/dev/urandom\"\n\n; This directive allows you to disable certain functions for security reasons.\n; It receives a comma-delimited list of function names.\n; http://php.net/disable-functions\ndisable_functions = \"disk_free_space,disk_total_space,diskfreespace,dl,get_current_user,getlastmo,getmygid,getmyinode,getmypid,getmyuid,ini_restore,link,pfsockopen,posix_getlogin,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_ttyname,posix_uname,proc_nice,proc_terminate,show_source,symlink,opcache_reset\"\n\n; This directive allows you to disable certain classes for security reasons.\n; It receives a comma-delimited list of class names.\n; http://php.net/disable-classes\ndisable_classes =\n\n; Colors for Syntax Highlighting mode. Anything that's acceptable in\n; would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume (128MB)\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This has only effect in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/track-errors\ntrack_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: On\n; Development Value: On\n; Production value: On\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_56\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any affect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a character encoding using\n; the Content-type: header. To disable sending of the charset, simply\n; set it to be empty.\n;\n; PHP's built-in default is text/html\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; mbstring or iconv output handler is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n; Always populate the $HTTP_RAW_POST_DATA variable. PHP's default behavior is\n; to disable this feature and it will be removed in a future version.\n; If post reading is disabled through enable_post_data_reading,\n; $HTTP_RAW_POST_DATA is *NOT* populated.\n; http://php.net/always-populate-raw-post-data\nalways_populate_raw_post_data = -1\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php56/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n; extension_dir = \"./\"\n; On windows:\n; extension_dir = \"ext\"\nextension_dir = \"/opt/php56/lib/php/extensions/no-debug-non-zts-20131226/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename.extension\n;\n; For example, on Windows:\n;\n; extension=msql.dll\n;\n; ... or under UNIX:\n;\n; extension=msql.so\n;\n; ... or with a path:\n;\n; extension=/path/to/extension/msql.so\n;\n; If you only provide the name of the extension, PHP will look for it in its\n; default extension directory.\n;\n; Windows Extensions\n; Note that ODBC support is built in, so no dll is needed for it.\n; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5)\n; extension folders as well as the separate PECL DLL download (PHP 5).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=php_bz2.dll\n;extension=php_curl.dll\n;extension=php_fileinfo.dll\n;extension=php_gd2.dll\n;extension=php_gettext.dll\n;extension=php_gmp.dll\n;extension=php_intl.dll\n;extension=php_imap.dll\n;extension=php_interbase.dll\n;extension=php_ldap.dll\n;extension=php_mbstring.dll\n;extension=php_exif.dll ; Must be after mbstring as it depends on it\n;extension=php_mysql.dll\n;extension=php_mysqli.dll\n;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client\n;extension=php_openssl.dll\n;extension=php_pdo_firebird.dll\n;extension=php_pdo_mysql.dll\n;extension=php_pdo_oci.dll\n;extension=php_pdo_odbc.dll\n;extension=php_pdo_pgsql.dll\n;extension=php_pdo_sqlite.dll\n;extension=php_pgsql.dll\n;extension=php_pspell.dll\n;extension=php_shmop.dll\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=php_snmp.dll\n\n;extension=php_soap.dll\n;extension=php_sockets.dll\n;extension=php_sqlite3.dll\n;extension=php_sybase_ct.dll\n;extension=php_tidy.dll\n;extension=php_xmlrpc.dll\n;extension=php_xsl.dll\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < intput_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n\n[sqlite]\n; http://php.net/sqlite.assoc-case\n;sqlite.assoc_case = 0\n\n[sqlite3]\n;sqlite3.extension_dir =\n\n[Pcre]\n;PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n;PCRE library recursion limit.\n;Please note that if you set this value to a high number you may consume all\n;the available process stack and eventually crash PHP (due to reaching the\n;stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/pdo_mysql.cache_size\npdo_mysql.cache_size = 2000\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/pdo_mysql.default-socket\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[SQL]\n; http://php.net/sql.safe-mode\nsql.safe_mode = Off\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n;birdstep.max_links = -1\n\n[Interbase]\n; Allow or prevent persistent links.\nibase.allow_persistent = 1\n\n; Maximum number of persistent links. -1 means no limit.\nibase.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\nibase.max_links = -1\n\n; Default database name for ibase_connect().\n;ibase.default_db =\n\n; Default username for ibase_connect().\n;ibase.default_user =\n\n; Default password for ibase_connect().\n;ibase.default_password =\n\n; Default charset for ibase_connect().\n;ibase.default_charset =\n\n; Default timestamp format.\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\n\n; Default date format.\nibase.dateformat = \"%Y-%m-%d\"\n\n; Default time format.\nibase.timeformat = \"%H:%M:%S\"\n\n[MySQL]\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysql.allow_local_infile\nmysql.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysql.allow-persistent\nmysql.allow_persistent = On\n\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/mysql.cache_size\nmysql.cache_size = 2000\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysql.max-persistent\nmysql.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/mysql.max-links\nmysql.max_links = -1\n\n; Default port number for mysql_connect(). If unset, mysql_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysql.default-port\nmysql.default_port =\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysql.default-socket\nmysql.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysql.default-host\nmysql.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysql.default-user\nmysql.default_user =\n\n; Default password for mysql_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysql.default_password\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysql.default-password\nmysql.default_password =\n\n; Maximum time (in seconds) for connect timeout. -1 means no limit\n; http://php.net/mysql.connect-timeout\nmysql.connect_timeout = 60\n\n; Trace mode. When trace_mode is active (=On), warnings for table/index scans and\n; SQL-Errors will be displayed.\n; http://php.net/mysql.trace-mode\nmysql.trace_mode = Off\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/mysqli.cache_size\nmysqli.cache_size = 2000\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_statistics\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_memory_statistics\nmysqlnd.collect_memory_statistics = 0\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\n; http://php.net/mysqlnd.net_cmd_buffer_size\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\n; http://php.net/mysqlnd.net_read_buffer_size\nmysqlnd.net_read_buffer_size = 131072\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[Sybase-CT]\n; Allow or prevent persistent links.\n; http://php.net/sybct.allow-persistent\nsybct.allow_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/sybct.max-persistent\nsybct.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/sybct.max-links\nsybct.max_links = -1\n\n; Minimum server message severity to display.\n; http://php.net/sybct.min-server-severity\nsybct.min_server_severity = 10\n\n; Minimum client message severity to display.\n; http://php.net/sybct.min-client-severity\nsybct.min_client_severity = 10\n\n; Set per-context timeout\n; http://php.net/sybct.timeout\n;sybct.timeout=\n\n;sybct.packet_size\n\n; The maximum time in seconds to wait for a connection attempt to succeed before returning failure.\n; Default: one minute\n;sybct.login_timeout=\n\n; The name of the host you claim to be connecting from, for display by sp_who.\n; Default: none\n;sybct.hostname=\n\n; Allows you to define how often deadlocks are to be retried. -1 means \"forever\".\n; Default: 0\n;sybct.deadlock_retry_count=\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept uninitialized session ID and regenerate\n; session ID if browser sends uninitialized session ID. Strict mode protects\n; applications from session fixation via session adoption vulnerability. It is\n; disabled by default for maximum compatibility, but enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started\n; on every session initialization. The probability is calculated by using\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator\n; and gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using the following equation:\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator and\n; session.gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request. Increasing this value to 1000 will give you\n; a 0.1% chance the gc will run on any give request. For high volume production servers,\n; this is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script would is the equivalent of\n; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; How many bytes to read from the file.\n; http://php.net/session.entropy-length\nsession.entropy_length = 32\n\n; Specified here to create the session id.\n; http://php.net/session.entropy-file\n; Defaults to /dev/urandom\n; On systems that don't have /dev/urandom but do have /dev/arandom, this will default to /dev/arandom\n; If neither are found at compile time, the default is no entropy file.\n; On windows, setting the entropy_length setting will activate the\n; Windows random source (using the CryptoAPI)\nsession.entropy_file = /dev/urandom\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Select a hash function for use in generating session ids.\n; Possible Values\n; 0 (MD5 128 bits)\n; 1 (SHA-1 160 bits)\n; This option may also be set to the name of any hash function supported by\n; the hash extension. A list of available hashes is returned by the hash_algos()\n; function.\n; http://php.net/session.hash-function\nsession.hash_function = 0\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.hash_bits_per_character = 5\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; form/fieldset are special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. If you want XHTML conformity, remove the form entry.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=,fieldset=\"\n; Development Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; Production Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; http://php.net/url-rewriter.tags\nurl_rewriter.tags = \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n[MSSQL]\n; Allow or prevent persistent links.\nmssql.allow_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\nmssql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\nmssql.max_links = -1\n\n; Minimum error severity to display.\nmssql.min_error_severity = 10\n\n; Minimum message severity to display.\nmssql.min_message_severity = 10\n\n; Compatibility mode with old versions of PHP 3.0.\nmssql.compatibility_mode = Off\n\n; Connect timeout\n;mssql.connect_timeout = 5\n\n; Query timeout\n;mssql.timeout = 60\n\n; Valid range 0 - 2147483647. Default = 4096.\n;mssql.textlimit = 4096\n\n; Valid range 0 - 2147483647. Default = 4096.\n;mssql.textsize = 4096\n\n; Limits the number of records in each batch. 0 = all records in one batch.\n;mssql.batchsize = 0\n\n; Specify how datetime and datetim4 columns are returned\n; On => Returns data converted to SQL server settings\n; Off => Returns values as YYYY-MM-DD hh:mm:ss\n;mssql.datetimeconvert = On\n\n; Use NT authentication when connecting to the server\nmssql.secure_connection = Off\n\n; Specify max number of processes. -1 = library default\n; msdlib defaults to 25\n; FreeTDS defaults to 4096\n;mssql.max_procs = -1\n\n; Specify client character set.\n; If empty or not set the client charset from freetds.conf is used\n; This is only used when compiled with FreeTDS\n;mssql.charset = \"ISO-8859-1\"\n\n[Assertion]\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Issue a PHP warning for each failed assertion.\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a components typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstrig.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_traslation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < intput_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 0\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[mcrypt]\n; For more information about mcrypt settings see http://php.net/mcrypt-module-open\n\n; Directory where to load mcrypt algorithms\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.algorithms_dir=\n\n; Directory where to load mcrypt modes\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.modes_dir=\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=0\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=64\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=4\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 100000 are allowed.\n;opcache.max_accelerated_files=2000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If disabled, PHPDoc comments are not loaded from SHM, so \"Doc Comments\"\n; may be always stored (save_comments=1), but not loaded by applications\n; that don't need them anyway.\n;opcache.load_comments=1\n\n; If enabled, a fast shutdown sequence is used for the accelerated code\n;opcache.fast_shutdown=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0xffffffff\n\n;opcache.inherited_hack=1\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_5.6.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php70-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (C:\\windows or C:\\winnt)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; html_errors\n; Default Value: On\n; Development Value: On\n; Production value: On\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.hash_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; track_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; url_rewriter.tags\n; Default Value: \"a=href,area=href,frame=src,form=,fieldset=\"\n; Development Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; Production Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume (128MB)\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This has only effect in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/track-errors\ntrack_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: On\n; Development Value: On\n; Production value: On\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_70\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any affect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; mbstring or iconv output handler is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php70/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n; extension_dir = \"./\"\n; On windows:\n; extension_dir = \"ext\"\nextension_dir = \"/opt/php70/lib/php/extensions/no-debug-non-zts-20151012/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename.extension\n;\n; For example, on Windows:\n;\n; extension=msql.dll\n;\n; ... or under UNIX:\n;\n; extension=msql.so\n;\n; ... or with a path:\n;\n; extension=/path/to/extension/msql.so\n;\n; If you only provide the name of the extension, PHP will look for it in its\n; default extension directory.\n;\n; Windows Extensions\n; Note that ODBC support is built in, so no dll is needed for it.\n; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=php_bz2.dll\n;extension=php_curl.dll\n;extension=php_fileinfo.dll\n;extension=php_gd2.dll\n;extension=php_gettext.dll\n;extension=php_gmp.dll\n;extension=php_intl.dll\n;extension=php_imap.dll\n;extension=php_interbase.dll\n;extension=php_ldap.dll\n;extension=php_mbstring.dll\n;extension=php_exif.dll ; Must be after mbstring as it depends on it\n;extension=php_mysqli.dll\n;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client\n;extension=php_openssl.dll\n;extension=php_pdo_firebird.dll\n;extension=php_pdo_mysql.dll\n;extension=php_pdo_oci.dll\n;extension=php_pdo_odbc.dll\n;extension=php_pdo_pgsql.dll\n;extension=php_pdo_sqlite.dll\n;extension=php_pgsql.dll\n;extension=php_shmop.dll\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=php_snmp.dll\n\n;extension=php_soap.dll\n;extension=php_sockets.dll\n;extension=php_sqlite3.dll\n;extension=php_tidy.dll\n;extension=php_xmlrpc.dll\n;extension=php_xsl.dll\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < intput_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n\n[sqlite3]\n;sqlite3.extension_dir =\n\n[Pcre]\n;PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n;PCRE library recursion limit.\n;Please note that if you set this value to a high number you may consume all\n;the available process stack and eventually crash PHP (due to reaching the\n;stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n;Enables or disables JIT compilation of patterns. This requires the PCRE\n;library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/pdo_mysql.cache_size\npdo_mysql.cache_size = 2000\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/pdo_mysql.default-socket\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[SQL]\n; http://php.net/sql.safe-mode\nsql.safe_mode = Off\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n;birdstep.max_links = -1\n\n[Interbase]\n; Allow or prevent persistent links.\nibase.allow_persistent = 1\n\n; Maximum number of persistent links. -1 means no limit.\nibase.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\nibase.max_links = -1\n\n; Default database name for ibase_connect().\n;ibase.default_db =\n\n; Default username for ibase_connect().\n;ibase.default_user =\n\n; Default password for ibase_connect().\n;ibase.default_password =\n\n; Default charset for ibase_connect().\n;ibase.default_charset =\n\n; Default timestamp format.\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\n\n; Default date format.\nibase.dateformat = \"%Y-%m-%d\"\n\n; Default time format.\nibase.timeformat = \"%H:%M:%S\"\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/mysqli.cache_size\nmysqli.cache_size = 2000\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_statistics\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_memory_statistics\nmysqlnd.collect_memory_statistics = 0\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\n; http://php.net/mysqlnd.net_cmd_buffer_size\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\n; http://php.net/mysqlnd.net_read_buffer_size\nmysqlnd.net_read_buffer_size = 131072\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept uninitialized session ID and regenerate\n; session ID if browser sends uninitialized session ID. Strict mode protects\n; applications from session fixation via session adoption vulnerability. It is\n; disabled by default for maximum compatibility, but enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started\n; on every session initialization. The probability is calculated by using\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator\n; and gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using the following equation:\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator and\n; session.gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request. Increasing this value to 1000 will give you\n; a 0.1% chance the gc will run on any give request. For high volume production servers,\n; this is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script would is the equivalent of\n; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; How many bytes to read from the file.\n; http://php.net/session.entropy-length\nsession.entropy_length = 32\n\n; Specified here to create the session id.\n; http://php.net/session.entropy-file\n; Defaults to /dev/urandom\n; On systems that don't have /dev/urandom but do have /dev/arandom, this will default to /dev/arandom\n; If neither are found at compile time, the default is no entropy file.\n; On windows, setting the entropy_length setting will activate the\n; Windows random source (using the CryptoAPI)\nsession.entropy_file = /dev/urandom\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Select a hash function for use in generating session ids.\n; Possible Values\n; 0 (MD5 128 bits)\n; 1 (SHA-1 160 bits)\n; This option may also be set to the name of any hash function supported by\n; the hash extension. A list of available hashes is returned by the hash_algos()\n; function.\n; http://php.net/session.hash-function\nsession.hash_function = 0\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.hash_bits_per_character = 5\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; form/fieldset are special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. If you want XHTML conformity, remove the form entry.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=,fieldset=\"\n; Development Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; Production Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; http://php.net/url-rewriter.tags\nurl_rewriter.tags = \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertationException on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a components typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_traslation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < intput_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 0\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[mcrypt]\n; For more information about mcrypt settings see http://php.net/mcrypt-module-open\n\n; Directory where to load mcrypt algorithms\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.algorithms_dir=\n\n; Directory where to load mcrypt modes\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.modes_dir=\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=0\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=64\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=4\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 100000 are allowed.\n;opcache.max_accelerated_files=2000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, a fast shutdown sequence is used for the accelerated code\n;opcache.fast_shutdown=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0xffffffff\n\n;opcache.inherited_hack=1\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_7.0.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php70-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php70-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php70-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php70\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php70/sbin/php-fpm\nphp_fpm_CONF=/opt/php70/etc/php70-fpm.conf\nphp_fpm_PID=/run/php70-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php70/etc/php70.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php70-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php70-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php70-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php70-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php70-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php70-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php70-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php70-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php70-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php70-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php70-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php70). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php70 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php70/var\n; Default Value: none\npid = /run/php70-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php70/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php70-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php70-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php70/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php70.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (C:\\windows or C:\\winnt)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; html_errors\n; Default Value: On\n; Development Value: On\n; Production value: On\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.hash_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; track_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; url_rewriter.tags\n; Default Value: \"a=href,area=href,frame=src,form=,fieldset=\"\n; Development Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; Production Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume (128MB)\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This has only effect in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/track-errors\ntrack_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: On\n; Development Value: On\n; Production value: On\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_70\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any affect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; mbstring or iconv output handler is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php70/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n; extension_dir = \"./\"\n; On windows:\n; extension_dir = \"ext\"\nextension_dir = \"/opt/php70/lib/php/extensions/no-debug-non-zts-20151012/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename.extension\n;\n; For example, on Windows:\n;\n; extension=msql.dll\n;\n; ... or under UNIX:\n;\n; extension=msql.so\n;\n; ... or with a path:\n;\n; extension=/path/to/extension/msql.so\n;\n; If you only provide the name of the extension, PHP will look for it in its\n; default extension directory.\n;\n; Windows Extensions\n; Note that ODBC support is built in, so no dll is needed for it.\n; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=php_bz2.dll\n;extension=php_curl.dll\n;extension=php_fileinfo.dll\n;extension=php_gd2.dll\n;extension=php_gettext.dll\n;extension=php_gmp.dll\n;extension=php_intl.dll\n;extension=php_imap.dll\n;extension=php_interbase.dll\n;extension=php_ldap.dll\n;extension=php_mbstring.dll\n;extension=php_exif.dll ; Must be after mbstring as it depends on it\n;extension=php_mysqli.dll\n;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client\n;extension=php_openssl.dll\n;extension=php_pdo_firebird.dll\n;extension=php_pdo_mysql.dll\n;extension=php_pdo_oci.dll\n;extension=php_pdo_odbc.dll\n;extension=php_pdo_pgsql.dll\n;extension=php_pdo_sqlite.dll\n;extension=php_pgsql.dll\n;extension=php_shmop.dll\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=php_snmp.dll\n\n;extension=php_soap.dll\n;extension=php_sockets.dll\n;extension=php_sqlite3.dll\n;extension=php_tidy.dll\n;extension=php_xmlrpc.dll\n;extension=php_xsl.dll\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < intput_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n\n[sqlite3]\n;sqlite3.extension_dir =\n\n[Pcre]\n;PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n;PCRE library recursion limit.\n;Please note that if you set this value to a high number you may consume all\n;the available process stack and eventually crash PHP (due to reaching the\n;stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n;Enables or disables JIT compilation of patterns. This requires the PCRE\n;library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/pdo_mysql.cache_size\npdo_mysql.cache_size = 2000\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/pdo_mysql.default-socket\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[SQL]\n; http://php.net/sql.safe-mode\nsql.safe_mode = Off\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n;birdstep.max_links = -1\n\n[Interbase]\n; Allow or prevent persistent links.\nibase.allow_persistent = 1\n\n; Maximum number of persistent links. -1 means no limit.\nibase.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\nibase.max_links = -1\n\n; Default database name for ibase_connect().\n;ibase.default_db =\n\n; Default username for ibase_connect().\n;ibase.default_user =\n\n; Default password for ibase_connect().\n;ibase.default_password =\n\n; Default charset for ibase_connect().\n;ibase.default_charset =\n\n; Default timestamp format.\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\n\n; Default date format.\nibase.dateformat = \"%Y-%m-%d\"\n\n; Default time format.\nibase.timeformat = \"%H:%M:%S\"\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/mysqli.cache_size\nmysqli.cache_size = 2000\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_statistics\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_memory_statistics\nmysqlnd.collect_memory_statistics = 0\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\n; http://php.net/mysqlnd.net_cmd_buffer_size\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\n; http://php.net/mysqlnd.net_read_buffer_size\nmysqlnd.net_read_buffer_size = 131072\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept uninitialized session ID and regenerate\n; session ID if browser sends uninitialized session ID. Strict mode protects\n; applications from session fixation via session adoption vulnerability. It is\n; disabled by default for maximum compatibility, but enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started\n; on every session initialization. The probability is calculated by using\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator\n; and gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using the following equation:\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator and\n; session.gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request. Increasing this value to 1000 will give you\n; a 0.1% chance the gc will run on any give request. For high volume production servers,\n; this is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script would is the equivalent of\n; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; How many bytes to read from the file.\n; http://php.net/session.entropy-length\nsession.entropy_length = 32\n\n; Specified here to create the session id.\n; http://php.net/session.entropy-file\n; Defaults to /dev/urandom\n; On systems that don't have /dev/urandom but do have /dev/arandom, this will default to /dev/arandom\n; If neither are found at compile time, the default is no entropy file.\n; On windows, setting the entropy_length setting will activate the\n; Windows random source (using the CryptoAPI)\nsession.entropy_file = /dev/urandom\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Select a hash function for use in generating session ids.\n; Possible Values\n; 0 (MD5 128 bits)\n; 1 (SHA-1 160 bits)\n; This option may also be set to the name of any hash function supported by\n; the hash extension. A list of available hashes is returned by the hash_algos()\n; function.\n; http://php.net/session.hash-function\nsession.hash_function = 0\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.hash_bits_per_character = 5\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; form/fieldset are special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. If you want XHTML conformity, remove the form entry.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=,fieldset=\"\n; Development Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; Production Value: \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n; http://php.net/url-rewriter.tags\nurl_rewriter.tags = \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertationException on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a components typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_traslation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < intput_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 0\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[mcrypt]\n; For more information about mcrypt settings see http://php.net/mcrypt-module-open\n\n; Directory where to load mcrypt algorithms\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.algorithms_dir=\n\n; Directory where to load mcrypt modes\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.modes_dir=\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=0\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=64\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=4\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 100000 are allowed.\n;opcache.max_accelerated_files=2000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, a fast shutdown sequence is used for the accelerated code\n;opcache.fast_shutdown=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0xffffffff\n\n;opcache.inherited_hack=1\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_7.0.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/php/php71-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (C:\\windows or C:\\winnt)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; html_errors\n; Default Value: On\n; Development Value: On\n; Production value: On\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; track_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume (128MB)\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This has only effect in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/track-errors\ntrack_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: On\n; Development Value: On\n; Production value: On\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_71\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any affect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php71/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n; extension_dir = \"./\"\n; On windows:\n; extension_dir = \"ext\"\nextension_dir = \"/opt/php71/lib/php/extensions/no-debug-non-zts-20160303/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n; http://php.net/cgi.dicard-path\n;cgi.discard_path=1\n\n; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; http://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename.extension\n;\n; For example, on Windows:\n;\n; extension=msql.dll\n;\n; ... or under UNIX:\n;\n; extension=msql.so\n;\n; ... or with a path:\n;\n; extension=/path/to/extension/msql.so\n;\n; If you only provide the name of the extension, PHP will look for it in its\n; default extension directory.\n;\n; Windows Extensions\n; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=php_bz2.dll\n;extension=php_curl.dll\n;extension=php_fileinfo.dll\n;extension=php_ftp.dll\n;extension=php_gd2.dll\n;extension=php_gettext.dll\n;extension=php_gmp.dll\n;extension=php_intl.dll\n;extension=php_imap.dll\n;extension=php_interbase.dll\n;extension=php_ldap.dll\n;extension=php_mbstring.dll\n;extension=php_exif.dll ; Must be after mbstring as it depends on it\n;extension=php_mysqli.dll\n;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client\n;extension=php_odbc.dll\n;extension=php_openssl.dll\n;extension=php_pdo_firebird.dll\n;extension=php_pdo_mysql.dll\n;extension=php_pdo_oci.dll\n;extension=php_pdo_odbc.dll\n;extension=php_pdo_pgsql.dll\n;extension=php_pdo_sqlite.dll\n;extension=php_pgsql.dll\n;extension=php_shmop.dll\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=php_snmp.dll\n\n;extension=php_soap.dll\n;extension=php_sockets.dll\n;extension=php_sqlite3.dll\n;extension=php_tidy.dll\n;extension=php_xmlrpc.dll\n;extension=php_xsl.dll\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < intput_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n;sqlite3.extension_dir =\n\n[Pcre]\n;PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n;PCRE library recursion limit.\n;Please note that if you set this value to a high number you may consume all\n;the available process stack and eventually crash PHP (due to reaching the\n;stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n;Enables or disables JIT compilation of patterns. This requires the PCRE\n;library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/pdo_mysql.cache_size\npdo_mysql.cache_size = 2000\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/pdo_mysql.default-socket\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[SQL]\n; http://php.net/sql.safe-mode\nsql.safe_mode = Off\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n;birdstep.max_links = -1\n\n[Interbase]\n; Allow or prevent persistent links.\nibase.allow_persistent = 1\n\n; Maximum number of persistent links. -1 means no limit.\nibase.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\nibase.max_links = -1\n\n; Default database name for ibase_connect().\n;ibase.default_db =\n\n; Default username for ibase_connect().\n;ibase.default_user =\n\n; Default password for ibase_connect().\n;ibase.default_password =\n\n; Default charset for ibase_connect().\n;ibase.default_charset =\n\n; Default timestamp format.\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\n\n; Default date format.\nibase.dateformat = \"%Y-%m-%d\"\n\n; Default time format.\nibase.timeformat = \"%H:%M:%S\"\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/mysqli.cache_size\nmysqli.cache_size = 2000\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_statistics\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_memory_statistics\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; http://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n; http://php.net/mysqlnd.log_mask\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\n; http://php.net/mysqlnd.mempool_default_size\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\n; http://php.net/mysqlnd.net_cmd_buffer_size\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\n; http://php.net/mysqlnd.net_read_buffer_size\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n; http://php.net/mysqlnd.net_read_timeout\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n; http://php.net/mysqlnd.sha256_server_public_key\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept uninitialized session ID and regenerate\n; session ID if browser sends uninitialized session ID. Strict mode protects\n; applications from session fixation via session adoption vulnerability. It is\n; disabled by default for maximum compatibility, but enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started\n; on every session initialization. The probability is calculated by using\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator\n; and gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using the following equation:\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator and\n; session.gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request. Increasing this value to 1000 will give you\n; a 0.1% chance the gc will run on any give request. For high volume production servers,\n; this is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script would is the equivalent of\n; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; http://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n;
is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; http://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute pathes, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertationException on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a components typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_traslation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < intput_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[mcrypt]\n; For more information about mcrypt settings see http://php.net/mcrypt-module-open\n\n; Directory where to load mcrypt algorithms\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.algorithms_dir=\n\n; Directory where to load mcrypt modes\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.modes_dir=\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=0\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, a fast shutdown sequence is used for the accelerated code\n; Depending on the used Memory Manager this may cause some incompatibilities.\n;opcache.fast_shutdown=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0xffffffff\n\n;opcache.inherited_hack=1\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_7.1.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php71-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php71-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php71-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php71\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php71/sbin/php-fpm\nphp_fpm_CONF=/opt/php71/etc/php71-fpm.conf\nphp_fpm_PID=/run/php71-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php71/etc/php71.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php71-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php71-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php71-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php71-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php71-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php71-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php71-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php71-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php71-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php71-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php71-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php71). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php71 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php71/var\n; Default Value: none\npid = /run/php71-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php71/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php71-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php71-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php71/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php71.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (C:\\windows or C:\\winnt)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; html_errors\n; Default Value: On\n; Development Value: On\n; Production value: On\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; track_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume (128MB)\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This has only effect in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/track-errors\ntrack_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: On\n; Development Value: On\n; Production value: On\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_71\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any affect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php71/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n; extension_dir = \"./\"\n; On windows:\n; extension_dir = \"ext\"\nextension_dir = \"/opt/php71/lib/php/extensions/no-debug-non-zts-20160303/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n; http://php.net/cgi.dicard-path\n;cgi.discard_path=1\n\n; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; http://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename.extension\n;\n; For example, on Windows:\n;\n; extension=msql.dll\n;\n; ... or under UNIX:\n;\n; extension=msql.so\n;\n; ... or with a path:\n;\n; extension=/path/to/extension/msql.so\n;\n; If you only provide the name of the extension, PHP will look for it in its\n; default extension directory.\n;\n; Windows Extensions\n; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=php_bz2.dll\n;extension=php_curl.dll\n;extension=php_fileinfo.dll\n;extension=php_ftp.dll\n;extension=php_gd2.dll\n;extension=php_gettext.dll\n;extension=php_gmp.dll\n;extension=php_intl.dll\n;extension=php_imap.dll\n;extension=php_interbase.dll\n;extension=php_ldap.dll\n;extension=php_mbstring.dll\n;extension=php_exif.dll ; Must be after mbstring as it depends on it\n;extension=php_mysqli.dll\n;extension=php_oci8_12c.dll ; Use with Oracle Database 12c Instant Client\n;extension=php_odbc.dll\n;extension=php_openssl.dll\n;extension=php_pdo_firebird.dll\n;extension=php_pdo_mysql.dll\n;extension=php_pdo_oci.dll\n;extension=php_pdo_odbc.dll\n;extension=php_pdo_pgsql.dll\n;extension=php_pdo_sqlite.dll\n;extension=php_pgsql.dll\n;extension=php_shmop.dll\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=php_snmp.dll\n\n;extension=php_soap.dll\n;extension=php_sockets.dll\n;extension=php_sqlite3.dll\n;extension=php_tidy.dll\n;extension=php_xmlrpc.dll\n;extension=php_xsl.dll\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < intput_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n;sqlite3.extension_dir =\n\n[Pcre]\n;PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n;PCRE library recursion limit.\n;Please note that if you set this value to a high number you may consume all\n;the available process stack and eventually crash PHP (due to reaching the\n;stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n;Enables or disables JIT compilation of patterns. This requires the PCRE\n;library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/pdo_mysql.cache_size\npdo_mysql.cache_size = 2000\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/pdo_mysql.default-socket\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[SQL]\n; http://php.net/sql.safe-mode\nsql.safe_mode = Off\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n;birdstep.max_links = -1\n\n[Interbase]\n; Allow or prevent persistent links.\nibase.allow_persistent = 1\n\n; Maximum number of persistent links. -1 means no limit.\nibase.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\nibase.max_links = -1\n\n; Default database name for ibase_connect().\n;ibase.default_db =\n\n; Default username for ibase_connect().\n;ibase.default_user =\n\n; Default password for ibase_connect().\n;ibase.default_password =\n\n; Default charset for ibase_connect().\n;ibase.default_charset =\n\n; Default timestamp format.\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\n\n; Default date format.\nibase.dateformat = \"%Y-%m-%d\"\n\n; Default time format.\nibase.timeformat = \"%H:%M:%S\"\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/mysqli.cache_size\nmysqli.cache_size = 2000\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_statistics\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_memory_statistics\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; http://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n; http://php.net/mysqlnd.log_mask\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\n; http://php.net/mysqlnd.mempool_default_size\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\n; http://php.net/mysqlnd.net_cmd_buffer_size\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\n; http://php.net/mysqlnd.net_read_buffer_size\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n; http://php.net/mysqlnd.net_read_timeout\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n; http://php.net/mysqlnd.sha256_server_public_key\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept uninitialized session ID and regenerate\n; session ID if browser sends uninitialized session ID. Strict mode protects\n; applications from session fixation via session adoption vulnerability. It is\n; disabled by default for maximum compatibility, but enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started\n; on every session initialization. The probability is calculated by using\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator\n; and gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using the following equation:\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator and\n; session.gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request. Increasing this value to 1000 will give you\n; a 0.1% chance the gc will run on any give request. For high volume production servers,\n; this is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script would is the equivalent of\n; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; http://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; http://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute pathes, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertationException on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a components typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_traslation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < intput_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[mcrypt]\n; For more information about mcrypt settings see http://php.net/mcrypt-module-open\n\n; Directory where to load mcrypt algorithms\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.algorithms_dir=\n\n; Directory where to load mcrypt modes\n; Default: Compiled in into libmcrypt (usually /usr/local/lib/libmcrypt)\n;mcrypt.modes_dir=\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, a fast shutdown sequence is used for the accelerated code\n; Depending on the used Memory Manager this may cause some incompatibilities.\n;opcache.fast_shutdown=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0xffffffff\n\n;opcache.inherited_hack=1\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_7.1.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/php/php72-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (C:\\windows or C:\\winnt)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; html_errors\n; Default Value: On\n; Development Value: On\n; Production value: On\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; track_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume (128MB)\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This has only effect in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; This directive is DEPRECATED.\n; Default Value: Off\n; Development Value: Off\n; Production Value: Off\n; http://php.net/track-errors\n;track_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: On\n; Development Value: On\n; Production value: On\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_72\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any affect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php72/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n; extension_dir = \"./\"\n; On windows:\n; extension_dir = \"ext\"\nextension_dir = \"/opt/php72/lib/php/extensions/no-debug-non-zts-20170718/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n; http://php.net/cgi.dicard-path\n;cgi.discard_path=1\n\n; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; http://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=fileinfo\n;extension=gd2\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=interbase\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sqlite3\n;extension=tidy\n;extension=xmlrpc\n;extension=xsl\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < intput_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n;sqlite3.extension_dir =\n\n[Pcre]\n;PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n;PCRE library recursion limit.\n;Please note that if you set this value to a high number you may consume all\n;the available process stack and eventually crash PHP (due to reaching the\n;stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n;Enables or disables JIT compilation of patterns. This requires the PCRE\n;library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/pdo_mysql.cache_size\npdo_mysql.cache_size = 2000\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/pdo_mysql.default-socket\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n;birdstep.max_links = -1\n\n[Interbase]\n; Allow or prevent persistent links.\nibase.allow_persistent = 1\n\n; Maximum number of persistent links. -1 means no limit.\nibase.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\nibase.max_links = -1\n\n; Default database name for ibase_connect().\n;ibase.default_db =\n\n; Default username for ibase_connect().\n;ibase.default_user =\n\n; Default password for ibase_connect().\n;ibase.default_password =\n\n; Default charset for ibase_connect().\n;ibase.default_charset =\n\n; Default timestamp format.\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\n\n; Default date format.\nibase.dateformat = \"%Y-%m-%d\"\n\n; Default time format.\nibase.timeformat = \"%H:%M:%S\"\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/mysqli.cache_size\nmysqli.cache_size = 2000\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_statistics\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_memory_statistics\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; http://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n; http://php.net/mysqlnd.log_mask\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\n; http://php.net/mysqlnd.mempool_default_size\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\n; http://php.net/mysqlnd.net_cmd_buffer_size\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\n; http://php.net/mysqlnd.net_read_buffer_size\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n; http://php.net/mysqlnd.net_read_timeout\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n; http://php.net/mysqlnd.sha256_server_public_key\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept uninitialized session ID and regenerate\n; session ID if browser sends uninitialized session ID. Strict mode protects\n; applications from session fixation via session adoption vulnerability. It is\n; disabled by default for maximum compatibility, but enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started\n; on every session initialization. The probability is calculated by using\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator\n; and gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using the following equation:\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator and\n; session.gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request. Increasing this value to 1000 will give you\n; a 0.1% chance the gc will run on any give request. For high volume production servers,\n; this is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script would is the equivalent of\n; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; http://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; http://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute pathes, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertationException on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a components typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_traslation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < intput_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=0\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0xffffffff\n\n;opcache.inherited_hack=1\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_7.2.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php72-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php72-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php72-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php72\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php72/sbin/php-fpm\nphp_fpm_CONF=/opt/php72/etc/php72-fpm.conf\nphp_fpm_PID=/run/php72-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php72/etc/php72.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php72-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php72-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php72-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php72-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php72-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php72-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php72-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php72-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php72-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php72-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php72-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php72). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php72 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php72/var\n; Default Value: none\npid = /run/php72-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php72/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php72-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php72-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php72/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php72.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (C:\\windows or C:\\winnt)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; html_errors\n; Default Value: On\n; Development Value: On\n; Production value: On\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; track_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume (128MB)\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This has only effect in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; This directive is DEPRECATED.\n; Default Value: Off\n; Development Value: Off\n; Production Value: Off\n; http://php.net/track-errors\n;track_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: On\n; Development Value: On\n; Production value: On\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_72\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any affect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php72/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n; extension_dir = \"./\"\n; On windows:\n; extension_dir = \"ext\"\nextension_dir = \"/opt/php72/lib/php/extensions/no-debug-non-zts-20170718/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n; http://php.net/cgi.dicard-path\n;cgi.discard_path=1\n\n; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; http://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=fileinfo\n;extension=gd2\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=interbase\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sqlite3\n;extension=tidy\n;extension=xmlrpc\n;extension=xsl\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < intput_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n;sqlite3.extension_dir =\n\n[Pcre]\n;PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n;PCRE library recursion limit.\n;Please note that if you set this value to a high number you may consume all\n;the available process stack and eventually crash PHP (due to reaching the\n;stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n;Enables or disables JIT compilation of patterns. This requires the PCRE\n;library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/pdo_mysql.cache_size\npdo_mysql.cache_size = 2000\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/pdo_mysql.default-socket\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n;birdstep.max_links = -1\n\n[Interbase]\n; Allow or prevent persistent links.\nibase.allow_persistent = 1\n\n; Maximum number of persistent links. -1 means no limit.\nibase.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\nibase.max_links = -1\n\n; Default database name for ibase_connect().\n;ibase.default_db =\n\n; Default username for ibase_connect().\n;ibase.default_user =\n\n; Default password for ibase_connect().\n;ibase.default_password =\n\n; Default charset for ibase_connect().\n;ibase.default_charset =\n\n; Default timestamp format.\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\n\n; Default date format.\nibase.dateformat = \"%Y-%m-%d\"\n\n; Default time format.\nibase.timeformat = \"%H:%M:%S\"\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; If mysqlnd is used: Number of cache slots for the internal result set cache\n; http://php.net/mysqli.cache_size\nmysqli.cache_size = 2000\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_statistics\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; http://php.net/mysqlnd.collect_memory_statistics\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; http://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n; http://php.net/mysqlnd.log_mask\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\n; http://php.net/mysqlnd.mempool_default_size\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\n; http://php.net/mysqlnd.net_cmd_buffer_size\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\n; http://php.net/mysqlnd.net_read_buffer_size\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n; http://php.net/mysqlnd.net_read_timeout\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n; http://php.net/mysqlnd.sha256_server_public_key\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept uninitialized session ID and regenerate\n; session ID if browser sends uninitialized session ID. Strict mode protects\n; applications from session fixation via session adoption vulnerability. It is\n; disabled by default for maximum compatibility, but enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started\n; on every session initialization. The probability is calculated by using\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator\n; and gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using the following equation:\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator and\n; session.gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any give request. Increasing this value to 1000 will give you\n; a 0.1% chance the gc will run on any give request. For high volume production servers,\n; this is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script would is the equivalent of\n; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; http://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; http://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute pathes, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertationException on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a components typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_traslation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < intput_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0xffffffff\n\n;opcache.inherited_hack=1\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_7.2.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/php/php73-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; html_errors\n; Default Value: On\n; Development Value: On\n; Production value: On\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; track_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume (128MB)\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This has only effect in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; This directive is DEPRECATED.\n; Default Value: Off\n; Development Value: Off\n; Production Value: Off\n; http://php.net/track-errors\n;track_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: On\n; Development Value: On\n; Production value: On\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_73\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (only base ASCII characters)\n; no_ctrl (all characters except control characters)\n; all (all characters)\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any affect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php73/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n; extension_dir = \"./\"\n; On windows:\n; extension_dir = \"ext\"\nextension_dir = \"/opt/php73/lib/php/extensions/no-debug-non-zts-20180731/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; http://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=fileinfo\n;extension=gd2\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=interbase\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xmlrpc\n;extension=xsl\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n;sqlite3.extension_dir =\n\n[Pcre]\n;PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n;PCRE library recursion limit.\n;Please note that if you set this value to a high number you may consume all\n;the available process stack and eventually crash PHP (due to reaching the\n;stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n;Enables or disables JIT compilation of patterns. This requires the PCRE\n;library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[Interbase]\n; Allow or prevent persistent links.\nibase.allow_persistent = 1\n\n; Maximum number of persistent links. -1 means no limit.\nibase.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\nibase.max_links = -1\n\n; Default database name for ibase_connect().\n;ibase.default_db =\n\n; Default username for ibase_connect().\n;ibase.default_user =\n\n; Default password for ibase_connect().\n;ibase.default_password =\n\n; Default charset for ibase_connect().\n;ibase.default_charset =\n\n; Default timestamp format.\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\n\n; Default date format.\nibase.dateformat = \"%Y-%m-%d\"\n\n; Default time format.\nibase.timeformat = \"%H:%M:%S\"\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; http://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Lax\" or \"Strict\"\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started\n; on every session initialization. The probability is calculated by using\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator\n; and gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any given request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using the following equation:\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator and\n; session.gc_divisor is the denominator in the equation. Setting this value to 100\n; when the session.gc_probability value is 1 will give you approximately a 1% chance\n; the gc will run on any given request. Increasing this value to 1000 will give you\n; a 0.1% chance the gc will run on any given request. For high volume production servers,\n; this is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script would is the equivalent of\n; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; http://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; http://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertionError on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=0\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_7.3.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php73-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php73-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php73-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php73\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php73/sbin/php-fpm\nphp_fpm_CONF=/opt/php73/etc/php73-fpm.conf\nphp_fpm_PID=/run/php73-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php73/etc/php73.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php73-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php73-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php73-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php73-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php73-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php73-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php73-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php73-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php73-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php73-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php73-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php73). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php73 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php73/var\n; Default Value: none\npid = /run/php73-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php73/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php73-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php73-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php73/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php73.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; html_errors\n; Default Value: On\n; Development Value: On\n; Production value: On\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; track_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume (128MB)\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This has only effect in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; This directive is DEPRECATED.\n; Default Value: Off\n; Development Value: Off\n; Production Value: Off\n; http://php.net/track-errors\n;track_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; Default Value: On\n; Development Value: On\n; Production value: On\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_73\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (only base ASCII characters)\n; no_ctrl (all characters except control characters)\n; all (all characters)\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any affect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php73/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n; extension_dir = \"./\"\n; On windows:\n; extension_dir = \"ext\"\nextension_dir = \"/opt/php73/lib/php/extensions/no-debug-non-zts-20180731/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; http://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=fileinfo\n;extension=gd2\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=interbase\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xmlrpc\n;extension=xsl\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n;sqlite3.extension_dir =\n\n[Pcre]\n;PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n;PCRE library recursion limit.\n;Please note that if you set this value to a high number you may consume all\n;the available process stack and eventually crash PHP (due to reaching the\n;stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n;Enables or disables JIT compilation of patterns. This requires the PCRE\n;library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[Interbase]\n; Allow or prevent persistent links.\nibase.allow_persistent = 1\n\n; Maximum number of persistent links. -1 means no limit.\nibase.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\nibase.max_links = -1\n\n; Default database name for ibase_connect().\n;ibase.default_db =\n\n; Default username for ibase_connect().\n;ibase.default_user =\n\n; Default password for ibase_connect().\n;ibase.default_password =\n\n; Default charset for ibase_connect().\n;ibase.default_charset =\n\n; Default timestamp format.\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\n\n; Default date format.\nibase.dateformat = \"%Y-%m-%d\"\n\n; Default time format.\nibase.timeformat = \"%H:%M:%S\"\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysql_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; http://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Lax\" or \"Strict\"\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started\n; on every session initialization. The probability is calculated by using\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator\n; and gc_divisor is the denominator in the equation. Setting this value to 1\n; when the session.gc_divisor value is 100 will give you approximately a 1% chance\n; the gc will run on any given request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using the following equation:\n; gc_probability/gc_divisor. Where session.gc_probability is the numerator and\n; session.gc_divisor is the denominator in the equation. Setting this value to 100\n; when the session.gc_probability value is 1 will give you approximately a 1% chance\n; the gc will run on any given request. Increasing this value to 1000 will give you\n; a 0.1% chance the gc will run on any given request. For high volume production servers,\n; this is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script would is the equivalent of\n; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; http://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; http://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertionError on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_7.3.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/php/php74-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions\n; Default: Off\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\nzend.exception_ignore_args = On\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; This directive is DEPRECATED.\n; Default Value: Off\n; Development Value: Off\n; Production Value: Off\n; http://php.net/track-errors\n;track_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_74\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; http://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php74/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php74/lib/php/extensions/no-debug-non-zts-20190902/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; http://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd2\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xmlrpc\n;extension=xsl\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[imap]\n; rsh/ssh logins are disabled by default. Use this INI entry if you want to\n; enable them. Note that the IMAP library does not filter mailbox names before\n; passing them to rsh/ssh command, thus passing untrusted data to this function\n; with rsh/ssh enabled is insecure.\n;imap.enable_insecure_rsh=0\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; http://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; http://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; http://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; http://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertionError on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n; Default: 100000\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n; Default: 1000000\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; http://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; http://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_7.4.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php74-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php74-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php74-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php74\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php74/sbin/php-fpm\nphp_fpm_CONF=/opt/php74/etc/php74-fpm.conf\nphp_fpm_PID=/run/php74-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php74/etc/php74.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php74-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php74-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php74-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php74-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php74-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php74-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php74-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php74-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php74-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php74-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php74-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php74). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php74 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php74/var\n; Default Value: none\npid = /run/php74-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php74/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php74-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php74-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php74/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php74.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n; Default: Off\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n; Default: \"\"\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions\n; Default: Off\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\nzend.exception_ignore_args = On\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. PHP's default behavior is to suppress those\n; errors from clients. Turning the display of startup errors on can be useful in\n; debugging configuration problems. We strongly recommend you\n; set this to 'off' for production servers.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is on by default.\n;report_zend_debug = 0\n\n; Store the last error/warning message in $php_errormsg (boolean). Setting this value\n; to On can assist in debugging and is appropriate for development servers. It should\n; however be disabled on production servers.\n; This directive is DEPRECATED.\n; Default Value: Off\n; Development Value: Off\n; Production Value: Off\n; http://php.net/track-errors\n;track_errors = Off\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_74\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; http://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php74/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php74/lib/php/extensions/no-debug-non-zts-20190902/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; http://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd2\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xmlrpc\n;extension=xsl\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.583333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.583333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[imap]\n; rsh/ssh logins are disabled by default. Use this INI entry if you want to\n; enable them. Note that the IMAP library does not filter mailbox names before\n; passing them to rsh/ssh command, thus passing untrusted data to this function\n; with rsh/ssh enabled is insecure.\n;imap.enable_insecure_rsh=0\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; http://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n;pdo_odbc.db2_instance_name\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; http://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; http://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; http://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertionError on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n; Eval the expression with current error_reporting(). Set to true if you want\n; error_reporting(0) around the eval().\n; http://php.net/assert.quiet-eval\n;assert.quiet_eval = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbsting.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; overload(replace) single byte functions by mbstring functions.\n; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),\n; etc. Possible values are 0,1,2,4 or combination of them.\n; For example, 7 for overload everything.\n; 0: No overload\n; 1: Overload mail() function\n; 2: Overload str*() functions\n; 4: Overload ereg*() functions\n; http://php.net/mbstring.func-overload\n;mbstring.func_overload = 0\n\n; enable strict encoding detection.\n; Default: Off\n;mbstring.strict_detection = On\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetype=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n; Default: 100000\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n; Default: 1000000\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; http://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; http://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n; Local Variables:\n; tab-width: 4\n; End:\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_7.4.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=jsmin.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/php/php80-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_80\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; http://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php80/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php80/lib/php/extensions/no-debug-non-zts-20200930/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; http://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=oci8_19 ; Use with Oracle Database 19 Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[imap]\n; rsh/ssh logins are disabled by default. Use this INI entry if you want to\n; enable them. Note that the IMAP library does not filter mailbox names before\n; passing them to rsh/ssh command, thus passing untrusted data to this function\n; with rsh/ssh enabled is insecure.\n;imap.enable_insecure_rsh=0\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; http://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; http://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; http://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; http://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertionError on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; http://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; http://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php80-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php80-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php80-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php80\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php80/sbin/php-fpm\nphp_fpm_CONF=/opt/php80/etc/php80-fpm.conf\nphp_fpm_PID=/run/php80-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php80/etc/php80.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php80-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php80-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php80-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php80-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php80-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php80-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php80-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php80-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php80-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php80-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php80-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php80). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php80 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php80/var\n; Default Value: none\npid = /run/php80-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php80/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php80-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php80-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php80/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php80.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; http://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; http://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; http://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; http://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; http://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; http://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; http://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; http://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; http://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; http://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; http://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume\n; http://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; http://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; http://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; http://php.net/log-errors\nlog_errors = On\n\n; Set maximum length of log_errors. In error_log information about the source is\n; added. The default is 1024 and 0 allows to not apply any maximum length at all.\n; http://php.net/log-errors-max-len\nlog_errors_max_len = 1024\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; http://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; http://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; http://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; http://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; http://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from http://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; http://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; http://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; http://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; http://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_80\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; http://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; http://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; http://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; http://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; http://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; http://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; http://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; http://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; http://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; http://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; http://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; http://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; http://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; http://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; http://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; http://php.net/include-path\ninclude_path\t= \".:/opt/php80/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; http://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; http://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; http://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php80/lib/php/extensions/no-debug-non-zts-20200930/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; http://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; http://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; http://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; http://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; http://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; http://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; http://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; http://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; http://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; http://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like http:// or ftp://) as files.\n; http://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; http://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; http://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; http://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; http://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=oci8_19 ; Use with Oracle Database 19 Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See http://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; http://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; http://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; http://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; http://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; http://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; http://php.net/filter.default\n;filter.default = unsafe_raw\n\n; http://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[imap]\n; rsh/ssh logins are disabled by default. Use this INI entry if you want to\n; enable them. Note that the IMAP library does not filter mailbox names before\n; passing them to rsh/ssh command, thus passing untrusted data to this function\n; with rsh/ssh enabled is insecure.\n;imap.enable_insecure_rsh=0\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; http://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; http://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; http://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; http://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; http://php.net/phar.readonly\n;phar.readonly = On\n\n; http://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; http://php.net/smtp\n;SMTP = localhost\n; http://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; http://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; http://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; http://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; http://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; http://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; http://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; http://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; http://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; http://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; http://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; http://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; Allow or prevent persistent links.\n; http://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; http://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; http://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; http://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; http://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; http://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; http://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; http://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; http://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; http://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; http://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; http://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; http://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; http://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; http://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; http://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; http://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; http://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; http://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; http://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; http://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; http://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; http://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; http://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; http://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; http://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; http://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; http://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; http://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; http://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; http://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; http://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; http://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; http://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; http://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; http://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; http://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; http://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; http://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; http://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; http://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; http://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; http://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; http://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; http://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; http://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; http://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; http://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; http://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; http://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; http://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertionError on failed assertions\n; http://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; http://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; http://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; http://php.net/assert.callback\n;assert.callback = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; http://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; http://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typlib on com_load()\n; http://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; http://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; http://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; http://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; http://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; http://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; http://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; http://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; http://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; http://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; http://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; http://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; http://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; http://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; http://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; http://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; http://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; http://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; http://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; http://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; http://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; http://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; http://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/php/php81-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; https://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; https://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; https://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; https://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; https://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; https://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; https://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; https://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; https://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; https://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; https://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; https://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume\n; https://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; https://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; https://php.net/log-errors\nlog_errors = On\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; https://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; https://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; https://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; https://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; https://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from https://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; https://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; https://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; https://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_81\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; https://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; https://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; https://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; https://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; https://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; https://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; https://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; https://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; https://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; https://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; https://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; https://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; https://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; https://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; https://php.net/include-path\ninclude_path\t= \".:/opt/php81/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; https://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; https://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; https://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php81/lib/php/extensions/no-debug-non-zts-20210902/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; https://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; https://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; https://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; https://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; https://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; https://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; https://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; https://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; https://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; https://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; https://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; https://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; https://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; https://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=oci8_19 ; Use with Oracle Database 19 Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See https://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; https://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; https://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; https://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; https://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; https://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; https://php.net/filter.default\n;filter.default = unsafe_raw\n\n; https://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[imap]\n; rsh/ssh logins are disabled by default. Use this INI entry if you want to\n; enable them. Note that the IMAP library does not filter mailbox names before\n; passing them to rsh/ssh command, thus passing untrusted data to this function\n; with rsh/ssh enabled is insecure.\n;imap.enable_insecure_rsh=0\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; https://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; https://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; https://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; https://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; https://php.net/phar.readonly\n;phar.readonly = On\n\n; https://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; https://php.net/smtp\n;SMTP = localhost\n; https://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; https://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; https://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; https://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; https://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; https://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; https://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; https://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; https://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; https://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; https://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; https://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; It allows the user to specify a folder where files that can be sent via LOAD DATA\n; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.\n;mysqli.local_infile_directory =\n\n; Allow or prevent persistent links.\n; https://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; https://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; https://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; https://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; https://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n; If this option is enabled, closing a persistent connection will rollback\n; any pending transactions of this connection, before it is put back\n; into the persistent connection pool.\n;mysqli.rollback_on_cached_plink = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; https://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; https://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; https://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; https://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; https://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; https://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; https://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; https://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; https://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; https://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; https://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; https://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; https://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; https://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; https://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; https://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; https://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; https://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; https://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; https://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; https://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; https://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; https://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; https://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; https://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; https://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; https://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; https://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; https://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; https://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; https://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; https://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; https://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; https://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; https://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; https://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; https://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; https://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; https://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; https://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; https://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; https://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertionError on failed assertions\n; https://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; https://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; https://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; https://php.net/assert.callback\n;assert.callback = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; https://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; https://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typelib on com_load()\n; https://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; https://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; https://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; https://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; https://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; https://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; https://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; https://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; https://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; https://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; https://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; https://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; https://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; https://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; https://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; https://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; https://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; https://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; https://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; https://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; https://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; https://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; https://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_8.1.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php81-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php81-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php81-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php81\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php81/sbin/php-fpm\nphp_fpm_CONF=/opt/php81/etc/php81-fpm.conf\nphp_fpm_PID=/run/php81-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php81/etc/php81.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php81-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php81-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php81-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php81-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php81-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php81-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php81-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php81-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php81-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php81-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php81-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php81). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php81 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php81/var\n; Default Value: none\npid = /run/php81-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php81/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php81-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php81-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php81/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php81.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; https://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; https://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; https://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; https://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; https://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; https://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; https://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; https://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; https://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; https://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; https://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; https://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume\n; https://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; https://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; https://php.net/log-errors\nlog_errors = On\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; https://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; https://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; https://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; https://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; https://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from https://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; https://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; https://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; https://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_81\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; https://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; https://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; https://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; https://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; https://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; https://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; https://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; https://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; https://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; https://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; https://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; https://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; https://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; https://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; https://php.net/include-path\ninclude_path\t= \".:/opt/php81/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; https://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; https://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; https://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php81/lib/php/extensions/no-debug-non-zts-20210902/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; https://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; https://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; https://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; https://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; https://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; https://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; https://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; https://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; https://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; https://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; https://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; https://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; https://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; https://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=oci8_19 ; Use with Oracle Database 19 Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See https://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; https://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; https://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; https://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; https://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; https://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; https://php.net/filter.default\n;filter.default = unsafe_raw\n\n; https://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[imap]\n; rsh/ssh logins are disabled by default. Use this INI entry if you want to\n; enable them. Note that the IMAP library does not filter mailbox names before\n; passing them to rsh/ssh command, thus passing untrusted data to this function\n; with rsh/ssh enabled is insecure.\n;imap.enable_insecure_rsh=0\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; https://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; https://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; https://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; https://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; https://php.net/phar.readonly\n;phar.readonly = On\n\n; https://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; https://php.net/smtp\n;SMTP = localhost\n; https://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; https://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; https://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; https://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; https://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; https://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; https://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; https://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; https://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; https://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; https://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; https://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; It allows the user to specify a folder where files that can be sent via LOAD DATA\n; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.\n;mysqli.local_infile_directory =\n\n; Allow or prevent persistent links.\n; https://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; https://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; https://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; https://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; https://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n; If this option is enabled, closing a persistent connection will rollback\n; any pending transactions of this connection, before it is put back\n; into the persistent connection pool.\n;mysqli.rollback_on_cached_plink = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; https://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; https://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; https://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; https://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; https://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; https://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; https://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; https://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; https://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; https://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; https://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; https://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; https://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; https://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; https://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; https://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; https://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; https://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; https://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; https://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; https://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; https://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; https://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; https://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; https://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; https://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; https://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; https://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; https://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; https://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; https://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; https://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; https://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; https://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; https://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; https://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; https://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; https://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; https://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; https://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; https://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; https://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertionError on failed assertions\n; https://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; https://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; https://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; https://php.net/assert.callback\n;assert.callback = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; https://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; https://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typelib on com_load()\n; https://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; https://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; https://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; https://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; https://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; https://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; https://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; https://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; https://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; https://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; https://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; https://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; https://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; https://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; https://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; https://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; https://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; https://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; https://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; https://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; https://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; https://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; https://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_8.1.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/php/php82-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; https://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; https://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; https://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; https://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; https://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; https://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; https://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; https://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; https://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; https://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; https://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; https://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume\n; https://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; https://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; https://php.net/log-errors\nlog_errors = On\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; https://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; https://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; https://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; https://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; https://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from https://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; https://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; https://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; https://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_82\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; https://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; https://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; https://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; https://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; https://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; https://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; https://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; https://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; https://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; https://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; https://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; https://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; https://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; https://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; https://php.net/include-path\ninclude_path\t= \".:/opt/php82/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; https://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; https://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; https://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php82/lib/php/extensions/no-debug-non-zts-20220829/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; https://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; https://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; https://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; https://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; https://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; https://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; https://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; https://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; https://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; https://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; https://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; https://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; https://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; https://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=oci8_19 ; Use with Oracle Database 19 Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See https://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; https://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; https://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; https://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; https://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; https://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; https://php.net/filter.default\n;filter.default = unsafe_raw\n\n; https://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[imap]\n; rsh/ssh logins are disabled by default. Use this INI entry if you want to\n; enable them. Note that the IMAP library does not filter mailbox names before\n; passing them to rsh/ssh command, thus passing untrusted data to this function\n; with rsh/ssh enabled is insecure.\n;imap.enable_insecure_rsh=0\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; https://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; https://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; https://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; https://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; https://php.net/phar.readonly\n;phar.readonly = On\n\n; https://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; https://php.net/smtp\n;SMTP = localhost\n; https://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; https://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; https://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; https://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; https://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; https://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; https://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; https://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; https://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; https://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; https://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; https://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; It allows the user to specify a folder where files that can be sent via LOAD DATA\n; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.\n;mysqli.local_infile_directory =\n\n; Allow or prevent persistent links.\n; https://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; https://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; https://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; https://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; https://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n; If this option is enabled, closing a persistent connection will rollback\n; any pending transactions of this connection, before it is put back\n; into the persistent connection pool.\n;mysqli.rollback_on_cached_plink = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; https://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; https://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; https://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; https://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; https://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; https://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; https://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; https://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; https://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; https://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; https://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; https://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; https://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; https://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; https://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; https://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; https://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; https://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; https://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; https://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; https://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; https://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; https://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; https://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; https://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; https://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; https://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; https://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; https://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; https://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; https://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; https://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; https://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; https://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; https://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; https://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; https://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; https://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; https://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; https://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; https://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; https://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertionError on failed assertions\n; https://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; https://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; https://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; https://php.net/assert.callback\n;assert.callback = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; https://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; https://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typelib on com_load()\n; https://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; https://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; https://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; https://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; https://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; https://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; https://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; https://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; https://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; https://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; https://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; https://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; https://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; https://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; https://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; https://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; https://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; https://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; https://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; https://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; https://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; https://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; https://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_8.2.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php82-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php82-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php82-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php82\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php82/sbin/php-fpm\nphp_fpm_CONF=/opt/php82/etc/php82-fpm.conf\nphp_fpm_PID=/run/php82-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php82/etc/php82.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php82-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php82-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php82-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php82-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php82-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php82-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php82-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php82-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php82-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php82-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php82-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php82). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php82 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php82/var\n; Default Value: none\npid = /run/php82-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php82/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php82-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php82-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php82/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php82.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable. (As of PHP 5.2.0)\n; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0)\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; https://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; https://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security conscience applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; https://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; https://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; https://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; https://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; https://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; https://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; https://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; https://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; https://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; https://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; Maximum amount of memory a script may consume\n; https://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0)\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; https://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; https://php.net/log-errors\nlog_errors = On\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; https://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; https://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; https://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; https://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; https://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from https://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; https://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; https://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; https://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_82\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; https://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; https://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; https://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; https://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; https://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; https://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; https://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; https://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; https://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; https://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; https://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; https://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; https://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; https://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; https://php.net/include-path\ninclude_path\t= \".:/opt/php82/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; https://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; https://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; https://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php82/lib/php/extensions/no-debug-non-zts-20220829/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; https://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; https://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; https://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; https://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; https://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; https://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; https://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; https://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; https://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; https://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; https://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; https://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; https://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; https://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the extensions/ (PHP 4) or ext/ (PHP 5+)\n; extension folders as well as the separate PECL DLL download (PHP 5+).\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=oci8_19 ; Use with Oracle Database 19 Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See https://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; https://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; https://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; https://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; https://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; https://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; https://php.net/filter.default\n;filter.default = unsafe_raw\n\n; https://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[imap]\n; rsh/ssh logins are disabled by default. Use this INI entry if you want to\n; enable them. Note that the IMAP library does not filter mailbox names before\n; passing them to rsh/ssh command, thus passing untrusted data to this function\n; with rsh/ssh enabled is insecure.\n;imap.enable_insecure_rsh=0\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; https://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; https://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; https://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; https://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; https://php.net/phar.readonly\n;phar.readonly = On\n\n; https://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; https://php.net/smtp\n;SMTP = localhost\n; https://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; https://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; https://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; https://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; https://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; https://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; https://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; https://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; https://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; https://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; https://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; https://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; It allows the user to specify a folder where files that can be sent via LOAD DATA\n; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.\n;mysqli.local_infile_directory =\n\n; Allow or prevent persistent links.\n; https://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; https://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; https://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; https://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; https://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n; If this option is enabled, closing a persistent connection will rollback\n; any pending transactions of this connection, before it is put back\n; into the persistent connection pool.\n;mysqli.rollback_on_cached_plink = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; https://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; https://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; https://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; https://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; https://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle 11g Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; https://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables statement prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; https://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; https://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; https://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; https://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; https://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; https://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; https://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; https://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; https://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; https://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; https://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; https://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; https://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; https://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; https://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; https://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; https://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; https://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; https://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; https://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; https://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; https://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; https://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; https://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; https://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; https://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; https://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; https://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; https://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; https://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; https://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; https://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; https://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; https://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; https://php.net/zend.assertions\nzend.assertions = -1\n\n; Assert(expr); active by default.\n; https://php.net/assert.active\n;assert.active = On\n\n; Throw an AssertionError on failed assertions\n; https://php.net/assert.exception\n;assert.exception = On\n\n; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active)\n; https://php.net/assert.warning\n;assert.warning = On\n\n; Don't bail out by default.\n; https://php.net/assert.bail\n;assert.bail = Off\n\n; User-function to be called if an assertion fails.\n; https://php.net/assert.callback\n;assert.callback = 0\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; https://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; https://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typelib on com_load()\n; https://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; https://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; https://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; https://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; https://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; https://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; https://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; https://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; https://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; https://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; https://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; https://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; https://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; https://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; https://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; https://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; https://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; https://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; https://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; https://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; https://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; Check the cache checksum each N requests.\n; The default value of \"0\" means that the checks are disabled.\n;opcache.consistency_checks=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; This should improve performance, but requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; https://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; https://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_8.2.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/php/php83-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable.\n; 3. A number of predefined registry keys on Windows\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; https://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; https://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security-conscious applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; session.sid_length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.assertions\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; https://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; https://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; https://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; https://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; https://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; https://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; https://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; https://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; https://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; https://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; How many multipart body parts (combined input variable and file uploads) may\n; be accepted.\n; Default Value: -1 (Sum of max_input_vars and max_file_uploads)\n;max_multipart_body_parts = 1500\n\n; Maximum amount of memory a script may consume\n; https://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; https://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; https://php.net/log-errors\nlog_errors = On\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; https://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; https://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; https://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; https://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; https://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from https://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; https://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; https://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; https://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_83\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; https://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; https://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; https://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; https://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; https://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; https://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; https://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; https://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; https://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; https://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; https://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; https://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; https://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; https://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; https://php.net/include-path\ninclude_path\t= \".:/opt/php83/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; https://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; https://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; https://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php83/lib/php/extensions/no-debug-non-zts-20230831/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; https://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; https://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; https://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; https://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; https://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; https://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; https://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; https://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; https://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; https://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; https://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; https://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; https://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; https://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; https://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the ext/\n; extension folders as well as the separate PECL DLL download.\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n\n; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used\n; otherwise it results in segfault when unloading after using SASL.\n; See https://github.com/php/php-src/issues/8620 for more info.\n;extension=ldap\n\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=oci8_19 ; Use with Oracle Database 19 Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See https://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n;extension=zip\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; https://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; https://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; https://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; https://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; https://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; https://php.net/filter.default\n;filter.default = unsafe_raw\n\n; https://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[imap]\n; rsh/ssh logins are disabled by default. Use this INI entry if you want to\n; enable them. Note that the IMAP library does not filter mailbox names before\n; passing them to rsh/ssh command, thus passing untrusted data to this function\n; with rsh/ssh enabled is insecure.\n;imap.enable_insecure_rsh=0\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; https://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; https://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; https://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; https://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; https://php.net/phar.readonly\n;phar.readonly = On\n\n; https://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; https://php.net/smtp\n;SMTP = localhost\n; https://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; https://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; https://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; Use mixed LF and CRLF line separators to keep compatibility with some\n; RFC 2822 non conformant MTA.\nmail.mixed_lf_and_crlf = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; https://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; https://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; https://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; https://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; https://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; https://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; https://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; https://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; https://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; It allows the user to specify a folder where files that can be sent via LOAD DATA\n; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.\n;mysqli.local_infile_directory =\n\n; Allow or prevent persistent links.\n; https://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; https://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; https://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; https://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; https://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; If this option is enabled, closing a persistent connection will rollback\n; any pending transactions of this connection, before it is put back\n; into the persistent connection pool.\n;mysqli.rollback_on_cached_plink = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; https://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; https://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; https://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; https://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; https://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; https://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables row prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; https://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Tuning: Sets the amount of LOB data that is internally returned from\n; Oracle Database when an Oracle LOB locator is initially retrieved as\n; part of a query. Setting this can improve performance by reducing\n; round-trips.\n; https://php.net/oci8.prefetch-lob-size\n; oci8.prefetch_lob_size = 0\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; https://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; https://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; https://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; https://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; https://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; https://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; https://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; https://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; https://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; https://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; https://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; https://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; https://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; https://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; https://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; https://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; https://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; https://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; https://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; https://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; https://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; https://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; https://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; https://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; https://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; https://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; https://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; https://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; https://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; https://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; https://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; https://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; https://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini!\n; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; https://php.net/zend.assertions\nzend.assertions = -1\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; https://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; https://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typelib on com_load()\n; https://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; https://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; https://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; https://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; https://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; https://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; https://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; https://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; https://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; https://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; https://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; https://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; https://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; https://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; https://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; https://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; https://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; https://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; https://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; https://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; https://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; Under certain circumstances (if only a single global PHP process is\n; started from which all others fork), this can increase performance\n; by a tiny amount because TLB misses are reduced. On the other hand, this\n; delays PHP startup, increases memory usage and degrades performance\n; under memory pressure - use with care.\n; Requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; https://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; https://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_8.3.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php83-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php83-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php83-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php83\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php83/sbin/php-fpm\nphp_fpm_CONF=/opt/php83/etc/php83-fpm.conf\nphp_fpm_PID=/run/php83-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php83/etc/php83.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php83-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php83-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php83-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php83-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php83-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php83-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php83-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php83-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php83-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php83-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php83-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php83). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php83 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php83/var\n; Default Value: none\npid = /run/php83-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php83/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php83-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php83-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php83/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php83.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable.\n; 3. A number of predefined registry keys on Windows\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; https://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; https://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security-conscious applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; session.sid_bits_per_character\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n\n; session.sid_length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.assertions\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; https://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; https://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; https://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; https://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; https://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; https://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; https://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; https://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; https://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; https://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; How many multipart body parts (combined input variable and file uploads) may\n; be accepted.\n; Default Value: -1 (Sum of max_input_vars and max_file_uploads)\n;max_multipart_body_parts = 1500\n\n; Maximum amount of memory a script may consume\n; https://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE and E_STRICT, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_STRICT - run-time notices, enable to have PHP suggest changes\n; to your code which will ensure the best interoperability\n; and forward compatibility of your code\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT\n; https://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; https://php.net/log-errors\nlog_errors = On\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; https://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; https://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; https://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; https://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; https://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from https://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; https://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; https://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; https://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_83\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; https://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; https://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; https://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; https://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; https://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; https://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; https://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; https://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; https://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; https://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; https://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; https://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; https://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; https://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; https://php.net/include-path\ninclude_path\t= \".:/opt/php83/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; https://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; https://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; https://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php83/lib/php/extensions/no-debug-non-zts-20230831/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; https://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; https://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; https://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; https://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; https://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; https://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; https://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; https://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; https://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; https://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; https://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; https://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; https://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; https://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; https://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the ext/\n; extension folders as well as the separate PECL DLL download.\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n\n; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used\n; otherwise it results in segfault when unloading after using SASL.\n; See https://github.com/php/php-src/issues/8620 for more info.\n;extension=ldap\n\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=imap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=oci8_12c ; Use with Oracle Database 12c Instant Client\n;extension=oci8_19 ; Use with Oracle Database 19 Instant Client\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_oci\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See https://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n;extension=zip\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; https://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; https://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; https://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; https://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; https://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; https://php.net/filter.default\n;filter.default = unsafe_raw\n\n; https://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[imap]\n; rsh/ssh logins are disabled by default. Use this INI entry if you want to\n; enable them. Note that the IMAP library does not filter mailbox names before\n; passing them to rsh/ssh command, thus passing untrusted data to this function\n; with rsh/ssh enabled is insecure.\n;imap.enable_insecure_rsh=0\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; https://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; https://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; https://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; https://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; https://php.net/phar.readonly\n;phar.readonly = On\n\n; https://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; https://php.net/smtp\n;SMTP = localhost\n; https://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; https://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; https://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; Use mixed LF and CRLF line separators to keep compatibility with some\n; RFC 2822 non conformant MTA.\nmail.mixed_lf_and_crlf = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; https://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; https://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; https://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; https://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; https://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; https://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; https://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; https://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; https://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; It allows the user to specify a folder where files that can be sent via LOAD DATA\n; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.\n;mysqli.local_infile_directory =\n\n; Allow or prevent persistent links.\n; https://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; https://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; https://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; https://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; https://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; Allow or prevent reconnect\nmysqli.reconnect = Off\n\n; If this option is enabled, closing a persistent connection will rollback\n; any pending transactions of this connection, before it is put back\n; into the persistent connection pool.\n;mysqli.rollback_on_cached_plink = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; https://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[OCI8]\n\n; Connection: Enables privileged connections using external\n; credentials (OCI_SYSOPER, OCI_SYSDBA)\n; https://php.net/oci8.privileged-connect\n;oci8.privileged_connect = Off\n\n; Connection: The maximum number of persistent OCI8 connections per\n; process. Using -1 means no limit.\n; https://php.net/oci8.max-persistent\n;oci8.max_persistent = -1\n\n; Connection: The maximum number of seconds a process is allowed to\n; maintain an idle persistent connection. Using -1 means idle\n; persistent connections will be maintained forever.\n; https://php.net/oci8.persistent-timeout\n;oci8.persistent_timeout = -1\n\n; Connection: The number of seconds that must pass before issuing a\n; ping during oci_pconnect() to check the connection validity. When\n; set to 0, each oci_pconnect() will cause a ping. Using -1 disables\n; pings completely.\n; https://php.net/oci8.ping-interval\n;oci8.ping_interval = 60\n\n; Connection: Set this to a user chosen connection class to be used\n; for all pooled server requests with Oracle Database Resident\n; Connection Pooling (DRCP). To use DRCP, this value should be set to\n; the same string for all web servers running the same application,\n; the database pool must be configured, and the connection string must\n; specify to use a pooled server.\n;oci8.connection_class =\n\n; High Availability: Using On lets PHP receive Fast Application\n; Notification (FAN) events generated when a database node fails. The\n; database must also be configured to post FAN events.\n;oci8.events = Off\n\n; Tuning: This option enables statement caching, and specifies how\n; many statements to cache. Using 0 disables statement caching.\n; https://php.net/oci8.statement-cache-size\n;oci8.statement_cache_size = 20\n\n; Tuning: Enables row prefetching and sets the default number of\n; rows that will be fetched automatically after statement execution.\n; https://php.net/oci8.default-prefetch\n;oci8.default_prefetch = 100\n\n; Tuning: Sets the amount of LOB data that is internally returned from\n; Oracle Database when an Oracle LOB locator is initially retrieved as\n; part of a query. Setting this can improve performance by reducing\n; round-trips.\n; https://php.net/oci8.prefetch-lob-size\n; oci8.prefetch_lob_size = 0\n\n; Compatibility. Using On means oci_close() will not close\n; oci_connect() and oci_new_connect() connections.\n; https://php.net/oci8.old-oci-close-semantics\n;oci8.old_oci_close_semantics = Off\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; https://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; https://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; https://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; https://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; https://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; https://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; https://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; https://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; https://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; https://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; https://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; https://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; https://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; https://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; https://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; https://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; https://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; https://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; https://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; https://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; https://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; https://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; https://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; https://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; https://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; Set session ID character length. This value could be between 22 to 256.\n; Shorter length than default is supported only for compatibility reason.\n; Users should use 32 or more chars.\n; https://php.net/session.sid-length\n; Default Value: 32\n; Development Value: 26\n; Production Value: 26\nsession.sid_length = 26\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; https://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Define how many bits are stored in each character when converting\n; the binary hash data to something readable.\n; Possible values:\n; 4 (4 bits: 0-9, a-f)\n; 5 (5 bits: 0-9, a-v)\n; 6 (6 bits: 0-9, a-z, A-Z, \"-\", \",\")\n; Default Value: 4\n; Development Value: 5\n; Production Value: 5\n; https://php.net/session.hash-bits-per-character\nsession.sid_bits_per_character = 5\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; https://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; https://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; https://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; https://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini!\n; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; https://php.net/zend.assertions\nzend.assertions = -1\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; https://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; https://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typelib on com_load()\n; https://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; https://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; https://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; https://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; https://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; https://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; https://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; https://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; https://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; https://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting cannot be empty.\n; https://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; https://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; https://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; https://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; https://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; https://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; https://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; https://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; https://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; https://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; https://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; Under certain circumstances (if only a single global PHP process is\n; started from which all others fork), this can increase performance\n; by a tiny amount because TLB misses are reduced. On the other hand, this\n; delays PHP startup, increases memory usage and degrades performance\n; under memory pressure - use with care.\n; Requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; https://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; https://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_8.3.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/php/php84-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable.\n; 3. A number of predefined registry keys on Windows\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; https://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; https://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security-conscious applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.assertions\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; https://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; https://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; https://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; https://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; https://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; https://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; https://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; https://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; https://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; https://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; How many multipart body parts (combined input variable and file uploads) may\n; be accepted.\n; Default Value: -1 (Sum of max_input_vars and max_file_uploads)\n;max_multipart_body_parts = 1500\n\n; Maximum amount of memory a script may consume\n; https://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED\n; https://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; https://php.net/log-errors\nlog_errors = On\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; https://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; https://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; https://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; https://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; https://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from https://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; https://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; https://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; https://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_84\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; https://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; https://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; https://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; https://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; https://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; https://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; https://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; https://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; https://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; https://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; https://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; https://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; https://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; https://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; https://php.net/include-path\ninclude_path\t= \".:/opt/php84/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; https://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; https://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; https://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php84/lib/php/extensions/no-debug-non-zts-20240924/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; https://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; https://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; https://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; https://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; https://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; https://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; https://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; https://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; https://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; https://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; https://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; https://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; https://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; https://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; https://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the ext/\n; extension folders as well as the separate PECL DLL download.\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See https://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n;extension=zip\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; https://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; https://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; https://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; https://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; https://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; https://php.net/filter.default\n;filter.default = unsafe_raw\n\n; https://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; https://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; https://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; https://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; https://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; https://php.net/phar.readonly\n;phar.readonly = On\n\n; https://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; https://php.net/smtp\n;SMTP = localhost\n; https://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; https://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; https://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; Use mixed LF and CRLF line separators to keep compatibility with some\n; RFC 2822 non conformant MTA.\nmail.mixed_lf_and_crlf = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; https://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; https://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; https://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; https://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; https://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; https://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; https://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; https://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; https://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; It allows the user to specify a folder where files that can be sent via LOAD DATA\n; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.\n;mysqli.local_infile_directory =\n\n; Allow or prevent persistent links.\n; https://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; https://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; https://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; https://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; https://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; If this option is enabled, closing a persistent connection will rollback\n; any pending transactions of this connection, before it is put back\n; into the persistent connection pool.\n;mysqli.rollback_on_cached_plink = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; https://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; https://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; https://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; https://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; https://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; https://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; https://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; https://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; https://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; https://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; https://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; https://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; https://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; https://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; https://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; https://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; https://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; https://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; https://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; https://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; https://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; https://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; https://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; https://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; https://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; https://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; https://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; https://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; https://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; https://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; https://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini!\n; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; https://php.net/zend.assertions\nzend.assertions = -1\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; https://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; https://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typelib on com_load()\n; https://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; https://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; https://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; https://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; https://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; https://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; https://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; https://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; https://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; https://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting must not be empty.\n; https://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; https://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; https://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; https://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; https://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; https://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; https://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; https://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; https://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; https://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; https://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; Under certain circumstances (if only a single global PHP process is\n; started from which all others fork), this can increase performance\n; by a tiny amount because TLB misses are reduced. On the other hand, this\n; delays PHP startup, increases memory usage and degrades performance\n; under memory pressure - use with care.\n; Requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; https://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; https://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_8.4.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php84-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php84-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php84-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php84\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php84/sbin/php-fpm\nphp_fpm_CONF=/opt/php84/etc/php84-fpm.conf\nphp_fpm_PID=/run/php84-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php84/etc/php84.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php84-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php84-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php84-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php84-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php84-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php84-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php84-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php84-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php84-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php84-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php84-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php84). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php84 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php84/var\n; Default Value: none\npid = /run/php84-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php84/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php84-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php84-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php84/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php84.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable.\n; 3. A number of predefined registry keys on Windows\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; https://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; https://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security-conscious applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; register_argc_argv\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.assertions\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; https://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; https://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; https://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; https://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; https://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; https://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; https://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; https://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; https://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; https://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; How many multipart body parts (combined input variable and file uploads) may\n; be accepted.\n; Default Value: -1 (Sum of max_input_vars and max_file_uploads)\n;max_multipart_body_parts = 1500\n\n; Maximum amount of memory a script may consume\n; https://php.net/memory-limit\nmemory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED\n; https://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; https://php.net/log-errors\nlog_errors = On\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; https://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; https://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; If this parameter is set to Off, then memory leaks will not be shown (on\n; stdout or in the log). This is only effective in a debug compile, and if\n; error reporting includes E_WARNING in the allowed list\n; https://php.net/report-memleaks\nreport_memleaks = On\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; https://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; https://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from https://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; https://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; https://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; https://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_84\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; https://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; https://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; https://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; https://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; https://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For performance reasons, this feature should be disabled\n; on production servers.\n; Note: This directive is hardcoded to On for the CLI SAPI\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n; https://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; https://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; https://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; https://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; https://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; https://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; https://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; https://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; https://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; https://php.net/include-path\ninclude_path\t= \".:/opt/php84/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; https://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; https://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; https://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php84/lib/php/extensions/no-debug-non-zts-20240924/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; https://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; https://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; https://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; https://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; https://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; https://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; https://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; https://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; https://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; https://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; https://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; https://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; https://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; https://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; https://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the ext/\n; extension folders as well as the separate PECL DLL download.\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=ldap\n;extension=mbstring\n;extension=exif ; Must be after mbstring as it depends on it\n;extension=mysqli\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See https://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n;extension=zip\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; https://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; https://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; https://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; https://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; https://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; https://php.net/filter.default\n;filter.default = unsafe_raw\n\n; https://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n;intl.error_level = E_WARNING\n;intl.use_exceptions = 0\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; https://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; https://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; https://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; https://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; https://php.net/phar.readonly\n;phar.readonly = On\n\n; https://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; https://php.net/smtp\n;SMTP = localhost\n; https://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; https://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; https://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; Use mixed LF and CRLF line separators to keep compatibility with some\n; RFC 2822 non conformant MTA.\nmail.mixed_lf_and_crlf = Off\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; https://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; https://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; https://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; https://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; https://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; https://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; https://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; https://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; https://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; It allows the user to specify a folder where files that can be sent via LOAD DATA\n; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.\n;mysqli.local_infile_directory =\n\n; Allow or prevent persistent links.\n; https://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; https://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect(). If unset, mysqli_connect() will use\n; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the\n; compile-time value defined MYSQL_PORT (in that order). Win32 will only look\n; at MYSQL_PORT.\n; https://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; https://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect() (doesn't apply in safe mode).\n; https://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect() (doesn't apply in safe mode).\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; https://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; If this option is enabled, closing a persistent connection will rollback\n; any pending transactions of this connection, before it is put back\n; into the persistent connection pool.\n;mysqli.rollback_on_cached_plink = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_memory_statistics = 0\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; https://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; https://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; https://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; https://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; https://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; https://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; https://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; https://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; https://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; https://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; https://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; https://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; https://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; https://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; https://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; https://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; https://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; https://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; https://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; https://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; https://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; https://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; https://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; https://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; https://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; https://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; https://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; https://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; https://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; https://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; https://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini!\n; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; https://php.net/zend.assertions\nzend.assertions = -1\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; https://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; https://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typelib on com_load()\n; https://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; https://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; https://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; https://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; https://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; https://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; https://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; https://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; https://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; https://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting must not be empty.\n; https://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; https://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; https://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; https://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; https://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; https://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; https://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; https://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; https://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; https://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; https://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; Under certain circumstances (if only a single global PHP process is\n; started from which all others fork), this can increase performance\n; by a tiny amount because TLB misses are reduced. On the other hand, this\n; delays PHP startup, increases memory usage and degrades performance\n; under memory pressure - use with care.\n; Requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; https://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; https://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\nzend_extension=\"/usr/local/ioncube/ioncube_loader_lin_8.4.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/php/php85-cli.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable.\n; 3. A number of predefined registry keys on Windows\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; https://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; https://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security-conscious applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; mysqlnd.collect_memory_statistics\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.assertions\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; https://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; https://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; https://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; https://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; https://php.net/realpath-cache-ttl\nrealpath_cache_ttl=5\n\n; Enables or disables the circular reference collector.\n; https://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; https://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; https://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 3600\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; https://php.net/max-input-time\nmax_input_time = 3600\n\n; Maximum input variable nesting level\n; https://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; How many multipart body parts (combined input variable and file uploads) may\n; be accepted.\n; Default Value: -1 (Sum of max_input_vars and max_file_uploads)\n;max_multipart_body_parts = 1500\n\n; Maximum amount of memory a script may consume\n; https://php.net/memory-limit\nmemory_limit = 395M\nmax_memory_limit = -1\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED\n; https://php.net/error-reporting\nerror_reporting = 1\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; https://php.net/log-errors\nlog_errors = On\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; https://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; https://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; https://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; https://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from https://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; https://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; https://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; https://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_cli_85\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; https://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n; This directive controls whether PHP will output the backtrace of fatal errors.\n; Default Value: On\n; Development Value: On\n; Production Value: On\n;fatal_error_backtraces = On\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; https://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; https://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; https://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; https://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For security reasons, this feature should be disabled\n; for non-CLI SAPIs.\n; Note: This directive is ignored for the CLI SAPI\n; This directive is deprecated.\n; https://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; https://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; https://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; https://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; https://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; https://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; https://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; https://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; https://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; https://php.net/include-path\ninclude_path\t= \".:/opt/php85/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; https://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; https://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; https://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php85/lib/php/extensions/no-debug-non-zts-20250925/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; https://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; https://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; https://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; https://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; https://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Prevent decoding of SCRIPT_FILENAME when using Apache ProxyPass or\n; ProxyPassMatch. This should be used if script file paths are not stored\n; in an encoded format on the file system.\n; Default is 1.\n;fastcgi.script_path_encoded = 0\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; https://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; https://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; https://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; https://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; https://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; https://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; https://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; https://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; https://php.net/default-socket-timeout\ndefault_socket_timeout = 3600\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; https://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the ext/\n; extension folders as well as the separate PECL DLL download.\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=exif\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=ldap\n;extension=mbstring\n;extension=mysqli\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See https://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n;extension=zip\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; https://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; https://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; https://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; https://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; https://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; https://php.net/filter.default\n;filter.default = unsafe_raw\n\n; https://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n; This directive is deprecated.\n;intl.error_level = E_WARNING\n; If enabled this directive indicates that when an error occurs within an\n; intl function a IntlException should be thrown.\n; Default is Off, which means errors need to be handled manually.\n;intl.use_exceptions = On\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; https://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; https://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; https://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; https://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; https://php.net/phar.readonly\n;phar.readonly = On\n\n; https://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; https://php.net/smtp\n;SMTP = localhost\n; https://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; https://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; https://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; Use mixed LF and CRLF line separators to keep compatibility with some\n; RFC 2822 non conformant MTA.\nmail.mixed_lf_and_crlf = Off\n\n; Control line ending mode for mail messages and headers.\n; Possible values: \"crlf\" (default), \"lf\", \"mixed\", \"os\"\n; - crlf: Use CRLF line endings\n; - lf: Use LF line endings only (converts CRLF in message to LF)\n; - mixed: Same as mail.mixed_lf_and_crlf = On\n; - os: Use CRLF on Windows, LF on other systems\nmail.cr_lf_mode = crlf\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; https://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; https://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; https://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; https://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; https://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; https://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; https://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; https://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; https://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; It allows the user to specify a folder where files that can be sent via LOAD DATA\n; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.\n;mysqli.local_infile_directory =\n\n; Allow or prevent persistent links.\n; https://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; https://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect().\n; https://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; https://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect().\n; https://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect().\n; https://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect().\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; https://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; If this option is enabled, closing a persistent connection will rollback\n; any pending transactions of this connection, before it is put back\n; into the persistent connection pool.\n;mysqli.rollback_on_cached_plink = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\nmysqlnd.collect_memory_statistics = Off\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; https://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; https://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; https://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; https://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; https://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; https://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; https://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; https://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; https://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; https://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; https://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; https://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; https://php.net/session.cookie-partitioned\n;session.cookie_partitioned = 0\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; https://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; https://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; https://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; https://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; https://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; https://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; https://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; https://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; https://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; https://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; https://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; https://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; https://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; https://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; https://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; https://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; https://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; https://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; https://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini!\n; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; https://php.net/zend.assertions\nzend.assertions = -1\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; https://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; https://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typelib on com_load()\n; https://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; https://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; https://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; https://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; https://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; https://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; https://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; https://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; https://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; https://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting must not be empty.\n; https://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; https://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; https://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; https://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; https://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; https://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; https://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; https://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; https://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; https://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; https://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables read-only mode for the second level cache directory.\n; It should improve performance for read-only containers,\n; when the cache is pre-warmed and packaged alongside the application.\n; Best used with `opcache.validate_timestamps=0`, `opcache.enable_file_override=1`\n; and `opcache.file_cache_consistency_checks=0`.\n; Note: A cache generated with a different build of PHP, a different file path,\n; or different settings (including which extensions are loaded), may be ignored.\n;opcache.file_cache_read_only=0\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; Under certain circumstances (if only a single global PHP process is\n; started from which all others fork), this can increase performance\n; by a tiny amount because TLB misses are reduced. On the other hand, this\n; delays PHP startup, increases memory usage and degrades performance\n; under memory pressure - use with care.\n; Requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; https://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; https://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; The libctx is an OpenSSL library context. OpenSSL defines a default library\n; context, but PHP OpenSSL also defines its own library context to avoid\n; interference with other libraries using OpenSSL and to provide an independent\n; context for each thread in ZTS. Possible values:\n; \"custom\" - use a custom library context (default)\n; \"default\" - use the default OpenSSL library context\n;openssl.libctx=custom\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\n;zend_extension=\"/usr/local/ioncube/ioncube_loader_lin_8.5.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n" }, { "path": "aegir/conf/php/php85-fpm", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: php85-fpm\n# Required-Start: $remote_fs $network\n# Required-Stop: $remote_fs $network\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: starts php85-fpm\n# Description: starts the PHP FastCGI Process Manager daemon\n### END INIT INFO\n\nprefix=/opt/php85\nexec_prefix=${prefix}\nphp_fpm_BIN=/opt/php85/sbin/php-fpm\nphp_fpm_CONF=/opt/php85/etc/php85-fpm.conf\nphp_fpm_PID=/run/php85-fpm.pid\nphp_opts=\"--fpm-config $php_fpm_CONF --pid $php_fpm_PID -c /opt/php85/etc/php85.ini\"\n\nwait_for_pid() {\n\ttry=0\n\n\twhile test $try -lt 5; do\n\n\t\tcase \"$1\" in\n\t\t\t'created')\n\t\t\tif [ -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\n\t\t\t'removed')\n\t\t\tif [ ! -f \"$2\" ]; then\n\t\t\t\ttry=''\n\t\t\t\tbreak\n\t\t\tfi\n\t\t\t;;\n\t\tesac\n\n\t\techo -n .\n\t\ttry=`expr $try + 1`\n\t\tsleep 1\n\n\tdone\n\n}\n\ncase \"$1\" in\n\tstart)\n\t\techo -n \"Starting php85-fpm...\"\n\n\t\t$php_fpm_BIN --daemonize $php_opts\n\n\t\tif [ \"$?\" != 0 ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\tfi\n\n\t\twait_for_pid created $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstop)\n\t\techo -n \"Gracefully shutting down php85-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php85-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -QUIT `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed. Use force-quit\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\tstatus)\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"php85-fpm is stopped\"\n\t\t\texit 0\n\t\tfi\n\n\t\tPID=`cat $php_fpm_PID`\n\t\tif ps -p $PID | grep -q $PID; then\n\t\t\techo \"php85-fpm (pid $PID) is running...\"\n\t\telse\n\t\t\techo \"php85-fpm dead but pid file exists\"\n\t\tfi\n\t;;\n\n\tforce-quit)\n\t\techo -n \"Terminating php85-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php85-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -TERM `cat $php_fpm_PID`\n\n\t\twait_for_pid removed $php_fpm_PID\n\n\t\tif [ -n \"$try\" ]; then\n\t\t\techo \" failed\"\n\t\t\texit 1\n\t\telse\n\t\t\techo \" done\"\n\t\tfi\n\t;;\n\n\trestart)\n\t\t$0 stop\n\t\t$0 start\n\t;;\n\n\treload)\n\n\t\techo -n \"Reloading service php85-fpm...\"\n\n\t\tif [ ! -r $php_fpm_PID ]; then\n\t\t\techo \"warning, no pid file found - php85-fpm is not running ?\"\n\t\t\texit 1\n\t\tfi\n\n\t\tkill -USR2 `cat $php_fpm_PID`\n\n\t\techo \" done\"\n\t;;\n\n\tconfigtest)\n\t\t$php_fpm_BIN -t\n\t;;\n\n\t*)\n\t\techo \"Usage: $0 {start|stop|force-quit|restart|reload|status|configtest}\"\n\t\texit 1\n\t;;\n\nesac\n" }, { "path": "aegir/conf/php/php85-fpm.conf", "content": ";;;;;;;;;;;;;;;;;;;;;\n; FPM Configuration ;\n;;;;;;;;;;;;;;;;;;;;;\n\n; All relative paths in this configuration file are relative to PHP's install\n; prefix (/opt/php85). This prefix can be dynamically changed by using the\n; '-p' argument from the command line.\n\n; Include one or more files. If glob(3) exists, it is used to include a bunch of\n; files from a glob(3) pattern. This directive can be used everywhere in the\n; file.\n; Relative path can also be used. They will be prefixed by:\n; - the global prefix if it's been set (-p argument)\n; - /opt/php85 otherwise\n;include=etc/fpm.d/*.conf\n\n;;;;;;;;;;;;;;;;;;\n; Global Options ;\n;;;;;;;;;;;;;;;;;;\n\n[global]\n; Pid file\n; Note: the default prefix is /opt/php85/var\n; Default Value: none\npid = /run/php85-fpm.pid\n\n; Error log file\n; If it's set to \"syslog\", log is sent to syslogd instead of being written\n; in a local file.\n; Note: the default prefix is /opt/php85/var\n; Default Value: log/php-fpm.log\nerror_log = /var/log/php/php85-fpm-error.log\n\n; syslog_facility is used to specify what type of program is logging the\n; message. This lets syslogd specify that messages from different facilities\n; will be handled differently.\n; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)\n; Default Value: daemon\nsyslog.facility = daemon\n\n; syslog_ident is prepended to every message. If you have multiple FPM\n; instances running on the same server, you can change the default value\n; which must suit common needs.\n; Default Value: php-fpm\nsyslog.ident = php85-fpm\n\n; Log level\n; Possible Values: alert, error, warning, notice, debug\n; Default Value: notice\nlog_level = warning\n\n; If this number of child processes exit with SIGSEGV or SIGBUS within the time\n; interval set by emergency_restart_interval then FPM will restart. A value\n; of '0' means 'Off'.\n; Default Value: 0\nemergency_restart_threshold = 5\n\n; Interval of time used by emergency_restart_interval to determine when\n; a graceful restart will be initiated. This can be useful to work around\n; accidental corruptions in an accelerator's shared memory.\n; Available Units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nemergency_restart_interval = 1m\n\n; Time limit for child processes to wait for a reaction on signals from master.\n; Available units: s(econds), m(inutes), h(ours), or d(ays)\n; Default Unit: seconds\n; Default Value: 0\nprocess_control_timeout = 5s\n\n; The maximum number of processes FPM will fork. This has been design to control\n; the global number of processes when using dynamic PM within a lot of pools.\n; Use it with caution.\n; Note: A value of 0 indicates no limit\n; Default Value: 0\nprocess.max = 0\n\n; Specify the nice(2) priority to apply to the master process (only if set)\n; The value can vary from -19 (highest priority) to 20 (lower priority)\n; Note: - It will only work if the FPM master process is launched as root\n; - The pool process will inherit the master process priority\n; unless it specified otherwise\n; Default Value: no set\n; process.priority = -19\n\n; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.\n; Default Value: yes\ndaemonize = yes\n\n; Set open file descriptor rlimit for the master process.\n; Default Value: system defined value\n;rlimit_files = 1024\n\n; Set max core size rlimit for the master process.\n; Possible Values: 'unlimited' or an integer greater or equal to 0\n; Default Value: system defined value\n;rlimit_core = 0\n\n; Specify the event mechanism FPM will use. The following is available:\n; - select (any POSIX os)\n; - poll (any POSIX os)\n; - epoll (linux >= 2.5.44)\n; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)\n; - /dev/poll (Solaris >= 7)\n; - port (Solaris >= 10)\n; Default Value: not set (auto detection)\n;events.mechanism = epoll\n\n;;;;;;;;;;;;;;;;;;;;\n; Pool Definitions ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Multiple pools of child processes may be started with different listening\n; ports and different management options. The name of the pool will be\n; used in logs and stats. There is no limitation on the number of pools which\n; FPM can handle. Your system will tell you anyway :)\n\ninclude = /opt/php85/etc/pool.d/*.conf\n" }, { "path": "aegir/conf/php/php85.ini", "content": "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; About php.ini ;\n;;;;;;;;;;;;;;;;;;;\n; PHP's initialization file, generally called php.ini, is responsible for\n; configuring many of the aspects of PHP's behavior.\n\n; PHP attempts to find and load this configuration from a number of locations.\n; The following is a summary of its search order:\n; 1. SAPI module specific location.\n; 2. The PHPRC environment variable.\n; 3. A number of predefined registry keys on Windows\n; 4. Current working directory (except CLI)\n; 5. The web server's directory (for SAPI modules), or directory of PHP\n; (otherwise in Windows)\n; 6. The directory from the --with-config-file-path compile time option, or the\n; Windows directory (usually C:\\windows)\n; See the PHP docs for more specific information.\n; https://php.net/configuration.file\n\n; The syntax of the file is extremely simple. Whitespace and lines\n; beginning with a semicolon are silently ignored (as you probably guessed).\n; Section headers (e.g. [Foo]) are also silently ignored, even though\n; they might mean something in the future.\n\n; Directives following the section heading [PATH=/www/mysite] only\n; apply to PHP files in the /www/mysite directory. Directives\n; following the section heading [HOST=www.example.com] only apply to\n; PHP files served from www.example.com. Directives set in these\n; special sections cannot be overridden by user-defined INI files or\n; at runtime. Currently, [PATH=] and [HOST=] sections only work under\n; CGI/FastCGI.\n; https://php.net/ini.sections\n\n; Directives are specified using the following syntax:\n; directive = value\n; Directive names are *case sensitive* - foo=bar is different from FOO=bar.\n; Directives are variables used to configure PHP or PHP extensions.\n; There is no name validation. If PHP can't find an expected\n; directive because it is not set or is mistyped, a default value will be used.\n\n; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one\n; of the INI constants (On, Off, True, False, Yes, No and None) or an expression\n; (e.g. E_ALL & ~E_NOTICE), a quoted string (\"bar\"), or a reference to a\n; previously set variable or directive (e.g. ${foo})\n\n; Expressions in the INI file are limited to bitwise operators and parentheses:\n; | bitwise OR\n; ^ bitwise XOR\n; & bitwise AND\n; ~ bitwise NOT\n; ! boolean NOT\n\n; Boolean flags can be turned on using the values 1, On, True or Yes.\n; They can be turned off using the values 0, Off, False or No.\n\n; An empty string can be denoted by simply not writing anything after the equal\n; sign, or by using the None keyword:\n\n; foo = ; sets foo to an empty string\n; foo = None ; sets foo to an empty string\n; foo = \"None\" ; sets foo to the string 'None'\n\n; If you use constants in your value, and these constants belong to a\n; dynamically loaded extension (either a PHP extension or a Zend extension),\n; you may only use these constants *after* the line that loads the extension.\n\n;;;;;;;;;;;;;;;;;;;\n; About this file ;\n;;;;;;;;;;;;;;;;;;;\n; PHP comes packaged with two INI files. One that is recommended to be used\n; in production environments and one that is recommended to be used in\n; development environments.\n\n; php.ini-production contains settings which hold security, performance and\n; best practices at its core. But please be aware, these settings may break\n; compatibility with older or less security-conscious applications. We\n; recommending using the production ini in production and testing environments.\n\n; php.ini-development is very similar to its production variant, except it is\n; much more verbose when it comes to errors. We recommend using the\n; development version only in development environments, as errors shown to\n; application users can inadvertently leak otherwise secure information.\n\n; This is the php.ini-production INI file.\n\n;;;;;;;;;;;;;;;;;;;\n; Quick Reference ;\n;;;;;;;;;;;;;;;;;;;\n\n; The following are all the settings which are different in either the production\n; or development versions of the INIs with respect to PHP's default behavior.\n; Please see the actual settings later in the document for more details as to why\n; we recommend these changes in PHP's behavior.\n\ndisplay_errors = Off\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; display_startup_errors\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n\n; error_reporting\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED\n\n; log_errors\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n\n; max_input_time\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n\n; mysqlnd.collect_memory_statistics\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\n\n; output_buffering\n; Default Value: Off\n; Development Value: 4096\n; Production Value: 4096\n\n; request_order\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n\n; session.gc_divisor\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n\n; short_open_tag\n; Default Value: On\n; Development Value: Off\n; Production Value: Off\n\n; variables_order\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\"\n\n; zend.assertions\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n\n; zend.exception_ignore_args\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\n\n; zend.exception_string_param_max_len\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n\n;;;;;;;;;;;;;;;;;;;;\n; php.ini Options ;\n;;;;;;;;;;;;;;;;;;;;\n; Name for user-defined php.ini (.htaccess) files. Default is \".user.ini\"\n;user_ini.filename = \".user.ini\"\n\n; To disable this feature set this option to an empty value\nuser_ini.filename =\n\n; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes)\n;user_ini.cache_ttl = 300\n\n;;;;;;;;;;;;;;;;;;;;\n; Language Options ;\n;;;;;;;;;;;;;;;;;;;;\n\n; Enable the PHP scripting language engine under Apache.\n; https://php.net/engine\nengine = On\n\n; This directive determines whether or not PHP will recognize code between\n; tags as PHP source which should be processed as such. It is\n; generally recommended that should be used and that this feature\n; should be disabled, as enabling it may result in issues when generating XML\n; documents, however this remains supported for backward compatibility reasons.\n; Note that this directive does not control the would work.\n; https://php.net/syntax-highlighting\n;highlight.string = #DD0000\n;highlight.comment = #FF9900\n;highlight.keyword = #007700\n;highlight.default = #0000BB\n;highlight.html = #000000\n\n; If enabled, the request will be allowed to complete even if the user aborts\n; the request. Consider enabling it if executing long requests, which may end up\n; being interrupted by the user or a browser timing out. PHP's default behavior\n; is to disable this feature.\n; https://php.net/ignore-user-abort\n;ignore_user_abort = On\n\n; Determines the size of the realpath cache to be used by PHP. This value should\n; be increased on systems where PHP opens many files to reflect the quantity of\n; the file operations performed.\n; Note: if open_basedir is set, the cache is disabled\n; https://php.net/realpath-cache-size\nrealpath_cache_size=64M\n\n; Duration of time, in seconds for which to cache realpath information for a given\n; file or directory. For systems with rarely changing files, consider increasing this\n; value.\n; https://php.net/realpath-cache-ttl\nrealpath_cache_ttl=180\n\n; Enables or disables the circular reference collector.\n; https://php.net/zend.enable-gc\nzend.enable_gc = On\n\n; If enabled, scripts may be written in encodings that are incompatible with\n; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such\n; encodings. To use this feature, mbstring extension must be enabled.\n;zend.multibyte = Off\n\n; Allows to set the default encoding for the scripts. This value will be used\n; unless \"declare(encoding=...)\" directive appears at the top of the script.\n; Only affects if zend.multibyte is set.\n;zend.script_encoding =\n\n; Allows to include or exclude arguments from stack traces generated for exceptions.\n; In production, it is recommended to turn this setting on to prohibit the output\n; of sensitive information in stack traces\n; Default Value: Off\n; Development Value: Off\n; Production Value: On\nzend.exception_ignore_args = On\n\n; Allows setting the maximum string length in an argument of a stringified stack trace\n; to a value between 0 and 1000000.\n; This has no effect when zend.exception_ignore_args is enabled.\n; Default Value: 15\n; Development Value: 15\n; Production Value: 0\n; In production, it is recommended to set this to 0 to reduce the output\n; of sensitive information in stack traces.\nzend.exception_string_param_max_len = 0\n\n;;;;;;;;;;;;;;;;;\n; Miscellaneous ;\n;;;;;;;;;;;;;;;;;\n\n; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header). It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; https://php.net/expose-php\nexpose_php = On\n\n;;;;;;;;;;;;;;;;;;;\n; Resource Limits ;\n;;;;;;;;;;;;;;;;;;;\n\n; Maximum execution time of each script, in seconds\n; https://php.net/max-execution-time\n; Note: This directive is hardcoded to 0 for the CLI SAPI\nmax_execution_time = 180\n\n; Maximum amount of time each script may spend parsing request data. It's a good\n; idea to limit this time on productions servers in order to eliminate unexpectedly\n; long running scripts.\n; Note: This directive is hardcoded to -1 for the CLI SAPI\n; Default Value: -1 (Unlimited)\n; Development Value: 60 (60 seconds)\n; Production Value: 60 (60 seconds)\n; https://php.net/max-input-time\nmax_input_time = 180\n\n; Maximum input variable nesting level\n; https://php.net/max-input-nesting-level\n;max_input_nesting_level = 64\n\n; How many GET/POST/COOKIE input variables may be accepted\nmax_input_vars = 9999\n\n; How many multipart body parts (combined input variable and file uploads) may\n; be accepted.\n; Default Value: -1 (Sum of max_input_vars and max_file_uploads)\n;max_multipart_body_parts = 1500\n\n; Maximum amount of memory a script may consume\n; https://php.net/memory-limit\nmemory_limit = 395M\nmax_memory_limit = 395M\n\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n; Error handling and logging ;\n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; This directive informs PHP of which errors, warnings and notices you would like\n; it to take action for. The recommended way of setting values for this\n; directive is through the use of the error level constants and bitwise\n; operators. The error level constants are below here for convenience as well as\n; some common settings and their meanings.\n; By default, PHP is set to take action on all errors, notices and warnings EXCEPT\n; those related to E_NOTICE, which together cover best practices and\n; recommended coding standards in PHP. For performance reasons, this is the\n; recommend error reporting setting. Your production server shouldn't be wasting\n; resources complaining about best practices and coding standards. That's what\n; development servers and development settings are for.\n; Note: The php.ini-development file has this setting as E_ALL. This\n; means it pretty much reports everything which is exactly what you want during\n; development and early testing.\n;\n; Error Level Constants:\n; E_ALL - All errors and warnings\n; E_ERROR - fatal run-time errors\n; E_RECOVERABLE_ERROR - almost fatal run-time errors\n; E_WARNING - run-time warnings (non-fatal errors)\n; E_PARSE - compile-time parse errors\n; E_NOTICE - run-time notices (these are warnings which often result\n; from a bug in your code, but it's possible that it was\n; intentional (e.g., using an uninitialized variable and\n; relying on the fact it is automatically initialized to an\n; empty string)\n; E_CORE_ERROR - fatal errors that occur during PHP's initial startup\n; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's\n; initial startup\n; E_COMPILE_ERROR - fatal compile-time errors\n; E_COMPILE_WARNING - compile-time warnings (non-fatal errors)\n; E_USER_ERROR - user-generated error message\n; E_USER_WARNING - user-generated warning message\n; E_USER_NOTICE - user-generated notice message\n; E_DEPRECATED - warn about code that will not work in future versions\n; of PHP\n; E_USER_DEPRECATED - user-generated deprecation warnings\n;\n; Common Values:\n; E_ALL (Show all errors, warnings and notices including coding standards.)\n; E_ALL & ~E_NOTICE (Show all errors, except for notices)\n; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors)\n; Default Value: E_ALL\n; Development Value: E_ALL\n; Production Value: E_ALL & ~E_DEPRECATED\n; https://php.net/error-reporting\nerror_reporting = E_ALL & ~E_DEPRECATED\n\n; This directive controls whether or not and where PHP will output errors,\n; notices and warnings too. Error output is very useful during development, but\n; it could be very dangerous in production environments. Depending on the code\n; which is triggering the error, sensitive information could potentially leak\n; out of your application such as database usernames and passwords or worse.\n; For production environments, we recommend logging errors rather than\n; sending them to STDOUT.\n; Possible Values:\n; Off = Do not display any errors\n; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)\n; On or stdout = Display errors to STDOUT\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-errors\ndisplay_errors = Off\n\n; The display of errors which occur during PHP's startup sequence are handled\n; separately from display_errors. We strongly recommend you set this to 'off'\n; for production servers to avoid leaking configuration details.\n; Default Value: On\n; Development Value: On\n; Production Value: Off\n; https://php.net/display-startup-errors\ndisplay_startup_errors = Off\n\n; Besides displaying errors, PHP can also log errors to locations such as a\n; server-specific log, STDERR, or a location specified by the error_log\n; directive found below. While errors should not be displayed on productions\n; servers they should still be monitored and logging is a great way to do that.\n; Default Value: Off\n; Development Value: On\n; Production Value: On\n; https://php.net/log-errors\nlog_errors = On\n\n; Do not log repeated messages. Repeated errors must occur in same file on same\n; line unless ignore_repeated_source is set true.\n; https://php.net/ignore-repeated-errors\nignore_repeated_errors = Off\n\n; Ignore source of message when ignoring repeated messages. When this setting\n; is On you will not log errors with repeated messages from different files or\n; source lines.\n; https://php.net/ignore-repeated-source\nignore_repeated_source = Off\n\n; This setting is off by default.\n;report_zend_debug = 0\n\n; Turn off normal error reporting and emit XML-RPC error XML\n; https://php.net/xmlrpc-errors\n;xmlrpc_errors = 0\n\n; An XML-RPC faultCode\n;xmlrpc_error_number = 0\n\n; When PHP displays or logs an error, it has the capability of formatting the\n; error message as HTML for easier reading. This directive controls whether\n; the error message is formatted as HTML or not.\n; Note: This directive is hardcoded to Off for the CLI SAPI\n; https://php.net/html-errors\nhtml_errors = Off\n\n; If html_errors is set to On *and* docref_root is not empty, then PHP\n; produces clickable error messages that direct to a page describing the error\n; or function causing the error in detail.\n; You can download a copy of the PHP manual from https://php.net/docs\n; and change docref_root to the base URL of your local copy including the\n; leading '/'. You must also specify the file extension being used including\n; the dot. PHP's default behavior is to leave these settings empty, in which\n; case no links to documentation are generated.\n; Note: Never use this feature for production boxes.\n; https://php.net/docref-root\n; Examples\n;docref_root = \"/phpmanual/\"\n\n; https://php.net/docref-ext\n;docref_ext = .html\n\n; String to output before an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-prepend-string\n; Example:\n;error_prepend_string = \"\"\n\n; String to output after an error message. PHP's default behavior is to leave\n; this setting blank.\n; https://php.net/error-append-string\n; Example:\n;error_append_string = \"\"\n\n; Log errors to specified file. PHP's default behavior is to leave this value\n; empty.\n; https://php.net/error-log\n; Example:\n;error_log = php_errors.log\n; Log errors to syslog (Event Log on Windows).\n;error_log = syslog\nerror_log = /var/log/php/error_log_85\n\n; The syslog ident is a string which is prepended to every message logged\n; to syslog. Only used when error_log is set to syslog.\n;syslog.ident = php\n\n; The syslog facility is used to specify what type of program is logging\n; the message. Only used when error_log is set to syslog.\n;syslog.facility = user\n\n; Set this to disable filtering control characters (the default).\n; Some loggers only accept NVT-ASCII, others accept anything that's not\n; control characters. If your logger accepts everything, then no filtering\n; is needed at all.\n; Allowed values are:\n; ascii (all printable ASCII characters and NL)\n; no-ctrl (all characters except control characters)\n; all (all characters)\n; raw (like \"all\", but messages are not split at newlines)\n; https://php.net/syslog.filter\n;syslog.filter = ascii\n\n;windows.show_crt_warning\n; Default value: 0\n; Development value: 0\n; Production value: 0\n\n; This directive controls whether PHP will output the backtrace of fatal errors.\n; Default Value: On\n; Development Value: On\n; Production Value: On\n;fatal_error_backtraces = On\n\n;;;;;;;;;;;;;;;;;\n; Data Handling ;\n;;;;;;;;;;;;;;;;;\n\n; The separator used in PHP generated URLs to separate arguments.\n; PHP's default setting is \"&\".\n; https://php.net/arg-separator.output\n; Example:\n;arg_separator.output = \"&\"\n\n; List of separator(s) used by PHP to parse input URLs into variables.\n; PHP's default setting is \"&\".\n; NOTE: Every character in this directive is considered as separator!\n; https://php.net/arg-separator.input\n; Example:\n;arg_separator.input = \";&\"\n\n; This directive determines which super global arrays are registered when PHP\n; starts up. G,P,C,E & S are abbreviations for the following respective super\n; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty\n; paid for the registration of these arrays and because ENV is not as commonly\n; used as the others, ENV is not recommended on productions servers. You\n; can still get access to the environment variables through getenv() should you\n; need to.\n; Default Value: \"EGPCS\"\n; Development Value: \"GPCS\"\n; Production Value: \"GPCS\";\n; https://php.net/variables-order\nvariables_order = \"GPCS\"\n\n; This directive determines which super global data (G,P & C) should be\n; registered into the super global array REQUEST. If so, it also determines\n; the order in which that data is registered. The values for this directive\n; are specified in the same manner as the variables_order directive,\n; EXCEPT one. Leaving this value empty will cause PHP to use the value set\n; in the variables_order directive. It does not mean it will leave the super\n; globals array REQUEST empty.\n; Default Value: None\n; Development Value: \"GP\"\n; Production Value: \"GP\"\n; https://php.net/request-order\nrequest_order = \"GP\"\n\n; This directive determines whether PHP registers $argv & $argc each time it\n; runs. $argv contains an array of all the arguments passed to PHP when a script\n; is invoked. $argc contains an integer representing the number of arguments\n; that were passed when the script was invoked. These arrays are extremely\n; useful when running scripts from the command line. When this directive is\n; enabled, registering these variables consumes CPU cycles and memory each time\n; a script is executed. For security reasons, this feature should be disabled\n; for non-CLI SAPIs.\n; Note: This directive is ignored for the CLI SAPI\n; This directive is deprecated.\n; https://php.net/register-argc-argv\nregister_argc_argv = Off\n\n; When enabled, the ENV, REQUEST and SERVER variables are created when they're\n; first used (Just In Time) instead of when the script starts. If these\n; variables are not used within a script, having this directive on will result\n; in a performance gain. The PHP directive register_argc_argv must be disabled\n; for this directive to have any effect.\n; https://php.net/auto-globals-jit\nauto_globals_jit = On\n\n; Whether PHP will read the POST data.\n; This option is enabled by default.\n; Most likely, you won't want to disable this option globally. It causes $_POST\n; and $_FILES to always be empty; the only way you will be able to read the\n; POST data will be through the php://input stream wrapper. This can be useful\n; to proxy requests or to process the POST data in a memory efficient fashion.\n; https://php.net/enable-post-data-reading\n;enable_post_data_reading = Off\n\n; Maximum size of POST data that PHP will accept.\n; Its value may be 0 to disable the limit. It is ignored if POST data reading\n; is disabled through enable_post_data_reading.\n; https://php.net/post-max-size\npost_max_size = 350M\n\n; Automatically add files before PHP document.\n; https://php.net/auto-prepend-file\nauto_prepend_file =\n\n; Automatically add files after PHP document.\n; https://php.net/auto-append-file\nauto_append_file =\n\n; By default, PHP will output a media type using the Content-Type header. To\n; disable this, simply set it to be empty.\n;\n; PHP's built-in default media type is set to text/html.\n; https://php.net/default-mimetype\ndefault_mimetype = \"text/html\"\n\n; PHP's default character set is set to UTF-8.\n; https://php.net/default-charset\ndefault_charset = \"UTF-8\"\n\n; PHP internal character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/internal-encoding\n;internal_encoding =\n\n; PHP input character encoding is set to empty.\n; If empty, default_charset is used.\n; https://php.net/input-encoding\n;input_encoding =\n\n; PHP output character encoding is set to empty.\n; If empty, default_charset is used.\n; See also output_buffer.\n; https://php.net/output-encoding\n;output_encoding =\n\n;;;;;;;;;;;;;;;;;;;;;;;;;\n; Paths and Directories ;\n;;;;;;;;;;;;;;;;;;;;;;;;;\n\n; UNIX: \"/path1:/path2\"\n;include_path = \".:/php/includes\"\n;\n; Windows: \"\\path1;\\path2\"\n;include_path = \".;c:\\php\\includes\"\n;\n; PHP's default setting for include_path is \".;/path/to/php/pear\"\n; https://php.net/include-path\ninclude_path\t= \".:/opt/php85/lib/php\"\n\n; The root of the PHP pages, used only if nonempty.\n; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root\n; if you are running php as a CGI under any web server (other than IIS)\n; see documentation for security issues. The alternate is to use the\n; cgi.force_redirect configuration below\n; https://php.net/doc-root\ndoc_root =\n\n; The directory under which PHP opens the script using /~username used only\n; if nonempty.\n; https://php.net/user-dir\nuser_dir =\n\n; Directory in which the loadable extensions (modules) reside.\n; https://php.net/extension-dir\n;extension_dir = \"./\"\n; On windows:\n;extension_dir = \"ext\"\nextension_dir = \"/opt/php85/lib/php/extensions/no-debug-non-zts-20250925/\"\n\n; Directory where the temporary files should be placed.\n; Defaults to the system default (see sys_get_temp_dir)\nsys_temp_dir = \"/tmp\"\n\n; Whether or not to enable the dl() function. The dl() function does NOT work\n; properly in multithreaded servers, such as IIS or Zeus, and is automatically\n; disabled on them.\n; https://php.net/enable-dl\nenable_dl = Off\n\n; cgi.force_redirect is necessary to provide security running PHP as a CGI under\n; most web servers. Left undefined, PHP turns this on by default. You can\n; turn it off here AT YOUR OWN RISK\n; **You CAN safely turn this off for IIS, in fact, you MUST.**\n; https://php.net/cgi.force-redirect\n;cgi.force_redirect = 1\n\n; if cgi.nph is enabled it will force cgi to always sent Status: 200 with\n; every request. PHP's default behavior is to disable this feature.\n;cgi.nph = 1\n\n; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape\n; (iPlanet) web servers, you MAY need to set an environment variable name that PHP\n; will look for to know it is OK to continue execution. Setting this variable MAY\n; cause security issues, KNOW WHAT YOU ARE DOING FIRST.\n; https://php.net/cgi.redirect-status-env\n;cgi.redirect_status_env =\n\n; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.\n; https://php.net/cgi.fix-pathinfo\n;cgi.fix_pathinfo=1\n\n; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside\n; of the web tree and people will not be able to circumvent .htaccess security.\n;cgi.discard_path=1\n\n; FastCGI under IIS supports the ability to impersonate\n; security tokens of the calling client. This allows IIS to define the\n; security context that the request runs under. mod_fastcgi under Apache\n; does not currently support this feature (03/17/2002)\n; Set to 1 if running under IIS. Default is zero.\n; https://php.net/fastcgi.impersonate\n;fastcgi.impersonate = 1\n\n; Prevent decoding of SCRIPT_FILENAME when using Apache ProxyPass or\n; ProxyPassMatch. This should be used if script file paths are not stored\n; in an encoded format on the file system.\n; Default is 1.\n;fastcgi.script_path_encoded = 0\n\n; Disable logging through FastCGI connection. PHP's default behavior is to enable\n; this feature.\n;fastcgi.logging = 0\n\n; cgi.rfc2616_headers configuration option tells PHP what type of headers to\n; use when sending HTTP response code. If set to 0, PHP sends Status: header that\n; is supported by Apache. When this option is set to 1, PHP will send\n; RFC2616 compliant header.\n; Default is zero.\n; https://php.net/cgi.rfc2616-headers\n;cgi.rfc2616_headers = 0\n\n; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #!\n; (shebang) at the top of the running script. This line might be needed if the\n; script support running both as stand-alone script and via PHP CGI<. PHP in CGI\n; mode skips this line and ignores its content if this directive is turned on.\n; https://php.net/cgi.check-shebang-line\n;cgi.check_shebang_line=1\n\n;;;;;;;;;;;;;;;;\n; File Uploads ;\n;;;;;;;;;;;;;;;;\n\n; Whether to allow HTTP file uploads.\n; https://php.net/file-uploads\nfile_uploads = On\n\n; Temporary directory for HTTP uploaded files (will use system default if not\n; specified).\n; https://php.net/upload-tmp-dir\nupload_tmp_dir = /tmp\n\n; Maximum allowed size for uploaded files.\n; https://php.net/upload-max-filesize\nupload_max_filesize = 325M\n\n; Maximum number of files that can be uploaded via a single request\nmax_file_uploads = 50\n\n;;;;;;;;;;;;;;;;;;\n; Fopen wrappers ;\n;;;;;;;;;;;;;;;;;;\n\n; Whether to allow the treatment of URLs (like http:// or ftp://) as files.\n; https://php.net/allow-url-fopen\nallow_url_fopen = On\n\n; Whether to allow include/require to open URLs (like https:// or ftp://) as files.\n; https://php.net/allow-url-include\nallow_url_include = Off\n\n; Define the anonymous ftp password (your email address). PHP's default setting\n; for this is empty.\n; https://php.net/from\n;from=\"john@doe.com\"\n\n; Define the User-Agent string. PHP's default setting for this is empty.\n; https://php.net/user-agent\n;user_agent=\"PHP\"\n\n; Default timeout for socket based streams (seconds)\n; https://php.net/default-socket-timeout\ndefault_socket_timeout = 180\n\n; If your scripts have to deal with files from Macintosh systems,\n; or you are running on a Mac and need to deal with files from\n; unix or win32 systems, setting this flag will cause PHP to\n; automatically detect the EOL character in those files so that\n; fgets() and file() will work regardless of the source of the file.\n; https://php.net/auto-detect-line-endings\nauto_detect_line_endings = On\n\n;;;;;;;;;;;;;;;;;;;;;;\n; Dynamic Extensions ;\n;;;;;;;;;;;;;;;;;;;;;;\n\n; If you wish to have an extension loaded automatically, use the following\n; syntax:\n;\n; extension=modulename\n;\n; For example:\n;\n; extension=mysqli\n;\n; When the extension library to load is not located in the default extension\n; directory, You may specify an absolute path to the library file:\n;\n; extension=/path/to/extension/mysqli.so\n;\n; Note : The syntax used in previous PHP versions ('extension=.so' and\n; 'extension='php_.dll') is supported for legacy reasons and may be\n; deprecated in a future PHP major version. So, when it is possible, please\n; move to the new ('extension=) syntax.\n;\n; Notes for Windows environments :\n;\n; - Many DLL files are located in the ext/\n; extension folders as well as the separate PECL DLL download.\n; Be sure to appropriately set the extension_dir directive.\n;\n;extension=bz2\n;extension=curl\n;extension=exif\n;extension=ffi\n;extension=ftp\n;extension=fileinfo\n;extension=gd\n;extension=gettext\n;extension=gmp\n;extension=intl\n;extension=ldap\n;extension=mbstring\n;extension=mysqli\n;extension=odbc\n;extension=openssl\n;extension=pdo_firebird\n;extension=pdo_mysql\n;extension=pdo_odbc\n;extension=pdo_pgsql\n;extension=pdo_sqlite\n;extension=pgsql\n;extension=shmop\n\n; The MIBS data available in the PHP distribution must be installed.\n; See https://www.php.net/manual/en/snmp.installation.php\n;extension=snmp\n\n;extension=soap\n;extension=sockets\n;extension=sodium\n;extension=sqlite3\n;extension=tidy\n;extension=xsl\n;extension=zip\n\n;zend_extension=opcache\n\n;;;;;;;;;;;;;;;;;;;\n; Module Settings ;\n;;;;;;;;;;;;;;;;;;;\n\n[CLI Server]\n; Whether the CLI web server uses ANSI color coding in its terminal output.\ncli_server.color = On\n\n[Date]\n; Defines the default timezone used by the date functions\n; https://php.net/date.timezone\ndate.timezone = \"UTC\"\n\n; https://php.net/date.default-latitude\n;date.default_latitude = 31.7667\n\n; https://php.net/date.default-longitude\n;date.default_longitude = 35.2333\n\n; https://php.net/date.sunrise-zenith\n;date.sunrise_zenith = 90.833333\n\n; https://php.net/date.sunset-zenith\n;date.sunset_zenith = 90.833333\n\n[filter]\n; https://php.net/filter.default\n;filter.default = unsafe_raw\n\n; https://php.net/filter.default-flags\n;filter.default_flags =\n\n[iconv]\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; If empty, default_charset or input_encoding or iconv.input_encoding is used.\n; The precedence is: default_charset < input_encoding < iconv.input_encoding\n;iconv.input_encoding =\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;iconv.internal_encoding =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; If empty, default_charset or output_encoding or iconv.output_encoding is used.\n; The precedence is: default_charset < output_encoding < iconv.output_encoding\n; To use an output encoding conversion, iconv's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n;iconv.output_encoding =\n\n[intl]\n;intl.default_locale =\n; This directive allows you to produce PHP errors when some error\n; happens within intl functions. The value is the level of the error produced.\n; Default is 0, which does not produce any errors.\n; This directive is deprecated.\n;intl.error_level = E_WARNING\n; If enabled this directive indicates that when an error occurs within an\n; intl function a IntlException should be thrown.\n; Default is Off, which means errors need to be handled manually.\n;intl.use_exceptions = On\n\n[sqlite3]\n; Directory pointing to SQLite3 extensions\n; https://php.net/sqlite3.extension-dir\n;sqlite3.extension_dir =\n\n; SQLite defensive mode flag (only available from SQLite 3.26+)\n; When the defensive flag is enabled, language features that allow ordinary\n; SQL to deliberately corrupt the database file are disabled. This forbids\n; writing directly to the schema, shadow tables (eg. FTS data tables), or\n; the sqlite_dbpage virtual table.\n; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html\n; (for older SQLite versions, this flag has no use)\n;sqlite3.defensive = 1\n\n[Pcre]\n; PCRE library backtracking limit.\n; https://php.net/pcre.backtrack-limit\n;pcre.backtrack_limit=100000\n\n; PCRE library recursion limit.\n; Please note that if you set this value to a high number you may consume all\n; the available process stack and eventually crash PHP (due to reaching the\n; stack size limit imposed by the Operating System).\n; https://php.net/pcre.recursion-limit\n;pcre.recursion_limit=100000\n\n; Enables or disables JIT compilation of patterns. This requires the PCRE\n; library to be compiled with JIT support.\n;pcre.jit=1\n\n[Pdo]\n; Whether to pool ODBC connections. Can be one of \"strict\", \"relaxed\" or \"off\"\n; https://php.net/pdo-odbc.connection-pooling\n;pdo_odbc.connection_pooling=strict\n\n[Pdo_mysql]\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\npdo_mysql.default_socket=\n\n[Phar]\n; https://php.net/phar.readonly\n;phar.readonly = On\n\n; https://php.net/phar.require-hash\n;phar.require_hash = On\n\n;phar.cache_list =\n\n[mail function]\n; For Win32 only.\n; https://php.net/smtp\n;SMTP = localhost\n; https://php.net/smtp-port\n;smtp_port = 25\n\n; For Win32 only.\n; https://php.net/sendmail-from\n;sendmail_from = me@example.com\n\n; For Unix only. You may supply arguments as well (default: \"sendmail -t -i\").\n; https://php.net/sendmail-path\nsendmail_path = /usr/sbin/sendmail -t -i\n\n; Force the addition of the specified parameters to be passed as extra parameters\n; to the sendmail binary. These parameters will always replace the value of\n; the 5th parameter to mail().\n;mail.force_extra_parameters =\n\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\nmail.add_x_header = Off\n\n; Use mixed LF and CRLF line separators to keep compatibility with some\n; RFC 2822 non conformant MTA.\nmail.mixed_lf_and_crlf = Off\n\n; Control line ending mode for mail messages and headers.\n; Possible values: \"crlf\" (default), \"lf\", \"mixed\", \"os\"\n; - crlf: Use CRLF line endings\n; - lf: Use LF line endings only (converts CRLF in message to LF)\n; - mixed: Same as mail.mixed_lf_and_crlf = On\n; - os: Use CRLF on Windows, LF on other systems\nmail.cr_lf_mode = crlf\n\n; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log =\n; Log mail to syslog (Event Log on Windows).\n;mail.log = syslog\n\n[ODBC]\n; https://php.net/odbc.default-db\n;odbc.default_db = Not yet implemented\n\n; https://php.net/odbc.default-user\n;odbc.default_user = Not yet implemented\n\n; https://php.net/odbc.default-pw\n;odbc.default_pw = Not yet implemented\n\n; Controls the ODBC cursor model.\n; Default: SQL_CURSOR_STATIC (default).\n;odbc.default_cursortype\n\n; Allow or prevent persistent links.\n; https://php.net/odbc.allow-persistent\nodbc.allow_persistent = On\n\n; Check that a connection is still valid before reuse.\n; https://php.net/odbc.check-persistent\nodbc.check_persistent = On\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/odbc.max-persistent\nodbc.max_persistent = -1\n\n; Maximum number of links (persistent + non-persistent). -1 means no limit.\n; https://php.net/odbc.max-links\nodbc.max_links = -1\n\n; Handling of LONG fields. Returns number of bytes to variables. 0 means\n; passthru.\n; https://php.net/odbc.defaultlrl\nodbc.defaultlrl = 4096\n\n; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char.\n; See the documentation on odbc_binmode and odbc_longreadlen for an explanation\n; of odbc.defaultlrl and odbc.defaultbinmode\n; https://php.net/odbc.defaultbinmode\nodbc.defaultbinmode = 1\n\n[MySQLi]\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/mysqli.max-persistent\nmysqli.max_persistent = -1\n\n; Allow accessing, from PHP's perspective, local files with LOAD DATA statements\n; https://php.net/mysqli.allow_local_infile\n;mysqli.allow_local_infile = On\n\n; It allows the user to specify a folder where files that can be sent via LOAD DATA\n; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled.\n;mysqli.local_infile_directory =\n\n; Allow or prevent persistent links.\n; https://php.net/mysqli.allow-persistent\nmysqli.allow_persistent = On\n\n; Maximum number of links. -1 means no limit.\n; https://php.net/mysqli.max-links\nmysqli.max_links = -1\n\n; Default port number for mysqli_connect().\n; https://php.net/mysqli.default-port\nmysqli.default_port = 3306\n\n; Default socket name for local MySQL connects. If empty, uses the built-in\n; MySQL defaults.\n; https://php.net/mysqli.default-socket\nmysqli.default_socket =\n\n; Default host for mysqli_connect().\n; https://php.net/mysqli.default-host\nmysqli.default_host =\n\n; Default user for mysqli_connect().\n; https://php.net/mysqli.default-user\nmysqli.default_user =\n\n; Default password for mysqli_connect().\n; Note that this is generally a *bad* idea to store passwords in this file.\n; *Any* user with PHP access can run 'echo get_cfg_var(\"mysqli.default_pw\")\n; and reveal this password! And of course, any users with read access to this\n; file will be able to reveal the password as well.\n; https://php.net/mysqli.default-pw\nmysqli.default_pw =\n\n; If this option is enabled, closing a persistent connection will rollback\n; any pending transactions of this connection, before it is put back\n; into the persistent connection pool.\n;mysqli.rollback_on_cached_plink = Off\n\n[mysqlnd]\n; Enable / Disable collection of general statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\nmysqlnd.collect_statistics = 0\n\n; Enable / Disable collection of memory usage statistics by mysqlnd which can be\n; used to tune and monitor MySQL operations.\n; Default Value: Off\n; Development Value: On\n; Production Value: Off\nmysqlnd.collect_memory_statistics = Off\n\n; Records communication from all extensions using mysqlnd to the specified log\n; file.\n; https://php.net/mysqlnd.debug\n;mysqlnd.debug =\n\n; Defines which queries will be logged.\n;mysqlnd.log_mask = 0\n\n; Default size of the mysqlnd memory pool, which is used by result sets.\nmysqlnd.mempool_default_size = 64000\n\n; Size of a pre-allocated buffer used when sending commands to MySQL in bytes.\nmysqlnd.net_cmd_buffer_size = 8192\n\n; Size of a pre-allocated buffer used for reading data sent by the server in\n; bytes.\nmysqlnd.net_read_buffer_size = 131072\n\n; Timeout for network requests in seconds.\n;mysqlnd.net_read_timeout = 31536000\n\n; SHA-256 Authentication Plugin related. File with the MySQL server public RSA\n; key.\n;mysqlnd.sha256_server_public_key =\n\n[PostgreSQL]\n; Allow or prevent persistent links.\n; https://php.net/pgsql.allow-persistent\npgsql.allow_persistent = On\n\n; Detect broken persistent links always with pg_pconnect().\n; Auto reset feature requires a little overheads.\n; https://php.net/pgsql.auto-reset-persistent\npgsql.auto_reset_persistent = Off\n\n; Maximum number of persistent links. -1 means no limit.\n; https://php.net/pgsql.max-persistent\npgsql.max_persistent = -1\n\n; Maximum number of links (persistent+non persistent). -1 means no limit.\n; https://php.net/pgsql.max-links\npgsql.max_links = -1\n\n; Ignore PostgreSQL backends Notice message or not.\n; Notice message logging require a little overheads.\n; https://php.net/pgsql.ignore-notice\npgsql.ignore_notice = 0\n\n; Log PostgreSQL backends Notice message or not.\n; Unless pgsql.ignore_notice=0, module cannot log notice message.\n; https://php.net/pgsql.log-notice\npgsql.log_notice = 0\n\n[bcmath]\n; Number of decimal digits for all bcmath functions.\n; https://php.net/bcmath.scale\nbcmath.scale = 0\n\n[browscap]\n; https://php.net/browscap\n;browscap = extra/browscap.ini\n\n[Session]\n; Handler used to store/retrieve data.\n; https://php.net/session.save-handler\nsession.save_handler = files\n\n; Argument passed to save_handler. In the case of files, this is the path\n; where data files are stored. Note: Windows users have to change this\n; variable in order to use PHP's session functions.\n;\n; The path can be defined as:\n;\n; session.save_path = \"N;/path\"\n;\n; where N is an integer. Instead of storing all the session files in\n; /path, what this will do is use subdirectories N-levels deep, and\n; store the session data in those directories. This is useful if\n; your OS has problems with many files in one directory, and is\n; a more efficient layout for servers that handle many sessions.\n;\n; NOTE 1: PHP will not create this directory structure automatically.\n; You can use the script in the ext/session dir for that purpose.\n; NOTE 2: See the section on garbage collection below if you choose to\n; use subdirectories for session storage\n;\n; The file storage module creates files using mode 600 by default.\n; You can change that by using\n;\n; session.save_path = \"N;MODE;/path\"\n;\n; where MODE is the octal representation of the mode. Note that this\n; does not overwrite the process's umask.\n; https://php.net/session.save-path\nsession.save_path = \"/opt/tmp\"\n\n; Whether to use strict session mode.\n; Strict session mode does not accept an uninitialized session ID, and\n; regenerates the session ID if the browser sends an uninitialized session ID.\n; Strict mode protects applications from session fixation via a session adoption\n; vulnerability. It is disabled by default for maximum compatibility, but\n; enabling it is encouraged.\n; https://wiki.php.net/rfc/strict_sessions\nsession.use_strict_mode = 0\n\n; Whether to use cookies.\n; https://php.net/session.use-cookies\nsession.use_cookies = 1\n\n; https://php.net/session.cookie-secure\n;session.cookie_secure =\n\n; https://php.net/session.cookie-partitioned\n;session.cookie_partitioned = 0\n\n; This option forces PHP to fetch and use a cookie for storing and maintaining\n; the session id. We encourage this operation as it's very helpful in combating\n; session hijacking when not specifying and managing your own session id. It is\n; not the be-all and end-all of session hijacking defense, but it's a good start.\n; https://php.net/session.use-only-cookies\nsession.use_only_cookies = 1\n\n; Name of the session (used as cookie name).\n; https://php.net/session.name\nsession.name = PHPSESSID\n\n; Initialize session on request startup.\n; https://php.net/session.auto-start\nsession.auto_start = 0\n\n; Lifetime in seconds of cookie or, if 0, until browser is restarted.\n; https://php.net/session.cookie-lifetime\nsession.cookie_lifetime = 0\n\n; The path for which the cookie is valid.\n; https://php.net/session.cookie-path\nsession.cookie_path = /\n\n; The domain for which the cookie is valid.\n; https://php.net/session.cookie-domain\nsession.cookie_domain =\n\n; Whether or not to add the httpOnly flag to the cookie, which makes it\n; inaccessible to browser scripting languages such as JavaScript.\n; https://php.net/session.cookie-httponly\nsession.cookie_httponly = 1\n\n; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)\n; Current valid values are \"Strict\", \"Lax\" or \"None\". When using \"None\",\n; make sure to include the quotes, as `none` is interpreted like `false` in ini files.\n; https://tools.ietf.org/html/draft-west-first-party-cookies-07\nsession.cookie_samesite =\n\n; Handler used to serialize data. php is the standard serializer of PHP.\n; https://php.net/session.serialize-handler\nsession.serialize_handler = php\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.gc-probability\nsession.gc_probability = 1\n\n; Defines the probability that the 'garbage collection' process is started on every\n; session initialization. The probability is calculated by using gc_probability/gc_divisor,\n; e.g. 1/100 means there is a 1% chance that the GC process starts on each request.\n; For high volume production servers, using a value of 1000 is a more efficient approach.\n; Default Value: 100\n; Development Value: 1000\n; Production Value: 1000\n; https://php.net/session.gc-divisor\nsession.gc_divisor = 1000\n\n; After this number of seconds, stored data will be seen as 'garbage' and\n; cleaned up by the garbage collection process.\n; https://php.net/session.gc-maxlifetime\nsession.gc_maxlifetime = 1440\n\n; NOTE: If you are using the subdirectory option for storing session files\n; (see session.save_path above), then garbage collection does *not*\n; happen automatically. You will need to do your own garbage\n; collection through a shell script, cron entry, or some other method.\n; For example, the following script is the equivalent of setting\n; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):\n; find /path/to/sessions -cmin +24 -type f | xargs rm\n\n; Check HTTP Referer to invalidate externally stored URLs containing ids.\n; HTTP_REFERER has to contain this substring for the session to be\n; considered as valid.\n; https://php.net/session.referer-check\nsession.referer_check =\n\n; Set to {nocache,private,public,} to determine HTTP caching aspects\n; or leave this empty to avoid sending anti-caching headers.\n; https://php.net/session.cache-limiter\nsession.cache_limiter = nocache\n\n; Document expires after n minutes.\n; https://php.net/session.cache-expire\nsession.cache_expire = 180\n\n; trans sid support is disabled by default.\n; Use of trans sid may risk your users' security.\n; Use this option with caution.\n; - User may send URL contains active session ID\n; to other person via. email/irc/etc.\n; - URL that contains active session ID may be stored\n; in publicly accessible computer.\n; - User may access your site with the same session ID\n; always using URL stored in browser's history or bookmarks.\n; https://php.net/session.use-trans-sid\nsession.use_trans_sid = 0\n\n; The URL rewriter will look for URLs in a defined set of HTML tags.\n; is special; if you include them here, the rewriter will\n; add a hidden field with the info which is otherwise appended\n; to URLs. tag's action attribute URL will not be modified\n; unless it is specified.\n; Note that all valid entries require a \"=\", even if no value follows.\n; Default Value: \"a=href,area=href,frame=src,form=\"\n; Development Value: \"a=href,area=href,frame=src,form=\"\n; Production Value: \"a=href,area=href,frame=src,form=\"\n; https://php.net/url-rewriter.tags\nsession.trans_sid_tags = \"a=href,area=href,frame=src,form=\"\n\n; URL rewriter does not rewrite absolute URLs by default.\n; To enable rewrites for absolute paths, target hosts must be specified\n; at RUNTIME. i.e. use ini_set()\n; tags is special. PHP will check action attribute's URL regardless\n; of session.trans_sid_tags setting.\n; If no host is defined, HTTP_HOST will be used for allowed host.\n; Example value: php.net,www.php.net,wiki.php.net\n; Use \",\" for multiple hosts. No spaces are allowed.\n; Default Value: \"\"\n; Development Value: \"\"\n; Production Value: \"\"\n;session.trans_sid_hosts=\"\"\n\n; Enable upload progress tracking in $_SESSION\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.enabled\n;session.upload_progress.enabled = On\n\n; Cleanup the progress information as soon as all POST data has been read\n; (i.e. upload completed).\n; Default Value: On\n; Development Value: On\n; Production Value: On\n; https://php.net/session.upload-progress.cleanup\n;session.upload_progress.cleanup = On\n\n; A prefix used for the upload progress key in $_SESSION\n; Default Value: \"upload_progress_\"\n; Development Value: \"upload_progress_\"\n; Production Value: \"upload_progress_\"\n; https://php.net/session.upload-progress.prefix\n;session.upload_progress.prefix = \"upload_progress_\"\n\n; The index name (concatenated with the prefix) in $_SESSION\n; containing the upload progress information\n; Default Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Development Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; Production Value: \"PHP_SESSION_UPLOAD_PROGRESS\"\n; https://php.net/session.upload-progress.name\n;session.upload_progress.name = \"PHP_SESSION_UPLOAD_PROGRESS\"\n\n; How frequently the upload progress should be updated.\n; Given either in percentages (per-file), or in bytes\n; Default Value: \"1%\"\n; Development Value: \"1%\"\n; Production Value: \"1%\"\n; https://php.net/session.upload-progress.freq\n;session.upload_progress.freq = \"1%\"\n\n; The minimum delay between updates, in seconds\n; Default Value: 1\n; Development Value: 1\n; Production Value: 1\n; https://php.net/session.upload-progress.min-freq\n;session.upload_progress.min_freq = \"1\"\n\n; Only write session data when session data is changed. Enabled by default.\n; https://php.net/session.lazy-write\n;session.lazy_write = On\n\n[Assertion]\n; Switch whether to compile assertions at all (to have no overhead at run-time)\n; -1: Do not compile at all\n; 0: Jump over assertion at run-time\n; 1: Execute assertions\n; Changing from or to a negative value is only possible in php.ini!\n; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0)\n; Default Value: 1\n; Development Value: 1\n; Production Value: -1\n; https://php.net/zend.assertions\nzend.assertions = -1\n\n[COM]\n; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs\n; https://php.net/com.typelib-file\n;com.typelib_file =\n\n; allow Distributed-COM calls\n; https://php.net/com.allow-dcom\n;com.allow_dcom = true\n\n; autoregister constants of a component's typelib on com_load()\n; https://php.net/com.autoregister-typelib\n;com.autoregister_typelib = true\n\n; register constants casesensitive\n; https://php.net/com.autoregister-casesensitive\n;com.autoregister_casesensitive = false\n\n; show warnings on duplicate constant registrations\n; https://php.net/com.autoregister-verbose\n;com.autoregister_verbose = true\n\n; The default character set code-page to use when passing strings to and from COM objects.\n; Default: system ANSI code page\n;com.code_page=\n\n; The version of the .NET framework to use. The value of the setting are the first three parts\n; of the framework's version number, separated by dots, and prefixed with \"v\", e.g. \"v4.0.30319\".\n;com.dotnet_version=\n\n[mbstring]\n; language for internal character representation.\n; This affects mb_send_mail() and mbstring.detect_order.\n; https://php.net/mbstring.language\n;mbstring.language = Japanese\n\n; Use of this INI entry is deprecated, use global internal_encoding instead.\n; internal/script encoding.\n; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*)\n; If empty, default_charset or internal_encoding or iconv.internal_encoding is used.\n; The precedence is: default_charset < internal_encoding < iconv.internal_encoding\n;mbstring.internal_encoding =\n\n; Use of this INI entry is deprecated, use global input_encoding instead.\n; http input encoding.\n; mbstring.encoding_translation = On is needed to use this setting.\n; If empty, default_charset or input_encoding or mbstring.input is used.\n; The precedence is: default_charset < input_encoding < mbstring.http_input\n; https://php.net/mbstring.http-input\n;mbstring.http_input =\n\n; Use of this INI entry is deprecated, use global output_encoding instead.\n; http output encoding.\n; mb_output_handler must be registered as output buffer to function.\n; If empty, default_charset or output_encoding or mbstring.http_output is used.\n; The precedence is: default_charset < output_encoding < mbstring.http_output\n; To use an output encoding conversion, mbstring's output handler must be set\n; otherwise output encoding conversion cannot be performed.\n; https://php.net/mbstring.http-output\n;mbstring.http_output =\n\n; enable automatic encoding translation according to\n; mbstring.internal_encoding setting. Input chars are\n; converted to internal encoding by setting this to On.\n; Note: Do _not_ use automatic encoding translation for\n; portable libs/applications.\n; https://php.net/mbstring.encoding-translation\n;mbstring.encoding_translation = Off\n\n; automatic encoding detection order.\n; \"auto\" detect order is changed according to mbstring.language\n; https://php.net/mbstring.detect-order\n;mbstring.detect_order = auto\n\n; substitute_character used when character cannot be converted\n; one from another\n; https://php.net/mbstring.substitute-character\n;mbstring.substitute_character = none\n\n; Enable strict encoding detection.\n;mbstring.strict_detection = Off\n\n; This directive specifies the regex pattern of content types for which mb_output_handler()\n; is activated.\n; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\\+xml)\n;mbstring.http_output_conv_mimetypes=\n\n; This directive specifies maximum stack depth for mbstring regular expressions. It is similar\n; to the pcre.recursion_limit for PCRE.\n;mbstring.regex_stack_limit=100000\n\n; This directive specifies maximum retry count for mbstring regular expressions. It is similar\n; to the pcre.backtrack_limit for PCRE.\n;mbstring.regex_retry_limit=1000000\n\n[gd]\n; Tell the jpeg decode to ignore warnings and try to create\n; a gd image. The warning will then be displayed as notices\n; disabled by default\n; https://php.net/gd.jpeg-ignore-warning\n;gd.jpeg_ignore_warning = 1\n\n[exif]\n; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS.\n; With mbstring support this will automatically be converted into the encoding\n; given by corresponding encode setting. When empty mbstring.internal_encoding\n; is used. For the decode settings you can distinguish between motorola and\n; intel byte order. A decode setting must not be empty.\n; https://php.net/exif.encode-unicode\n;exif.encode_unicode = ISO-8859-15\n\n; https://php.net/exif.decode-unicode-motorola\n;exif.decode_unicode_motorola = UCS-2BE\n\n; https://php.net/exif.decode-unicode-intel\n;exif.decode_unicode_intel = UCS-2LE\n\n; https://php.net/exif.encode-jis\n;exif.encode_jis =\n\n; https://php.net/exif.decode-jis-motorola\n;exif.decode_jis_motorola = JIS\n\n; https://php.net/exif.decode-jis-intel\n;exif.decode_jis_intel = JIS\n\n[Tidy]\n; The path to a default tidy configuration file to use when using tidy\n; https://php.net/tidy.default-config\n;tidy.default_config = /usr/local/lib/php/default.tcfg\n\n; Should tidy clean and repair output automatically?\n; WARNING: Do not use this option if you are generating non-html content\n; such as dynamic images\n; https://php.net/tidy.clean-output\ntidy.clean_output = Off\n\n[soap]\n; Enables or disables WSDL caching feature.\n; https://php.net/soap.wsdl-cache-enabled\nsoap.wsdl_cache_enabled=1\n\n; Sets the directory name where SOAP extension will put cache files.\n; https://php.net/soap.wsdl-cache-dir\nsoap.wsdl_cache_dir=\"/tmp\"\n\n; (time to live) Sets the number of second while cached file will be used\n; instead of original one.\n; https://php.net/soap.wsdl-cache-ttl\nsoap.wsdl_cache_ttl=86400\n\n; Sets the size of the cache limit. (Max. number of WSDL files to cache)\nsoap.wsdl_cache_limit = 5\n\n[sysvshm]\n; A default size of the shared memory segment\n;sysvshm.init_mem = 10000\n\n[ldap]\n; Sets the maximum number of open links or -1 for unlimited.\nldap.max_links = -1\n\n[dba]\n;dba.default_handler=\n\n[opcache]\n; Determines if Zend OPCache is enabled\n;opcache.enable=1\n\n; Determines if Zend OPCache is enabled for the CLI version of PHP\n;opcache.enable_cli=0\n\n; The OPcache shared memory storage size.\n;opcache.memory_consumption=128\n\n; The amount of memory for interned strings in Mbytes.\n;opcache.interned_strings_buffer=8\n\n; The maximum number of keys (scripts) in the OPcache hash table.\n; Only numbers between 200 and 1000000 are allowed.\n;opcache.max_accelerated_files=10000\n\n; The maximum percentage of \"wasted\" memory until a restart is scheduled.\n;opcache.max_wasted_percentage=5\n\n; When this directive is enabled, the OPcache appends the current working\n; directory to the script key, thus eliminating possible collisions between\n; files with the same name (basename). Disabling the directive improves\n; performance, but may break existing applications.\n;opcache.use_cwd=1\n\n; When disabled, you must reset the OPcache manually or restart the\n; webserver for changes to the filesystem to take effect.\n;opcache.validate_timestamps=1\n\n; How often (in seconds) to check file timestamps for changes to the shared\n; memory storage allocation. (\"1\" means validate once per second, but only\n; once per request. \"0\" means always validate)\n;opcache.revalidate_freq=2\n\n; Enables or disables file search in include_path optimization\n;opcache.revalidate_path=0\n\n; If disabled, all PHPDoc comments are dropped from the code to reduce the\n; size of the optimized code.\n;opcache.save_comments=1\n\n; If enabled, compilation warnings (including notices and deprecations) will\n; be recorded and replayed each time a file is included. Otherwise, compilation\n; warnings will only be emitted when the file is first cached.\n;opcache.record_warnings=0\n\n; Allow file existence override (file_exists, etc.) performance feature.\n;opcache.enable_file_override=0\n\n; A bitmask, where each bit enables or disables the appropriate OPcache\n; passes\n;opcache.optimization_level=0x7FFFBFFF\n\n;opcache.dups_fix=0\n\n; The location of the OPcache blacklist file (wildcards allowed).\n; Each OPcache blacklist file is a text file that holds the names of files\n; that should not be accelerated. The file format is to add each filename\n; to a new line. The filename may be a full path or just a file prefix\n; (i.e., /var/www/x blacklists all the files and directories in /var/www\n; that start with 'x'). Line starting with a ; are ignored (comments).\n;opcache.blacklist_filename=\n\n; Allows exclusion of large files from being cached. By default all files\n; are cached.\n;opcache.max_file_size=0\n\n; How long to wait (in seconds) for a scheduled restart to begin if the cache\n; is not being accessed.\n;opcache.force_restart_timeout=180\n\n; OPcache error_log file name. Empty string assumes \"stderr\".\n;opcache.error_log=\n\n; All OPcache errors go to the Web server log.\n; By default, only fatal errors (level 0) or errors (level 1) are logged.\n; You can also enable warnings (level 2), info messages (level 3) or\n; debug messages (level 4).\n;opcache.log_verbosity_level=1\n\n; Preferred Shared Memory back-end. Leave empty and let the system decide.\n;opcache.preferred_memory_model=\n\n; Protect the shared memory from unexpected writing during script execution.\n; Useful for internal debugging only.\n;opcache.protect_memory=0\n\n; Allows calling OPcache API functions only from PHP scripts which path is\n; started from specified string. The default \"\" means no restriction\n;opcache.restrict_api=\n\n; Mapping base of shared memory segments (for Windows only). All the PHP\n; processes have to map shared memory into the same address space. This\n; directive allows to manually fix the \"Unable to reattach to base address\"\n; errors.\n;opcache.mmap_base=\n\n; Facilitates multiple OPcache instances per user (for Windows only). All PHP\n; processes with the same cache ID and user share an OPcache instance.\n;opcache.cache_id=\n\n; Enables and sets the second level cache directory.\n; It should improve performance when SHM memory is full, at server restart or\n; SHM reset. The default \"\" disables file based caching.\n;opcache.file_cache=\n\n; Enables or disables read-only mode for the second level cache directory.\n; It should improve performance for read-only containers,\n; when the cache is pre-warmed and packaged alongside the application.\n; Best used with `opcache.validate_timestamps=0`, `opcache.enable_file_override=1`\n; and `opcache.file_cache_consistency_checks=0`.\n; Note: A cache generated with a different build of PHP, a different file path,\n; or different settings (including which extensions are loaded), may be ignored.\n;opcache.file_cache_read_only=0\n\n; Enables or disables opcode caching in shared memory.\n;opcache.file_cache_only=0\n\n; Enables or disables checksum validation when script loaded from file cache.\n;opcache.file_cache_consistency_checks=1\n\n; Implies opcache.file_cache_only=1 for a certain process that failed to\n; reattach to the shared memory (for Windows only). Explicitly enabled file\n; cache is required.\n;opcache.file_cache_fallback=1\n\n; Enables or disables copying of PHP code (text segment) into HUGE PAGES.\n; Under certain circumstances (if only a single global PHP process is\n; started from which all others fork), this can increase performance\n; by a tiny amount because TLB misses are reduced. On the other hand, this\n; delays PHP startup, increases memory usage and degrades performance\n; under memory pressure - use with care.\n; Requires appropriate OS configuration.\n;opcache.huge_code_pages=0\n\n; Validate cached file permissions.\n;opcache.validate_permission=0\n\n; Prevent name collisions in chroot'ed environment.\n;opcache.validate_root=0\n\n; If specified, it produces opcode dumps for debugging different stages of\n; optimizations.\n;opcache.opt_debug_level=0\n\n; Specifies a PHP script that is going to be compiled and executed at server\n; start-up.\n; https://php.net/opcache.preload\n;opcache.preload=\n\n; Preloading code as root is not allowed for security reasons. This directive\n; facilitates to let the preloading to be run as another user.\n; https://php.net/opcache.preload_user\n;opcache.preload_user=\n\n; Prevents caching files that are less than this number of seconds old. It\n; protects from caching of incompletely updated files. In case all file updates\n; on your site are atomic, you may increase performance by setting it to \"0\".\n;opcache.file_update_protection=2\n\n; Absolute path used to store shared lockfiles (for *nix only).\n;opcache.lockfile_path=/tmp\n\n[curl]\n; A default value for the CURLOPT_CAINFO option. This is required to be an\n; absolute path.\n;curl.cainfo =\n\n[openssl]\n; The location of a Certificate Authority (CA) file on the local filesystem\n; to use when verifying the identity of SSL/TLS peers. Most users should\n; not specify a value for this directive as PHP will attempt to use the\n; OS-managed cert stores in its absence. If specified, this value may still\n; be overridden on a per-stream basis via the \"cafile\" SSL stream context\n; option.\n;openssl.cafile=\n\n; If openssl.cafile is not specified or if the CA file is not found, the\n; directory pointed to by openssl.capath is searched for a suitable\n; certificate. This value must be a correctly hashed certificate directory.\n; Most users should not specify a value for this directive as PHP will\n; attempt to use the OS-managed cert stores in its absence. If specified,\n; this value may still be overridden on a per-stream basis via the \"capath\"\n; SSL stream context option.\n;openssl.capath=\n\n; The libctx is an OpenSSL library context. OpenSSL defines a default library\n; context, but PHP OpenSSL also defines its own library context to avoid\n; interference with other libraries using OpenSSL and to provide an independent\n; context for each thread in ZTS. Possible values:\n; \"custom\" - use a custom library context (default)\n; \"default\" - use the default OpenSSL library context\n;openssl.libctx=custom\n\n[ffi]\n; FFI API restriction. Possible values:\n; \"preload\" - enabled in CLI scripts and preloaded files (default)\n; \"false\" - always disabled\n; \"true\" - always enabled\n;ffi.enable=preload\n\n; List of headers files to preload, wildcard patterns allowed.\n;ffi.preload=\n\n[Zend]\n;zend_extension=\"/usr/local/ioncube/ioncube_loader_lin_8.5.so\"\n\n; fix for segfaults\nauto_globals_jit = Off\n\ncgi.fix_pathinfo = 1\nmbstring.http_input = \"pass\"\nmbstring.http_output = \"pass\"\nmbstring.encoding_translation = 0\n\n; Enable Extensions\nextension=uploadprogress.so\nextension=imagick.so\nextension=redis.so\n\n; APCu\nextension=apcu.so\napc.enable_cli=1\napc.gc_ttl=300\napc.shm_segments=1\napc.shm_size=256M\napc.slam_defense=0\napc.ttl=0\n;\n" }, { "path": "aegir/conf/redis/redis-server", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides:\t\tredis-server\n# Required-Start:\t$syslog $remote_fs\n# Required-Stop:\t$syslog $remote_fs\n# Should-Start:\t\t$local_fs\n# Should-Stop:\t\t$local_fs\n# Default-Start:\t2 3 4 5\n# Default-Stop:\t\t0 1 6\n# Short-Description: redis-server - Persistent key-value db\n# Description: redis-server - Persistent key-value db\n### END INIT INFO\n\nPATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nDAEMON=/usr/bin/redis-server\nDAEMON_ARGS=/etc/redis/redis.conf\nNAME=redis-server\nDESC=redis-server\nPIDFILE=/run/redis/redis.pid\n\ntest -x $DAEMON || exit 0\n\n[ -d /run/redis ] || mkdir -p /run/redis\n[ -d /run/redis ] && chown -R redis:redis /run/redis\n\nmaxclients=$(awk '/^[ \\t]*maxclients[ \\t]/ { print $2 }' /etc/redis/redis.conf)\nif [ ! -z \"$maxclients\" ] && [ \"$maxclients\" -gt 992 ]; then\n ulimit -n $((maxclients+32))\nfi\n\ncase \"$1\" in\n start)\n\techo -n \"Starting $DESC: \"\n\ttouch $PIDFILE\n\tchown redis:redis $PIDFILE\n\tif start-stop-daemon --start --quiet --umask 007 --pidfile $PIDFILE --chuid redis:redis --exec $DAEMON -- $DAEMON_ARGS\n\tthen\n\t\techo \"$NAME.\"\n\telse\n\t\techo \"failed\"\n\tfi\n\t;;\n stop)\n\techo -n \"Stopping $DESC: \"\n\tif start-stop-daemon --stop --retry 8 --quiet --oknodo --pidfile $PIDFILE --exec $DAEMON\n\tthen\n\t\techo \"$NAME.\"\n\telse\n\t\techo \"failed\"\n\tfi\n\trm -f $PIDFILE\n\tsleep 1\n\t;;\n\n restart|force-reload)\n\t${0} stop\n\t${0} start\n\t;;\n\n reload)\n echo -n \"Reloading service ${NAME}...\"\n if [ ! -r ${PIDFILE} ]; then\n echo \"warning, no pid file found - ${NAME} is not running ?\"\n exit 1\n fi\n kill -USR2 `cat ${PIDFILE}`\n echo \" done\"\n\t;;\n\n status)\n\techo -n \"$DESC is \"\n\tif start-stop-daemon --stop --quiet --signal 0 --name ${NAME} --pidfile ${PIDFILE}\n\tthen\n\t\techo \"running\"\n\telse\n\t\techo \"not running\"\n\t\texit 1\n\tfi\n\t;;\n\n *)\n\techo \"Usage: service $NAME {start|stop|restart|reload|force-reload}\" >&2\n\texit 1\n\t;;\nesac\n\nexit 0\n" }, { "path": "aegir/conf/redis/redis.conf", "content": "# Redis configuration file example.\n#\n# Note that in order to read the configuration file, Redis must be\n# started with the file path as first argument:\n#\n# ./redis-server /path/to/redis.conf\n\n# Note on units: when memory size is needed, it is possible to specify\n# it in the usual form of 1k 5GB 4M and so forth:\n#\n# 1k => 1000 bytes\n# 1kb => 1024 bytes\n# 1m => 1000000 bytes\n# 1mb => 1024*1024 bytes\n# 1g => 1000000000 bytes\n# 1gb => 1024*1024*1024 bytes\n#\n# units are case insensitive so 1GB 1Gb 1gB are all the same.\n\n################################## INCLUDES ###################################\n\n# Include one or more other config files here. This is useful if you\n# have a standard template that goes to all Redis servers but also need\n# to customize a few per-server settings. Include files can include\n# other files, so use this wisely.\n#\n# Notice option \"include\" won't be rewritten by command \"CONFIG REWRITE\"\n# from admin or Redis Sentinel. Since Redis always uses the last processed\n# line as value of a configuration directive, you'd better put includes\n# at the beginning of this file to avoid overwriting config change at runtime.\n#\n# If instead you are interested in using includes to override configuration\n# options, it is better to use include as the last line.\n#\n# include /path/to/local.conf\n# include /path/to/other.conf\n\n################################## MODULES #####################################\n\n# Load modules at startup. If the server is not able to load modules\n# it will abort. It is possible to use multiple loadmodule directives.\n#\n# loadmodule /path/to/my_module.so\n# loadmodule /path/to/other_module.so\n\n################################## NETWORK #####################################\n\n# By default, if no \"bind\" configuration directive is specified, Redis listens\n# for connections from all the network interfaces available on the server.\n# It is possible to listen to just one or multiple selected interfaces using\n# the \"bind\" configuration directive, followed by one or more IP addresses.\n#\n# Examples:\n#\n# xbind 192.168.1.100 10.0.0.1\n# xbind 127.0.0.1 ::1\n#\n# ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the\n# internet, binding to all the interfaces is dangerous and will expose the\n# instance to everybody on the internet. So by default we uncomment the\n# following bind directive, that will force Redis to listen only into\n# the IPv4 lookback interface address (this means Redis will be able to\n# accept connections only from clients running into the same computer it\n# is running).\n#\n# IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES\n# JUST COMMENT THE FOLLOWING LINE.\n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nbind 127.0.0.1\n\n# Protected mode is a layer of security protection, in order to avoid that\n# Redis instances left open on the internet are accessed and exploited.\n#\n# When protected mode is on and if:\n#\n# 1) The server is not binding explicitly to a set of addresses using the\n# \"bind\" directive.\n# 2) No password is configured.\n#\n# The server only accepts connections from clients connecting from the\n# IPv4 and IPv6 loopback addresses 127.0.0.1 and ::1, and from Unix domain\n# sockets.\n#\n# By default protected mode is enabled. You should disable it only if\n# you are sure you want clients from other hosts to connect to Redis\n# even if no authentication is configured, nor a specific set of interfaces\n# are explicitly listed using the \"bind\" directive.\nprotected-mode no\n\n# Accept connections on the specified port, default is 6379 (IANA #815344).\n# If port 0 is specified Redis will not listen on a TCP socket.\nport 6379\n\n# TCP listen() backlog.\n#\n# In high requests-per-second environments you need an high backlog in order\n# to avoid slow clients connections issues. Note that the Linux kernel\n# will silently truncate it to the value of /proc/sys/net/core/somaxconn so\n# make sure to raise both the value of somaxconn and tcp_max_syn_backlog\n# in order to get the desired effect.\ntcp-backlog 511\n\n# Unix socket.\n#\n# Specify the path for the Unix socket that will be used to listen for\n# incoming connections. There is no default, so Redis will not listen\n# on a unix socket when not specified.\n#\n# unixsocket /run/redis/redis.sock\n# unixsocketperm 777\n\n# Close the connection after a client is idle for N seconds (0 to disable)\ntimeout 3600\n\n# TCP keepalive.\n#\n# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence\n# of communication. This is useful for two reasons:\n#\n# 1) Detect dead peers.\n# 2) Take the connection alive from the point of view of network\n# equipment in the middle.\n#\n# On Linux, the specified value (in seconds) is the period used to send ACKs.\n# Note that to close the connection the double of the time is needed.\n# On other kernels the period depends on the kernel configuration.\n#\n# A reasonable value for this option is 300 seconds, which is the new\n# Redis default starting with Redis 3.2.1.\ntcp-keepalive 300\n\n################################# GENERAL #####################################\n\n# By default Redis does not run as a daemon. Use 'yes' if you need it.\n# Note that Redis will write a pid file in /run/redis.pid when daemonized.\ndaemonize yes\n\n# If you run Redis from upstart or systemd, Redis can interact with your\n# supervision tree. Options:\n# supervised no - no supervision interaction\n# supervised upstart - signal upstart by putting Redis into SIGSTOP mode\n# supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET\n# supervised auto - detect upstart or systemd method based on\n# UPSTART_JOB or NOTIFY_SOCKET environment variables\n# Note: these supervision methods only signal \"process is ready.\"\n# They do not enable continuous liveness pings back to your supervisor.\nsupervised no\n\n# If a pid file is specified, Redis writes it where specified at startup\n# and removes it at exit.\n#\n# When the server runs non daemonized, no pid file is created if none is\n# specified in the configuration. When the server is daemonized, the pid file\n# is used even if not specified, defaulting to \"/run/redis.pid\".\n#\n# Creating a pid file is best effort: if Redis is not able to create it\n# nothing bad happens, the server will start and run normally.\npidfile /run/redis/redis.pid\n\n# Specify the server verbosity level.\n# This can be one of:\n# debug (a lot of information, useful for development/testing)\n# verbose (many rarely useful info, but not a mess like the debug level)\n# notice (moderately verbose, what you want in production probably)\n# warning (only very important / critical messages are logged)\nloglevel warning\n\n# Specify the log file name. Also the empty string can be used to force\n# Redis to log on the standard output. Note that if you use standard\n# output for logging but daemonize, logs will be sent to /dev/null\nlogfile /var/log/redis/redis-server.log\n\n# To enable logging to the system logger, just set 'syslog-enabled' to yes,\n# and optionally update the other syslog parameters to suit your needs.\n# syslog-enabled no\n\n# Specify the syslog identity.\n# syslog-ident redis\n\n# Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.\n# syslog-facility local0\n\n# Set the number of databases. The default database is DB 0, you can select\n# a different one on a per-connection basis using SELECT where\n# dbid is a number between 0 and 'databases'-1\ndatabases 8\n\n# By default Redis shows an ASCII art logo only when started to log to the\n# standard output and if the standard output is a TTY. Basically this means\n# that normally a logo is displayed only in interactive sessions.\n#\n# However it is possible to force the pre-4.0 behavior and always show a\n# ASCII art logo in startup logs by setting the following option to yes.\nalways-show-logo yes\n\n################################ SNAPSHOTTING ################################\n#\n# Save the DB on disk:\n#\n# save \n#\n# Will save the DB if both the given number of seconds and the given\n# number of write operations against the DB occurred.\n#\n# In the example below the behaviour will be to save:\n# after 900 sec (15 min) if at least 1 key changed\n# after 300 sec (5 min) if at least 10 keys changed\n# after 60 sec if at least 10000 keys changed\n#\n# Note: you can disable saving completely by commenting out all \"save\" lines.\n#\n# It is also possible to remove all the previously configured save\n# points by adding a save directive with a single empty string argument\n# like in the following example:\n#\n# save \"\"\n\n# save 900 1\n# save 300 10\n# save 60 10000\n\n# By default Redis will stop accepting writes if RDB snapshots are enabled\n# (at least one save point) and the latest background save failed.\n# This will make the user aware (in a hard way) that data is not persisting\n# on disk properly, otherwise chances are that no one will notice and some\n# disaster will happen.\n#\n# If the background saving process will start working again Redis will\n# automatically allow writes again.\n#\n# However if you have setup your proper monitoring of the Redis server\n# and persistence, you may want to disable this feature so that Redis will\n# continue to work as usual even if there are problems with disk,\n# permissions, and so forth.\nstop-writes-on-bgsave-error no\n\n# Compress string objects using LZF when dump .rdb databases?\n# For default that's set to 'yes' as it's almost always a win.\n# If you want to save some CPU in the saving child set it to 'no' but\n# the dataset will likely be bigger if you have compressible values or keys.\nrdbcompression yes\n\n# Since version 5 of RDB a CRC64 checksum is placed at the end of the file.\n# This makes the format more resistant to corruption but there is a performance\n# hit to pay (around 10%) when saving and loading RDB files, so you can disable it\n# for maximum performances.\n#\n# RDB files created with checksum disabled have a checksum of zero that will\n# tell the loading code to skip the check.\nrdbchecksum no\n\n# The filename where to dump the DB\ndbfilename dump.rdb\n\n# The working directory.\n#\n# The DB will be written inside this directory, with the filename specified\n# above using the 'dbfilename' configuration directive.\n#\n# The Append Only File will also be created inside this directory.\n#\n# Note that you must specify a directory here, not a file name.\ndir /var/lib/redis/\n\n################################# REPLICATION #################################\n\n# Master-Slave replication. Use slaveof to make a Redis instance a copy of\n# another Redis server. A few things to understand ASAP about Redis replication.\n#\n# 1) Redis replication is asynchronous, but you can configure a master to\n# stop accepting writes if it appears to be not connected with at least\n# a given number of slaves.\n# 2) Redis slaves are able to perform a partial resynchronization with the\n# master if the replication link is lost for a relatively small amount of\n# time. You may want to configure the replication backlog size (see the next\n# sections of this file) with a sensible value depending on your needs.\n# 3) Replication is automatic and does not need user intervention. After a\n# network partition slaves automatically try to reconnect to masters\n# and resynchronize with them.\n#\n# slaveof \n\n# If the master is password protected (using the \"requirepass\" configuration\n# directive below) it is possible to tell the slave to authenticate before\n# starting the replication synchronization process, otherwise the master will\n# refuse the slave request.\n#\n# masterauth \n\n# When a slave loses its connection with the master, or when the replication\n# is still in progress, the slave can act in two different ways:\n#\n# 1) if slave-serve-stale-data is set to 'yes' (the default) the slave will\n# still reply to client requests, possibly with out of date data, or the\n# data set may just be empty if this is the first synchronization.\n#\n# 2) if slave-serve-stale-data is set to 'no' the slave will reply with\n# an error \"SYNC with master in progress\" to all the kind of commands\n# but to INFO and SLAVEOF.\n#\nslave-serve-stale-data yes\n\n# You can configure a slave instance to accept writes or not. Writing against\n# a slave instance may be useful to store some ephemeral data (because data\n# written on a slave will be easily deleted after resync with the master) but\n# may also cause problems if clients are writing to it because of a\n# misconfiguration.\n#\n# Since Redis 2.6 by default slaves are read-only.\n#\n# Note: read only slaves are not designed to be exposed to untrusted clients\n# on the internet. It's just a protection layer against misuse of the instance.\n# Still a read only slave exports by default all the administrative commands\n# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve\n# security of read only slaves using 'rename-command' to shadow all the\n# administrative / dangerous commands.\nslave-read-only yes\n\n# Replication SYNC strategy: disk or socket.\n#\n# -------------------------------------------------------\n# WARNING: DISKLESS REPLICATION IS EXPERIMENTAL CURRENTLY\n# -------------------------------------------------------\n#\n# New slaves and reconnecting slaves that are not able to continue the replication\n# process just receiving differences, need to do what is called a \"full\n# synchronization\". An RDB file is transmitted from the master to the slaves.\n# The transmission can happen in two different ways:\n#\n# 1) Disk-backed: The Redis master creates a new process that writes the RDB\n# file on disk. Later the file is transferred by the parent\n# process to the slaves incrementally.\n# 2) Diskless: The Redis master creates a new process that directly writes the\n# RDB file to slave sockets, without touching the disk at all.\n#\n# With disk-backed replication, while the RDB file is generated, more slaves\n# can be queued and served with the RDB file as soon as the current child producing\n# the RDB file finishes its work. With diskless replication instead once\n# the transfer starts, new slaves arriving will be queued and a new transfer\n# will start when the current one terminates.\n#\n# When diskless replication is used, the master waits a configurable amount of\n# time (in seconds) before starting the transfer in the hope that multiple slaves\n# will arrive and the transfer can be parallelized.\n#\n# With slow disks and fast (large bandwidth) networks, diskless replication\n# works better.\nrepl-diskless-sync no\n\n# When diskless replication is enabled, it is possible to configure the delay\n# the server waits in order to spawn the child that transfers the RDB via socket\n# to the slaves.\n#\n# This is important since once the transfer starts, it is not possible to serve\n# new slaves arriving, that will be queued for the next RDB transfer, so the server\n# waits a delay in order to let more slaves arrive.\n#\n# The delay is specified in seconds, and by default is 5 seconds. To disable\n# it entirely just set it to 0 seconds and the transfer will start ASAP.\nrepl-diskless-sync-delay 5\n\n# Slaves send PINGs to server in a predefined interval. It's possible to change\n# this interval with the repl_ping_slave_period option. The default value is 10\n# seconds.\n#\n# repl-ping-slave-period 10\n\n# The following option sets the replication timeout for:\n#\n# 1) Bulk transfer I/O during SYNC, from the point of view of slave.\n# 2) Master timeout from the point of view of slaves (data, pings).\n# 3) Slave timeout from the point of view of masters (REPLCONF ACK pings).\n#\n# It is important to make sure that this value is greater than the value\n# specified for repl-ping-slave-period otherwise a timeout will be detected\n# every time there is low traffic between the master and the slave.\n#\n# repl-timeout 60\n\n# Disable TCP_NODELAY on the slave socket after SYNC?\n#\n# If you select \"yes\" Redis will use a smaller number of TCP packets and\n# less bandwidth to send data to slaves. But this can add a delay for\n# the data to appear on the slave side, up to 40 milliseconds with\n# Linux kernels using a default configuration.\n#\n# If you select \"no\" the delay for data to appear on the slave side will\n# be reduced but more bandwidth will be used for replication.\n#\n# By default we optimize for low latency, but in very high traffic conditions\n# or when the master and slaves are many hops away, turning this to \"yes\" may\n# be a good idea.\nrepl-disable-tcp-nodelay no\n\n# Set the replication backlog size. The backlog is a buffer that accumulates\n# slave data when slaves are disconnected for some time, so that when a slave\n# wants to reconnect again, often a full resync is not needed, but a partial\n# resync is enough, just passing the portion of data the slave missed while\n# disconnected.\n#\n# The bigger the replication backlog, the longer the time the slave can be\n# disconnected and later be able to perform a partial resynchronization.\n#\n# The backlog is only allocated once there is at least a slave connected.\n#\n# repl-backlog-size 1mb\n\n# After a master has no longer connected slaves for some time, the backlog\n# will be freed. The following option configures the amount of seconds that\n# need to elapse, starting from the time the last slave disconnected, for\n# the backlog buffer to be freed.\n#\n# Note that slaves never free the backlog for timeout, since they may be\n# promoted to masters later, and should be able to correctly \"partially\n# resynchronize\" with the slaves: hence they should always accumulate backlog.\n#\n# A value of 0 means to never release the backlog.\n#\n# repl-backlog-ttl 3600\n\n# The slave priority is an integer number published by Redis in the INFO output.\n# It is used by Redis Sentinel in order to select a slave to promote into a\n# master if the master is no longer working correctly.\n#\n# A slave with a low priority number is considered better for promotion, so\n# for instance if there are three slaves with priority 10, 100, 25 Sentinel will\n# pick the one with priority 10, that is the lowest.\n#\n# However a special priority of 0 marks the slave as not able to perform the\n# role of master, so a slave with priority of 0 will never be selected by\n# Redis Sentinel for promotion.\n#\n# By default the priority is 100.\nslave-priority 100\n\n# It is possible for a master to stop accepting writes if there are less than\n# N slaves connected, having a lag less or equal than M seconds.\n#\n# The N slaves need to be in \"online\" state.\n#\n# The lag in seconds, that must be <= the specified value, is calculated from\n# the last ping received from the slave, that is usually sent every second.\n#\n# This option does not GUARANTEE that N replicas will accept the write, but\n# will limit the window of exposure for lost writes in case not enough slaves\n# are available, to the specified number of seconds.\n#\n# For example to require at least 3 slaves with a lag <= 10 seconds use:\n#\n# min-slaves-to-write 3\n# min-slaves-max-lag 10\n#\n# Setting one or the other to 0 disables the feature.\n#\n# By default min-slaves-to-write is set to 0 (feature disabled) and\n# min-slaves-max-lag is set to 10.\n\n# A Redis master is able to list the address and port of the attached\n# slaves in different ways. For example the \"INFO replication\" section\n# offers this information, which is used, among other tools, by\n# Redis Sentinel in order to discover slave instances.\n# Another place where this info is available is in the output of the\n# \"ROLE\" command of a master.\n#\n# The listed IP and address normally reported by a slave is obtained\n# in the following way:\n#\n# IP: The address is auto detected by checking the peer address\n# of the socket used by the slave to connect with the master.\n#\n# Port: The port is communicated by the slave during the replication\n# handshake, and is normally the port that the slave is using to\n# list for connections.\n#\n# However when port forwarding or Network Address Translation (NAT) is\n# used, the slave may be actually reachable via different IP and port\n# pairs. The following two options can be used by a slave in order to\n# report to its master a specific set of IP and port, so that both INFO\n# and ROLE will report those values.\n#\n# There is no need to use both the options if you need to override just\n# the port or the IP address.\n#\n# slave-announce-ip 5.5.5.5\n# slave-announce-port 1234\n\n################################## SECURITY ###################################\n\n# Require clients to issue AUTH before processing any other\n# commands. This might be useful in environments in which you do not trust\n# others with access to the host running redis-server.\n#\n# This should stay commented out for backward compatibility and because most\n# people do not need auth (e.g. they run their own servers).\n#\n# Warning: since Redis is pretty fast an outside user can try up to\n# 150k passwords per second against a good box. This means that you should\n# use a very strong password otherwise it will be very easy to break.\n#\n# requirepass isfoobared\n\n# Command renaming.\n#\n# It is possible to change the name of dangerous commands in a shared\n# environment. For instance the CONFIG command may be renamed into something\n# hard to guess so that it will still be available for internal-use tools\n# but not available for general clients.\n#\n# Example:\n#\n# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52\n#\n# It is also possible to completely kill a command by renaming it into\n# an empty string:\n#\n# rename-command CONFIG \"\"\n#\n# Please note that changing the name of commands that are logged into the\n# AOF file or transmitted to slaves may cause problems.\n\n################################### CLIENTS ####################################\n\n# Set the max number of connected clients at the same time. By default\n# this limit is set to 10000 clients, however if the Redis server is not\n# able to configure the process file limit to allow for the specified limit\n# the max number of allowed clients is set to the current file limit\n# minus 32 (as Redis reserves a few file descriptors for internal uses).\n#\n# Once the limit is reached Redis will close all the new connections sending\n# an error 'max number of clients reached'.\n#\nmaxclients 4000\n\n############################## MEMORY MANAGEMENT ################################\n\n# Set a memory usage limit to the specified amount of bytes.\n# When the memory limit is reached Redis will try to remove keys\n# according to the eviction policy selected (see maxmemory-policy).\n#\n# If Redis can't remove keys according to the policy, or if the policy is\n# set to 'noeviction', Redis will start to reply with errors to commands\n# that would use more memory, like SET, LPUSH, and so on, and will continue\n# to reply to read-only commands like GET.\n#\n# This option is usually useful when using Redis as an LRU or LFU cache, or to\n# set a hard memory limit for an instance (using the 'noeviction' policy).\n#\n# WARNING: If you have slaves attached to an instance with maxmemory on,\n# the size of the output buffers needed to feed the slaves are subtracted\n# from the used memory count, so that network problems / resyncs will\n# not trigger a loop where keys are evicted, and in turn the output\n# buffer of slaves is full with DELs of keys evicted triggering the deletion\n# of more keys, and so forth until the database is completely emptied.\n#\n# In short... if you have slaves attached it is suggested that you set a lower\n# limit for maxmemory so that there is some free RAM on the system for slave\n# output buffers (but this is not needed if the policy is 'noeviction').\n#\nmaxmemory 88MB\n\n# MAXMEMORY POLICY: how Redis will select what to remove when maxmemory\n# is reached. You can select among five behaviors:\n#\n# volatile-lru -> Evict using approximated LRU among the keys with an expire set.\n# allkeys-lru -> Evict any key using approximated LRU.\n# volatile-lfu -> Evict using approximated LFU among the keys with an expire set.\n# allkeys-lfu -> Evict any key using approximated LFU.\n# volatile-random -> Remove a random key among the ones with an expire set.\n# allkeys-random -> Remove a random key, any key.\n# volatile-ttl -> Remove the key with the nearest expire time (minor TTL)\n# noeviction -> Don't evict anything, just return an error on write operations.\n#\n# LRU means Least Recently Used\n# LFU means Least Frequently Used\n#\n# Both LRU, LFU and volatile-ttl are implemented using approximated\n# randomized algorithms.\n#\n# Note: with any of the above policies, Redis will return an error on write\n# operations, when there are no suitable keys for eviction.\n#\n# At the date of writing these commands are: set setnx setex append\n# incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd\n# sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby\n# zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby\n# getset mset msetnx exec sort\n#\n# The default is: noeviction\n#\nmaxmemory-policy allkeys-lru\n\n# LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated\n# algorithms (in order to save memory), so you can tune it for speed or\n# accuracy. For default Redis will check five keys and pick the one that was\n# used less recently, you can change the sample size using the following\n# configuration directive.\n#\n# The default of 5 produces good enough results. 10 Approximates very closely\n# true LRU but costs more CPU. 3 is faster but not very accurate.\n#\n# maxmemory-samples 5\n\n############################# LAZY FREEING ####################################\n\n# Redis has two primitives to delete keys. One is called DEL and is a blocking\n# deletion of the object. It means that the server stops processing new commands\n# in order to reclaim all the memory associated with an object in a synchronous\n# way. If the key deleted is associated with a small object, the time needed\n# in order to execute the DEL command is very small and comparable to most other\n# O(1) or O(log_N) commands in Redis. However if the key is associated with an\n# aggregated value containing millions of elements, the server can block for\n# a long time (even seconds) in order to complete the operation.\n#\n# For the above reasons Redis also offers non blocking deletion primitives\n# such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and\n# FLUSHDB commands, in order to reclaim memory in background. Those commands\n# are executed in constant time. Another thread will incrementally free the\n# object in the background as fast as possible.\n#\n# DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled.\n# It's up to the design of the application to understand when it is a good\n# idea to use one or the other. However the Redis server sometimes has to\n# delete keys or flush the whole database as a side effect of other operations.\n# Specifically Redis deletes objects independently of a user call in the\n# following scenarios:\n#\n# 1) On eviction, because of the maxmemory and maxmemory policy configurations,\n# in order to make room for new data, without going over the specified\n# memory limit.\n# 2) Because of expire: when a key with an associated time to live (see the\n# EXPIRE command) must be deleted from memory.\n# 3) Because of a side effect of a command that stores data on a key that may\n# already exist. For example the RENAME command may delete the old key\n# content when it is replaced with another one. Similarly SUNIONSTORE\n# or SORT with STORE option may delete existing keys. The SET command\n# itself removes any old content of the specified key in order to replace\n# it with the specified string.\n# 4) During replication, when a slave performs a full resynchronization with\n# its master, the content of the whole database is removed in order to\n# load the RDB file just transfered.\n#\n# In all the above cases the default is to delete objects in a blocking way,\n# like if DEL was called. However you can configure each case specifically\n# in order to instead release memory in a non-blocking way like if UNLINK\n# was called, using the following configuration directives:\n\nlazyfree-lazy-eviction yes\nlazyfree-lazy-expire yes\nlazyfree-lazy-server-del yes\nslave-lazy-flush yes\n\n############################## APPEND ONLY MODE ###############################\n\n# By default Redis asynchronously dumps the dataset on disk. This mode is\n# good enough in many applications, but an issue with the Redis process or\n# a power outage may result into a few minutes of writes lost (depending on\n# the configured save points).\n#\n# The Append Only File is an alternative persistence mode that provides\n# much better durability. For instance using the default data fsync policy\n# (see later in the config file) Redis can lose just one second of writes in a\n# dramatic event like a server power outage, or a single write if something\n# wrong with the Redis process itself happens, but the operating system is\n# still running correctly.\n#\n# AOF and RDB persistence can be enabled at the same time without problems.\n# If the AOF is enabled on startup Redis will load the AOF, that is the file\n# with the better durability guarantees.\n#\n# Please check http://redis.io/topics/persistence for more information.\n\nappendonly no\n\n# The name of the append only file (default: \"appendonly.aof\")\n\nappendfilename \"appendonly.aof\"\n\n# The fsync() call tells the Operating System to actually write data on disk\n# instead of waiting for more data in the output buffer. Some OS will really flush\n# data on disk, some other OS will just try to do it ASAP.\n#\n# Redis supports three different modes:\n#\n# no: don't fsync, just let the OS flush the data when it wants. Faster.\n# always: fsync after every write to the append only log. Slow, Safest.\n# everysec: fsync only one time every second. Compromise.\n#\n# The default is \"everysec\", as that's usually the right compromise between\n# speed and data safety. It's up to you to understand if you can relax this to\n# \"no\" that will let the operating system flush the output buffer when\n# it wants, for better performances (but if you can live with the idea of\n# some data loss consider the default persistence mode that's snapshotting),\n# or on the contrary, use \"always\" that's very slow but a bit safer than\n# everysec.\n#\n# More details please check the following article:\n# http://antirez.com/post/redis-persistence-demystified.html\n#\n# If unsure, use \"everysec\".\n\n# appendfsync always\nappendfsync everysec\n# appendfsync no\n\n# When the AOF fsync policy is set to always or everysec, and a background\n# saving process (a background save or AOF log background rewriting) is\n# performing a lot of I/O against the disk, in some Linux configurations\n# Redis may block too long on the fsync() call. Note that there is no fix for\n# this currently, as even performing fsync in a different thread will block\n# our synchronous write(2) call.\n#\n# In order to mitigate this problem it's possible to use the following option\n# that will prevent fsync() from being called in the main process while a\n# BGSAVE or BGREWRITEAOF is in progress.\n#\n# This means that while another child is saving, the durability of Redis is\n# the same as \"appendfsync none\". In practical terms, this means that it is\n# possible to lose up to 30 seconds of log in the worst scenario (with the\n# default Linux settings).\n#\n# If you have latency problems turn this to \"yes\". Otherwise leave it as\n# \"no\" that is the safest pick from the point of view of durability.\n\nno-appendfsync-on-rewrite no\n\n# Automatic rewrite of the append only file.\n# Redis is able to automatically rewrite the log file implicitly calling\n# BGREWRITEAOF when the AOF log size grows by the specified percentage.\n#\n# This is how it works: Redis remembers the size of the AOF file after the\n# latest rewrite (if no rewrite has happened since the restart, the size of\n# the AOF at startup is used).\n#\n# This base size is compared to the current size. If the current size is\n# bigger than the specified percentage, the rewrite is triggered. Also\n# you need to specify a minimal size for the AOF file to be rewritten, this\n# is useful to avoid rewriting the AOF file even if the percentage increase\n# is reached but it is still pretty small.\n#\n# Specify a percentage of zero in order to disable the automatic AOF\n# rewrite feature.\n\nauto-aof-rewrite-percentage 100\nauto-aof-rewrite-min-size 64mb\n\n# An AOF file may be found to be truncated at the end during the Redis\n# startup process, when the AOF data gets loaded back into memory.\n# This may happen when the system where Redis is running\n# crashes, especially when an ext4 filesystem is mounted without the\n# data=ordered option (however this can't happen when Redis itself\n# crashes or aborts but the operating system still works correctly).\n#\n# Redis can either exit with an error when this happens, or load as much\n# data as possible (the default now) and start if the AOF file is found\n# to be truncated at the end. The following option controls this behavior.\n#\n# If aof-load-truncated is set to yes, a truncated AOF file is loaded and\n# the Redis server starts emitting a log to inform the user of the event.\n# Otherwise if the option is set to no, the server aborts with an error\n# and refuses to start. When the option is set to no, the user requires\n# to fix the AOF file using the \"redis-check-aof\" utility before to restart\n# the server.\n#\n# Note that if the AOF file will be found to be corrupted in the middle\n# the server will still exit with an error. This option only applies when\n# Redis will try to read more data from the AOF file but not enough bytes\n# will be found.\naof-load-truncated yes\n\n# When rewriting the AOF file, Redis is able to use an RDB preamble in the\n# AOF file for faster rewrites and recoveries. When this option is turned\n# on the rewritten AOF file is composed of two different stanzas:\n#\n# [RDB file][AOF tail]\n#\n# When loading Redis recognizes that the AOF file starts with the \"REDIS\"\n# string and loads the prefixed RDB file, and continues loading the AOF\n# tail.\n#\n# This is currently turned off by default in order to avoid the surprise\n# of a format change, but will at some point be used as the default.\naof-use-rdb-preamble no\n\n################################ LUA SCRIPTING ###############################\n\n# Max execution time of a Lua script in milliseconds.\n#\n# If the maximum execution time is reached Redis will log that a script is\n# still in execution after the maximum allowed time and will start to\n# reply to queries with an error.\n#\n# When a long running script exceeds the maximum execution time only the\n# SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be\n# used to stop a script that did not yet called write commands. The second\n# is the only way to shut down the server in the case a write command was\n# already issued by the script but the user doesn't want to wait for the natural\n# termination of the script.\n#\n# Set it to 0 or a negative value for unlimited execution without warnings.\nlua-time-limit 5000\n\n################################ REDIS CLUSTER ###############################\n#\n# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n# WARNING EXPERIMENTAL: Redis Cluster is considered to be stable code, however\n# in order to mark it as \"mature\" we need to wait for a non trivial percentage\n# of users to deploy it in production.\n# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n#\n# Normal Redis instances can't be part of a Redis Cluster; only nodes that are\n# started as cluster nodes can. In order to start a Redis instance as a\n# cluster node enable the cluster support uncommenting the following:\n#\n# cluster-enabled yes\n\n# Every cluster node has a cluster configuration file. This file is not\n# intended to be edited by hand. It is created and updated by Redis nodes.\n# Every Redis Cluster node requires a different cluster configuration file.\n# Make sure that instances running in the same system do not have\n# overlapping cluster configuration file names.\n#\n# cluster-config-file nodes-6379.conf\n\n# Cluster node timeout is the amount of milliseconds a node must be unreachable\n# for it to be considered in failure state.\n# Most other internal time limits are multiple of the node timeout.\n#\n# cluster-node-timeout 15000\n\n# A slave of a failing master will avoid to start a failover if its data\n# looks too old.\n#\n# There is no simple way for a slave to actually have an exact measure of\n# its \"data age\", so the following two checks are performed:\n#\n# 1) If there are multiple slaves able to failover, they exchange messages\n# in order to try to give an advantage to the slave with the best\n# replication offset (more data from the master processed).\n# Slaves will try to get their rank by offset, and apply to the start\n# of the failover a delay proportional to their rank.\n#\n# 2) Every single slave computes the time of the last interaction with\n# its master. This can be the last ping or command received (if the master\n# is still in the \"connected\" state), or the time that elapsed since the\n# disconnection with the master (if the replication link is currently down).\n# If the last interaction is too old, the slave will not try to failover\n# at all.\n#\n# The point \"2\" can be tuned by user. Specifically a slave will not perform\n# the failover if, since the last interaction with the master, the time\n# elapsed is greater than:\n#\n# (node-timeout * slave-validity-factor) + repl-ping-slave-period\n#\n# So for example if node-timeout is 30 seconds, and the slave-validity-factor\n# is 10, and assuming a default repl-ping-slave-period of 10 seconds, the\n# slave will not try to failover if it was not able to talk with the master\n# for longer than 310 seconds.\n#\n# A large slave-validity-factor may allow slaves with too old data to failover\n# a master, while a too small value may prevent the cluster from being able to\n# elect a slave at all.\n#\n# For maximum availability, it is possible to set the slave-validity-factor\n# to a value of 0, which means, that slaves will always try to failover the\n# master regardless of the last time they interacted with the master.\n# (However they'll always try to apply a delay proportional to their\n# offset rank).\n#\n# Zero is the only value able to guarantee that when all the partitions heal\n# the cluster will always be able to continue.\n#\n# cluster-slave-validity-factor 10\n\n# Cluster slaves are able to migrate to orphaned masters, that are masters\n# that are left without working slaves. This improves the cluster ability\n# to resist to failures as otherwise an orphaned master can't be failed over\n# in case of failure if it has no working slaves.\n#\n# Slaves migrate to orphaned masters only if there are still at least a\n# given number of other working slaves for their old master. This number\n# is the \"migration barrier\". A migration barrier of 1 means that a slave\n# will migrate only if there is at least 1 other working slave for its master\n# and so forth. It usually reflects the number of slaves you want for every\n# master in your cluster.\n#\n# Default is 1 (slaves migrate only if their masters remain with at least\n# one slave). To disable migration just set it to a very large value.\n# A value of 0 can be set but is useful only for debugging and dangerous\n# in production.\n#\n# cluster-migration-barrier 1\n\n# By default Redis Cluster nodes stop accepting queries if they detect there\n# is at least an hash slot uncovered (no available node is serving it).\n# This way if the cluster is partially down (for example a range of hash slots\n# are no longer covered) all the cluster becomes, eventually, unavailable.\n# It automatically returns available as soon as all the slots are covered again.\n#\n# However sometimes you want the subset of the cluster which is working,\n# to continue to accept queries for the part of the key space that is still\n# covered. In order to do so, just set the cluster-require-full-coverage\n# option to no.\n#\n# cluster-require-full-coverage yes\n\n# This option, when set to yes, prevents slaves from trying to failover its\n# master during master failures. However the master can still perform a\n# manual failover, if forced to do so.\n#\n# This is useful in different scenarios, especially in the case of multiple\n# data center operations, where we want one side to never be promoted if not\n# in the case of a total DC failure.\n#\n# cluster-slave-no-failover no\n\n# In order to setup your cluster make sure to read the documentation\n# available at http://redis.io web site.\n\n########################## CLUSTER DOCKER/NAT support ########################\n\n# In certain deployments, Redis Cluster nodes address discovery fails, because\n# addresses are NAT-ted or because ports are forwarded (the typical case is\n# Docker and other containers).\n#\n# In order to make Redis Cluster working in such environments, a static\n# configuration where each node knows its public address is needed. The\n# following two options are used for this scope, and are:\n#\n# * cluster-announce-ip\n# * cluster-announce-port\n# * cluster-announce-bus-port\n#\n# Each instruct the node about its address, client port, and cluster message\n# bus port. The information is then published in the header of the bus packets\n# so that other nodes will be able to correctly map the address of the node\n# publishing the information.\n#\n# If the above options are not used, the normal Redis Cluster auto-detection\n# will be used instead.\n#\n# Note that when remapped, the bus port may not be at the fixed offset of\n# clients port + 10000, so you can specify any port and bus-port depending\n# on how they get remapped. If the bus-port is not set, a fixed offset of\n# 10000 will be used as usually.\n#\n# Example:\n#\n# cluster-announce-ip 10.1.1.5\n# cluster-announce-port 6379\n# cluster-announce-bus-port 6380\n\n################################## SLOW LOG ###################################\n\n# The Redis Slow Log is a system to log queries that exceeded a specified\n# execution time. The execution time does not include the I/O operations\n# like talking with the client, sending the reply and so forth,\n# but just the time needed to actually execute the command (this is the only\n# stage of command execution where the thread is blocked and can not serve\n# other requests in the meantime).\n#\n# You can configure the slow log with two parameters: one tells Redis\n# what is the execution time, in microseconds, to exceed in order for the\n# command to get logged, and the other parameter is the length of the\n# slow log. When a new command is logged the oldest one is removed from the\n# queue of logged commands.\n\n# The following time is expressed in microseconds, so 1000000 is equivalent\n# to one second. Note that a negative number disables the slow log, while\n# a value of zero forces the logging of every command.\nslowlog-log-slower-than 10000\n\n# There is no limit to this length. Just be aware that it will consume memory.\n# You can reclaim memory used by the slow log with SLOWLOG RESET.\nslowlog-max-len 128\n\n################################ LATENCY MONITOR ##############################\n\n# The Redis latency monitoring subsystem samples different operations\n# at runtime in order to collect data related to possible sources of\n# latency of a Redis instance.\n#\n# Via the LATENCY command this information is available to the user that can\n# print graphs and obtain reports.\n#\n# The system only logs operations that were performed in a time equal or\n# greater than the amount of milliseconds specified via the\n# latency-monitor-threshold configuration directive. When its value is set\n# to zero, the latency monitor is turned off.\n#\n# By default latency monitoring is disabled since it is mostly not needed\n# if you don't have latency issues, and collecting data has a performance\n# impact, that while very small, can be measured under big load. Latency\n# monitoring can easily be enabled at runtime using the command\n# \"CONFIG SET latency-monitor-threshold \" if needed.\nlatency-monitor-threshold 0\n\n############################# EVENT NOTIFICATION ##############################\n\n# Redis can notify Pub/Sub clients about events happening in the key space.\n# This feature is documented at http://redis.io/topics/notifications\n#\n# For instance if keyspace events notification is enabled, and a client\n# performs a DEL operation on key \"foo\" stored in the Database 0, two\n# messages will be published via Pub/Sub:\n#\n# PUBLISH __keyspace@0__:foo del\n# PUBLISH __keyevent@0__:del foo\n#\n# It is possible to select the events that Redis will notify among a set\n# of classes. Every class is identified by a single character:\n#\n# K Keyspace events, published with __keyspace@__ prefix.\n# E Keyevent events, published with __keyevent@__ prefix.\n# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ...\n# $ String commands\n# l List commands\n# s Set commands\n# h Hash commands\n# z Sorted set commands\n# x Expired events (events generated every time a key expires)\n# e Evicted events (events generated when a key is evicted for maxmemory)\n# A Alias for g$lshzxe, so that the \"AKE\" string means all the events.\n#\n# The \"notify-keyspace-events\" takes as argument a string that is composed\n# of zero or multiple characters. The empty string means that notifications\n# are disabled.\n#\n# Example: to enable list and generic events, from the point of view of the\n# event name, use:\n#\n# notify-keyspace-events Elg\n#\n# Example 2: to get the stream of the expired keys subscribing to channel\n# name __keyevent@0__:expired use:\n#\n# notify-keyspace-events Ex\n#\n# By default all notifications are disabled because most users don't need\n# this feature and the feature has some overhead. Note that if you don't\n# specify at least one of K or E, no events will be delivered.\nnotify-keyspace-events \"\"\n\n############################### ADVANCED CONFIG ###############################\n\n# Hashes are encoded using a memory efficient data structure when they have a\n# small number of entries, and the biggest entry does not exceed a given\n# threshold. These thresholds can be configured using the following directives.\nhash-max-ziplist-entries 512\nhash-max-ziplist-value 64\n\n# Lists are also encoded in a special way to save a lot of space.\n# The number of entries allowed per internal list node can be specified\n# as a fixed maximum size or a maximum number of elements.\n# For a fixed maximum size, use -5 through -1, meaning:\n# -5: max size: 64 Kb <-- not recommended for normal workloads\n# -4: max size: 32 Kb <-- not recommended\n# -3: max size: 16 Kb <-- probably not recommended\n# -2: max size: 8 Kb <-- good\n# -1: max size: 4 Kb <-- good\n# Positive numbers mean store up to _exactly_ that number of elements\n# per list node.\n# The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size),\n# but if your use case is unique, adjust the settings as necessary.\nlist-max-ziplist-size -2\n\n# Lists may also be compressed.\n# Compress depth is the number of quicklist ziplist nodes from *each* side of\n# the list to *exclude* from compression. The head and tail of the list\n# are always uncompressed for fast push/pop operations. Settings are:\n# 0: disable all list compression\n# 1: depth 1 means \"don't start compressing until after 1 node into the list,\n# going from either the head or tail\"\n# So: [head]->node->node->...->node->[tail]\n# [head], [tail] will always be uncompressed; inner nodes will compress.\n# 2: [head]->[next]->node->node->...->node->[prev]->[tail]\n# 2 here means: don't compress head or head->next or tail->prev or tail,\n# but compress all nodes between them.\n# 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail]\n# etc.\nlist-compress-depth 0\n\n# Sets have a special encoding in just one case: when a set is composed\n# of just strings that happen to be integers in radix 10 in the range\n# of 64 bit signed integers.\n# The following configuration setting sets the limit in the size of the\n# set in order to use this special memory saving encoding.\nset-max-intset-entries 512\n\n# Similarly to hashes and lists, sorted sets are also specially encoded in\n# order to save a lot of space. This encoding is only used when the length and\n# elements of a sorted set are below the following limits:\nzset-max-ziplist-entries 128\nzset-max-ziplist-value 64\n\n# HyperLogLog sparse representation bytes limit. The limit includes the\n# 16 bytes header. When an HyperLogLog using the sparse representation crosses\n# this limit, it is converted into the dense representation.\n#\n# A value greater than 16000 is totally useless, since at that point the\n# dense representation is more memory efficient.\n#\n# The suggested value is ~ 3000 in order to have the benefits of\n# the space efficient encoding without slowing down too much PFADD,\n# which is O(N) with the sparse encoding. The value can be raised to\n# ~ 10000 when CPU is not a concern, but space is, and the data set is\n# composed of many HyperLogLogs with cardinality in the 0 - 15000 range.\nhll-sparse-max-bytes 3000\n\n# Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in\n# order to help rehashing the main Redis hash table (the one mapping top-level\n# keys to values). The hash table implementation Redis uses (see dict.c)\n# performs a lazy rehashing: the more operation you run into a hash table\n# that is rehashing, the more rehashing \"steps\" are performed, so if the\n# server is idle the rehashing is never complete and some more memory is used\n# by the hash table.\n#\n# The default is to use this millisecond 10 times every second in order to\n# actively rehash the main dictionaries, freeing memory when possible.\n#\n# If unsure:\n# use \"activerehashing no\" if you have hard latency requirements and it is\n# not a good thing in your environment that Redis can reply from time to time\n# to queries with 2 milliseconds delay.\n#\n# use \"activerehashing yes\" if you don't have such hard requirements but\n# want to free memory asap when possible.\nactiverehashing yes\n\n# The client output buffer limits can be used to force disconnection of clients\n# that are not reading data from the server fast enough for some reason (a\n# common reason is that a Pub/Sub client can't consume messages as fast as the\n# publisher can produce them).\n#\n# The limit can be set differently for the three different classes of clients:\n#\n# normal -> normal clients including MONITOR clients\n# slave -> slave clients\n# pubsub -> clients subscribed to at least one pubsub channel or pattern\n#\n# The syntax of every client-output-buffer-limit directive is the following:\n#\n# client-output-buffer-limit \n#\n# A client is immediately disconnected once the hard limit is reached, or if\n# the soft limit is reached and remains reached for the specified number of\n# seconds (continuously).\n# So for instance if the hard limit is 32 megabytes and the soft limit is\n# 16 megabytes / 10 seconds, the client will get disconnected immediately\n# if the size of the output buffers reach 32 megabytes, but will also get\n# disconnected if the client reaches 16 megabytes and continuously overcomes\n# the limit for 10 seconds.\n#\n# By default normal clients are not limited because they don't receive data\n# without asking (in a push way), but just after a request, so only\n# asynchronous clients may create a scenario where data is requested faster\n# than it can read.\n#\n# Instead there is a default limit for pubsub and slave clients, since\n# subscribers and slaves receive data in a push fashion.\n#\n# Both the hard or the soft limit can be disabled by setting them to zero.\nclient-output-buffer-limit normal 0 0 0\nclient-output-buffer-limit slave 256mb 64mb 60\nclient-output-buffer-limit pubsub 32mb 8mb 60\n\n# Client query buffers accumulate new commands. They are limited to a fixed\n# amount by default in order to avoid that a protocol desynchronization (for\n# instance due to a bug in the client) will lead to unbound memory usage in\n# the query buffer. However you can configure it here if you have very special\n# needs, such us huge multi/exec requests or alike.\n#\n# client-query-buffer-limit 1gb\n\n# In the Redis protocol, bulk requests, that are, elements representing single\n# strings, are normally limited ot 512 mb. However you can change this limit\n# here.\n#\n# proto-max-bulk-len 512mb\n\n# Redis calls an internal function to perform many background tasks, like\n# closing connections of clients in timeout, purging expired keys that are\n# never requested, and so forth.\n#\n# Not all tasks are performed with the same frequency, but Redis checks for\n# tasks to perform according to the specified \"hz\" value.\n#\n# By default \"hz\" is set to 10. Raising the value will use more CPU when\n# Redis is idle, but at the same time will make Redis more responsive when\n# there are many keys expiring at the same time, and timeouts may be\n# handled with more precision.\n#\n# The range is between 1 and 500, however a value over 100 is usually not\n# a good idea. Most users should use the default of 10 and raise this up to\n# 100 only in environments where very low latency is required.\nhz 10\n\n# When a child rewrites the AOF file, if the following option is enabled\n# the file will be fsync-ed every 32 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\naof-rewrite-incremental-fsync yes\n\n# Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good\n# idea to start with the default settings and only change them after investigating\n# how to improve the performances and how the keys LFU change over time, which\n# is possible to inspect via the OBJECT FREQ command.\n#\n# There are two tunable parameters in the Redis LFU implementation: the\n# counter logarithm factor and the counter decay time. It is important to\n# understand what the two parameters mean before changing them.\n#\n# The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis\n# uses a probabilistic increment with logarithmic behavior. Given the value\n# of the old counter, when a key is accessed, the counter is incremented in\n# this way:\n#\n# 1. A random number R between 0 and 1 is extracted.\n# 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1).\n# 3. The counter is incremented only if R < P.\n#\n# The default lfu-log-factor is 10. This is a table of how the frequency\n# counter changes with a different number of accesses with different\n# logarithmic factors:\n#\n# +--------+------------+------------+------------+------------+------------+\n# | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits |\n# +--------+------------+------------+------------+------------+------------+\n# | 0 | 104 | 255 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 1 | 18 | 49 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 10 | 10 | 18 | 142 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 100 | 8 | 11 | 49 | 143 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n#\n# NOTE: The above table was obtained by running the following commands:\n#\n# redis-benchmark -n 1000000 incr foo\n# redis-cli object freq foo\n#\n# NOTE 2: The counter initial value is 5 in order to give new objects a chance\n# to accumulate hits.\n#\n# The counter decay time is the time, in minutes, that must elapse in order\n# for the key counter to be divided by two (or decremented if it has a value\n# less <= 10).\n#\n# The default value for the lfu-decay-time is 1. A Special value of 0 means to\n# decay the counter every time it happens to be scanned.\n#\n# lfu-log-factor 10\n# lfu-decay-time 1\n\n########################### ACTIVE DEFRAGMENTATION #######################\n#\n# WARNING THIS FEATURE IS EXPERIMENTAL. However it was stress tested\n# even in production and manually tested by multiple engineers for some\n# time.\n#\n# What is active defragmentation?\n# -------------------------------\n#\n# Active (online) defragmentation allows a Redis server to compact the\n# spaces left between small allocations and deallocations of data in memory,\n# thus allowing to reclaim back memory.\n#\n# Fragmentation is a natural process that happens with every allocator (but\n# less so with Jemalloc, fortunately) and certain workloads. Normally a server\n# restart is needed in order to lower the fragmentation, or at least to flush\n# away all the data and create it again. However thanks to this feature\n# implemented by Oran Agra for Redis 4.0 this process can happen at runtime\n# in an \"hot\" way, while the server is running.\n#\n# Basically when the fragmentation is over a certain level (see the\n# configuration options below) Redis will start to create new copies of the\n# values in contiguous memory regions by exploiting certain specific Jemalloc\n# features (in order to understand if an allocation is causing fragmentation\n# and to allocate it in a better place), and at the same time, will release the\n# old copies of the data. This process, repeated incrementally for all the keys\n# will cause the fragmentation to drop back to normal values.\n#\n# Important things to understand:\n#\n# 1. This feature is disabled by default, and only works if you compiled Redis\n# to use the copy of Jemalloc we ship with the source code of Redis.\n# This is the default with Linux builds.\n#\n# 2. You never need to enable this feature if you don't have fragmentation\n# issues.\n#\n# 3. Once you experience fragmentation, you can enable this feature when\n# needed with the command \"CONFIG SET activedefrag yes\".\n#\n# The configuration parameters are able to fine tune the behavior of the\n# defragmentation process. If you are not sure about what they mean it is\n# a good idea to leave the defaults untouched.\n\n# Enabled active defragmentation\n# activedefrag yes\n\n# Minimum amount of fragmentation waste to start active defrag\n# active-defrag-ignore-bytes 100mb\n\n# Minimum percentage of fragmentation to start active defrag\n# active-defrag-threshold-lower 10\n\n# Maximum percentage of fragmentation at which we use maximum effort\n# active-defrag-threshold-upper 100\n\n# Minimal effort for defrag in CPU percentage\n# active-defrag-cycle-min 25\n\n# Maximal effort for defrag in CPU percentage\n# active-defrag-cycle-max 75\n\n" }, { "path": "aegir/conf/redis/redis4.conf", "content": "# Redis configuration file example.\n#\n# Note that in order to read the configuration file, Redis must be\n# started with the file path as first argument:\n#\n# ./redis-server /path/to/redis.conf\n\n# Note on units: when memory size is needed, it is possible to specify\n# it in the usual form of 1k 5GB 4M and so forth:\n#\n# 1k => 1000 bytes\n# 1kb => 1024 bytes\n# 1m => 1000000 bytes\n# 1mb => 1024*1024 bytes\n# 1g => 1000000000 bytes\n# 1gb => 1024*1024*1024 bytes\n#\n# units are case insensitive so 1GB 1Gb 1gB are all the same.\n\n################################## INCLUDES ###################################\n\n# Include one or more other config files here. This is useful if you\n# have a standard template that goes to all Redis servers but also need\n# to customize a few per-server settings. Include files can include\n# other files, so use this wisely.\n#\n# Notice option \"include\" won't be rewritten by command \"CONFIG REWRITE\"\n# from admin or Redis Sentinel. Since Redis always uses the last processed\n# line as value of a configuration directive, you'd better put includes\n# at the beginning of this file to avoid overwriting config change at runtime.\n#\n# If instead you are interested in using includes to override configuration\n# options, it is better to use include as the last line.\n#\n# include /path/to/local.conf\n# include /path/to/other.conf\n\n################################## MODULES #####################################\n\n# Load modules at startup. If the server is not able to load modules\n# it will abort. It is possible to use multiple loadmodule directives.\n#\n# loadmodule /path/to/my_module.so\n# loadmodule /path/to/other_module.so\n\n################################## NETWORK #####################################\n\n# By default, if no \"bind\" configuration directive is specified, Redis listens\n# for connections from all the network interfaces available on the server.\n# It is possible to listen to just one or multiple selected interfaces using\n# the \"bind\" configuration directive, followed by one or more IP addresses.\n#\n# Examples:\n#\n# xbind 192.168.1.100 10.0.0.1\n# xbind 127.0.0.1 ::1\n#\n# ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the\n# internet, binding to all the interfaces is dangerous and will expose the\n# instance to everybody on the internet. So by default we uncomment the\n# following bind directive, that will force Redis to listen only into\n# the IPv4 lookback interface address (this means Redis will be able to\n# accept connections only from clients running into the same computer it\n# is running).\n#\n# IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES\n# JUST COMMENT THE FOLLOWING LINE.\n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nbind 127.0.0.1\n\n# Protected mode is a layer of security protection, in order to avoid that\n# Redis instances left open on the internet are accessed and exploited.\n#\n# When protected mode is on and if:\n#\n# 1) The server is not binding explicitly to a set of addresses using the\n# \"bind\" directive.\n# 2) No password is configured.\n#\n# The server only accepts connections from clients connecting from the\n# IPv4 and IPv6 loopback addresses 127.0.0.1 and ::1, and from Unix domain\n# sockets.\n#\n# By default protected mode is enabled. You should disable it only if\n# you are sure you want clients from other hosts to connect to Redis\n# even if no authentication is configured, nor a specific set of interfaces\n# are explicitly listed using the \"bind\" directive.\nprotected-mode no\n\n# Accept connections on the specified port, default is 6379 (IANA #815344).\n# If port 0 is specified Redis will not listen on a TCP socket.\nport 6379\n\n# TCP listen() backlog.\n#\n# In high requests-per-second environments you need an high backlog in order\n# to avoid slow clients connections issues. Note that the Linux kernel\n# will silently truncate it to the value of /proc/sys/net/core/somaxconn so\n# make sure to raise both the value of somaxconn and tcp_max_syn_backlog\n# in order to get the desired effect.\ntcp-backlog 511\n\n# Unix socket.\n#\n# Specify the path for the Unix socket that will be used to listen for\n# incoming connections. There is no default, so Redis will not listen\n# on a unix socket when not specified.\n#\n# unixsocket /run/redis/redis.sock\n# unixsocketperm 777\n\n# Close the connection after a client is idle for N seconds (0 to disable)\ntimeout 3600\n\n# TCP keepalive.\n#\n# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence\n# of communication. This is useful for two reasons:\n#\n# 1) Detect dead peers.\n# 2) Take the connection alive from the point of view of network\n# equipment in the middle.\n#\n# On Linux, the specified value (in seconds) is the period used to send ACKs.\n# Note that to close the connection the double of the time is needed.\n# On other kernels the period depends on the kernel configuration.\n#\n# A reasonable value for this option is 300 seconds, which is the new\n# Redis default starting with Redis 3.2.1.\ntcp-keepalive 300\n\n################################# GENERAL #####################################\n\n# By default Redis does not run as a daemon. Use 'yes' if you need it.\n# Note that Redis will write a pid file in /run/redis.pid when daemonized.\ndaemonize yes\n\n# If you run Redis from upstart or systemd, Redis can interact with your\n# supervision tree. Options:\n# supervised no - no supervision interaction\n# supervised upstart - signal upstart by putting Redis into SIGSTOP mode\n# supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET\n# supervised auto - detect upstart or systemd method based on\n# UPSTART_JOB or NOTIFY_SOCKET environment variables\n# Note: these supervision methods only signal \"process is ready.\"\n# They do not enable continuous liveness pings back to your supervisor.\nsupervised no\n\n# If a pid file is specified, Redis writes it where specified at startup\n# and removes it at exit.\n#\n# When the server runs non daemonized, no pid file is created if none is\n# specified in the configuration. When the server is daemonized, the pid file\n# is used even if not specified, defaulting to \"/run/redis.pid\".\n#\n# Creating a pid file is best effort: if Redis is not able to create it\n# nothing bad happens, the server will start and run normally.\npidfile /run/redis/redis.pid\n\n# Specify the server verbosity level.\n# This can be one of:\n# debug (a lot of information, useful for development/testing)\n# verbose (many rarely useful info, but not a mess like the debug level)\n# notice (moderately verbose, what you want in production probably)\n# warning (only very important / critical messages are logged)\nloglevel warning\n\n# Specify the log file name. Also the empty string can be used to force\n# Redis to log on the standard output. Note that if you use standard\n# output for logging but daemonize, logs will be sent to /dev/null\nlogfile /var/log/redis/redis-server.log\n\n# To enable logging to the system logger, just set 'syslog-enabled' to yes,\n# and optionally update the other syslog parameters to suit your needs.\n# syslog-enabled no\n\n# Specify the syslog identity.\n# syslog-ident redis\n\n# Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.\n# syslog-facility local0\n\n# Set the number of databases. The default database is DB 0, you can select\n# a different one on a per-connection basis using SELECT where\n# dbid is a number between 0 and 'databases'-1\ndatabases 8\n\n# By default Redis shows an ASCII art logo only when started to log to the\n# standard output and if the standard output is a TTY. Basically this means\n# that normally a logo is displayed only in interactive sessions.\n#\n# However it is possible to force the pre-4.0 behavior and always show a\n# ASCII art logo in startup logs by setting the following option to yes.\nalways-show-logo yes\n\n################################ SNAPSHOTTING ################################\n#\n# Save the DB on disk:\n#\n# save \n#\n# Will save the DB if both the given number of seconds and the given\n# number of write operations against the DB occurred.\n#\n# In the example below the behaviour will be to save:\n# after 900 sec (15 min) if at least 1 key changed\n# after 300 sec (5 min) if at least 10 keys changed\n# after 60 sec if at least 10000 keys changed\n#\n# Note: you can disable saving completely by commenting out all \"save\" lines.\n#\n# It is also possible to remove all the previously configured save\n# points by adding a save directive with a single empty string argument\n# like in the following example:\n#\n# save \"\"\n\n# save 900 1\n# save 300 10\n# save 60 10000\n\n# By default Redis will stop accepting writes if RDB snapshots are enabled\n# (at least one save point) and the latest background save failed.\n# This will make the user aware (in a hard way) that data is not persisting\n# on disk properly, otherwise chances are that no one will notice and some\n# disaster will happen.\n#\n# If the background saving process will start working again Redis will\n# automatically allow writes again.\n#\n# However if you have setup your proper monitoring of the Redis server\n# and persistence, you may want to disable this feature so that Redis will\n# continue to work as usual even if there are problems with disk,\n# permissions, and so forth.\nstop-writes-on-bgsave-error no\n\n# Compress string objects using LZF when dump .rdb databases?\n# For default that's set to 'yes' as it's almost always a win.\n# If you want to save some CPU in the saving child set it to 'no' but\n# the dataset will likely be bigger if you have compressible values or keys.\nrdbcompression yes\n\n# Since version 5 of RDB a CRC64 checksum is placed at the end of the file.\n# This makes the format more resistant to corruption but there is a performance\n# hit to pay (around 10%) when saving and loading RDB files, so you can disable it\n# for maximum performances.\n#\n# RDB files created with checksum disabled have a checksum of zero that will\n# tell the loading code to skip the check.\nrdbchecksum no\n\n# The filename where to dump the DB\ndbfilename dump.rdb\n\n# The working directory.\n#\n# The DB will be written inside this directory, with the filename specified\n# above using the 'dbfilename' configuration directive.\n#\n# The Append Only File will also be created inside this directory.\n#\n# Note that you must specify a directory here, not a file name.\ndir /var/lib/redis/\n\n################################# REPLICATION #################################\n\n# Master-Slave replication. Use slaveof to make a Redis instance a copy of\n# another Redis server. A few things to understand ASAP about Redis replication.\n#\n# 1) Redis replication is asynchronous, but you can configure a master to\n# stop accepting writes if it appears to be not connected with at least\n# a given number of slaves.\n# 2) Redis slaves are able to perform a partial resynchronization with the\n# master if the replication link is lost for a relatively small amount of\n# time. You may want to configure the replication backlog size (see the next\n# sections of this file) with a sensible value depending on your needs.\n# 3) Replication is automatic and does not need user intervention. After a\n# network partition slaves automatically try to reconnect to masters\n# and resynchronize with them.\n#\n# slaveof \n\n# If the master is password protected (using the \"requirepass\" configuration\n# directive below) it is possible to tell the slave to authenticate before\n# starting the replication synchronization process, otherwise the master will\n# refuse the slave request.\n#\n# masterauth \n\n# When a slave loses its connection with the master, or when the replication\n# is still in progress, the slave can act in two different ways:\n#\n# 1) if slave-serve-stale-data is set to 'yes' (the default) the slave will\n# still reply to client requests, possibly with out of date data, or the\n# data set may just be empty if this is the first synchronization.\n#\n# 2) if slave-serve-stale-data is set to 'no' the slave will reply with\n# an error \"SYNC with master in progress\" to all the kind of commands\n# but to INFO and SLAVEOF.\n#\nslave-serve-stale-data yes\n\n# You can configure a slave instance to accept writes or not. Writing against\n# a slave instance may be useful to store some ephemeral data (because data\n# written on a slave will be easily deleted after resync with the master) but\n# may also cause problems if clients are writing to it because of a\n# misconfiguration.\n#\n# Since Redis 2.6 by default slaves are read-only.\n#\n# Note: read only slaves are not designed to be exposed to untrusted clients\n# on the internet. It's just a protection layer against misuse of the instance.\n# Still a read only slave exports by default all the administrative commands\n# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve\n# security of read only slaves using 'rename-command' to shadow all the\n# administrative / dangerous commands.\nslave-read-only yes\n\n# Replication SYNC strategy: disk or socket.\n#\n# -------------------------------------------------------\n# WARNING: DISKLESS REPLICATION IS EXPERIMENTAL CURRENTLY\n# -------------------------------------------------------\n#\n# New slaves and reconnecting slaves that are not able to continue the replication\n# process just receiving differences, need to do what is called a \"full\n# synchronization\". An RDB file is transmitted from the master to the slaves.\n# The transmission can happen in two different ways:\n#\n# 1) Disk-backed: The Redis master creates a new process that writes the RDB\n# file on disk. Later the file is transferred by the parent\n# process to the slaves incrementally.\n# 2) Diskless: The Redis master creates a new process that directly writes the\n# RDB file to slave sockets, without touching the disk at all.\n#\n# With disk-backed replication, while the RDB file is generated, more slaves\n# can be queued and served with the RDB file as soon as the current child producing\n# the RDB file finishes its work. With diskless replication instead once\n# the transfer starts, new slaves arriving will be queued and a new transfer\n# will start when the current one terminates.\n#\n# When diskless replication is used, the master waits a configurable amount of\n# time (in seconds) before starting the transfer in the hope that multiple slaves\n# will arrive and the transfer can be parallelized.\n#\n# With slow disks and fast (large bandwidth) networks, diskless replication\n# works better.\nrepl-diskless-sync no\n\n# When diskless replication is enabled, it is possible to configure the delay\n# the server waits in order to spawn the child that transfers the RDB via socket\n# to the slaves.\n#\n# This is important since once the transfer starts, it is not possible to serve\n# new slaves arriving, that will be queued for the next RDB transfer, so the server\n# waits a delay in order to let more slaves arrive.\n#\n# The delay is specified in seconds, and by default is 5 seconds. To disable\n# it entirely just set it to 0 seconds and the transfer will start ASAP.\nrepl-diskless-sync-delay 5\n\n# Slaves send PINGs to server in a predefined interval. It's possible to change\n# this interval with the repl_ping_slave_period option. The default value is 10\n# seconds.\n#\n# repl-ping-slave-period 10\n\n# The following option sets the replication timeout for:\n#\n# 1) Bulk transfer I/O during SYNC, from the point of view of slave.\n# 2) Master timeout from the point of view of slaves (data, pings).\n# 3) Slave timeout from the point of view of masters (REPLCONF ACK pings).\n#\n# It is important to make sure that this value is greater than the value\n# specified for repl-ping-slave-period otherwise a timeout will be detected\n# every time there is low traffic between the master and the slave.\n#\n# repl-timeout 60\n\n# Disable TCP_NODELAY on the slave socket after SYNC?\n#\n# If you select \"yes\" Redis will use a smaller number of TCP packets and\n# less bandwidth to send data to slaves. But this can add a delay for\n# the data to appear on the slave side, up to 40 milliseconds with\n# Linux kernels using a default configuration.\n#\n# If you select \"no\" the delay for data to appear on the slave side will\n# be reduced but more bandwidth will be used for replication.\n#\n# By default we optimize for low latency, but in very high traffic conditions\n# or when the master and slaves are many hops away, turning this to \"yes\" may\n# be a good idea.\nrepl-disable-tcp-nodelay no\n\n# Set the replication backlog size. The backlog is a buffer that accumulates\n# slave data when slaves are disconnected for some time, so that when a slave\n# wants to reconnect again, often a full resync is not needed, but a partial\n# resync is enough, just passing the portion of data the slave missed while\n# disconnected.\n#\n# The bigger the replication backlog, the longer the time the slave can be\n# disconnected and later be able to perform a partial resynchronization.\n#\n# The backlog is only allocated once there is at least a slave connected.\n#\n# repl-backlog-size 1mb\n\n# After a master has no longer connected slaves for some time, the backlog\n# will be freed. The following option configures the amount of seconds that\n# need to elapse, starting from the time the last slave disconnected, for\n# the backlog buffer to be freed.\n#\n# Note that slaves never free the backlog for timeout, since they may be\n# promoted to masters later, and should be able to correctly \"partially\n# resynchronize\" with the slaves: hence they should always accumulate backlog.\n#\n# A value of 0 means to never release the backlog.\n#\n# repl-backlog-ttl 3600\n\n# The slave priority is an integer number published by Redis in the INFO output.\n# It is used by Redis Sentinel in order to select a slave to promote into a\n# master if the master is no longer working correctly.\n#\n# A slave with a low priority number is considered better for promotion, so\n# for instance if there are three slaves with priority 10, 100, 25 Sentinel will\n# pick the one with priority 10, that is the lowest.\n#\n# However a special priority of 0 marks the slave as not able to perform the\n# role of master, so a slave with priority of 0 will never be selected by\n# Redis Sentinel for promotion.\n#\n# By default the priority is 100.\nslave-priority 100\n\n# It is possible for a master to stop accepting writes if there are less than\n# N slaves connected, having a lag less or equal than M seconds.\n#\n# The N slaves need to be in \"online\" state.\n#\n# The lag in seconds, that must be <= the specified value, is calculated from\n# the last ping received from the slave, that is usually sent every second.\n#\n# This option does not GUARANTEE that N replicas will accept the write, but\n# will limit the window of exposure for lost writes in case not enough slaves\n# are available, to the specified number of seconds.\n#\n# For example to require at least 3 slaves with a lag <= 10 seconds use:\n#\n# min-slaves-to-write 3\n# min-slaves-max-lag 10\n#\n# Setting one or the other to 0 disables the feature.\n#\n# By default min-slaves-to-write is set to 0 (feature disabled) and\n# min-slaves-max-lag is set to 10.\n\n# A Redis master is able to list the address and port of the attached\n# slaves in different ways. For example the \"INFO replication\" section\n# offers this information, which is used, among other tools, by\n# Redis Sentinel in order to discover slave instances.\n# Another place where this info is available is in the output of the\n# \"ROLE\" command of a master.\n#\n# The listed IP and address normally reported by a slave is obtained\n# in the following way:\n#\n# IP: The address is auto detected by checking the peer address\n# of the socket used by the slave to connect with the master.\n#\n# Port: The port is communicated by the slave during the replication\n# handshake, and is normally the port that the slave is using to\n# list for connections.\n#\n# However when port forwarding or Network Address Translation (NAT) is\n# used, the slave may be actually reachable via different IP and port\n# pairs. The following two options can be used by a slave in order to\n# report to its master a specific set of IP and port, so that both INFO\n# and ROLE will report those values.\n#\n# There is no need to use both the options if you need to override just\n# the port or the IP address.\n#\n# slave-announce-ip 5.5.5.5\n# slave-announce-port 1234\n\n################################## SECURITY ###################################\n\n# Require clients to issue AUTH before processing any other\n# commands. This might be useful in environments in which you do not trust\n# others with access to the host running redis-server.\n#\n# This should stay commented out for backward compatibility and because most\n# people do not need auth (e.g. they run their own servers).\n#\n# Warning: since Redis is pretty fast an outside user can try up to\n# 150k passwords per second against a good box. This means that you should\n# use a very strong password otherwise it will be very easy to break.\n#\n# requirepass isfoobared\n\n# Command renaming.\n#\n# It is possible to change the name of dangerous commands in a shared\n# environment. For instance the CONFIG command may be renamed into something\n# hard to guess so that it will still be available for internal-use tools\n# but not available for general clients.\n#\n# Example:\n#\n# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52\n#\n# It is also possible to completely kill a command by renaming it into\n# an empty string:\n#\n# rename-command CONFIG \"\"\n#\n# Please note that changing the name of commands that are logged into the\n# AOF file or transmitted to slaves may cause problems.\n\n################################### CLIENTS ####################################\n\n# Set the max number of connected clients at the same time. By default\n# this limit is set to 10000 clients, however if the Redis server is not\n# able to configure the process file limit to allow for the specified limit\n# the max number of allowed clients is set to the current file limit\n# minus 32 (as Redis reserves a few file descriptors for internal uses).\n#\n# Once the limit is reached Redis will close all the new connections sending\n# an error 'max number of clients reached'.\n#\nmaxclients 4000\n\n############################## MEMORY MANAGEMENT ################################\n\n# Set a memory usage limit to the specified amount of bytes.\n# When the memory limit is reached Redis will try to remove keys\n# according to the eviction policy selected (see maxmemory-policy).\n#\n# If Redis can't remove keys according to the policy, or if the policy is\n# set to 'noeviction', Redis will start to reply with errors to commands\n# that would use more memory, like SET, LPUSH, and so on, and will continue\n# to reply to read-only commands like GET.\n#\n# This option is usually useful when using Redis as an LRU or LFU cache, or to\n# set a hard memory limit for an instance (using the 'noeviction' policy).\n#\n# WARNING: If you have slaves attached to an instance with maxmemory on,\n# the size of the output buffers needed to feed the slaves are subtracted\n# from the used memory count, so that network problems / resyncs will\n# not trigger a loop where keys are evicted, and in turn the output\n# buffer of slaves is full with DELs of keys evicted triggering the deletion\n# of more keys, and so forth until the database is completely emptied.\n#\n# In short... if you have slaves attached it is suggested that you set a lower\n# limit for maxmemory so that there is some free RAM on the system for slave\n# output buffers (but this is not needed if the policy is 'noeviction').\n#\nmaxmemory 88MB\n\n# MAXMEMORY POLICY: how Redis will select what to remove when maxmemory\n# is reached. You can select among five behaviors:\n#\n# volatile-lru -> Evict using approximated LRU among the keys with an expire set.\n# allkeys-lru -> Evict any key using approximated LRU.\n# volatile-lfu -> Evict using approximated LFU among the keys with an expire set.\n# allkeys-lfu -> Evict any key using approximated LFU.\n# volatile-random -> Remove a random key among the ones with an expire set.\n# allkeys-random -> Remove a random key, any key.\n# volatile-ttl -> Remove the key with the nearest expire time (minor TTL)\n# noeviction -> Don't evict anything, just return an error on write operations.\n#\n# LRU means Least Recently Used\n# LFU means Least Frequently Used\n#\n# Both LRU, LFU and volatile-ttl are implemented using approximated\n# randomized algorithms.\n#\n# Note: with any of the above policies, Redis will return an error on write\n# operations, when there are no suitable keys for eviction.\n#\n# At the date of writing these commands are: set setnx setex append\n# incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd\n# sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby\n# zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby\n# getset mset msetnx exec sort\n#\n# The default is: noeviction\n#\nmaxmemory-policy allkeys-lru\n\n# LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated\n# algorithms (in order to save memory), so you can tune it for speed or\n# accuracy. For default Redis will check five keys and pick the one that was\n# used less recently, you can change the sample size using the following\n# configuration directive.\n#\n# The default of 5 produces good enough results. 10 Approximates very closely\n# true LRU but costs more CPU. 3 is faster but not very accurate.\n#\n# maxmemory-samples 5\n\n############################# LAZY FREEING ####################################\n\n# Redis has two primitives to delete keys. One is called DEL and is a blocking\n# deletion of the object. It means that the server stops processing new commands\n# in order to reclaim all the memory associated with an object in a synchronous\n# way. If the key deleted is associated with a small object, the time needed\n# in order to execute the DEL command is very small and comparable to most other\n# O(1) or O(log_N) commands in Redis. However if the key is associated with an\n# aggregated value containing millions of elements, the server can block for\n# a long time (even seconds) in order to complete the operation.\n#\n# For the above reasons Redis also offers non blocking deletion primitives\n# such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and\n# FLUSHDB commands, in order to reclaim memory in background. Those commands\n# are executed in constant time. Another thread will incrementally free the\n# object in the background as fast as possible.\n#\n# DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled.\n# It's up to the design of the application to understand when it is a good\n# idea to use one or the other. However the Redis server sometimes has to\n# delete keys or flush the whole database as a side effect of other operations.\n# Specifically Redis deletes objects independently of a user call in the\n# following scenarios:\n#\n# 1) On eviction, because of the maxmemory and maxmemory policy configurations,\n# in order to make room for new data, without going over the specified\n# memory limit.\n# 2) Because of expire: when a key with an associated time to live (see the\n# EXPIRE command) must be deleted from memory.\n# 3) Because of a side effect of a command that stores data on a key that may\n# already exist. For example the RENAME command may delete the old key\n# content when it is replaced with another one. Similarly SUNIONSTORE\n# or SORT with STORE option may delete existing keys. The SET command\n# itself removes any old content of the specified key in order to replace\n# it with the specified string.\n# 4) During replication, when a slave performs a full resynchronization with\n# its master, the content of the whole database is removed in order to\n# load the RDB file just transfered.\n#\n# In all the above cases the default is to delete objects in a blocking way,\n# like if DEL was called. However you can configure each case specifically\n# in order to instead release memory in a non-blocking way like if UNLINK\n# was called, using the following configuration directives:\n\nlazyfree-lazy-eviction yes\nlazyfree-lazy-expire yes\nlazyfree-lazy-server-del yes\nslave-lazy-flush yes\n\n############################## APPEND ONLY MODE ###############################\n\n# By default Redis asynchronously dumps the dataset on disk. This mode is\n# good enough in many applications, but an issue with the Redis process or\n# a power outage may result into a few minutes of writes lost (depending on\n# the configured save points).\n#\n# The Append Only File is an alternative persistence mode that provides\n# much better durability. For instance using the default data fsync policy\n# (see later in the config file) Redis can lose just one second of writes in a\n# dramatic event like a server power outage, or a single write if something\n# wrong with the Redis process itself happens, but the operating system is\n# still running correctly.\n#\n# AOF and RDB persistence can be enabled at the same time without problems.\n# If the AOF is enabled on startup Redis will load the AOF, that is the file\n# with the better durability guarantees.\n#\n# Please check http://redis.io/topics/persistence for more information.\n\nappendonly no\n\n# The name of the append only file (default: \"appendonly.aof\")\n\nappendfilename \"appendonly.aof\"\n\n# The fsync() call tells the Operating System to actually write data on disk\n# instead of waiting for more data in the output buffer. Some OS will really flush\n# data on disk, some other OS will just try to do it ASAP.\n#\n# Redis supports three different modes:\n#\n# no: don't fsync, just let the OS flush the data when it wants. Faster.\n# always: fsync after every write to the append only log. Slow, Safest.\n# everysec: fsync only one time every second. Compromise.\n#\n# The default is \"everysec\", as that's usually the right compromise between\n# speed and data safety. It's up to you to understand if you can relax this to\n# \"no\" that will let the operating system flush the output buffer when\n# it wants, for better performances (but if you can live with the idea of\n# some data loss consider the default persistence mode that's snapshotting),\n# or on the contrary, use \"always\" that's very slow but a bit safer than\n# everysec.\n#\n# More details please check the following article:\n# http://antirez.com/post/redis-persistence-demystified.html\n#\n# If unsure, use \"everysec\".\n\n# appendfsync always\nappendfsync everysec\n# appendfsync no\n\n# When the AOF fsync policy is set to always or everysec, and a background\n# saving process (a background save or AOF log background rewriting) is\n# performing a lot of I/O against the disk, in some Linux configurations\n# Redis may block too long on the fsync() call. Note that there is no fix for\n# this currently, as even performing fsync in a different thread will block\n# our synchronous write(2) call.\n#\n# In order to mitigate this problem it's possible to use the following option\n# that will prevent fsync() from being called in the main process while a\n# BGSAVE or BGREWRITEAOF is in progress.\n#\n# This means that while another child is saving, the durability of Redis is\n# the same as \"appendfsync none\". In practical terms, this means that it is\n# possible to lose up to 30 seconds of log in the worst scenario (with the\n# default Linux settings).\n#\n# If you have latency problems turn this to \"yes\". Otherwise leave it as\n# \"no\" that is the safest pick from the point of view of durability.\n\nno-appendfsync-on-rewrite no\n\n# Automatic rewrite of the append only file.\n# Redis is able to automatically rewrite the log file implicitly calling\n# BGREWRITEAOF when the AOF log size grows by the specified percentage.\n#\n# This is how it works: Redis remembers the size of the AOF file after the\n# latest rewrite (if no rewrite has happened since the restart, the size of\n# the AOF at startup is used).\n#\n# This base size is compared to the current size. If the current size is\n# bigger than the specified percentage, the rewrite is triggered. Also\n# you need to specify a minimal size for the AOF file to be rewritten, this\n# is useful to avoid rewriting the AOF file even if the percentage increase\n# is reached but it is still pretty small.\n#\n# Specify a percentage of zero in order to disable the automatic AOF\n# rewrite feature.\n\nauto-aof-rewrite-percentage 100\nauto-aof-rewrite-min-size 64mb\n\n# An AOF file may be found to be truncated at the end during the Redis\n# startup process, when the AOF data gets loaded back into memory.\n# This may happen when the system where Redis is running\n# crashes, especially when an ext4 filesystem is mounted without the\n# data=ordered option (however this can't happen when Redis itself\n# crashes or aborts but the operating system still works correctly).\n#\n# Redis can either exit with an error when this happens, or load as much\n# data as possible (the default now) and start if the AOF file is found\n# to be truncated at the end. The following option controls this behavior.\n#\n# If aof-load-truncated is set to yes, a truncated AOF file is loaded and\n# the Redis server starts emitting a log to inform the user of the event.\n# Otherwise if the option is set to no, the server aborts with an error\n# and refuses to start. When the option is set to no, the user requires\n# to fix the AOF file using the \"redis-check-aof\" utility before to restart\n# the server.\n#\n# Note that if the AOF file will be found to be corrupted in the middle\n# the server will still exit with an error. This option only applies when\n# Redis will try to read more data from the AOF file but not enough bytes\n# will be found.\naof-load-truncated yes\n\n# When rewriting the AOF file, Redis is able to use an RDB preamble in the\n# AOF file for faster rewrites and recoveries. When this option is turned\n# on the rewritten AOF file is composed of two different stanzas:\n#\n# [RDB file][AOF tail]\n#\n# When loading Redis recognizes that the AOF file starts with the \"REDIS\"\n# string and loads the prefixed RDB file, and continues loading the AOF\n# tail.\n#\n# This is currently turned off by default in order to avoid the surprise\n# of a format change, but will at some point be used as the default.\naof-use-rdb-preamble no\n\n################################ LUA SCRIPTING ###############################\n\n# Max execution time of a Lua script in milliseconds.\n#\n# If the maximum execution time is reached Redis will log that a script is\n# still in execution after the maximum allowed time and will start to\n# reply to queries with an error.\n#\n# When a long running script exceeds the maximum execution time only the\n# SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be\n# used to stop a script that did not yet called write commands. The second\n# is the only way to shut down the server in the case a write command was\n# already issued by the script but the user doesn't want to wait for the natural\n# termination of the script.\n#\n# Set it to 0 or a negative value for unlimited execution without warnings.\nlua-time-limit 5000\n\n################################ REDIS CLUSTER ###############################\n#\n# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n# WARNING EXPERIMENTAL: Redis Cluster is considered to be stable code, however\n# in order to mark it as \"mature\" we need to wait for a non trivial percentage\n# of users to deploy it in production.\n# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n#\n# Normal Redis instances can't be part of a Redis Cluster; only nodes that are\n# started as cluster nodes can. In order to start a Redis instance as a\n# cluster node enable the cluster support uncommenting the following:\n#\n# cluster-enabled yes\n\n# Every cluster node has a cluster configuration file. This file is not\n# intended to be edited by hand. It is created and updated by Redis nodes.\n# Every Redis Cluster node requires a different cluster configuration file.\n# Make sure that instances running in the same system do not have\n# overlapping cluster configuration file names.\n#\n# cluster-config-file nodes-6379.conf\n\n# Cluster node timeout is the amount of milliseconds a node must be unreachable\n# for it to be considered in failure state.\n# Most other internal time limits are multiple of the node timeout.\n#\n# cluster-node-timeout 15000\n\n# A slave of a failing master will avoid to start a failover if its data\n# looks too old.\n#\n# There is no simple way for a slave to actually have an exact measure of\n# its \"data age\", so the following two checks are performed:\n#\n# 1) If there are multiple slaves able to failover, they exchange messages\n# in order to try to give an advantage to the slave with the best\n# replication offset (more data from the master processed).\n# Slaves will try to get their rank by offset, and apply to the start\n# of the failover a delay proportional to their rank.\n#\n# 2) Every single slave computes the time of the last interaction with\n# its master. This can be the last ping or command received (if the master\n# is still in the \"connected\" state), or the time that elapsed since the\n# disconnection with the master (if the replication link is currently down).\n# If the last interaction is too old, the slave will not try to failover\n# at all.\n#\n# The point \"2\" can be tuned by user. Specifically a slave will not perform\n# the failover if, since the last interaction with the master, the time\n# elapsed is greater than:\n#\n# (node-timeout * slave-validity-factor) + repl-ping-slave-period\n#\n# So for example if node-timeout is 30 seconds, and the slave-validity-factor\n# is 10, and assuming a default repl-ping-slave-period of 10 seconds, the\n# slave will not try to failover if it was not able to talk with the master\n# for longer than 310 seconds.\n#\n# A large slave-validity-factor may allow slaves with too old data to failover\n# a master, while a too small value may prevent the cluster from being able to\n# elect a slave at all.\n#\n# For maximum availability, it is possible to set the slave-validity-factor\n# to a value of 0, which means, that slaves will always try to failover the\n# master regardless of the last time they interacted with the master.\n# (However they'll always try to apply a delay proportional to their\n# offset rank).\n#\n# Zero is the only value able to guarantee that when all the partitions heal\n# the cluster will always be able to continue.\n#\n# cluster-slave-validity-factor 10\n\n# Cluster slaves are able to migrate to orphaned masters, that are masters\n# that are left without working slaves. This improves the cluster ability\n# to resist to failures as otherwise an orphaned master can't be failed over\n# in case of failure if it has no working slaves.\n#\n# Slaves migrate to orphaned masters only if there are still at least a\n# given number of other working slaves for their old master. This number\n# is the \"migration barrier\". A migration barrier of 1 means that a slave\n# will migrate only if there is at least 1 other working slave for its master\n# and so forth. It usually reflects the number of slaves you want for every\n# master in your cluster.\n#\n# Default is 1 (slaves migrate only if their masters remain with at least\n# one slave). To disable migration just set it to a very large value.\n# A value of 0 can be set but is useful only for debugging and dangerous\n# in production.\n#\n# cluster-migration-barrier 1\n\n# By default Redis Cluster nodes stop accepting queries if they detect there\n# is at least an hash slot uncovered (no available node is serving it).\n# This way if the cluster is partially down (for example a range of hash slots\n# are no longer covered) all the cluster becomes, eventually, unavailable.\n# It automatically returns available as soon as all the slots are covered again.\n#\n# However sometimes you want the subset of the cluster which is working,\n# to continue to accept queries for the part of the key space that is still\n# covered. In order to do so, just set the cluster-require-full-coverage\n# option to no.\n#\n# cluster-require-full-coverage yes\n\n# This option, when set to yes, prevents slaves from trying to failover its\n# master during master failures. However the master can still perform a\n# manual failover, if forced to do so.\n#\n# This is useful in different scenarios, especially in the case of multiple\n# data center operations, where we want one side to never be promoted if not\n# in the case of a total DC failure.\n#\n# cluster-slave-no-failover no\n\n# In order to setup your cluster make sure to read the documentation\n# available at http://redis.io web site.\n\n########################## CLUSTER DOCKER/NAT support ########################\n\n# In certain deployments, Redis Cluster nodes address discovery fails, because\n# addresses are NAT-ted or because ports are forwarded (the typical case is\n# Docker and other containers).\n#\n# In order to make Redis Cluster working in such environments, a static\n# configuration where each node knows its public address is needed. The\n# following two options are used for this scope, and are:\n#\n# * cluster-announce-ip\n# * cluster-announce-port\n# * cluster-announce-bus-port\n#\n# Each instruct the node about its address, client port, and cluster message\n# bus port. The information is then published in the header of the bus packets\n# so that other nodes will be able to correctly map the address of the node\n# publishing the information.\n#\n# If the above options are not used, the normal Redis Cluster auto-detection\n# will be used instead.\n#\n# Note that when remapped, the bus port may not be at the fixed offset of\n# clients port + 10000, so you can specify any port and bus-port depending\n# on how they get remapped. If the bus-port is not set, a fixed offset of\n# 10000 will be used as usually.\n#\n# Example:\n#\n# cluster-announce-ip 10.1.1.5\n# cluster-announce-port 6379\n# cluster-announce-bus-port 6380\n\n################################## SLOW LOG ###################################\n\n# The Redis Slow Log is a system to log queries that exceeded a specified\n# execution time. The execution time does not include the I/O operations\n# like talking with the client, sending the reply and so forth,\n# but just the time needed to actually execute the command (this is the only\n# stage of command execution where the thread is blocked and can not serve\n# other requests in the meantime).\n#\n# You can configure the slow log with two parameters: one tells Redis\n# what is the execution time, in microseconds, to exceed in order for the\n# command to get logged, and the other parameter is the length of the\n# slow log. When a new command is logged the oldest one is removed from the\n# queue of logged commands.\n\n# The following time is expressed in microseconds, so 1000000 is equivalent\n# to one second. Note that a negative number disables the slow log, while\n# a value of zero forces the logging of every command.\nslowlog-log-slower-than 10000\n\n# There is no limit to this length. Just be aware that it will consume memory.\n# You can reclaim memory used by the slow log with SLOWLOG RESET.\nslowlog-max-len 128\n\n################################ LATENCY MONITOR ##############################\n\n# The Redis latency monitoring subsystem samples different operations\n# at runtime in order to collect data related to possible sources of\n# latency of a Redis instance.\n#\n# Via the LATENCY command this information is available to the user that can\n# print graphs and obtain reports.\n#\n# The system only logs operations that were performed in a time equal or\n# greater than the amount of milliseconds specified via the\n# latency-monitor-threshold configuration directive. When its value is set\n# to zero, the latency monitor is turned off.\n#\n# By default latency monitoring is disabled since it is mostly not needed\n# if you don't have latency issues, and collecting data has a performance\n# impact, that while very small, can be measured under big load. Latency\n# monitoring can easily be enabled at runtime using the command\n# \"CONFIG SET latency-monitor-threshold \" if needed.\nlatency-monitor-threshold 0\n\n############################# EVENT NOTIFICATION ##############################\n\n# Redis can notify Pub/Sub clients about events happening in the key space.\n# This feature is documented at http://redis.io/topics/notifications\n#\n# For instance if keyspace events notification is enabled, and a client\n# performs a DEL operation on key \"foo\" stored in the Database 0, two\n# messages will be published via Pub/Sub:\n#\n# PUBLISH __keyspace@0__:foo del\n# PUBLISH __keyevent@0__:del foo\n#\n# It is possible to select the events that Redis will notify among a set\n# of classes. Every class is identified by a single character:\n#\n# K Keyspace events, published with __keyspace@__ prefix.\n# E Keyevent events, published with __keyevent@__ prefix.\n# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ...\n# $ String commands\n# l List commands\n# s Set commands\n# h Hash commands\n# z Sorted set commands\n# x Expired events (events generated every time a key expires)\n# e Evicted events (events generated when a key is evicted for maxmemory)\n# A Alias for g$lshzxe, so that the \"AKE\" string means all the events.\n#\n# The \"notify-keyspace-events\" takes as argument a string that is composed\n# of zero or multiple characters. The empty string means that notifications\n# are disabled.\n#\n# Example: to enable list and generic events, from the point of view of the\n# event name, use:\n#\n# notify-keyspace-events Elg\n#\n# Example 2: to get the stream of the expired keys subscribing to channel\n# name __keyevent@0__:expired use:\n#\n# notify-keyspace-events Ex\n#\n# By default all notifications are disabled because most users don't need\n# this feature and the feature has some overhead. Note that if you don't\n# specify at least one of K or E, no events will be delivered.\nnotify-keyspace-events \"\"\n\n############################### ADVANCED CONFIG ###############################\n\n# Hashes are encoded using a memory efficient data structure when they have a\n# small number of entries, and the biggest entry does not exceed a given\n# threshold. These thresholds can be configured using the following directives.\nhash-max-ziplist-entries 512\nhash-max-ziplist-value 64\n\n# Lists are also encoded in a special way to save a lot of space.\n# The number of entries allowed per internal list node can be specified\n# as a fixed maximum size or a maximum number of elements.\n# For a fixed maximum size, use -5 through -1, meaning:\n# -5: max size: 64 Kb <-- not recommended for normal workloads\n# -4: max size: 32 Kb <-- not recommended\n# -3: max size: 16 Kb <-- probably not recommended\n# -2: max size: 8 Kb <-- good\n# -1: max size: 4 Kb <-- good\n# Positive numbers mean store up to _exactly_ that number of elements\n# per list node.\n# The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size),\n# but if your use case is unique, adjust the settings as necessary.\nlist-max-ziplist-size -2\n\n# Lists may also be compressed.\n# Compress depth is the number of quicklist ziplist nodes from *each* side of\n# the list to *exclude* from compression. The head and tail of the list\n# are always uncompressed for fast push/pop operations. Settings are:\n# 0: disable all list compression\n# 1: depth 1 means \"don't start compressing until after 1 node into the list,\n# going from either the head or tail\"\n# So: [head]->node->node->...->node->[tail]\n# [head], [tail] will always be uncompressed; inner nodes will compress.\n# 2: [head]->[next]->node->node->...->node->[prev]->[tail]\n# 2 here means: don't compress head or head->next or tail->prev or tail,\n# but compress all nodes between them.\n# 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail]\n# etc.\nlist-compress-depth 0\n\n# Sets have a special encoding in just one case: when a set is composed\n# of just strings that happen to be integers in radix 10 in the range\n# of 64 bit signed integers.\n# The following configuration setting sets the limit in the size of the\n# set in order to use this special memory saving encoding.\nset-max-intset-entries 512\n\n# Similarly to hashes and lists, sorted sets are also specially encoded in\n# order to save a lot of space. This encoding is only used when the length and\n# elements of a sorted set are below the following limits:\nzset-max-ziplist-entries 128\nzset-max-ziplist-value 64\n\n# HyperLogLog sparse representation bytes limit. The limit includes the\n# 16 bytes header. When an HyperLogLog using the sparse representation crosses\n# this limit, it is converted into the dense representation.\n#\n# A value greater than 16000 is totally useless, since at that point the\n# dense representation is more memory efficient.\n#\n# The suggested value is ~ 3000 in order to have the benefits of\n# the space efficient encoding without slowing down too much PFADD,\n# which is O(N) with the sparse encoding. The value can be raised to\n# ~ 10000 when CPU is not a concern, but space is, and the data set is\n# composed of many HyperLogLogs with cardinality in the 0 - 15000 range.\nhll-sparse-max-bytes 3000\n\n# Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in\n# order to help rehashing the main Redis hash table (the one mapping top-level\n# keys to values). The hash table implementation Redis uses (see dict.c)\n# performs a lazy rehashing: the more operation you run into a hash table\n# that is rehashing, the more rehashing \"steps\" are performed, so if the\n# server is idle the rehashing is never complete and some more memory is used\n# by the hash table.\n#\n# The default is to use this millisecond 10 times every second in order to\n# actively rehash the main dictionaries, freeing memory when possible.\n#\n# If unsure:\n# use \"activerehashing no\" if you have hard latency requirements and it is\n# not a good thing in your environment that Redis can reply from time to time\n# to queries with 2 milliseconds delay.\n#\n# use \"activerehashing yes\" if you don't have such hard requirements but\n# want to free memory asap when possible.\nactiverehashing yes\n\n# The client output buffer limits can be used to force disconnection of clients\n# that are not reading data from the server fast enough for some reason (a\n# common reason is that a Pub/Sub client can't consume messages as fast as the\n# publisher can produce them).\n#\n# The limit can be set differently for the three different classes of clients:\n#\n# normal -> normal clients including MONITOR clients\n# slave -> slave clients\n# pubsub -> clients subscribed to at least one pubsub channel or pattern\n#\n# The syntax of every client-output-buffer-limit directive is the following:\n#\n# client-output-buffer-limit \n#\n# A client is immediately disconnected once the hard limit is reached, or if\n# the soft limit is reached and remains reached for the specified number of\n# seconds (continuously).\n# So for instance if the hard limit is 32 megabytes and the soft limit is\n# 16 megabytes / 10 seconds, the client will get disconnected immediately\n# if the size of the output buffers reach 32 megabytes, but will also get\n# disconnected if the client reaches 16 megabytes and continuously overcomes\n# the limit for 10 seconds.\n#\n# By default normal clients are not limited because they don't receive data\n# without asking (in a push way), but just after a request, so only\n# asynchronous clients may create a scenario where data is requested faster\n# than it can read.\n#\n# Instead there is a default limit for pubsub and slave clients, since\n# subscribers and slaves receive data in a push fashion.\n#\n# Both the hard or the soft limit can be disabled by setting them to zero.\nclient-output-buffer-limit normal 0 0 0\nclient-output-buffer-limit slave 256mb 64mb 60\nclient-output-buffer-limit pubsub 32mb 8mb 60\n\n# Client query buffers accumulate new commands. They are limited to a fixed\n# amount by default in order to avoid that a protocol desynchronization (for\n# instance due to a bug in the client) will lead to unbound memory usage in\n# the query buffer. However you can configure it here if you have very special\n# needs, such us huge multi/exec requests or alike.\n#\n# client-query-buffer-limit 1gb\n\n# In the Redis protocol, bulk requests, that are, elements representing single\n# strings, are normally limited ot 512 mb. However you can change this limit\n# here.\n#\n# proto-max-bulk-len 512mb\n\n# Redis calls an internal function to perform many background tasks, like\n# closing connections of clients in timeout, purging expired keys that are\n# never requested, and so forth.\n#\n# Not all tasks are performed with the same frequency, but Redis checks for\n# tasks to perform according to the specified \"hz\" value.\n#\n# By default \"hz\" is set to 10. Raising the value will use more CPU when\n# Redis is idle, but at the same time will make Redis more responsive when\n# there are many keys expiring at the same time, and timeouts may be\n# handled with more precision.\n#\n# The range is between 1 and 500, however a value over 100 is usually not\n# a good idea. Most users should use the default of 10 and raise this up to\n# 100 only in environments where very low latency is required.\nhz 10\n\n# When a child rewrites the AOF file, if the following option is enabled\n# the file will be fsync-ed every 32 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\naof-rewrite-incremental-fsync yes\n\n# Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good\n# idea to start with the default settings and only change them after investigating\n# how to improve the performances and how the keys LFU change over time, which\n# is possible to inspect via the OBJECT FREQ command.\n#\n# There are two tunable parameters in the Redis LFU implementation: the\n# counter logarithm factor and the counter decay time. It is important to\n# understand what the two parameters mean before changing them.\n#\n# The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis\n# uses a probabilistic increment with logarithmic behavior. Given the value\n# of the old counter, when a key is accessed, the counter is incremented in\n# this way:\n#\n# 1. A random number R between 0 and 1 is extracted.\n# 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1).\n# 3. The counter is incremented only if R < P.\n#\n# The default lfu-log-factor is 10. This is a table of how the frequency\n# counter changes with a different number of accesses with different\n# logarithmic factors:\n#\n# +--------+------------+------------+------------+------------+------------+\n# | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits |\n# +--------+------------+------------+------------+------------+------------+\n# | 0 | 104 | 255 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 1 | 18 | 49 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 10 | 10 | 18 | 142 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 100 | 8 | 11 | 49 | 143 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n#\n# NOTE: The above table was obtained by running the following commands:\n#\n# redis-benchmark -n 1000000 incr foo\n# redis-cli object freq foo\n#\n# NOTE 2: The counter initial value is 5 in order to give new objects a chance\n# to accumulate hits.\n#\n# The counter decay time is the time, in minutes, that must elapse in order\n# for the key counter to be divided by two (or decremented if it has a value\n# less <= 10).\n#\n# The default value for the lfu-decay-time is 1. A Special value of 0 means to\n# decay the counter every time it happens to be scanned.\n#\n# lfu-log-factor 10\n# lfu-decay-time 1\n\n########################### ACTIVE DEFRAGMENTATION #######################\n#\n# WARNING THIS FEATURE IS EXPERIMENTAL. However it was stress tested\n# even in production and manually tested by multiple engineers for some\n# time.\n#\n# What is active defragmentation?\n# -------------------------------\n#\n# Active (online) defragmentation allows a Redis server to compact the\n# spaces left between small allocations and deallocations of data in memory,\n# thus allowing to reclaim back memory.\n#\n# Fragmentation is a natural process that happens with every allocator (but\n# less so with Jemalloc, fortunately) and certain workloads. Normally a server\n# restart is needed in order to lower the fragmentation, or at least to flush\n# away all the data and create it again. However thanks to this feature\n# implemented by Oran Agra for Redis 4.0 this process can happen at runtime\n# in an \"hot\" way, while the server is running.\n#\n# Basically when the fragmentation is over a certain level (see the\n# configuration options below) Redis will start to create new copies of the\n# values in contiguous memory regions by exploiting certain specific Jemalloc\n# features (in order to understand if an allocation is causing fragmentation\n# and to allocate it in a better place), and at the same time, will release the\n# old copies of the data. This process, repeated incrementally for all the keys\n# will cause the fragmentation to drop back to normal values.\n#\n# Important things to understand:\n#\n# 1. This feature is disabled by default, and only works if you compiled Redis\n# to use the copy of Jemalloc we ship with the source code of Redis.\n# This is the default with Linux builds.\n#\n# 2. You never need to enable this feature if you don't have fragmentation\n# issues.\n#\n# 3. Once you experience fragmentation, you can enable this feature when\n# needed with the command \"CONFIG SET activedefrag yes\".\n#\n# The configuration parameters are able to fine tune the behavior of the\n# defragmentation process. If you are not sure about what they mean it is\n# a good idea to leave the defaults untouched.\n\n# Enabled active defragmentation\n# activedefrag yes\n\n# Minimum amount of fragmentation waste to start active defrag\n# active-defrag-ignore-bytes 100mb\n\n# Minimum percentage of fragmentation to start active defrag\n# active-defrag-threshold-lower 10\n\n# Maximum percentage of fragmentation at which we use maximum effort\n# active-defrag-threshold-upper 100\n\n# Minimal effort for defrag in CPU percentage\n# active-defrag-cycle-min 25\n\n# Maximal effort for defrag in CPU percentage\n# active-defrag-cycle-max 75\n\n" }, { "path": "aegir/conf/redis/redis5.conf", "content": "# Redis configuration file example.\n#\n# Note that in order to read the configuration file, Redis must be\n# started with the file path as first argument:\n#\n# ./redis-server /path/to/redis.conf\n\n# Note on units: when memory size is needed, it is possible to specify\n# it in the usual form of 1k 5GB 4M and so forth:\n#\n# 1k => 1000 bytes\n# 1kb => 1024 bytes\n# 1m => 1000000 bytes\n# 1mb => 1024*1024 bytes\n# 1g => 1000000000 bytes\n# 1gb => 1024*1024*1024 bytes\n#\n# units are case insensitive so 1GB 1Gb 1gB are all the same.\n\n################################## INCLUDES ###################################\n\n# Include one or more other config files here. This is useful if you\n# have a standard template that goes to all Redis servers but also need\n# to customize a few per-server settings. Include files can include\n# other files, so use this wisely.\n#\n# Notice option \"include\" won't be rewritten by command \"CONFIG REWRITE\"\n# from admin or Redis Sentinel. Since Redis always uses the last processed\n# line as value of a configuration directive, you'd better put includes\n# at the beginning of this file to avoid overwriting config change at runtime.\n#\n# If instead you are interested in using includes to override configuration\n# options, it is better to use include as the last line.\n#\n# include /path/to/local.conf\n# include /path/to/other.conf\n\n################################## MODULES #####################################\n\n# Load modules at startup. If the server is not able to load modules\n# it will abort. It is possible to use multiple loadmodule directives.\n#\n# loadmodule /path/to/my_module.so\n# loadmodule /path/to/other_module.so\n\n################################## NETWORK #####################################\n\n# By default, if no \"bind\" configuration directive is specified, Redis listens\n# for connections from all the network interfaces available on the server.\n# It is possible to listen to just one or multiple selected interfaces using\n# the \"bind\" configuration directive, followed by one or more IP addresses.\n#\n# Examples:\n#\n# xbind 192.168.1.100 10.0.0.1\n# xbind 127.0.0.1 ::1\n#\n# ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the\n# internet, binding to all the interfaces is dangerous and will expose the\n# instance to everybody on the internet. So by default we uncomment the\n# following bind directive, that will force Redis to listen only into\n# the IPv4 loopback interface address (this means Redis will be able to\n# accept connections only from clients running into the same computer it\n# is running).\n#\n# IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES\n# JUST COMMENT THE FOLLOWING LINE.\n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nbind 127.0.0.1\n\n# Protected mode is a layer of security protection, in order to avoid that\n# Redis instances left open on the internet are accessed and exploited.\n#\n# When protected mode is on and if:\n#\n# 1) The server is not binding explicitly to a set of addresses using the\n# \"bind\" directive.\n# 2) No password is configured.\n#\n# The server only accepts connections from clients connecting from the\n# IPv4 and IPv6 loopback addresses 127.0.0.1 and ::1, and from Unix domain\n# sockets.\n#\n# By default protected mode is enabled. You should disable it only if\n# you are sure you want clients from other hosts to connect to Redis\n# even if no authentication is configured, nor a specific set of interfaces\n# are explicitly listed using the \"bind\" directive.\nprotected-mode no\n\n# Accept connections on the specified port, default is 6379 (IANA #815344).\n# If port 0 is specified Redis will not listen on a TCP socket.\nport 6379\n\n# TCP listen() backlog.\n#\n# In high requests-per-second environments you need an high backlog in order\n# to avoid slow clients connections issues. Note that the Linux kernel\n# will silently truncate it to the value of /proc/sys/net/core/somaxconn so\n# make sure to raise both the value of somaxconn and tcp_max_syn_backlog\n# in order to get the desired effect.\ntcp-backlog 511\n\n# Unix socket.\n#\n# Specify the path for the Unix socket that will be used to listen for\n# incoming connections. There is no default, so Redis will not listen\n# on a unix socket when not specified.\n#\n# unixsocket /run/redis/redis.sock\n# unixsocketperm 777\n\n# Close the connection after a client is idle for N seconds (0 to disable)\ntimeout 3600\n\n# TCP keepalive.\n#\n# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence\n# of communication. This is useful for two reasons:\n#\n# 1) Detect dead peers.\n# 2) Take the connection alive from the point of view of network\n# equipment in the middle.\n#\n# On Linux, the specified value (in seconds) is the period used to send ACKs.\n# Note that to close the connection the double of the time is needed.\n# On other kernels the period depends on the kernel configuration.\n#\n# A reasonable value for this option is 300 seconds, which is the new\n# Redis default starting with Redis 3.2.1.\ntcp-keepalive 300\n\n################################# GENERAL #####################################\n\n# By default Redis does not run as a daemon. Use 'yes' if you need it.\n# Note that Redis will write a pid file in /run/redis.pid when daemonized.\ndaemonize yes\n\n# If you run Redis from upstart or systemd, Redis can interact with your\n# supervision tree. Options:\n# supervised no - no supervision interaction\n# supervised upstart - signal upstart by putting Redis into SIGSTOP mode\n# supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET\n# supervised auto - detect upstart or systemd method based on\n# UPSTART_JOB or NOTIFY_SOCKET environment variables\n# Note: these supervision methods only signal \"process is ready.\"\n# They do not enable continuous liveness pings back to your supervisor.\nsupervised no\n\n# If a pid file is specified, Redis writes it where specified at startup\n# and removes it at exit.\n#\n# When the server runs non daemonized, no pid file is created if none is\n# specified in the configuration. When the server is daemonized, the pid file\n# is used even if not specified, defaulting to \"/run/redis.pid\".\n#\n# Creating a pid file is best effort: if Redis is not able to create it\n# nothing bad happens, the server will start and run normally.\npidfile /run/redis/redis.pid\n\n# Specify the server verbosity level.\n# This can be one of:\n# debug (a lot of information, useful for development/testing)\n# verbose (many rarely useful info, but not a mess like the debug level)\n# notice (moderately verbose, what you want in production probably)\n# warning (only very important / critical messages are logged)\nloglevel warning\n\n# Specify the log file name. Also the empty string can be used to force\n# Redis to log on the standard output. Note that if you use standard\n# output for logging but daemonize, logs will be sent to /dev/null\nlogfile /var/log/redis/redis-server.log\n\n# To enable logging to the system logger, just set 'syslog-enabled' to yes,\n# and optionally update the other syslog parameters to suit your needs.\n# syslog-enabled no\n\n# Specify the syslog identity.\n# syslog-ident redis\n\n# Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.\n# syslog-facility local0\n\n# Set the number of databases. The default database is DB 0, you can select\n# a different one on a per-connection basis using SELECT where\n# dbid is a number between 0 and 'databases'-1\ndatabases 8\n\n# By default Redis shows an ASCII art logo only when started to log to the\n# standard output and if the standard output is a TTY. Basically this means\n# that normally a logo is displayed only in interactive sessions.\n#\n# However it is possible to force the pre-4.0 behavior and always show a\n# ASCII art logo in startup logs by setting the following option to yes.\nalways-show-logo yes\n\n################################ SNAPSHOTTING ################################\n#\n# Save the DB on disk:\n#\n# save \n#\n# Will save the DB if both the given number of seconds and the given\n# number of write operations against the DB occurred.\n#\n# In the example below the behaviour will be to save:\n# after 900 sec (15 min) if at least 1 key changed\n# after 300 sec (5 min) if at least 10 keys changed\n# after 60 sec if at least 10000 keys changed\n#\n# Note: you can disable saving completely by commenting out all \"save\" lines.\n#\n# It is also possible to remove all the previously configured save\n# points by adding a save directive with a single empty string argument\n# like in the following example:\n#\n# save \"\"\n\n# save 900 1\n# save 300 10\n# save 60 10000\n\n# By default Redis will stop accepting writes if RDB snapshots are enabled\n# (at least one save point) and the latest background save failed.\n# This will make the user aware (in a hard way) that data is not persisting\n# on disk properly, otherwise chances are that no one will notice and some\n# disaster will happen.\n#\n# If the background saving process will start working again Redis will\n# automatically allow writes again.\n#\n# However if you have setup your proper monitoring of the Redis server\n# and persistence, you may want to disable this feature so that Redis will\n# continue to work as usual even if there are problems with disk,\n# permissions, and so forth.\nstop-writes-on-bgsave-error no\n\n# Compress string objects using LZF when dump .rdb databases?\n# For default that's set to 'yes' as it's almost always a win.\n# If you want to save some CPU in the saving child set it to 'no' but\n# the dataset will likely be bigger if you have compressible values or keys.\nrdbcompression yes\n\n# Since version 5 of RDB a CRC64 checksum is placed at the end of the file.\n# This makes the format more resistant to corruption but there is a performance\n# hit to pay (around 10%) when saving and loading RDB files, so you can disable it\n# for maximum performances.\n#\n# RDB files created with checksum disabled have a checksum of zero that will\n# tell the loading code to skip the check.\nrdbchecksum no\n\n# The filename where to dump the DB\ndbfilename dump.rdb\n\n# The working directory.\n#\n# The DB will be written inside this directory, with the filename specified\n# above using the 'dbfilename' configuration directive.\n#\n# The Append Only File will also be created inside this directory.\n#\n# Note that you must specify a directory here, not a file name.\ndir /var/lib/redis/\n\n################################# REPLICATION #################################\n\n# Master-Replica replication. Use replicaof to make a Redis instance a copy of\n# another Redis server. A few things to understand ASAP about Redis replication.\n#\n# +------------------+ +---------------+\n# | Master | ---> | Replica |\n# | (receive writes) | | (exact copy) |\n# +------------------+ +---------------+\n#\n# 1) Redis replication is asynchronous, but you can configure a master to\n# stop accepting writes if it appears to be not connected with at least\n# a given number of replicas.\n# 2) Redis replicas are able to perform a partial resynchronization with the\n# master if the replication link is lost for a relatively small amount of\n# time. You may want to configure the replication backlog size (see the next\n# sections of this file) with a sensible value depending on your needs.\n# 3) Replication is automatic and does not need user intervention. After a\n# network partition replicas automatically try to reconnect to masters\n# and resynchronize with them.\n#\n# replicaof \n\n# If the master is password protected (using the \"requirepass\" configuration\n# directive below) it is possible to tell the replica to authenticate before\n# starting the replication synchronization process, otherwise the master will\n# refuse the replica request.\n#\n# masterauth \n\n# When a replica loses its connection with the master, or when the replication\n# is still in progress, the replica can act in two different ways:\n#\n# 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will\n# still reply to client requests, possibly with out of date data, or the\n# data set may just be empty if this is the first synchronization.\n#\n# 2) if replica-serve-stale-data is set to 'no' the replica will reply with\n# an error \"SYNC with master in progress\" to all the kind of commands\n# but to INFO, replicaOF, AUTH, PING, SHUTDOWN, REPLCONF, ROLE, CONFIG,\n# SUBSCRIBE, UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB,\n# COMMAND, POST, HOST: and LATENCY.\n#\nreplica-serve-stale-data yes\n\n# You can configure a replica instance to accept writes or not. Writing against\n# a replica instance may be useful to store some ephemeral data (because data\n# written on a replica will be easily deleted after resync with the master) but\n# may also cause problems if clients are writing to it because of a\n# misconfiguration.\n#\n# Since Redis 2.6 by default replicas are read-only.\n#\n# Note: read only replicas are not designed to be exposed to untrusted clients\n# on the internet. It's just a protection layer against misuse of the instance.\n# Still a read only replica exports by default all the administrative commands\n# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve\n# security of read only replicas using 'rename-command' to shadow all the\n# administrative / dangerous commands.\nreplica-read-only yes\n\n# Replication SYNC strategy: disk or socket.\n#\n# -------------------------------------------------------\n# WARNING: DISKLESS REPLICATION IS EXPERIMENTAL CURRENTLY\n# -------------------------------------------------------\n#\n# New replicas and reconnecting replicas that are not able to continue the replication\n# process just receiving differences, need to do what is called a \"full\n# synchronization\". An RDB file is transmitted from the master to the replicas.\n# The transmission can happen in two different ways:\n#\n# 1) Disk-backed: The Redis master creates a new process that writes the RDB\n# file on disk. Later the file is transferred by the parent\n# process to the replicas incrementally.\n# 2) Diskless: The Redis master creates a new process that directly writes the\n# RDB file to replica sockets, without touching the disk at all.\n#\n# With disk-backed replication, while the RDB file is generated, more replicas\n# can be queued and served with the RDB file as soon as the current child producing\n# the RDB file finishes its work. With diskless replication instead once\n# the transfer starts, new replicas arriving will be queued and a new transfer\n# will start when the current one terminates.\n#\n# When diskless replication is used, the master waits a configurable amount of\n# time (in seconds) before starting the transfer in the hope that multiple replicas\n# will arrive and the transfer can be parallelized.\n#\n# With slow disks and fast (large bandwidth) networks, diskless replication\n# works better.\nrepl-diskless-sync no\n\n# When diskless replication is enabled, it is possible to configure the delay\n# the server waits in order to spawn the child that transfers the RDB via socket\n# to the replicas.\n#\n# This is important since once the transfer starts, it is not possible to serve\n# new replicas arriving, that will be queued for the next RDB transfer, so the server\n# waits a delay in order to let more replicas arrive.\n#\n# The delay is specified in seconds, and by default is 5 seconds. To disable\n# it entirely just set it to 0 seconds and the transfer will start ASAP.\nrepl-diskless-sync-delay 5\n\n# Replicas send PINGs to server in a predefined interval. It's possible to change\n# this interval with the repl_ping_replica_period option. The default value is 10\n# seconds.\n#\n# repl-ping-replica-period 10\n\n# The following option sets the replication timeout for:\n#\n# 1) Bulk transfer I/O during SYNC, from the point of view of replica.\n# 2) Master timeout from the point of view of replicas (data, pings).\n# 3) Replica timeout from the point of view of masters (REPLCONF ACK pings).\n#\n# It is important to make sure that this value is greater than the value\n# specified for repl-ping-replica-period otherwise a timeout will be detected\n# every time there is low traffic between the master and the replica.\n#\n# repl-timeout 60\n\n# Disable TCP_NODELAY on the replica socket after SYNC?\n#\n# If you select \"yes\" Redis will use a smaller number of TCP packets and\n# less bandwidth to send data to replicas. But this can add a delay for\n# the data to appear on the replica side, up to 40 milliseconds with\n# Linux kernels using a default configuration.\n#\n# If you select \"no\" the delay for data to appear on the replica side will\n# be reduced but more bandwidth will be used for replication.\n#\n# By default we optimize for low latency, but in very high traffic conditions\n# or when the master and replicas are many hops away, turning this to \"yes\" may\n# be a good idea.\nrepl-disable-tcp-nodelay no\n\n# Set the replication backlog size. The backlog is a buffer that accumulates\n# replica data when replicas are disconnected for some time, so that when a replica\n# wants to reconnect again, often a full resync is not needed, but a partial\n# resync is enough, just passing the portion of data the replica missed while\n# disconnected.\n#\n# The bigger the replication backlog, the longer the time the replica can be\n# disconnected and later be able to perform a partial resynchronization.\n#\n# The backlog is only allocated once there is at least a replica connected.\n#\n# repl-backlog-size 1mb\n\n# After a master has no longer connected replicas for some time, the backlog\n# will be freed. The following option configures the amount of seconds that\n# need to elapse, starting from the time the last replica disconnected, for\n# the backlog buffer to be freed.\n#\n# Note that replicas never free the backlog for timeout, since they may be\n# promoted to masters later, and should be able to correctly \"partially\n# resynchronize\" with the replicas: hence they should always accumulate backlog.\n#\n# A value of 0 means to never release the backlog.\n#\n# repl-backlog-ttl 3600\n\n# The replica priority is an integer number published by Redis in the INFO output.\n# It is used by Redis Sentinel in order to select a replica to promote into a\n# master if the master is no longer working correctly.\n#\n# A replica with a low priority number is considered better for promotion, so\n# for instance if there are three replicas with priority 10, 100, 25 Sentinel will\n# pick the one with priority 10, that is the lowest.\n#\n# However a special priority of 0 marks the replica as not able to perform the\n# role of master, so a replica with priority of 0 will never be selected by\n# Redis Sentinel for promotion.\n#\n# By default the priority is 100.\nreplica-priority 100\n\n# It is possible for a master to stop accepting writes if there are less than\n# N replicas connected, having a lag less or equal than M seconds.\n#\n# The N replicas need to be in \"online\" state.\n#\n# The lag in seconds, that must be <= the specified value, is calculated from\n# the last ping received from the replica, that is usually sent every second.\n#\n# This option does not GUARANTEE that N replicas will accept the write, but\n# will limit the window of exposure for lost writes in case not enough replicas\n# are available, to the specified number of seconds.\n#\n# For example to require at least 3 replicas with a lag <= 10 seconds use:\n#\n# min-replicas-to-write 3\n# min-replicas-max-lag 10\n#\n# Setting one or the other to 0 disables the feature.\n#\n# By default min-replicas-to-write is set to 0 (feature disabled) and\n# min-replicas-max-lag is set to 10.\n\n# A Redis master is able to list the address and port of the attached\n# replicas in different ways. For example the \"INFO replication\" section\n# offers this information, which is used, among other tools, by\n# Redis Sentinel in order to discover replica instances.\n# Another place where this info is available is in the output of the\n# \"ROLE\" command of a master.\n#\n# The listed IP and address normally reported by a replica is obtained\n# in the following way:\n#\n# IP: The address is auto detected by checking the peer address\n# of the socket used by the replica to connect with the master.\n#\n# Port: The port is communicated by the replica during the replication\n# handshake, and is normally the port that the replica is using to\n# listen for connections.\n#\n# However when port forwarding or Network Address Translation (NAT) is\n# used, the replica may be actually reachable via different IP and port\n# pairs. The following two options can be used by a replica in order to\n# report to its master a specific set of IP and port, so that both INFO\n# and ROLE will report those values.\n#\n# There is no need to use both the options if you need to override just\n# the port or the IP address.\n#\n# replica-announce-ip 5.5.5.5\n# replica-announce-port 1234\n\n################################## SECURITY ###################################\n\n# Require clients to issue AUTH before processing any other\n# commands. This might be useful in environments in which you do not trust\n# others with access to the host running redis-server.\n#\n# This should stay commented out for backward compatibility and because most\n# people do not need auth (e.g. they run their own servers).\n#\n# Warning: since Redis is pretty fast an outside user can try up to\n# 150k passwords per second against a good box. This means that you should\n# use a very strong password otherwise it will be very easy to break.\n#\n# requirepass isfoobared\n\n# Command renaming.\n#\n# It is possible to change the name of dangerous commands in a shared\n# environment. For instance the CONFIG command may be renamed into something\n# hard to guess so that it will still be available for internal-use tools\n# but not available for general clients.\n#\n# Example:\n#\n# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52\n#\n# It is also possible to completely kill a command by renaming it into\n# an empty string:\n#\n# rename-command CONFIG \"\"\n#\n# Please note that changing the name of commands that are logged into the\n# AOF file or transmitted to replicas may cause problems.\n\n################################### CLIENTS ####################################\n\n# Set the max number of connected clients at the same time. By default\n# this limit is set to 10000 clients, however if the Redis server is not\n# able to configure the process file limit to allow for the specified limit\n# the max number of allowed clients is set to the current file limit\n# minus 32 (as Redis reserves a few file descriptors for internal uses).\n#\n# Once the limit is reached Redis will close all the new connections sending\n# an error 'max number of clients reached'.\n#\nmaxclients 4000\n\n############################## MEMORY MANAGEMENT ################################\n\n# Set a memory usage limit to the specified amount of bytes.\n# When the memory limit is reached Redis will try to remove keys\n# according to the eviction policy selected (see maxmemory-policy).\n#\n# If Redis can't remove keys according to the policy, or if the policy is\n# set to 'noeviction', Redis will start to reply with errors to commands\n# that would use more memory, like SET, LPUSH, and so on, and will continue\n# to reply to read-only commands like GET.\n#\n# This option is usually useful when using Redis as an LRU or LFU cache, or to\n# set a hard memory limit for an instance (using the 'noeviction' policy).\n#\n# WARNING: If you have replicas attached to an instance with maxmemory on,\n# the size of the output buffers needed to feed the replicas are subtracted\n# from the used memory count, so that network problems / resyncs will\n# not trigger a loop where keys are evicted, and in turn the output\n# buffer of replicas is full with DELs of keys evicted triggering the deletion\n# of more keys, and so forth until the database is completely emptied.\n#\n# In short... if you have replicas attached it is suggested that you set a lower\n# limit for maxmemory so that there is some free RAM on the system for replica\n# output buffers (but this is not needed if the policy is 'noeviction').\n#\nmaxmemory 88MB\n\n# MAXMEMORY POLICY: how Redis will select what to remove when maxmemory\n# is reached. You can select among five behaviors:\n#\n# volatile-lru -> Evict using approximated LRU among the keys with an expire set.\n# allkeys-lru -> Evict any key using approximated LRU.\n# volatile-lfu -> Evict using approximated LFU among the keys with an expire set.\n# allkeys-lfu -> Evict any key using approximated LFU.\n# volatile-random -> Remove a random key among the ones with an expire set.\n# allkeys-random -> Remove a random key, any key.\n# volatile-ttl -> Remove the key with the nearest expire time (minor TTL)\n# noeviction -> Don't evict anything, just return an error on write operations.\n#\n# LRU means Least Recently Used\n# LFU means Least Frequently Used\n#\n# Both LRU, LFU and volatile-ttl are implemented using approximated\n# randomized algorithms.\n#\n# Note: with any of the above policies, Redis will return an error on write\n# operations, when there are no suitable keys for eviction.\n#\n# At the date of writing these commands are: set setnx setex append\n# incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd\n# sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby\n# zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby\n# getset mset msetnx exec sort\n#\n# The default is: noeviction\n#\nmaxmemory-policy allkeys-lru\n\n# LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated\n# algorithms (in order to save memory), so you can tune it for speed or\n# accuracy. For default Redis will check five keys and pick the one that was\n# used less recently, you can change the sample size using the following\n# configuration directive.\n#\n# The default of 5 produces good enough results. 10 Approximates very closely\n# true LRU but costs more CPU. 3 is faster but not very accurate.\n#\n# maxmemory-samples 5\n\n# Starting from Redis 5, by default a replica will ignore its maxmemory setting\n# (unless it is promoted to master after a failover or manually). It means\n# that the eviction of keys will be just handled by the master, sending the\n# DEL commands to the replica as keys evict in the master side.\n#\n# This behavior ensures that masters and replicas stay consistent, and is usually\n# what you want, however if your replica is writable, or you want the replica to have\n# a different memory setting, and you are sure all the writes performed to the\n# replica are idempotent, then you may change this default (but be sure to understand\n# what you are doing).\n#\n# Note that since the replica by default does not evict, it may end using more\n# memory than the one set via maxmemory (there are certain buffers that may\n# be larger on the replica, or data structures may sometimes take more memory and so\n# forth). So make sure you monitor your replicas and make sure they have enough\n# memory to never hit a real out-of-memory condition before the master hits\n# the configured maxmemory setting.\n#\n# replica-ignore-maxmemory yes\n\n############################# LAZY FREEING ####################################\n\n# Redis has two primitives to delete keys. One is called DEL and is a blocking\n# deletion of the object. It means that the server stops processing new commands\n# in order to reclaim all the memory associated with an object in a synchronous\n# way. If the key deleted is associated with a small object, the time needed\n# in order to execute the DEL command is very small and comparable to most other\n# O(1) or O(log_N) commands in Redis. However if the key is associated with an\n# aggregated value containing millions of elements, the server can block for\n# a long time (even seconds) in order to complete the operation.\n#\n# For the above reasons Redis also offers non blocking deletion primitives\n# such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and\n# FLUSHDB commands, in order to reclaim memory in background. Those commands\n# are executed in constant time. Another thread will incrementally free the\n# object in the background as fast as possible.\n#\n# DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled.\n# It's up to the design of the application to understand when it is a good\n# idea to use one or the other. However the Redis server sometimes has to\n# delete keys or flush the whole database as a side effect of other operations.\n# Specifically Redis deletes objects independently of a user call in the\n# following scenarios:\n#\n# 1) On eviction, because of the maxmemory and maxmemory policy configurations,\n# in order to make room for new data, without going over the specified\n# memory limit.\n# 2) Because of expire: when a key with an associated time to live (see the\n# EXPIRE command) must be deleted from memory.\n# 3) Because of a side effect of a command that stores data on a key that may\n# already exist. For example the RENAME command may delete the old key\n# content when it is replaced with another one. Similarly SUNIONSTORE\n# or SORT with STORE option may delete existing keys. The SET command\n# itself removes any old content of the specified key in order to replace\n# it with the specified string.\n# 4) During replication, when a replica performs a full resynchronization with\n# its master, the content of the whole database is removed in order to\n# load the RDB file just transferred.\n#\n# In all the above cases the default is to delete objects in a blocking way,\n# like if DEL was called. However you can configure each case specifically\n# in order to instead release memory in a non-blocking way like if UNLINK\n# was called, using the following configuration directives:\n\nlazyfree-lazy-eviction yes\nlazyfree-lazy-expire yes\nlazyfree-lazy-server-del yes\nreplica-lazy-flush yes\n\n############################## APPEND ONLY MODE ###############################\n\n# By default Redis asynchronously dumps the dataset on disk. This mode is\n# good enough in many applications, but an issue with the Redis process or\n# a power outage may result into a few minutes of writes lost (depending on\n# the configured save points).\n#\n# The Append Only File is an alternative persistence mode that provides\n# much better durability. For instance using the default data fsync policy\n# (see later in the config file) Redis can lose just one second of writes in a\n# dramatic event like a server power outage, or a single write if something\n# wrong with the Redis process itself happens, but the operating system is\n# still running correctly.\n#\n# AOF and RDB persistence can be enabled at the same time without problems.\n# If the AOF is enabled on startup Redis will load the AOF, that is the file\n# with the better durability guarantees.\n#\n# Please check http://redis.io/topics/persistence for more information.\n\nappendonly no\n\n# The name of the append only file (default: \"appendonly.aof\")\n\nappendfilename \"appendonly.aof\"\n\n# The fsync() call tells the Operating System to actually write data on disk\n# instead of waiting for more data in the output buffer. Some OS will really flush\n# data on disk, some other OS will just try to do it ASAP.\n#\n# Redis supports three different modes:\n#\n# no: don't fsync, just let the OS flush the data when it wants. Faster.\n# always: fsync after every write to the append only log. Slow, Safest.\n# everysec: fsync only one time every second. Compromise.\n#\n# The default is \"everysec\", as that's usually the right compromise between\n# speed and data safety. It's up to you to understand if you can relax this to\n# \"no\" that will let the operating system flush the output buffer when\n# it wants, for better performances (but if you can live with the idea of\n# some data loss consider the default persistence mode that's snapshotting),\n# or on the contrary, use \"always\" that's very slow but a bit safer than\n# everysec.\n#\n# More details please check the following article:\n# http://antirez.com/post/redis-persistence-demystified.html\n#\n# If unsure, use \"everysec\".\n\n# appendfsync always\nappendfsync everysec\n# appendfsync no\n\n# When the AOF fsync policy is set to always or everysec, and a background\n# saving process (a background save or AOF log background rewriting) is\n# performing a lot of I/O against the disk, in some Linux configurations\n# Redis may block too long on the fsync() call. Note that there is no fix for\n# this currently, as even performing fsync in a different thread will block\n# our synchronous write(2) call.\n#\n# In order to mitigate this problem it's possible to use the following option\n# that will prevent fsync() from being called in the main process while a\n# BGSAVE or BGREWRITEAOF is in progress.\n#\n# This means that while another child is saving, the durability of Redis is\n# the same as \"appendfsync none\". In practical terms, this means that it is\n# possible to lose up to 30 seconds of log in the worst scenario (with the\n# default Linux settings).\n#\n# If you have latency problems turn this to \"yes\". Otherwise leave it as\n# \"no\" that is the safest pick from the point of view of durability.\n\nno-appendfsync-on-rewrite no\n\n# Automatic rewrite of the append only file.\n# Redis is able to automatically rewrite the log file implicitly calling\n# BGREWRITEAOF when the AOF log size grows by the specified percentage.\n#\n# This is how it works: Redis remembers the size of the AOF file after the\n# latest rewrite (if no rewrite has happened since the restart, the size of\n# the AOF at startup is used).\n#\n# This base size is compared to the current size. If the current size is\n# bigger than the specified percentage, the rewrite is triggered. Also\n# you need to specify a minimal size for the AOF file to be rewritten, this\n# is useful to avoid rewriting the AOF file even if the percentage increase\n# is reached but it is still pretty small.\n#\n# Specify a percentage of zero in order to disable the automatic AOF\n# rewrite feature.\n\nauto-aof-rewrite-percentage 100\nauto-aof-rewrite-min-size 64mb\n\n# An AOF file may be found to be truncated at the end during the Redis\n# startup process, when the AOF data gets loaded back into memory.\n# This may happen when the system where Redis is running\n# crashes, especially when an ext4 filesystem is mounted without the\n# data=ordered option (however this can't happen when Redis itself\n# crashes or aborts but the operating system still works correctly).\n#\n# Redis can either exit with an error when this happens, or load as much\n# data as possible (the default now) and start if the AOF file is found\n# to be truncated at the end. The following option controls this behavior.\n#\n# If aof-load-truncated is set to yes, a truncated AOF file is loaded and\n# the Redis server starts emitting a log to inform the user of the event.\n# Otherwise if the option is set to no, the server aborts with an error\n# and refuses to start. When the option is set to no, the user requires\n# to fix the AOF file using the \"redis-check-aof\" utility before to restart\n# the server.\n#\n# Note that if the AOF file will be found to be corrupted in the middle\n# the server will still exit with an error. This option only applies when\n# Redis will try to read more data from the AOF file but not enough bytes\n# will be found.\naof-load-truncated yes\n\n# When rewriting the AOF file, Redis is able to use an RDB preamble in the\n# AOF file for faster rewrites and recoveries. When this option is turned\n# on the rewritten AOF file is composed of two different stanzas:\n#\n# [RDB file][AOF tail]\n#\n# When loading Redis recognizes that the AOF file starts with the \"REDIS\"\n# string and loads the prefixed RDB file, and continues loading the AOF\n# tail.\naof-use-rdb-preamble yes\n\n################################ LUA SCRIPTING ###############################\n\n# Max execution time of a Lua script in milliseconds.\n#\n# If the maximum execution time is reached Redis will log that a script is\n# still in execution after the maximum allowed time and will start to\n# reply to queries with an error.\n#\n# When a long running script exceeds the maximum execution time only the\n# SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be\n# used to stop a script that did not yet called write commands. The second\n# is the only way to shut down the server in the case a write command was\n# already issued by the script but the user doesn't want to wait for the natural\n# termination of the script.\n#\n# Set it to 0 or a negative value for unlimited execution without warnings.\nlua-time-limit 5000\n\n################################ REDIS CLUSTER ###############################\n\n# Normal Redis instances can't be part of a Redis Cluster; only nodes that are\n# started as cluster nodes can. In order to start a Redis instance as a\n# cluster node enable the cluster support uncommenting the following:\n#\n# cluster-enabled yes\n\n# Every cluster node has a cluster configuration file. This file is not\n# intended to be edited by hand. It is created and updated by Redis nodes.\n# Every Redis Cluster node requires a different cluster configuration file.\n# Make sure that instances running in the same system do not have\n# overlapping cluster configuration file names.\n#\n# cluster-config-file nodes-6379.conf\n\n# Cluster node timeout is the amount of milliseconds a node must be unreachable\n# for it to be considered in failure state.\n# Most other internal time limits are multiple of the node timeout.\n#\n# cluster-node-timeout 15000\n\n# A replica of a failing master will avoid to start a failover if its data\n# looks too old.\n#\n# There is no simple way for a replica to actually have an exact measure of\n# its \"data age\", so the following two checks are performed:\n#\n# 1) If there are multiple replicas able to failover, they exchange messages\n# in order to try to give an advantage to the replica with the best\n# replication offset (more data from the master processed).\n# Replicas will try to get their rank by offset, and apply to the start\n# of the failover a delay proportional to their rank.\n#\n# 2) Every single replica computes the time of the last interaction with\n# its master. This can be the last ping or command received (if the master\n# is still in the \"connected\" state), or the time that elapsed since the\n# disconnection with the master (if the replication link is currently down).\n# If the last interaction is too old, the replica will not try to failover\n# at all.\n#\n# The point \"2\" can be tuned by user. Specifically a replica will not perform\n# the failover if, since the last interaction with the master, the time\n# elapsed is greater than:\n#\n# (node-timeout * replica-validity-factor) + repl-ping-replica-period\n#\n# So for example if node-timeout is 30 seconds, and the replica-validity-factor\n# is 10, and assuming a default repl-ping-replica-period of 10 seconds, the\n# replica will not try to failover if it was not able to talk with the master\n# for longer than 310 seconds.\n#\n# A large replica-validity-factor may allow replicas with too old data to failover\n# a master, while a too small value may prevent the cluster from being able to\n# elect a replica at all.\n#\n# For maximum availability, it is possible to set the replica-validity-factor\n# to a value of 0, which means, that replicas will always try to failover the\n# master regardless of the last time they interacted with the master.\n# (However they'll always try to apply a delay proportional to their\n# offset rank).\n#\n# Zero is the only value able to guarantee that when all the partitions heal\n# the cluster will always be able to continue.\n#\n# cluster-replica-validity-factor 10\n\n# Cluster replicas are able to migrate to orphaned masters, that are masters\n# that are left without working replicas. This improves the cluster ability\n# to resist to failures as otherwise an orphaned master can't be failed over\n# in case of failure if it has no working replicas.\n#\n# Replicas migrate to orphaned masters only if there are still at least a\n# given number of other working replicas for their old master. This number\n# is the \"migration barrier\". A migration barrier of 1 means that a replica\n# will migrate only if there is at least 1 other working replica for its master\n# and so forth. It usually reflects the number of replicas you want for every\n# master in your cluster.\n#\n# Default is 1 (replicas migrate only if their masters remain with at least\n# one replica). To disable migration just set it to a very large value.\n# A value of 0 can be set but is useful only for debugging and dangerous\n# in production.\n#\n# cluster-migration-barrier 1\n\n# By default Redis Cluster nodes stop accepting queries if they detect there\n# is at least an hash slot uncovered (no available node is serving it).\n# This way if the cluster is partially down (for example a range of hash slots\n# are no longer covered) all the cluster becomes, eventually, unavailable.\n# It automatically returns available as soon as all the slots are covered again.\n#\n# However sometimes you want the subset of the cluster which is working,\n# to continue to accept queries for the part of the key space that is still\n# covered. In order to do so, just set the cluster-require-full-coverage\n# option to no.\n#\n# cluster-require-full-coverage yes\n\n# This option, when set to yes, prevents replicas from trying to failover its\n# master during master failures. However the master can still perform a\n# manual failover, if forced to do so.\n#\n# This is useful in different scenarios, especially in the case of multiple\n# data center operations, where we want one side to never be promoted if not\n# in the case of a total DC failure.\n#\n# cluster-replica-no-failover no\n\n# In order to setup your cluster make sure to read the documentation\n# available at http://redis.io web site.\n\n########################## CLUSTER DOCKER/NAT support ########################\n\n# In certain deployments, Redis Cluster nodes address discovery fails, because\n# addresses are NAT-ted or because ports are forwarded (the typical case is\n# Docker and other containers).\n#\n# In order to make Redis Cluster working in such environments, a static\n# configuration where each node knows its public address is needed. The\n# following two options are used for this scope, and are:\n#\n# * cluster-announce-ip\n# * cluster-announce-port\n# * cluster-announce-bus-port\n#\n# Each instruct the node about its address, client port, and cluster message\n# bus port. The information is then published in the header of the bus packets\n# so that other nodes will be able to correctly map the address of the node\n# publishing the information.\n#\n# If the above options are not used, the normal Redis Cluster auto-detection\n# will be used instead.\n#\n# Note that when remapped, the bus port may not be at the fixed offset of\n# clients port + 10000, so you can specify any port and bus-port depending\n# on how they get remapped. If the bus-port is not set, a fixed offset of\n# 10000 will be used as usually.\n#\n# Example:\n#\n# cluster-announce-ip 10.1.1.5\n# cluster-announce-port 6379\n# cluster-announce-bus-port 6380\n\n################################## SLOW LOG ###################################\n\n# The Redis Slow Log is a system to log queries that exceeded a specified\n# execution time. The execution time does not include the I/O operations\n# like talking with the client, sending the reply and so forth,\n# but just the time needed to actually execute the command (this is the only\n# stage of command execution where the thread is blocked and can not serve\n# other requests in the meantime).\n#\n# You can configure the slow log with two parameters: one tells Redis\n# what is the execution time, in microseconds, to exceed in order for the\n# command to get logged, and the other parameter is the length of the\n# slow log. When a new command is logged the oldest one is removed from the\n# queue of logged commands.\n\n# The following time is expressed in microseconds, so 1000000 is equivalent\n# to one second. Note that a negative number disables the slow log, while\n# a value of zero forces the logging of every command.\nslowlog-log-slower-than 10000\n\n# There is no limit to this length. Just be aware that it will consume memory.\n# You can reclaim memory used by the slow log with SLOWLOG RESET.\nslowlog-max-len 128\n\n################################ LATENCY MONITOR ##############################\n\n# The Redis latency monitoring subsystem samples different operations\n# at runtime in order to collect data related to possible sources of\n# latency of a Redis instance.\n#\n# Via the LATENCY command this information is available to the user that can\n# print graphs and obtain reports.\n#\n# The system only logs operations that were performed in a time equal or\n# greater than the amount of milliseconds specified via the\n# latency-monitor-threshold configuration directive. When its value is set\n# to zero, the latency monitor is turned off.\n#\n# By default latency monitoring is disabled since it is mostly not needed\n# if you don't have latency issues, and collecting data has a performance\n# impact, that while very small, can be measured under big load. Latency\n# monitoring can easily be enabled at runtime using the command\n# \"CONFIG SET latency-monitor-threshold \" if needed.\nlatency-monitor-threshold 0\n\n############################# EVENT NOTIFICATION ##############################\n\n# Redis can notify Pub/Sub clients about events happening in the key space.\n# This feature is documented at http://redis.io/topics/notifications\n#\n# For instance if keyspace events notification is enabled, and a client\n# performs a DEL operation on key \"foo\" stored in the Database 0, two\n# messages will be published via Pub/Sub:\n#\n# PUBLISH __keyspace@0__:foo del\n# PUBLISH __keyevent@0__:del foo\n#\n# It is possible to select the events that Redis will notify among a set\n# of classes. Every class is identified by a single character:\n#\n# K Keyspace events, published with __keyspace@__ prefix.\n# E Keyevent events, published with __keyevent@__ prefix.\n# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ...\n# $ String commands\n# l List commands\n# s Set commands\n# h Hash commands\n# z Sorted set commands\n# x Expired events (events generated every time a key expires)\n# e Evicted events (events generated when a key is evicted for maxmemory)\n# A Alias for g$lshzxe, so that the \"AKE\" string means all the events.\n#\n# The \"notify-keyspace-events\" takes as argument a string that is composed\n# of zero or multiple characters. The empty string means that notifications\n# are disabled.\n#\n# Example: to enable list and generic events, from the point of view of the\n# event name, use:\n#\n# notify-keyspace-events Elg\n#\n# Example 2: to get the stream of the expired keys subscribing to channel\n# name __keyevent@0__:expired use:\n#\n# notify-keyspace-events Ex\n#\n# By default all notifications are disabled because most users don't need\n# this feature and the feature has some overhead. Note that if you don't\n# specify at least one of K or E, no events will be delivered.\nnotify-keyspace-events \"\"\n\n############################### ADVANCED CONFIG ###############################\n\n# Hashes are encoded using a memory efficient data structure when they have a\n# small number of entries, and the biggest entry does not exceed a given\n# threshold. These thresholds can be configured using the following directives.\nhash-max-ziplist-entries 512\nhash-max-ziplist-value 64\n\n# Lists are also encoded in a special way to save a lot of space.\n# The number of entries allowed per internal list node can be specified\n# as a fixed maximum size or a maximum number of elements.\n# For a fixed maximum size, use -5 through -1, meaning:\n# -5: max size: 64 Kb <-- not recommended for normal workloads\n# -4: max size: 32 Kb <-- not recommended\n# -3: max size: 16 Kb <-- probably not recommended\n# -2: max size: 8 Kb <-- good\n# -1: max size: 4 Kb <-- good\n# Positive numbers mean store up to _exactly_ that number of elements\n# per list node.\n# The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size),\n# but if your use case is unique, adjust the settings as necessary.\nlist-max-ziplist-size -2\n\n# Lists may also be compressed.\n# Compress depth is the number of quicklist ziplist nodes from *each* side of\n# the list to *exclude* from compression. The head and tail of the list\n# are always uncompressed for fast push/pop operations. Settings are:\n# 0: disable all list compression\n# 1: depth 1 means \"don't start compressing until after 1 node into the list,\n# going from either the head or tail\"\n# So: [head]->node->node->...->node->[tail]\n# [head], [tail] will always be uncompressed; inner nodes will compress.\n# 2: [head]->[next]->node->node->...->node->[prev]->[tail]\n# 2 here means: don't compress head or head->next or tail->prev or tail,\n# but compress all nodes between them.\n# 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail]\n# etc.\nlist-compress-depth 0\n\n# Sets have a special encoding in just one case: when a set is composed\n# of just strings that happen to be integers in radix 10 in the range\n# of 64 bit signed integers.\n# The following configuration setting sets the limit in the size of the\n# set in order to use this special memory saving encoding.\nset-max-intset-entries 512\n\n# Similarly to hashes and lists, sorted sets are also specially encoded in\n# order to save a lot of space. This encoding is only used when the length and\n# elements of a sorted set are below the following limits:\nzset-max-ziplist-entries 128\nzset-max-ziplist-value 64\n\n# HyperLogLog sparse representation bytes limit. The limit includes the\n# 16 bytes header. When an HyperLogLog using the sparse representation crosses\n# this limit, it is converted into the dense representation.\n#\n# A value greater than 16000 is totally useless, since at that point the\n# dense representation is more memory efficient.\n#\n# The suggested value is ~ 3000 in order to have the benefits of\n# the space efficient encoding without slowing down too much PFADD,\n# which is O(N) with the sparse encoding. The value can be raised to\n# ~ 10000 when CPU is not a concern, but space is, and the data set is\n# composed of many HyperLogLogs with cardinality in the 0 - 15000 range.\nhll-sparse-max-bytes 3000\n\n# Streams macro node max size / items. The stream data structure is a radix\n# tree of big nodes that encode multiple items inside. Using this configuration\n# it is possible to configure how big a single node can be in bytes, and the\n# maximum number of items it may contain before switching to a new node when\n# appending new stream entries. If any of the following settings are set to\n# zero, the limit is ignored, so for instance it is possible to set just a\n# max entires limit by setting max-bytes to 0 and max-entries to the desired\n# value.\nstream-node-max-bytes 4096\nstream-node-max-entries 100\n\n# Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in\n# order to help rehashing the main Redis hash table (the one mapping top-level\n# keys to values). The hash table implementation Redis uses (see dict.c)\n# performs a lazy rehashing: the more operation you run into a hash table\n# that is rehashing, the more rehashing \"steps\" are performed, so if the\n# server is idle the rehashing is never complete and some more memory is used\n# by the hash table.\n#\n# The default is to use this millisecond 10 times every second in order to\n# actively rehash the main dictionaries, freeing memory when possible.\n#\n# If unsure:\n# use \"activerehashing no\" if you have hard latency requirements and it is\n# not a good thing in your environment that Redis can reply from time to time\n# to queries with 2 milliseconds delay.\n#\n# use \"activerehashing yes\" if you don't have such hard requirements but\n# want to free memory asap when possible.\nactiverehashing yes\n\n# The client output buffer limits can be used to force disconnection of clients\n# that are not reading data from the server fast enough for some reason (a\n# common reason is that a Pub/Sub client can't consume messages as fast as the\n# publisher can produce them).\n#\n# The limit can be set differently for the three different classes of clients:\n#\n# normal -> normal clients including MONITOR clients\n# replica -> replica clients\n# pubsub -> clients subscribed to at least one pubsub channel or pattern\n#\n# The syntax of every client-output-buffer-limit directive is the following:\n#\n# client-output-buffer-limit \n#\n# A client is immediately disconnected once the hard limit is reached, or if\n# the soft limit is reached and remains reached for the specified number of\n# seconds (continuously).\n# So for instance if the hard limit is 32 megabytes and the soft limit is\n# 16 megabytes / 10 seconds, the client will get disconnected immediately\n# if the size of the output buffers reach 32 megabytes, but will also get\n# disconnected if the client reaches 16 megabytes and continuously overcomes\n# the limit for 10 seconds.\n#\n# By default normal clients are not limited because they don't receive data\n# without asking (in a push way), but just after a request, so only\n# asynchronous clients may create a scenario where data is requested faster\n# than it can read.\n#\n# Instead there is a default limit for pubsub and replica clients, since\n# subscribers and replicas receive data in a push fashion.\n#\n# Both the hard or the soft limit can be disabled by setting them to zero.\nclient-output-buffer-limit normal 0 0 0\nclient-output-buffer-limit replica 256mb 64mb 60\nclient-output-buffer-limit pubsub 32mb 8mb 60\n\n# Client query buffers accumulate new commands. They are limited to a fixed\n# amount by default in order to avoid that a protocol desynchronization (for\n# instance due to a bug in the client) will lead to unbound memory usage in\n# the query buffer. However you can configure it here if you have very special\n# needs, such us huge multi/exec requests or alike.\n#\n# client-query-buffer-limit 1gb\n\n# In the Redis protocol, bulk requests, that are, elements representing single\n# strings, are normally limited ot 512 mb. However you can change this limit\n# here.\n#\n# proto-max-bulk-len 512mb\n\n# Redis calls an internal function to perform many background tasks, like\n# closing connections of clients in timeout, purging expired keys that are\n# never requested, and so forth.\n#\n# Not all tasks are performed with the same frequency, but Redis checks for\n# tasks to perform according to the specified \"hz\" value.\n#\n# By default \"hz\" is set to 10. Raising the value will use more CPU when\n# Redis is idle, but at the same time will make Redis more responsive when\n# there are many keys expiring at the same time, and timeouts may be\n# handled with more precision.\n#\n# The range is between 1 and 500, however a value over 100 is usually not\n# a good idea. Most users should use the default of 10 and raise this up to\n# 100 only in environments where very low latency is required.\nhz 10\n\n# Normally it is useful to have an HZ value which is proportional to the\n# number of clients connected. This is useful in order, for instance, to\n# avoid too many clients are processed for each background task invocation\n# in order to avoid latency spikes.\n#\n# Since the default HZ value by default is conservatively set to 10, Redis\n# offers, and enables by default, the ability to use an adaptive HZ value\n# which will temporary raise when there are many connected clients.\n#\n# When dynamic HZ is enabled, the actual configured HZ will be used as\n# as a baseline, but multiples of the configured HZ value will be actually\n# used as needed once more clients are connected. In this way an idle\n# instance will use very little CPU time while a busy instance will be\n# more responsive.\ndynamic-hz yes\n\n# When a child rewrites the AOF file, if the following option is enabled\n# the file will be fsync-ed every 32 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\naof-rewrite-incremental-fsync yes\n\n# When redis saves RDB file, if the following option is enabled\n# the file will be fsync-ed every 32 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\nrdb-save-incremental-fsync yes\n\n# Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good\n# idea to start with the default settings and only change them after investigating\n# how to improve the performances and how the keys LFU change over time, which\n# is possible to inspect via the OBJECT FREQ command.\n#\n# There are two tunable parameters in the Redis LFU implementation: the\n# counter logarithm factor and the counter decay time. It is important to\n# understand what the two parameters mean before changing them.\n#\n# The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis\n# uses a probabilistic increment with logarithmic behavior. Given the value\n# of the old counter, when a key is accessed, the counter is incremented in\n# this way:\n#\n# 1. A random number R between 0 and 1 is extracted.\n# 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1).\n# 3. The counter is incremented only if R < P.\n#\n# The default lfu-log-factor is 10. This is a table of how the frequency\n# counter changes with a different number of accesses with different\n# logarithmic factors:\n#\n# +--------+------------+------------+------------+------------+------------+\n# | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits |\n# +--------+------------+------------+------------+------------+------------+\n# | 0 | 104 | 255 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 1 | 18 | 49 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 10 | 10 | 18 | 142 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 100 | 8 | 11 | 49 | 143 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n#\n# NOTE: The above table was obtained by running the following commands:\n#\n# redis-benchmark -n 1000000 incr foo\n# redis-cli object freq foo\n#\n# NOTE 2: The counter initial value is 5 in order to give new objects a chance\n# to accumulate hits.\n#\n# The counter decay time is the time, in minutes, that must elapse in order\n# for the key counter to be divided by two (or decremented if it has a value\n# less <= 10).\n#\n# The default value for the lfu-decay-time is 1. A Special value of 0 means to\n# decay the counter every time it happens to be scanned.\n#\n# lfu-log-factor 10\n# lfu-decay-time 1\n\n########################### ACTIVE DEFRAGMENTATION #######################\n#\n# WARNING THIS FEATURE IS EXPERIMENTAL. However it was stress tested\n# even in production and manually tested by multiple engineers for some\n# time.\n#\n# What is active defragmentation?\n# -------------------------------\n#\n# Active (online) defragmentation allows a Redis server to compact the\n# spaces left between small allocations and deallocations of data in memory,\n# thus allowing to reclaim back memory.\n#\n# Fragmentation is a natural process that happens with every allocator (but\n# less so with Jemalloc, fortunately) and certain workloads. Normally a server\n# restart is needed in order to lower the fragmentation, or at least to flush\n# away all the data and create it again. However thanks to this feature\n# implemented by Oran Agra for Redis 4.0 this process can happen at runtime\n# in an \"hot\" way, while the server is running.\n#\n# Basically when the fragmentation is over a certain level (see the\n# configuration options below) Redis will start to create new copies of the\n# values in contiguous memory regions by exploiting certain specific Jemalloc\n# features (in order to understand if an allocation is causing fragmentation\n# and to allocate it in a better place), and at the same time, will release the\n# old copies of the data. This process, repeated incrementally for all the keys\n# will cause the fragmentation to drop back to normal values.\n#\n# Important things to understand:\n#\n# 1. This feature is disabled by default, and only works if you compiled Redis\n# to use the copy of Jemalloc we ship with the source code of Redis.\n# This is the default with Linux builds.\n#\n# 2. You never need to enable this feature if you don't have fragmentation\n# issues.\n#\n# 3. Once you experience fragmentation, you can enable this feature when\n# needed with the command \"CONFIG SET activedefrag yes\".\n#\n# The configuration parameters are able to fine tune the behavior of the\n# defragmentation process. If you are not sure about what they mean it is\n# a good idea to leave the defaults untouched.\n\n# Enabled active defragmentation\n# activedefrag yes\n\n# Minimum amount of fragmentation waste to start active defrag\n# active-defrag-ignore-bytes 100mb\n\n# Minimum percentage of fragmentation to start active defrag\n# active-defrag-threshold-lower 10\n\n# Maximum percentage of fragmentation at which we use maximum effort\n# active-defrag-threshold-upper 100\n\n# Minimal effort for defrag in CPU percentage\n# active-defrag-cycle-min 5\n\n# Maximal effort for defrag in CPU percentage\n# active-defrag-cycle-max 75\n\n# Maximum number of set/hash/zset/list fields that will be processed from\n# the main dictionary scan\n# active-defrag-max-scan-fields 1000\n\n" }, { "path": "aegir/conf/redis/redis6.conf", "content": "# Redis configuration file example.\n#\n# Note that in order to read the configuration file, Redis must be\n# started with the file path as first argument:\n#\n# ./redis-server /path/to/redis.conf\n\n# Note on units: when memory size is needed, it is possible to specify\n# it in the usual form of 1k 5GB 4M and so forth:\n#\n# 1k => 1000 bytes\n# 1kb => 1024 bytes\n# 1m => 1000000 bytes\n# 1mb => 1024*1024 bytes\n# 1g => 1000000000 bytes\n# 1gb => 1024*1024*1024 bytes\n#\n# units are case insensitive so 1GB 1Gb 1gB are all the same.\n\n################################## INCLUDES ###################################\n\n# Include one or more other config files here. This is useful if you\n# have a standard template that goes to all Redis servers but also need\n# to customize a few per-server settings. Include files can include\n# other files, so use this wisely.\n#\n# Note that option \"include\" won't be rewritten by command \"CONFIG REWRITE\"\n# from admin or Redis Sentinel. Since Redis always uses the last processed\n# line as value of a configuration directive, you'd better put includes\n# at the beginning of this file to avoid overwriting config change at runtime.\n#\n# If instead you are interested in using includes to override configuration\n# options, it is better to use include as the last line.\n#\n# include /path/to/local.conf\n# include /path/to/other.conf\n\n################################## MODULES #####################################\n\n# Load modules at startup. If the server is not able to load modules\n# it will abort. It is possible to use multiple loadmodule directives.\n#\n# loadmodule /path/to/my_module.so\n# loadmodule /path/to/other_module.so\n\n################################## NETWORK #####################################\n\n# By default, if no \"bind\" configuration directive is specified, Redis listens\n# for connections from all available network interfaces on the host machine.\n# It is possible to listen to just one or multiple selected interfaces using\n# the \"bind\" configuration directive, followed by one or more IP addresses.\n# Each address can be prefixed by \"-\", which means that redis will not fail to\n# start if the address is not available. Being not available only refers to\n# addresses that does not correspond to any network interfece. Addresses that\n# are already in use will always fail, and unsupported protocols will always BE\n# silently skipped.\n#\n# Examples:\n#\n# xbind 192.168.1.100 10.0.0.1 # listens on two specific IPv4 addresses\n# xbind 127.0.0.1 ::1 # listens on loopback IPv4 and IPv6\n# xbind * -::* # like the default, all available interfaces\n#\n# ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the\n# internet, binding to all the interfaces is dangerous and will expose the\n# instance to everybody on the internet. So by default we uncomment the\n# following bind directive, that will force Redis to listen only on the\n# IPv4 and IPv6 (if available) loopback interface addresses (this means Redis\n# will only be able to accept client connections from the same host that it is\n# running on).\n#\n# IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES\n# JUST COMMENT OUT THE FOLLOWING LINE.\n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nbind 127.0.0.1\n\n# Protected mode is a layer of security protection, in order to avoid that\n# Redis instances left open on the internet are accessed and exploited.\n#\n# When protected mode is on and if:\n#\n# 1) The server is not binding explicitly to a set of addresses using the\n# \"bind\" directive.\n# 2) No password is configured.\n#\n# The server only accepts connections from clients connecting from the\n# IPv4 and IPv6 loopback addresses 127.0.0.1 and ::1, and from Unix domain\n# sockets.\n#\n# By default protected mode is enabled. You should disable it only if\n# you are sure you want clients from other hosts to connect to Redis\n# even if no authentication is configured, nor a specific set of interfaces\n# are explicitly listed using the \"bind\" directive.\nprotected-mode no\n\n# Accept connections on the specified port, default is 6379 (IANA #815344).\n# If port 0 is specified Redis will not listen on a TCP socket.\nport 6379\n\n# TCP listen() backlog.\n#\n# In high requests-per-second environments you need a high backlog in order\n# to avoid slow clients connection issues. Note that the Linux kernel\n# will silently truncate it to the value of /proc/sys/net/core/somaxconn so\n# make sure to raise both the value of somaxconn and tcp_max_syn_backlog\n# in order to get the desired effect.\ntcp-backlog 511\n\n# Unix socket.\n#\n# Specify the path for the Unix socket that will be used to listen for\n# incoming connections. There is no default, so Redis will not listen\n# on a unix socket when not specified.\n#\n# unixsocket /run/redis/redis.sock\n# unixsocketperm 777\n\n# Close the connection after a client is idle for N seconds (0 to disable)\ntimeout 900\n\n# TCP keepalive.\n#\n# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence\n# of communication. This is useful for two reasons:\n#\n# 1) Detect dead peers.\n# 2) Force network equipment in the middle to consider the connection to be\n# alive.\n#\n# On Linux, the specified value (in seconds) is the period used to send ACKs.\n# Note that to close the connection the double of the time is needed.\n# On other kernels the period depends on the kernel configuration.\n#\n# A reasonable value for this option is 300 seconds, which is the new\n# Redis default starting with Redis 3.2.1.\ntcp-keepalive 300\n\n################################# TLS/SSL #####################################\n\n# By default, TLS/SSL is disabled. To enable it, the \"tls-port\" configuration\n# directive can be used to define TLS-listening ports. To enable TLS on the\n# default port, use:\n#\n# port 0\n# tls-port 6379\n\n# Configure a X.509 certificate and private key to use for authenticating the\n# server to connected clients, masters or cluster peers. These files should be\n# PEM formatted.\n#\n# tls-cert-file redis.crt\n# tls-key-file redis.key\n#\n# If the key file is encrypted using a passphrase, it can be included here\n# as well.\n#\n# tls-key-file-pass secret\n\n# Normally Redis uses the same certificate for both server functions (accepting\n# connections) and client functions (replicating from a master, establishing\n# cluster bus connections, etc.).\n#\n# Sometimes certificates are issued with attributes that designate them as\n# client-only or server-only certificates. In that case it may be desired to use\n# different certificates for incoming (server) and outgoing (client)\n# connections. To do that, use the following directives:\n#\n# tls-client-cert-file client.crt\n# tls-client-key-file client.key\n#\n# If the key file is encrypted using a passphrase, it can be included here\n# as well.\n#\n# tls-client-key-file-pass secret\n\n# Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange,\n# required by older versions of OpenSSL (<3.0). Newer versions do not require\n# this configuration and recommend against it.\n#\n# tls-dh-params-file redis.dh\n\n# Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL\n# clients and peers. Redis requires an explicit configuration of at least one\n# of these, and will not implicitly use the system wide configuration.\n#\n# tls-ca-cert-file ca.crt\n# tls-ca-cert-dir /etc/ssl/certs\n\n# By default, clients (including replica servers) on a TLS port are required\n# to authenticate using valid client side certificates.\n#\n# If \"no\" is specified, client certificates are not required and not accepted.\n# If \"optional\" is specified, client certificates are accepted and must be\n# valid if provided, but are not required.\n#\n# tls-auth-clients no\n# tls-auth-clients optional\n\n# By default, a Redis replica does not attempt to establish a TLS connection\n# with its master.\n#\n# Use the following directive to enable TLS on replication links.\n#\n# tls-replication yes\n\n# By default, the Redis Cluster bus uses a plain TCP connection. To enable\n# TLS for the bus protocol, use the following directive:\n#\n# tls-cluster yes\n\n# By default, only TLSv1.2 and TLSv1.3 are enabled and it is highly recommended\n# that older formally deprecated versions are kept disabled to reduce the attack surface.\n# You can explicitly specify TLS versions to support.\n# Allowed values are case insensitive and include \"TLSv1\", \"TLSv1.1\", \"TLSv1.2\",\n# \"TLSv1.3\" (OpenSSL >= 1.1.1) or any combination.\n# To enable only TLSv1.2 and TLSv1.3, use:\n#\n# tls-protocols \"TLSv1.2 TLSv1.3\"\n\n# Configure allowed ciphers. See the ciphers(1ssl) manpage for more information\n# about the syntax of this string.\n#\n# Note: this configuration applies only to <= TLSv1.2.\n#\n# tls-ciphers DEFAULT:!MEDIUM\n\n# Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more\n# information about the syntax of this string, and specifically for TLSv1.3\n# ciphersuites.\n#\n# tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256\n\n# When choosing a cipher, use the server's preference instead of the client\n# preference. By default, the server follows the client's preference.\n#\n# tls-prefer-server-ciphers yes\n\n# By default, TLS session caching is enabled to allow faster and less expensive\n# reconnections by clients that support it. Use the following directive to disable\n# caching.\n#\n# tls-session-caching no\n\n# Change the default number of TLS sessions cached. A zero value sets the cache\n# to unlimited size. The default size is 20480.\n#\n# tls-session-cache-size 5000\n\n# Change the default timeout of cached TLS sessions. The default timeout is 300\n# seconds.\n#\n# tls-session-cache-timeout 60\n\n################################# GENERAL #####################################\n\n# By default Redis does not run as a daemon. Use 'yes' if you need it.\n# Note that Redis will write a pid file in /run/redis.pid when daemonized.\n# When Redis is supervised by upstart or systemd, this parameter has no impact.\ndaemonize yes\n\n# If you run Redis from upstart or systemd, Redis can interact with your\n# supervision tree. Options:\n# supervised no - no supervision interaction\n# supervised upstart - signal upstart by putting Redis into SIGSTOP mode\n# requires \"expect stop\" in your upstart job config\n# supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET\n# on startup, and updating Redis status on a regular\n# basis.\n# supervised auto - detect upstart or systemd method based on\n# UPSTART_JOB or NOTIFY_SOCKET environment variables\n# Note: these supervision methods only signal \"process is ready.\"\n# They do not enable continuous pings back to your supervisor.\n#\n# The default is \"no\". To run under upstart/systemd, you can simply uncomment\n# the line below:\n#\n# supervised auto\n\n# If a pid file is specified, Redis writes it where specified at startup\n# and removes it at exit.\n#\n# When the server runs non daemonized, no pid file is created if none is\n# specified in the configuration. When the server is daemonized, the pid file\n# is used even if not specified, defaulting to \"/run/redis.pid\".\n#\n# Creating a pid file is best effort: if Redis is not able to create it\n# nothing bad happens, the server will start and run normally.\n#\n# Note that on modern Linux systems \"/run/redis.pid\" is more conforming\n# and should be used instead.\npidfile /run/redis/redis.pid\n\n# Specify the server verbosity level.\n# This can be one of:\n# debug (a lot of information, useful for development/testing)\n# verbose (many rarely useful info, but not a mess like the debug level)\n# notice (moderately verbose, what you want in production probably)\n# warning (only very important / critical messages are logged)\nloglevel warning\n\n# Specify the log file name. Also the empty string can be used to force\n# Redis to log on the standard output. Note that if you use standard\n# output for logging but daemonize, logs will be sent to /dev/null\nlogfile /var/log/redis/redis-server.log\n\n# To enable logging to the system logger, just set 'syslog-enabled' to yes,\n# and optionally update the other syslog parameters to suit your needs.\n# syslog-enabled no\n\n# Specify the syslog identity.\n# syslog-ident redis\n\n# Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.\n# syslog-facility local0\n\n# To disable the built in crash log, which will possibly produce cleaner core\n# dumps when they are needed, uncomment the following:\n#\n# crash-log-enabled no\n\n# To disable the fast memory check that's run as part of the crash log, which\n# will possibly let redis terminate sooner, uncomment the following:\n#\n# crash-memcheck-enabled no\n\n# Set the number of databases. The default database is DB 0, you can select\n# a different one on a per-connection basis using SELECT where\n# dbid is a number between 0 and 'databases'-1\ndatabases 8\n\n# By default Redis shows an ASCII art logo only when started to log to the\n# standard output and if the standard output is a TTY and syslog logging is\n# disabled. Basically this means that normally a logo is displayed only in\n# interactive sessions.\n#\n# However it is possible to force the pre-4.0 behavior and always show a\n# ASCII art logo in startup logs by setting the following option to yes.\nalways-show-logo no\n\n# By default, Redis modifies the process title (as seen in 'top' and 'ps') to\n# provide some runtime information. It is possible to disable this and leave\n# the process name as executed by setting the following to no.\nset-proc-title yes\n\n# When changing the process title, Redis uses the following template to construct\n# the modified title.\n#\n# Template variables are specified in curly brackets. The following variables are\n# supported:\n#\n# {title} Name of process as executed if parent, or type of child process.\n# {listen-addr} Bind address or '*' followed by TCP or TLS port listening on, or\n# Unix socket if only that's available.\n# {server-mode} Special mode, i.e. \"[sentinel]\" or \"[cluster]\".\n# {port} TCP port listening on, or 0.\n# {tls-port} TLS port listening on, or 0.\n# {unixsocket} Unix domain socket listening on, or \"\".\n# {config-file} Name of configuration file used.\n#\nproc-title-template \"{title} {listen-addr} {server-mode}\"\n\n################################ SNAPSHOTTING ################################\n\n# Save the DB to disk.\n#\n# save \n#\n# Redis will save the DB if both the given number of seconds and the given\n# number of write operations against the DB occurred.\n#\n# Snapshotting can be completely disabled with a single empty string argument\n# as in following example:\n#\n# save \"\"\n#\n# Unless specified otherwise, by default Redis will save the DB:\n# * After 3600 seconds (an hour) if at least 1 key changed\n# * After 300 seconds (5 minutes) if at least 100 keys changed\n# * After 60 seconds if at least 10000 keys changed\n#\n# You can set these explicitly by uncommenting the three following lines.\n#\n# save 3600 1\n# save 300 100\n# save 60 10000\n\n# By default Redis will stop accepting writes if RDB snapshots are enabled\n# (at least one save point) and the latest background save failed.\n# This will make the user aware (in a hard way) that data is not persisting\n# on disk properly, otherwise chances are that no one will notice and some\n# disaster will happen.\n#\n# If the background saving process will start working again Redis will\n# automatically allow writes again.\n#\n# However if you have setup your proper monitoring of the Redis server\n# and persistence, you may want to disable this feature so that Redis will\n# continue to work as usual even if there are problems with disk,\n# permissions, and so forth.\nstop-writes-on-bgsave-error no\n\n# Compress string objects using LZF when dump .rdb databases?\n# By default compression is enabled as it's almost always a win.\n# If you want to save some CPU in the saving child set it to 'no' but\n# the dataset will likely be bigger if you have compressible values or keys.\nrdbcompression yes\n\n# Since version 5 of RDB a CRC64 checksum is placed at the end of the file.\n# This makes the format more resistant to corruption but there is a performance\n# hit to pay (around 10%) when saving and loading RDB files, so you can disable it\n# for maximum performances.\n#\n# RDB files created with checksum disabled have a checksum of zero that will\n# tell the loading code to skip the check.\nrdbchecksum no\n\n# Enables or disables full sanitation checks for ziplist and listpack etc when\n# loading an RDB or RESTORE payload. This reduces the chances of a assertion or\n# crash later on while processing commands.\n# Options:\n# no - Never perform full sanitation\n# yes - Always perform full sanitation\n# clients - Perform full sanitation only for user connections.\n# Excludes: RDB files, RESTORE commands received from the master\n# connection, and client connections which have the\n# skip-sanitize-payload ACL flag.\n# The default should be 'clients' but since it currently affects cluster\n# resharding via MIGRATE, it is temporarily set to 'no' by default.\n#\n# sanitize-dump-payload no\n\n# The filename where to dump the DB\ndbfilename dump.rdb\n\n# Remove RDB files used by replication in instances without persistence\n# enabled. By default this option is disabled, however there are environments\n# where for regulations or other security concerns, RDB files persisted on\n# disk by masters in order to feed replicas, or stored on disk by replicas\n# in order to load them for the initial synchronization, should be deleted\n# ASAP. Note that this option ONLY WORKS in instances that have both AOF\n# and RDB persistence disabled, otherwise is completely ignored.\n#\n# An alternative (and sometimes better) way to obtain the same effect is\n# to use diskless replication on both master and replicas instances. However\n# in the case of replicas, diskless is not always an option.\nrdb-del-sync-files no\n\n# The working directory.\n#\n# The DB will be written inside this directory, with the filename specified\n# above using the 'dbfilename' configuration directive.\n#\n# The Append Only File will also be created inside this directory.\n#\n# Note that you must specify a directory here, not a file name.\ndir /var/lib/redis/\n\n################################# REPLICATION #################################\n\n# Master-Replica replication. Use replicaof to make a Redis instance a copy of\n# another Redis server. A few things to understand ASAP about Redis replication.\n#\n# +------------------+ +---------------+\n# | Master | ---> | Replica |\n# | (receive writes) | | (exact copy) |\n# +------------------+ +---------------+\n#\n# 1) Redis replication is asynchronous, but you can configure a master to\n# stop accepting writes if it appears to be not connected with at least\n# a given number of replicas.\n# 2) Redis replicas are able to perform a partial resynchronization with the\n# master if the replication link is lost for a relatively small amount of\n# time. You may want to configure the replication backlog size (see the next\n# sections of this file) with a sensible value depending on your needs.\n# 3) Replication is automatic and does not need user intervention. After a\n# network partition replicas automatically try to reconnect to masters\n# and resynchronize with them.\n#\n# replicaof \n\n# If the master is password protected (using the \"requirepass\" configuration\n# directive below) it is possible to tell the replica to authenticate before\n# starting the replication synchronization process, otherwise the master will\n# refuse the replica request.\n#\n# masterauth \n#\n# However this is not enough if you are using Redis ACLs (for Redis version\n# 6 or greater), and the default user is not capable of running the PSYNC\n# command and/or other commands needed for replication. In this case it's\n# better to configure a special user to use with replication, and specify the\n# masteruser configuration as such:\n#\n# masteruser \n#\n# When masteruser is specified, the replica will authenticate against its\n# master using the new AUTH form: AUTH .\n\n# When a replica loses its connection with the master, or when the replication\n# is still in progress, the replica can act in two different ways:\n#\n# 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will\n# still reply to client requests, possibly with out of date data, or the\n# data set may just be empty if this is the first synchronization.\n#\n# 2) If replica-serve-stale-data is set to 'no' the replica will reply with\n# an error \"SYNC with master in progress\" to all commands except:\n# INFO, REPLICAOF, AUTH, PING, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE,\n# UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST,\n# HOST and LATENCY.\n#\nreplica-serve-stale-data yes\n\n# You can configure a replica instance to accept writes or not. Writing against\n# a replica instance may be useful to store some ephemeral data (because data\n# written on a replica will be easily deleted after resync with the master) but\n# may also cause problems if clients are writing to it because of a\n# misconfiguration.\n#\n# Since Redis 2.6 by default replicas are read-only.\n#\n# Note: read only replicas are not designed to be exposed to untrusted clients\n# on the internet. It's just a protection layer against misuse of the instance.\n# Still a read only replica exports by default all the administrative commands\n# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve\n# security of read only replicas using 'rename-command' to shadow all the\n# administrative / dangerous commands.\nreplica-read-only yes\n\n# Replication SYNC strategy: disk or socket.\n#\n# New replicas and reconnecting replicas that are not able to continue the\n# replication process just receiving differences, need to do what is called a\n# \"full synchronization\". An RDB file is transmitted from the master to the\n# replicas.\n#\n# The transmission can happen in two different ways:\n#\n# 1) Disk-backed: The Redis master creates a new process that writes the RDB\n# file on disk. Later the file is transferred by the parent\n# process to the replicas incrementally.\n# 2) Diskless: The Redis master creates a new process that directly writes the\n# RDB file to replica sockets, without touching the disk at all.\n#\n# With disk-backed replication, while the RDB file is generated, more replicas\n# can be queued and served with the RDB file as soon as the current child\n# producing the RDB file finishes its work. With diskless replication instead\n# once the transfer starts, new replicas arriving will be queued and a new\n# transfer will start when the current one terminates.\n#\n# When diskless replication is used, the master waits a configurable amount of\n# time (in seconds) before starting the transfer in the hope that multiple\n# replicas will arrive and the transfer can be parallelized.\n#\n# With slow disks and fast (large bandwidth) networks, diskless replication\n# works better.\nrepl-diskless-sync no\n\n# When diskless replication is enabled, it is possible to configure the delay\n# the server waits in order to spawn the child that transfers the RDB via socket\n# to the replicas.\n#\n# This is important since once the transfer starts, it is not possible to serve\n# new replicas arriving, that will be queued for the next RDB transfer, so the\n# server waits a delay in order to let more replicas arrive.\n#\n# The delay is specified in seconds, and by default is 5 seconds. To disable\n# it entirely just set it to 0 seconds and the transfer will start ASAP.\nrepl-diskless-sync-delay 5\n\n# -----------------------------------------------------------------------------\n# WARNING: RDB diskless load is experimental. Since in this setup the replica\n# does not immediately store an RDB on disk, it may cause data loss during\n# failovers. RDB diskless load + Redis modules not handling I/O reads may also\n# cause Redis to abort in case of I/O errors during the initial synchronization\n# stage with the master. Use only if you know what you are doing.\n# -----------------------------------------------------------------------------\n#\n# Replica can load the RDB it reads from the replication link directly from the\n# socket, or store the RDB to a file and read that file after it was completely\n# received from the master.\n#\n# In many cases the disk is slower than the network, and storing and loading\n# the RDB file may increase replication time (and even increase the master's\n# Copy on Write memory and salve buffers).\n# However, parsing the RDB file directly from the socket may mean that we have\n# to flush the contents of the current database before the full rdb was\n# received. For this reason we have the following options:\n#\n# \"disabled\" - Don't use diskless load (store the rdb file to the disk first)\n# \"on-empty-db\" - Use diskless load only when it is completely safe.\n# \"swapdb\" - Keep a copy of the current db contents in RAM while parsing\n# the data directly from the socket. note that this requires\n# sufficient memory, if you don't have it, you risk an OOM kill.\nrepl-diskless-load disabled\n\n# Replicas send PINGs to server in a predefined interval. It's possible to\n# change this interval with the repl_ping_replica_period option. The default\n# value is 10 seconds.\n#\n# repl-ping-replica-period 10\n\n# The following option sets the replication timeout for:\n#\n# 1) Bulk transfer I/O during SYNC, from the point of view of replica.\n# 2) Master timeout from the point of view of replicas (data, pings).\n# 3) Replica timeout from the point of view of masters (REPLCONF ACK pings).\n#\n# It is important to make sure that this value is greater than the value\n# specified for repl-ping-replica-period otherwise a timeout will be detected\n# every time there is low traffic between the master and the replica. The default\n# value is 60 seconds.\n#\n# repl-timeout 60\n\n# Disable TCP_NODELAY on the replica socket after SYNC?\n#\n# If you select \"yes\" Redis will use a smaller number of TCP packets and\n# less bandwidth to send data to replicas. But this can add a delay for\n# the data to appear on the replica side, up to 40 milliseconds with\n# Linux kernels using a default configuration.\n#\n# If you select \"no\" the delay for data to appear on the replica side will\n# be reduced but more bandwidth will be used for replication.\n#\n# By default we optimize for low latency, but in very high traffic conditions\n# or when the master and replicas are many hops away, turning this to \"yes\" may\n# be a good idea.\nrepl-disable-tcp-nodelay no\n\n# Set the replication backlog size. The backlog is a buffer that accumulates\n# replica data when replicas are disconnected for some time, so that when a\n# replica wants to reconnect again, often a full resync is not needed, but a\n# partial resync is enough, just passing the portion of data the replica\n# missed while disconnected.\n#\n# The bigger the replication backlog, the longer the replica can endure the\n# disconnect and later be able to perform a partial resynchronization.\n#\n# The backlog is only allocated if there is at least one replica connected.\n#\n# repl-backlog-size 1mb\n\n# After a master has no connected replicas for some time, the backlog will be\n# freed. The following option configures the amount of seconds that need to\n# elapse, starting from the time the last replica disconnected, for the backlog\n# buffer to be freed.\n#\n# Note that replicas never free the backlog for timeout, since they may be\n# promoted to masters later, and should be able to correctly \"partially\n# resynchronize\" with other replicas: hence they should always accumulate backlog.\n#\n# A value of 0 means to never release the backlog.\n#\n# repl-backlog-ttl 3600\n\n# The replica priority is an integer number published by Redis in the INFO\n# output. It is used by Redis Sentinel in order to select a replica to promote\n# into a master if the master is no longer working correctly.\n#\n# A replica with a low priority number is considered better for promotion, so\n# for instance if there are three replicas with priority 10, 100, 25 Sentinel\n# will pick the one with priority 10, that is the lowest.\n#\n# However a special priority of 0 marks the replica as not able to perform the\n# role of master, so a replica with priority of 0 will never be selected by\n# Redis Sentinel for promotion.\n#\n# By default the priority is 100.\nreplica-priority 100\n\n# -----------------------------------------------------------------------------\n# By default, Redis Sentinel includes all replicas in its reports. A replica\n# can be excluded from Redis Sentinel's announcements. An unannounced replica\n# will be ignored by the 'sentinel replicas ' command and won't be\n# exposed to Redis Sentinel's clients.\n#\n# This option does not change the behavior of replica-priority. Even with\n# replica-announced set to 'no', the replica can be promoted to master. To\n# prevent this behavior, set replica-priority to 0.\n#\n# replica-announced yes\n\n# It is possible for a master to stop accepting writes if there are less than\n# N replicas connected, having a lag less or equal than M seconds.\n#\n# The N replicas need to be in \"online\" state.\n#\n# The lag in seconds, that must be <= the specified value, is calculated from\n# the last ping received from the replica, that is usually sent every second.\n#\n# This option does not GUARANTEE that N replicas will accept the write, but\n# will limit the window of exposure for lost writes in case not enough replicas\n# are available, to the specified number of seconds.\n#\n# For example to require at least 3 replicas with a lag <= 10 seconds use:\n#\n# min-replicas-to-write 3\n# min-replicas-max-lag 10\n#\n# Setting one or the other to 0 disables the feature.\n#\n# By default min-replicas-to-write is set to 0 (feature disabled) and\n# min-replicas-max-lag is set to 10.\n\n# A Redis master is able to list the address and port of the attached\n# replicas in different ways. For example the \"INFO replication\" section\n# offers this information, which is used, among other tools, by\n# Redis Sentinel in order to discover replica instances.\n# Another place where this info is available is in the output of the\n# \"ROLE\" command of a master.\n#\n# The listed IP address and port normally reported by a replica is\n# obtained in the following way:\n#\n# IP: The address is auto detected by checking the peer address\n# of the socket used by the replica to connect with the master.\n#\n# Port: The port is communicated by the replica during the replication\n# handshake, and is normally the port that the replica is using to\n# listen for connections.\n#\n# However when port forwarding or Network Address Translation (NAT) is\n# used, the replica may actually be reachable via different IP and port\n# pairs. The following two options can be used by a replica in order to\n# report to its master a specific set of IP and port, so that both INFO\n# and ROLE will report those values.\n#\n# There is no need to use both the options if you need to override just\n# the port or the IP address.\n#\n# replica-announce-ip 5.5.5.5\n# replica-announce-port 1234\n\n############################### KEYS TRACKING #################################\n\n# Redis implements server assisted support for client side caching of values.\n# This is implemented using an invalidation table that remembers, using\n# a radix key indexed by key name, what clients have which keys. In turn\n# this is used in order to send invalidation messages to clients. Please\n# check this page to understand more about the feature:\n#\n# https://redis.io/topics/client-side-caching\n#\n# When tracking is enabled for a client, all the read only queries are assumed\n# to be cached: this will force Redis to store information in the invalidation\n# table. When keys are modified, such information is flushed away, and\n# invalidation messages are sent to the clients. However if the workload is\n# heavily dominated by reads, Redis could use more and more memory in order\n# to track the keys fetched by many clients.\n#\n# For this reason it is possible to configure a maximum fill value for the\n# invalidation table. By default it is set to 1M of keys, and once this limit\n# is reached, Redis will start to evict keys in the invalidation table\n# even if they were not modified, just to reclaim memory: this will in turn\n# force the clients to invalidate the cached values. Basically the table\n# maximum size is a trade off between the memory you want to spend server\n# side to track information about who cached what, and the ability of clients\n# to retain cached objects in memory.\n#\n# If you set the value to 0, it means there are no limits, and Redis will\n# retain as many keys as needed in the invalidation table.\n# In the \"stats\" INFO section, you can find information about the number of\n# keys in the invalidation table at every given moment.\n#\n# Note: when key tracking is used in broadcasting mode, no memory is used\n# in the server side so this setting is useless.\n#\n# tracking-table-max-keys 1000000\n\n################################## SECURITY ###################################\n\n# Warning: since Redis is pretty fast, an outside user can try up to\n# 1 million passwords per second against a modern box. This means that you\n# should use very strong passwords, otherwise they will be very easy to break.\n# Note that because the password is really a shared secret between the client\n# and the server, and should not be memorized by any human, the password\n# can be easily a long string from /dev/urandom or whatever, so by using a\n# long and unguessable password no brute force attack will be possible.\n\n# Redis ACL users are defined in the following format:\n#\n# user ... acl rules ...\n#\n# For example:\n#\n# user worker +@list +@connection ~jobs:* on >ffa9203c493aa99\n#\n# The special username \"default\" is used for new connections. If this user\n# has the \"nopass\" rule, then new connections will be immediately authenticated\n# as the \"default\" user without the need of any password provided via the\n# AUTH command. Otherwise if the \"default\" user is not flagged with \"nopass\"\n# the connections will start in not authenticated state, and will require\n# AUTH (or the HELLO command AUTH option) in order to be authenticated and\n# start to work.\n#\n# The ACL rules that describe what a user can do are the following:\n#\n# on Enable the user: it is possible to authenticate as this user.\n# off Disable the user: it's no longer possible to authenticate\n# with this user, however the already authenticated connections\n# will still work.\n# skip-sanitize-payload RESTORE dump-payload sanitation is skipped.\n# sanitize-payload RESTORE dump-payload is sanitized (default).\n# + Allow the execution of that command\n# - Disallow the execution of that command\n# +@ Allow the execution of all the commands in such category\n# with valid categories are like @admin, @set, @sortedset, ...\n# and so forth, see the full list in the server.c file where\n# the Redis command table is described and defined.\n# The special category @all means all the commands, but currently\n# present in the server, and that will be loaded in the future\n# via modules.\n# +|subcommand Allow a specific subcommand of an otherwise\n# disabled command. Note that this form is not\n# allowed as negative like -DEBUG|SEGFAULT, but\n# only additive starting with \"+\".\n# allcommands Alias for +@all. Note that it implies the ability to execute\n# all the future commands loaded via the modules system.\n# nocommands Alias for -@all.\n# ~ Add a pattern of keys that can be mentioned as part of\n# commands. For instance ~* allows all the keys. The pattern\n# is a glob-style pattern like the one of KEYS.\n# It is possible to specify multiple patterns.\n# allkeys Alias for ~*\n# resetkeys Flush the list of allowed keys patterns.\n# & Add a glob-style pattern of Pub/Sub channels that can be\n# accessed by the user. It is possible to specify multiple channel\n# patterns.\n# allchannels Alias for &*\n# resetchannels Flush the list of allowed channel patterns.\n# > Add this password to the list of valid password for the user.\n# For example >mypass will add \"mypass\" to the list.\n# This directive clears the \"nopass\" flag (see later).\n# < Remove this password from the list of valid passwords.\n# nopass All the set passwords of the user are removed, and the user\n# is flagged as requiring no password: it means that every\n# password will work against this user. If this directive is\n# used for the default user, every new connection will be\n# immediately authenticated with the default user without\n# any explicit AUTH command required. Note that the \"resetpass\"\n# directive will clear this condition.\n# resetpass Flush the list of allowed passwords. Moreover removes the\n# \"nopass\" status. After \"resetpass\" the user has no associated\n# passwords and there is no way to authenticate without adding\n# some password (or setting it as \"nopass\" later).\n# reset Performs the following actions: resetpass, resetkeys, off,\n# -@all. The user returns to the same state it has immediately\n# after its creation.\n#\n# ACL rules can be specified in any order: for instance you can start with\n# passwords, then flags, or key patterns. However note that the additive\n# and subtractive rules will CHANGE MEANING depending on the ordering.\n# For instance see the following example:\n#\n# user alice on +@all -DEBUG ~* >somepassword\n#\n# This will allow \"alice\" to use all the commands with the exception of the\n# DEBUG command, since +@all added all the commands to the set of the commands\n# alice can use, and later DEBUG was removed. However if we invert the order\n# of two ACL rules the result will be different:\n#\n# user alice on -DEBUG +@all ~* >somepassword\n#\n# Now DEBUG was removed when alice had yet no commands in the set of allowed\n# commands, later all the commands are added, so the user will be able to\n# execute everything.\n#\n# Basically ACL rules are processed left-to-right.\n#\n# For more information about ACL configuration please refer to\n# the Redis web site at https://redis.io/topics/acl\n\n# ACL LOG\n#\n# The ACL Log tracks failed commands and authentication events associated\n# with ACLs. The ACL Log is useful to troubleshoot failed commands blocked\n# by ACLs. The ACL Log is stored in memory. You can reclaim memory with\n# ACL LOG RESET. Define the maximum entry length of the ACL Log below.\nacllog-max-len 128\n\n# Using an external ACL file\n#\n# Instead of configuring users here in this file, it is possible to use\n# a stand-alone file just listing users. The two methods cannot be mixed:\n# if you configure users here and at the same time you activate the external\n# ACL file, the server will refuse to start.\n#\n# The format of the external ACL user file is exactly the same as the\n# format that is used inside redis.conf to describe users.\n#\n# aclfile /etc/redis/users.acl\n\n# IMPORTANT NOTE: starting with Redis 6 \"requirepass\" is just a compatibility\n# layer on top of the new ACL system. The option effect will be just setting\n# the password for the default user. Clients will still authenticate using\n# AUTH as usually, or more explicitly with AUTH default \n# if they follow the new protocol: both will work.\n#\n# The requirepass is not compatable with aclfile option and the ACL LOAD\n# command, these will cause requirepass to be ignored.\n#\n# requirepass isfoobared\n\n# New users are initialized with restrictive permissions by default, via the\n# equivalent of this ACL rule 'off resetkeys -@all'. Starting with Redis 6.2, it\n# is possible to manage access to Pub/Sub channels with ACL rules as well. The\n# default Pub/Sub channels permission if new users is controlled by the\n# acl-pubsub-default configuration directive, which accepts one of these values:\n#\n# allchannels: grants access to all Pub/Sub channels\n# resetchannels: revokes access to all Pub/Sub channels\n#\n# To ensure backward compatibility while upgrading Redis 6.0, acl-pubsub-default\n# defaults to the 'allchannels' permission.\n#\n# Future compatibility note: it is very likely that in a future version of Redis\n# the directive's default of 'allchannels' will be changed to 'resetchannels' in\n# order to provide better out-of-the-box Pub/Sub security. Therefore, it is\n# recommended that you explicitly define Pub/Sub permissions for all users\n# rather then rely on implicit default values. Once you've set explicit\n# Pub/Sub for all existing users, you should uncomment the following line.\n#\n# acl-pubsub-default resetchannels\n\n# Command renaming (DEPRECATED).\n#\n# ------------------------------------------------------------------------\n# WARNING: avoid using this option if possible. Instead use ACLs to remove\n# commands from the default user, and put them only in some admin user you\n# create for administrative purposes.\n# ------------------------------------------------------------------------\n#\n# It is possible to change the name of dangerous commands in a shared\n# environment. For instance the CONFIG command may be renamed into something\n# hard to guess so that it will still be available for internal-use tools\n# but not available for general clients.\n#\n# Example:\n#\n# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52\n#\n# It is also possible to completely kill a command by renaming it into\n# an empty string:\n#\n# rename-command CONFIG \"\"\n#\n# Please note that changing the name of commands that are logged into the\n# AOF file or transmitted to replicas may cause problems.\n\n################################### CLIENTS ####################################\n\n# Set the max number of connected clients at the same time. By default\n# this limit is set to 10000 clients, however if the Redis server is not\n# able to configure the process file limit to allow for the specified limit\n# the max number of allowed clients is set to the current file limit\n# minus 32 (as Redis reserves a few file descriptors for internal uses).\n#\n# Once the limit is reached Redis will close all the new connections sending\n# an error 'max number of clients reached'.\n#\n# IMPORTANT: When Redis Cluster is used, the max number of connections is also\n# shared with the cluster bus: every node in the cluster will use two\n# connections, one incoming and another outgoing. It is important to size the\n# limit accordingly in case of very large clusters.\n#\nmaxclients 4000\n\n############################## MEMORY MANAGEMENT ################################\n\n# Set a memory usage limit to the specified amount of bytes.\n# When the memory limit is reached Redis will try to remove keys\n# according to the eviction policy selected (see maxmemory-policy).\n#\n# If Redis can't remove keys according to the policy, or if the policy is\n# set to 'noeviction', Redis will start to reply with errors to commands\n# that would use more memory, like SET, LPUSH, and so on, and will continue\n# to reply to read-only commands like GET.\n#\n# This option is usually useful when using Redis as an LRU or LFU cache, or to\n# set a hard memory limit for an instance (using the 'noeviction' policy).\n#\n# WARNING: If you have replicas attached to an instance with maxmemory on,\n# the size of the output buffers needed to feed the replicas are subtracted\n# from the used memory count, so that network problems / resyncs will\n# not trigger a loop where keys are evicted, and in turn the output\n# buffer of replicas is full with DELs of keys evicted triggering the deletion\n# of more keys, and so forth until the database is completely emptied.\n#\n# In short... if you have replicas attached it is suggested that you set a lower\n# limit for maxmemory so that there is some free RAM on the system for replica\n# output buffers (but this is not needed if the policy is 'noeviction').\n#\nmaxmemory 88MB\n\n# MAXMEMORY POLICY: how Redis will select what to remove when maxmemory\n# is reached. You can select one from the following behaviors:\n#\n# volatile-lru -> Evict using approximated LRU, only keys with an expire set.\n# allkeys-lru -> Evict any key using approximated LRU.\n# volatile-lfu -> Evict using approximated LFU, only keys with an expire set.\n# allkeys-lfu -> Evict any key using approximated LFU.\n# volatile-random -> Remove a random key having an expire set.\n# allkeys-random -> Remove a random key, any key.\n# volatile-ttl -> Remove the key with the nearest expire time (minor TTL)\n# noeviction -> Don't evict anything, just return an error on write operations.\n#\n# LRU means Least Recently Used\n# LFU means Least Frequently Used\n#\n# Both LRU, LFU and volatile-ttl are implemented using approximated\n# randomized algorithms.\n#\n# Note: with any of the above policies, when there are no suitable keys for\n# eviction, Redis will return an error on write operations that require\n# more memory. These are usually commands that create new keys, add data or\n# modify existing keys. A few examples are: SET, INCR, HSET, LPUSH, SUNIONSTORE,\n# SORT (due to the STORE argument), and EXEC (if the transaction includes any\n# command that requires memory).\n#\n# The default is: noeviction\n#\nmaxmemory-policy allkeys-lru\n\n# LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated\n# algorithms (in order to save memory), so you can tune it for speed or\n# accuracy. By default Redis will check five keys and pick the one that was\n# used least recently, you can change the sample size using the following\n# configuration directive.\n#\n# The default of 5 produces good enough results. 10 Approximates very closely\n# true LRU but costs more CPU. 3 is faster but not very accurate.\n#\n# maxmemory-samples 5\n\n# Eviction processing is designed to function well with the default setting.\n# If there is an unusually large amount of write traffic, this value may need to\n# be increased. Decreasing this value may reduce latency at the risk of\n# eviction processing effectiveness\n# 0 = minimum latency, 10 = default, 100 = process without regard to latency\n#\n# maxmemory-eviction-tenacity 10\n\n# Starting from Redis 5, by default a replica will ignore its maxmemory setting\n# (unless it is promoted to master after a failover or manually). It means\n# that the eviction of keys will be just handled by the master, sending the\n# DEL commands to the replica as keys evict in the master side.\n#\n# This behavior ensures that masters and replicas stay consistent, and is usually\n# what you want, however if your replica is writable, or you want the replica\n# to have a different memory setting, and you are sure all the writes performed\n# to the replica are idempotent, then you may change this default (but be sure\n# to understand what you are doing).\n#\n# Note that since the replica by default does not evict, it may end using more\n# memory than the one set via maxmemory (there are certain buffers that may\n# be larger on the replica, or data structures may sometimes take more memory\n# and so forth). So make sure you monitor your replicas and make sure they\n# have enough memory to never hit a real out-of-memory condition before the\n# master hits the configured maxmemory setting.\n#\n# replica-ignore-maxmemory yes\n\n# Redis reclaims expired keys in two ways: upon access when those keys are\n# found to be expired, and also in background, in what is called the\n# \"active expire key\". The key space is slowly and interactively scanned\n# looking for expired keys to reclaim, so that it is possible to free memory\n# of keys that are expired and will never be accessed again in a short time.\n#\n# The default effort of the expire cycle will try to avoid having more than\n# ten percent of expired keys still in memory, and will try to avoid consuming\n# more than 25% of total memory and to add latency to the system. However\n# it is possible to increase the expire \"effort\" that is normally set to\n# \"1\", to a greater value, up to the value \"10\". At its maximum value the\n# system will use more CPU, longer cycles (and technically may introduce\n# more latency), and will tolerate less already expired keys still present\n# in the system. It's a tradeoff between memory, CPU and latency.\n#\n# active-expire-effort 1\n\n############################# LAZY FREEING ####################################\n\n# Redis has two primitives to delete keys. One is called DEL and is a blocking\n# deletion of the object. It means that the server stops processing new commands\n# in order to reclaim all the memory associated with an object in a synchronous\n# way. If the key deleted is associated with a small object, the time needed\n# in order to execute the DEL command is very small and comparable to most other\n# O(1) or O(log_N) commands in Redis. However if the key is associated with an\n# aggregated value containing millions of elements, the server can block for\n# a long time (even seconds) in order to complete the operation.\n#\n# For the above reasons Redis also offers non blocking deletion primitives\n# such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and\n# FLUSHDB commands, in order to reclaim memory in background. Those commands\n# are executed in constant time. Another thread will incrementally free the\n# object in the background as fast as possible.\n#\n# DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled.\n# It's up to the design of the application to understand when it is a good\n# idea to use one or the other. However the Redis server sometimes has to\n# delete keys or flush the whole database as a side effect of other operations.\n# Specifically Redis deletes objects independently of a user call in the\n# following scenarios:\n#\n# 1) On eviction, because of the maxmemory and maxmemory policy configurations,\n# in order to make room for new data, without going over the specified\n# memory limit.\n# 2) Because of expire: when a key with an associated time to live (see the\n# EXPIRE command) must be deleted from memory.\n# 3) Because of a side effect of a command that stores data on a key that may\n# already exist. For example the RENAME command may delete the old key\n# content when it is replaced with another one. Similarly SUNIONSTORE\n# or SORT with STORE option may delete existing keys. The SET command\n# itself removes any old content of the specified key in order to replace\n# it with the specified string.\n# 4) During replication, when a replica performs a full resynchronization with\n# its master, the content of the whole database is removed in order to\n# load the RDB file just transferred.\n#\n# In all the above cases the default is to delete objects in a blocking way,\n# like if DEL was called. However you can configure each case specifically\n# in order to instead release memory in a non-blocking way like if UNLINK\n# was called, using the following configuration directives.\n\nlazyfree-lazy-eviction yes\nlazyfree-lazy-expire yes\nlazyfree-lazy-server-del yes\nreplica-lazy-flush yes\n\n# It is also possible, for the case when to replace the user code DEL calls\n# with UNLINK calls is not easy, to modify the default behavior of the DEL\n# command to act exactly like UNLINK, using the following configuration\n# directive:\n\nlazyfree-lazy-user-del yes\n\n# FLUSHDB, FLUSHALL, and SCRIPT FLUSH support both asynchronous and synchronous\n# deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the\n# commands. When neither flag is passed, this directive will be used to determine\n# if the data should be deleted asynchronously.\n\nlazyfree-lazy-user-flush yes\n\n################################ THREADED I/O #################################\n\n# Redis is mostly single threaded, however there are certain threaded\n# operations such as UNLINK, slow I/O accesses and other things that are\n# performed on side threads.\n#\n# Now it is also possible to handle Redis clients socket reads and writes\n# in different I/O threads. Since especially writing is so slow, normally\n# Redis users use pipelining in order to speed up the Redis performances per\n# core, and spawn multiple instances in order to scale more. Using I/O\n# threads it is possible to easily speedup two times Redis without resorting\n# to pipelining nor sharding of the instance.\n#\n# By default threading is disabled, we suggest enabling it only in machines\n# that have at least 4 or more cores, leaving at least one spare core.\n# Using more than 8 threads is unlikely to help much. We also recommend using\n# threaded I/O only if you actually have performance problems, with Redis\n# instances being able to use a quite big percentage of CPU time, otherwise\n# there is no point in using this feature.\n#\n# So for instance if you have a four cores boxes, try to use 2 or 3 I/O\n# threads, if you have a 8 cores, try to use 6 threads. In order to\n# enable I/O threads use the following configuration directive:\n#\n# io-threads 4\n#\n# Setting io-threads to 1 will just use the main thread as usual.\n# When I/O threads are enabled, we only use threads for writes, that is\n# to thread the write(2) syscall and transfer the client buffers to the\n# socket. However it is also possible to enable threading of reads and\n# protocol parsing using the following configuration directive, by setting\n# it to yes:\n#\n# io-threads-do-reads no\n#\n# Usually threading reads doesn't help much.\n#\n# NOTE 1: This configuration directive cannot be changed at runtime via\n# CONFIG SET. Aso this feature currently does not work when SSL is\n# enabled.\n#\n# NOTE 2: If you want to test the Redis speedup using redis-benchmark, make\n# sure you also run the benchmark itself in threaded mode, using the\n# --threads option to match the number of Redis threads, otherwise you'll not\n# be able to notice the improvements.\n\n############################ KERNEL OOM CONTROL ##############################\n\n# On Linux, it is possible to hint the kernel OOM killer on what processes\n# should be killed first when out of memory.\n#\n# Enabling this feature makes Redis actively control the oom_score_adj value\n# for all its processes, depending on their role. The default scores will\n# attempt to have background child processes killed before all others, and\n# replicas killed before masters.\n#\n# Redis supports three options:\n#\n# no: Don't make changes to oom-score-adj (default).\n# yes: Alias to \"relative\" see below.\n# absolute: Values in oom-score-adj-values are written as is to the kernel.\n# relative: Values are used relative to the initial value of oom_score_adj when\n# the server starts and are then clamped to a range of -1000 to 1000.\n# Because typically the initial value is 0, they will often match the\n# absolute values.\noom-score-adj no\n\n# When oom-score-adj is used, this directive controls the specific values used\n# for master, replica and background child processes. Values range -2000 to\n# 2000 (higher means more likely to be killed).\n#\n# Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities)\n# can freely increase their value, but not decrease it below its initial\n# settings. This means that setting oom-score-adj to \"relative\" and setting the\n# oom-score-adj-values to positive values will always succeed.\noom-score-adj-values 0 200 800\n\n\n#################### KERNEL transparent hugepage CONTROL ######################\n\n# Usually the kernel Transparent Huge Pages control is set to \"madvise\" or\n# or \"never\" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which\n# case this config has no effect. On systems in which it is set to \"always\",\n# redis will attempt to disable it specifically for the redis process in order\n# to avoid latency problems specifically with fork(2) and CoW.\n# If for some reason you prefer to keep it enabled, you can set this config to\n# \"no\" and the kernel global to \"always\".\n\ndisable-thp yes\n\n############################## APPEND ONLY MODE ###############################\n\n# By default Redis asynchronously dumps the dataset on disk. This mode is\n# good enough in many applications, but an issue with the Redis process or\n# a power outage may result into a few minutes of writes lost (depending on\n# the configured save points).\n#\n# The Append Only File is an alternative persistence mode that provides\n# much better durability. For instance using the default data fsync policy\n# (see later in the config file) Redis can lose just one second of writes in a\n# dramatic event like a server power outage, or a single write if something\n# wrong with the Redis process itself happens, but the operating system is\n# still running correctly.\n#\n# AOF and RDB persistence can be enabled at the same time without problems.\n# If the AOF is enabled on startup Redis will load the AOF, that is the file\n# with the better durability guarantees.\n#\n# Please check https://redis.io/topics/persistence for more information.\n\nappendonly no\n\n# The name of the append only file (default: \"appendonly.aof\")\n\nappendfilename \"appendonly.aof\"\n\n# The fsync() call tells the Operating System to actually write data on disk\n# instead of waiting for more data in the output buffer. Some OS will really flush\n# data on disk, some other OS will just try to do it ASAP.\n#\n# Redis supports three different modes:\n#\n# no: don't fsync, just let the OS flush the data when it wants. Faster.\n# always: fsync after every write to the append only log. Slow, Safest.\n# everysec: fsync only one time every second. Compromise.\n#\n# The default is \"everysec\", as that's usually the right compromise between\n# speed and data safety. It's up to you to understand if you can relax this to\n# \"no\" that will let the operating system flush the output buffer when\n# it wants, for better performances (but if you can live with the idea of\n# some data loss consider the default persistence mode that's snapshotting),\n# or on the contrary, use \"always\" that's very slow but a bit safer than\n# everysec.\n#\n# More details please check the following article:\n# http://antirez.com/post/redis-persistence-demystified.html\n#\n# If unsure, use \"everysec\".\n\n# appendfsync always\nappendfsync everysec\n# appendfsync no\n\n# When the AOF fsync policy is set to always or everysec, and a background\n# saving process (a background save or AOF log background rewriting) is\n# performing a lot of I/O against the disk, in some Linux configurations\n# Redis may block too long on the fsync() call. Note that there is no fix for\n# this currently, as even performing fsync in a different thread will block\n# our synchronous write(2) call.\n#\n# In order to mitigate this problem it's possible to use the following option\n# that will prevent fsync() from being called in the main process while a\n# BGSAVE or BGREWRITEAOF is in progress.\n#\n# This means that while another child is saving, the durability of Redis is\n# the same as \"appendfsync none\". In practical terms, this means that it is\n# possible to lose up to 30 seconds of log in the worst scenario (with the\n# default Linux settings).\n#\n# If you have latency problems turn this to \"yes\". Otherwise leave it as\n# \"no\" that is the safest pick from the point of view of durability.\n\nno-appendfsync-on-rewrite no\n\n# Automatic rewrite of the append only file.\n# Redis is able to automatically rewrite the log file implicitly calling\n# BGREWRITEAOF when the AOF log size grows by the specified percentage.\n#\n# This is how it works: Redis remembers the size of the AOF file after the\n# latest rewrite (if no rewrite has happened since the restart, the size of\n# the AOF at startup is used).\n#\n# This base size is compared to the current size. If the current size is\n# bigger than the specified percentage, the rewrite is triggered. Also\n# you need to specify a minimal size for the AOF file to be rewritten, this\n# is useful to avoid rewriting the AOF file even if the percentage increase\n# is reached but it is still pretty small.\n#\n# Specify a percentage of zero in order to disable the automatic AOF\n# rewrite feature.\n\nauto-aof-rewrite-percentage 100\nauto-aof-rewrite-min-size 64mb\n\n# An AOF file may be found to be truncated at the end during the Redis\n# startup process, when the AOF data gets loaded back into memory.\n# This may happen when the system where Redis is running\n# crashes, especially when an ext4 filesystem is mounted without the\n# data=ordered option (however this can't happen when Redis itself\n# crashes or aborts but the operating system still works correctly).\n#\n# Redis can either exit with an error when this happens, or load as much\n# data as possible (the default now) and start if the AOF file is found\n# to be truncated at the end. The following option controls this behavior.\n#\n# If aof-load-truncated is set to yes, a truncated AOF file is loaded and\n# the Redis server starts emitting a log to inform the user of the event.\n# Otherwise if the option is set to no, the server aborts with an error\n# and refuses to start. When the option is set to no, the user requires\n# to fix the AOF file using the \"redis-check-aof\" utility before to restart\n# the server.\n#\n# Note that if the AOF file will be found to be corrupted in the middle\n# the server will still exit with an error. This option only applies when\n# Redis will try to read more data from the AOF file but not enough bytes\n# will be found.\naof-load-truncated yes\n\n# When rewriting the AOF file, Redis is able to use an RDB preamble in the\n# AOF file for faster rewrites and recoveries. When this option is turned\n# on the rewritten AOF file is composed of two different stanzas:\n#\n# [RDB file][AOF tail]\n#\n# When loading, Redis recognizes that the AOF file starts with the \"REDIS\"\n# string and loads the prefixed RDB file, then continues loading the AOF\n# tail.\naof-use-rdb-preamble yes\n\n################################ LUA SCRIPTING ###############################\n\n# Max execution time of a Lua script in milliseconds.\n#\n# If the maximum execution time is reached Redis will log that a script is\n# still in execution after the maximum allowed time and will start to\n# reply to queries with an error.\n#\n# When a long running script exceeds the maximum execution time only the\n# SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be\n# used to stop a script that did not yet call any write commands. The second\n# is the only way to shut down the server in the case a write command was\n# already issued by the script but the user doesn't want to wait for the natural\n# termination of the script.\n#\n# Set it to 0 or a negative value for unlimited execution without warnings.\nlua-time-limit 5000\n\n################################ REDIS CLUSTER ###############################\n\n# Normal Redis instances can't be part of a Redis Cluster; only nodes that are\n# started as cluster nodes can. In order to start a Redis instance as a\n# cluster node enable the cluster support uncommenting the following:\n#\n# cluster-enabled yes\n\n# Every cluster node has a cluster configuration file. This file is not\n# intended to be edited by hand. It is created and updated by Redis nodes.\n# Every Redis Cluster node requires a different cluster configuration file.\n# Make sure that instances running in the same system do not have\n# overlapping cluster configuration file names.\n#\n# cluster-config-file nodes-6379.conf\n\n# Cluster node timeout is the amount of milliseconds a node must be unreachable\n# for it to be considered in failure state.\n# Most other internal time limits are a multiple of the node timeout.\n#\n# cluster-node-timeout 15000\n\n# A replica of a failing master will avoid to start a failover if its data\n# looks too old.\n#\n# There is no simple way for a replica to actually have an exact measure of\n# its \"data age\", so the following two checks are performed:\n#\n# 1) If there are multiple replicas able to failover, they exchange messages\n# in order to try to give an advantage to the replica with the best\n# replication offset (more data from the master processed).\n# Replicas will try to get their rank by offset, and apply to the start\n# of the failover a delay proportional to their rank.\n#\n# 2) Every single replica computes the time of the last interaction with\n# its master. This can be the last ping or command received (if the master\n# is still in the \"connected\" state), or the time that elapsed since the\n# disconnection with the master (if the replication link is currently down).\n# If the last interaction is too old, the replica will not try to failover\n# at all.\n#\n# The point \"2\" can be tuned by user. Specifically a replica will not perform\n# the failover if, since the last interaction with the master, the time\n# elapsed is greater than:\n#\n# (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period\n#\n# So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor\n# is 10, and assuming a default repl-ping-replica-period of 10 seconds, the\n# replica will not try to failover if it was not able to talk with the master\n# for longer than 310 seconds.\n#\n# A large cluster-replica-validity-factor may allow replicas with too old data to failover\n# a master, while a too small value may prevent the cluster from being able to\n# elect a replica at all.\n#\n# For maximum availability, it is possible to set the cluster-replica-validity-factor\n# to a value of 0, which means, that replicas will always try to failover the\n# master regardless of the last time they interacted with the master.\n# (However they'll always try to apply a delay proportional to their\n# offset rank).\n#\n# Zero is the only value able to guarantee that when all the partitions heal\n# the cluster will always be able to continue.\n#\n# cluster-replica-validity-factor 10\n\n# Cluster replicas are able to migrate to orphaned masters, that are masters\n# that are left without working replicas. This improves the cluster ability\n# to resist to failures as otherwise an orphaned master can't be failed over\n# in case of failure if it has no working replicas.\n#\n# Replicas migrate to orphaned masters only if there are still at least a\n# given number of other working replicas for their old master. This number\n# is the \"migration barrier\". A migration barrier of 1 means that a replica\n# will migrate only if there is at least 1 other working replica for its master\n# and so forth. It usually reflects the number of replicas you want for every\n# master in your cluster.\n#\n# Default is 1 (replicas migrate only if their masters remain with at least\n# one replica). To disable migration just set it to a very large value or\n# set cluster-allow-replica-migration to 'no'.\n# A value of 0 can be set but is useful only for debugging and dangerous\n# in production.\n#\n# cluster-migration-barrier 1\n\n# Turning off this option allows to use less automatic cluster configuration.\n# It both disables migration to orphaned masters and migration from masters\n# that became empty.\n#\n# Default is 'yes' (allow automatic migrations).\n#\n# cluster-allow-replica-migration yes\n\n# By default Redis Cluster nodes stop accepting queries if they detect there\n# is at least a hash slot uncovered (no available node is serving it).\n# This way if the cluster is partially down (for example a range of hash slots\n# are no longer covered) all the cluster becomes, eventually, unavailable.\n# It automatically returns available as soon as all the slots are covered again.\n#\n# However sometimes you want the subset of the cluster which is working,\n# to continue to accept queries for the part of the key space that is still\n# covered. In order to do so, just set the cluster-require-full-coverage\n# option to no.\n#\n# cluster-require-full-coverage yes\n\n# This option, when set to yes, prevents replicas from trying to failover its\n# master during master failures. However the replica can still perform a\n# manual failover, if forced to do so.\n#\n# This is useful in different scenarios, especially in the case of multiple\n# data center operations, where we want one side to never be promoted if not\n# in the case of a total DC failure.\n#\n# cluster-replica-no-failover no\n\n# This option, when set to yes, allows nodes to serve read traffic while the\n# the cluster is in a down state, as long as it believes it owns the slots.\n#\n# This is useful for two cases. The first case is for when an application\n# doesn't require consistency of data during node failures or network partitions.\n# One example of this is a cache, where as long as the node has the data it\n# should be able to serve it.\n#\n# The second use case is for configurations that don't meet the recommended\n# three shards but want to enable cluster mode and scale later. A\n# master outage in a 1 or 2 shard configuration causes a read/write outage to the\n# entire cluster without this option set, with it set there is only a write outage.\n# Without a quorum of masters, slot ownership will not change automatically.\n#\n# cluster-allow-reads-when-down no\n\n# In order to setup your cluster make sure to read the documentation\n# available at https://redis.io web site.\n\n########################## CLUSTER DOCKER/NAT support ########################\n\n# In certain deployments, Redis Cluster nodes address discovery fails, because\n# addresses are NAT-ted or because ports are forwarded (the typical case is\n# Docker and other containers).\n#\n# In order to make Redis Cluster working in such environments, a static\n# configuration where each node knows its public address is needed. The\n# following four options are used for this scope, and are:\n#\n# * cluster-announce-ip\n# * cluster-announce-port\n# * cluster-announce-tls-port\n# * cluster-announce-bus-port\n#\n# Each instructs the node about its address, client ports (for connections\n# without and with TLS) and cluster message bus port. The information is then\n# published in the header of the bus packets so that other nodes will be able to\n# correctly map the address of the node publishing the information.\n#\n# If cluster-tls is set to yes and cluster-announce-tls-port is omitted or set\n# to zero, then cluster-announce-port refers to the TLS port. Note also that\n# cluster-announce-tls-port has no effect if cluster-tls is set to no.\n#\n# If the above options are not used, the normal Redis Cluster auto-detection\n# will be used instead.\n#\n# Note that when remapped, the bus port may not be at the fixed offset of\n# clients port + 10000, so you can specify any port and bus-port depending\n# on how they get remapped. If the bus-port is not set, a fixed offset of\n# 10000 will be used as usual.\n#\n# Example:\n#\n# cluster-announce-ip 10.1.1.5\n# cluster-announce-tls-port 6379\n# cluster-announce-port 0\n# cluster-announce-bus-port 6380\n\n################################## SLOW LOG ###################################\n\n# The Redis Slow Log is a system to log queries that exceeded a specified\n# execution time. The execution time does not include the I/O operations\n# like talking with the client, sending the reply and so forth,\n# but just the time needed to actually execute the command (this is the only\n# stage of command execution where the thread is blocked and can not serve\n# other requests in the meantime).\n#\n# You can configure the slow log with two parameters: one tells Redis\n# what is the execution time, in microseconds, to exceed in order for the\n# command to get logged, and the other parameter is the length of the\n# slow log. When a new command is logged the oldest one is removed from the\n# queue of logged commands.\n\n# The following time is expressed in microseconds, so 1000000 is equivalent\n# to one second. Note that a negative number disables the slow log, while\n# a value of zero forces the logging of every command.\nslowlog-log-slower-than 10000\n\n# There is no limit to this length. Just be aware that it will consume memory.\n# You can reclaim memory used by the slow log with SLOWLOG RESET.\nslowlog-max-len 128\n\n################################ LATENCY MONITOR ##############################\n\n# The Redis latency monitoring subsystem samples different operations\n# at runtime in order to collect data related to possible sources of\n# latency of a Redis instance.\n#\n# Via the LATENCY command this information is available to the user that can\n# print graphs and obtain reports.\n#\n# The system only logs operations that were performed in a time equal or\n# greater than the amount of milliseconds specified via the\n# latency-monitor-threshold configuration directive. When its value is set\n# to zero, the latency monitor is turned off.\n#\n# By default latency monitoring is disabled since it is mostly not needed\n# if you don't have latency issues, and collecting data has a performance\n# impact, that while very small, can be measured under big load. Latency\n# monitoring can easily be enabled at runtime using the command\n# \"CONFIG SET latency-monitor-threshold \" if needed.\nlatency-monitor-threshold 0\n\n############################# EVENT NOTIFICATION ##############################\n\n# Redis can notify Pub/Sub clients about events happening in the key space.\n# This feature is documented at https://redis.io/topics/notifications\n#\n# For instance if keyspace events notification is enabled, and a client\n# performs a DEL operation on key \"foo\" stored in the Database 0, two\n# messages will be published via Pub/Sub:\n#\n# PUBLISH __keyspace@0__:foo del\n# PUBLISH __keyevent@0__:del foo\n#\n# It is possible to select the events that Redis will notify among a set\n# of classes. Every class is identified by a single character:\n#\n# K Keyspace events, published with __keyspace@__ prefix.\n# E Keyevent events, published with __keyevent@__ prefix.\n# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ...\n# $ String commands\n# l List commands\n# s Set commands\n# h Hash commands\n# z Sorted set commands\n# x Expired events (events generated every time a key expires)\n# e Evicted events (events generated when a key is evicted for maxmemory)\n# t Stream commands\n# d Module key type events\n# m Key-miss events (Note: It is not included in the 'A' class)\n# A Alias for g$lshzxetd, so that the \"AKE\" string means all the events\n# (Except key-miss events which are excluded from 'A' due to their\n# unique nature).\n#\n# The \"notify-keyspace-events\" takes as argument a string that is composed\n# of zero or multiple characters. The empty string means that notifications\n# are disabled.\n#\n# Example: to enable list and generic events, from the point of view of the\n# event name, use:\n#\n# notify-keyspace-events Elg\n#\n# Example 2: to get the stream of the expired keys subscribing to channel\n# name __keyevent@0__:expired use:\n#\n# notify-keyspace-events Ex\n#\n# By default all notifications are disabled because most users don't need\n# this feature and the feature has some overhead. Note that if you don't\n# specify at least one of K or E, no events will be delivered.\nnotify-keyspace-events \"\"\n\n############################### GOPHER SERVER #################################\n\n# Redis contains an implementation of the Gopher protocol, as specified in\n# the RFC 1436 (https://www.ietf.org/rfc/rfc1436.txt).\n#\n# The Gopher protocol was very popular in the late '90s. It is an alternative\n# to the web, and the implementation both server and client side is so simple\n# that the Redis server has just 100 lines of code in order to implement this\n# support.\n#\n# What do you do with Gopher nowadays? Well Gopher never *really* died, and\n# lately there is a movement in order for the Gopher more hierarchical content\n# composed of just plain text documents to be resurrected. Some want a simpler\n# internet, others believe that the mainstream internet became too much\n# controlled, and it's cool to create an alternative space for people that\n# want a bit of fresh air.\n#\n# Anyway for the 10nth birthday of the Redis, we gave it the Gopher protocol\n# as a gift.\n#\n# --- HOW IT WORKS? ---\n#\n# The Redis Gopher support uses the inline protocol of Redis, and specifically\n# two kind of inline requests that were anyway illegal: an empty request\n# or any request that starts with \"/\" (there are no Redis commands starting\n# with such a slash). Normal RESP2/RESP3 requests are completely out of the\n# path of the Gopher protocol implementation and are served as usual as well.\n#\n# If you open a connection to Redis when Gopher is enabled and send it\n# a string like \"/foo\", if there is a key named \"/foo\" it is served via the\n# Gopher protocol.\n#\n# In order to create a real Gopher \"hole\" (the name of a Gopher site in Gopher\n# talking), you likely need a script like the following:\n#\n# https://github.com/antirez/gopher2redis\n#\n# --- SECURITY WARNING ---\n#\n# If you plan to put Redis on the internet in a publicly accessible address\n# to server Gopher pages MAKE SURE TO SET A PASSWORD to the instance.\n# Once a password is set:\n#\n# 1. The Gopher server (when enabled, not by default) will still serve\n# content via Gopher.\n# 2. However other commands cannot be called before the client will\n# authenticate.\n#\n# So use the 'requirepass' option to protect your instance.\n#\n# Note that Gopher is not currently supported when 'io-threads-do-reads'\n# is enabled.\n#\n# To enable Gopher support, uncomment the following line and set the option\n# from no (the default) to yes.\n#\n# gopher-enabled no\n\n############################### ADVANCED CONFIG ###############################\n\n# Hashes are encoded using a memory efficient data structure when they have a\n# small number of entries, and the biggest entry does not exceed a given\n# threshold. These thresholds can be configured using the following directives.\nhash-max-ziplist-entries 512\nhash-max-ziplist-value 64\n\n# Lists are also encoded in a special way to save a lot of space.\n# The number of entries allowed per internal list node can be specified\n# as a fixed maximum size or a maximum number of elements.\n# For a fixed maximum size, use -5 through -1, meaning:\n# -5: max size: 64 Kb <-- not recommended for normal workloads\n# -4: max size: 32 Kb <-- not recommended\n# -3: max size: 16 Kb <-- probably not recommended\n# -2: max size: 8 Kb <-- good\n# -1: max size: 4 Kb <-- good\n# Positive numbers mean store up to _exactly_ that number of elements\n# per list node.\n# The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size),\n# but if your use case is unique, adjust the settings as necessary.\nlist-max-ziplist-size -2\n\n# Lists may also be compressed.\n# Compress depth is the number of quicklist ziplist nodes from *each* side of\n# the list to *exclude* from compression. The head and tail of the list\n# are always uncompressed for fast push/pop operations. Settings are:\n# 0: disable all list compression\n# 1: depth 1 means \"don't start compressing until after 1 node into the list,\n# going from either the head or tail\"\n# So: [head]->node->node->...->node->[tail]\n# [head], [tail] will always be uncompressed; inner nodes will compress.\n# 2: [head]->[next]->node->node->...->node->[prev]->[tail]\n# 2 here means: don't compress head or head->next or tail->prev or tail,\n# but compress all nodes between them.\n# 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail]\n# etc.\nlist-compress-depth 0\n\n# Sets have a special encoding in just one case: when a set is composed\n# of just strings that happen to be integers in radix 10 in the range\n# of 64 bit signed integers.\n# The following configuration setting sets the limit in the size of the\n# set in order to use this special memory saving encoding.\nset-max-intset-entries 512\n\n# Similarly to hashes and lists, sorted sets are also specially encoded in\n# order to save a lot of space. This encoding is only used when the length and\n# elements of a sorted set are below the following limits:\nzset-max-ziplist-entries 128\nzset-max-ziplist-value 64\n\n# HyperLogLog sparse representation bytes limit. The limit includes the\n# 16 bytes header. When an HyperLogLog using the sparse representation crosses\n# this limit, it is converted into the dense representation.\n#\n# A value greater than 16000 is totally useless, since at that point the\n# dense representation is more memory efficient.\n#\n# The suggested value is ~ 3000 in order to have the benefits of\n# the space efficient encoding without slowing down too much PFADD,\n# which is O(N) with the sparse encoding. The value can be raised to\n# ~ 10000 when CPU is not a concern, but space is, and the data set is\n# composed of many HyperLogLogs with cardinality in the 0 - 15000 range.\nhll-sparse-max-bytes 3000\n\n# Streams macro node max size / items. The stream data structure is a radix\n# tree of big nodes that encode multiple items inside. Using this configuration\n# it is possible to configure how big a single node can be in bytes, and the\n# maximum number of items it may contain before switching to a new node when\n# appending new stream entries. If any of the following settings are set to\n# zero, the limit is ignored, so for instance it is possible to set just a\n# max entries limit by setting max-bytes to 0 and max-entries to the desired\n# value.\nstream-node-max-bytes 4096\nstream-node-max-entries 100\n\n# Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in\n# order to help rehashing the main Redis hash table (the one mapping top-level\n# keys to values). The hash table implementation Redis uses (see dict.c)\n# performs a lazy rehashing: the more operation you run into a hash table\n# that is rehashing, the more rehashing \"steps\" are performed, so if the\n# server is idle the rehashing is never complete and some more memory is used\n# by the hash table.\n#\n# The default is to use this millisecond 10 times every second in order to\n# actively rehash the main dictionaries, freeing memory when possible.\n#\n# If unsure:\n# use \"activerehashing no\" if you have hard latency requirements and it is\n# not a good thing in your environment that Redis can reply from time to time\n# to queries with 2 milliseconds delay.\n#\n# use \"activerehashing yes\" if you don't have such hard requirements but\n# want to free memory asap when possible.\nactiverehashing yes\n\n# The client output buffer limits can be used to force disconnection of clients\n# that are not reading data from the server fast enough for some reason (a\n# common reason is that a Pub/Sub client can't consume messages as fast as the\n# publisher can produce them).\n#\n# The limit can be set differently for the three different classes of clients:\n#\n# normal -> normal clients including MONITOR clients\n# replica -> replica clients\n# pubsub -> clients subscribed to at least one pubsub channel or pattern\n#\n# The syntax of every client-output-buffer-limit directive is the following:\n#\n# client-output-buffer-limit \n#\n# A client is immediately disconnected once the hard limit is reached, or if\n# the soft limit is reached and remains reached for the specified number of\n# seconds (continuously).\n# So for instance if the hard limit is 32 megabytes and the soft limit is\n# 16 megabytes / 10 seconds, the client will get disconnected immediately\n# if the size of the output buffers reach 32 megabytes, but will also get\n# disconnected if the client reaches 16 megabytes and continuously overcomes\n# the limit for 10 seconds.\n#\n# By default normal clients are not limited because they don't receive data\n# without asking (in a push way), but just after a request, so only\n# asynchronous clients may create a scenario where data is requested faster\n# than it can read.\n#\n# Instead there is a default limit for pubsub and replica clients, since\n# subscribers and replicas receive data in a push fashion.\n#\n# Both the hard or the soft limit can be disabled by setting them to zero.\nclient-output-buffer-limit normal 0 0 0\nclient-output-buffer-limit replica 256mb 64mb 60\nclient-output-buffer-limit pubsub 32mb 8mb 60\n\n# Client query buffers accumulate new commands. They are limited to a fixed\n# amount by default in order to avoid that a protocol desynchronization (for\n# instance due to a bug in the client) will lead to unbound memory usage in\n# the query buffer. However you can configure it here if you have very special\n# needs, such us huge multi/exec requests or alike.\n#\n# client-query-buffer-limit 1gb\n\n# In the Redis protocol, bulk requests, that are, elements representing single\n# strings, are normally limited to 512 mb. However you can change this limit\n# here, but must be 1mb or greater\n#\n# proto-max-bulk-len 512mb\n\n# Redis calls an internal function to perform many background tasks, like\n# closing connections of clients in timeout, purging expired keys that are\n# never requested, and so forth.\n#\n# Not all tasks are performed with the same frequency, but Redis checks for\n# tasks to perform according to the specified \"hz\" value.\n#\n# By default \"hz\" is set to 10. Raising the value will use more CPU when\n# Redis is idle, but at the same time will make Redis more responsive when\n# there are many keys expiring at the same time, and timeouts may be\n# handled with more precision.\n#\n# The range is between 1 and 500, however a value over 100 is usually not\n# a good idea. Most users should use the default of 10 and raise this up to\n# 100 only in environments where very low latency is required.\nhz 10\n\n# Normally it is useful to have an HZ value which is proportional to the\n# number of clients connected. This is useful in order, for instance, to\n# avoid too many clients are processed for each background task invocation\n# in order to avoid latency spikes.\n#\n# Since the default HZ value by default is conservatively set to 10, Redis\n# offers, and enables by default, the ability to use an adaptive HZ value\n# which will temporarily raise when there are many connected clients.\n#\n# When dynamic HZ is enabled, the actual configured HZ will be used\n# as a baseline, but multiples of the configured HZ value will be actually\n# used as needed once more clients are connected. In this way an idle\n# instance will use very little CPU time while a busy instance will be\n# more responsive.\ndynamic-hz yes\n\n# When a child rewrites the AOF file, if the following option is enabled\n# the file will be fsync-ed every 32 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\naof-rewrite-incremental-fsync yes\n\n# When redis saves RDB file, if the following option is enabled\n# the file will be fsync-ed every 32 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\nrdb-save-incremental-fsync yes\n\n# Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good\n# idea to start with the default settings and only change them after investigating\n# how to improve the performances and how the keys LFU change over time, which\n# is possible to inspect via the OBJECT FREQ command.\n#\n# There are two tunable parameters in the Redis LFU implementation: the\n# counter logarithm factor and the counter decay time. It is important to\n# understand what the two parameters mean before changing them.\n#\n# The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis\n# uses a probabilistic increment with logarithmic behavior. Given the value\n# of the old counter, when a key is accessed, the counter is incremented in\n# this way:\n#\n# 1. A random number R between 0 and 1 is extracted.\n# 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1).\n# 3. The counter is incremented only if R < P.\n#\n# The default lfu-log-factor is 10. This is a table of how the frequency\n# counter changes with a different number of accesses with different\n# logarithmic factors:\n#\n# +--------+------------+------------+------------+------------+------------+\n# | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits |\n# +--------+------------+------------+------------+------------+------------+\n# | 0 | 104 | 255 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 1 | 18 | 49 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 10 | 10 | 18 | 142 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 100 | 8 | 11 | 49 | 143 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n#\n# NOTE: The above table was obtained by running the following commands:\n#\n# redis-benchmark -n 1000000 incr foo\n# redis-cli object freq foo\n#\n# NOTE 2: The counter initial value is 5 in order to give new objects a chance\n# to accumulate hits.\n#\n# The counter decay time is the time, in minutes, that must elapse in order\n# for the key counter to be divided by two (or decremented if it has a value\n# less <= 10).\n#\n# The default value for the lfu-decay-time is 1. A special value of 0 means to\n# decay the counter every time it happens to be scanned.\n#\n# lfu-log-factor 10\n# lfu-decay-time 1\n\n########################### ACTIVE DEFRAGMENTATION #######################\n#\n# What is active defragmentation?\n# -------------------------------\n#\n# Active (online) defragmentation allows a Redis server to compact the\n# spaces left between small allocations and deallocations of data in memory,\n# thus allowing to reclaim back memory.\n#\n# Fragmentation is a natural process that happens with every allocator (but\n# less so with Jemalloc, fortunately) and certain workloads. Normally a server\n# restart is needed in order to lower the fragmentation, or at least to flush\n# away all the data and create it again. However thanks to this feature\n# implemented by Oran Agra for Redis 4.0 this process can happen at runtime\n# in a \"hot\" way, while the server is running.\n#\n# Basically when the fragmentation is over a certain level (see the\n# configuration options below) Redis will start to create new copies of the\n# values in contiguous memory regions by exploiting certain specific Jemalloc\n# features (in order to understand if an allocation is causing fragmentation\n# and to allocate it in a better place), and at the same time, will release the\n# old copies of the data. This process, repeated incrementally for all the keys\n# will cause the fragmentation to drop back to normal values.\n#\n# Important things to understand:\n#\n# 1. This feature is disabled by default, and only works if you compiled Redis\n# to use the copy of Jemalloc we ship with the source code of Redis.\n# This is the default with Linux builds.\n#\n# 2. You never need to enable this feature if you don't have fragmentation\n# issues.\n#\n# 3. Once you experience fragmentation, you can enable this feature when\n# needed with the command \"CONFIG SET activedefrag yes\".\n#\n# The configuration parameters are able to fine tune the behavior of the\n# defragmentation process. If you are not sure about what they mean it is\n# a good idea to leave the defaults untouched.\n\n# Enabled active defragmentation\n# activedefrag no\n\n# Minimum amount of fragmentation waste to start active defrag\n# active-defrag-ignore-bytes 100mb\n\n# Minimum percentage of fragmentation to start active defrag\n# active-defrag-threshold-lower 10\n\n# Maximum percentage of fragmentation at which we use maximum effort\n# active-defrag-threshold-upper 100\n\n# Minimal effort for defrag in CPU percentage, to be used when the lower\n# threshold is reached\n# active-defrag-cycle-min 1\n\n# Maximal effort for defrag in CPU percentage, to be used when the upper\n# threshold is reached\n# active-defrag-cycle-max 25\n\n# Maximum number of set/hash/zset/list fields that will be processed from\n# the main dictionary scan\n# active-defrag-max-scan-fields 1000\n\n# Jemalloc background thread for purging will be enabled by default\njemalloc-bg-thread yes\n\n# It is possible to pin different threads and processes of Redis to specific\n# CPUs in your system, in order to maximize the performances of the server.\n# This is useful both in order to pin different Redis threads in different\n# CPUs, but also in order to make sure that multiple Redis instances running\n# in the same host will be pinned to different CPUs.\n#\n# Normally you can do this using the \"taskset\" command, however it is also\n# possible to this via Redis configuration directly, both in Linux and FreeBSD.\n#\n# You can pin the server/IO threads, bio threads, aof rewrite child process, and\n# the bgsave child process. The syntax to specify the cpu list is the same as\n# the taskset command:\n#\n# Set redis server/io threads to cpu affinity 0,2,4,6:\n# server_cpulist 0-7:2\n#\n# Set bio threads to cpu affinity 1,3:\n# bio_cpulist 1,3\n#\n# Set aof rewrite child process to cpu affinity 8,9,10,11:\n# aof_rewrite_cpulist 8-11\n#\n# Set bgsave child process to cpu affinity 1,10,11\n# bgsave_cpulist 1,10-11\n\n# In some cases redis will emit warnings and even refuse to start if it detects\n# that the system is in bad state, it is possible to suppress these warnings\n# by setting the following config which takes a space delimited list of warnings\n# to suppress\n#\n# ignore-warnings ARM64-COW-BUG\n" }, { "path": "aegir/conf/redis/redis7.conf", "content": "# Redis configuration file example.\n#\n# Note that in order to read the configuration file, Redis must be\n# started with the file path as first argument:\n#\n# ./redis-server /path/to/redis.conf\n\n# Note on units: when memory size is needed, it is possible to specify\n# it in the usual form of 1k 5GB 4M and so forth:\n#\n# 1k => 1000 bytes\n# 1kb => 1024 bytes\n# 1m => 1000000 bytes\n# 1mb => 1024*1024 bytes\n# 1g => 1000000000 bytes\n# 1gb => 1024*1024*1024 bytes\n#\n# units are case insensitive so 1GB 1Gb 1gB are all the same.\n\n################################## INCLUDES ###################################\n\n# Include one or more other config files here. This is useful if you\n# have a standard template that goes to all Redis servers but also need\n# to customize a few per-server settings. Include files can include\n# other files, so use this wisely.\n#\n# Note that option \"include\" won't be rewritten by command \"CONFIG REWRITE\"\n# from admin or Redis Sentinel. Since Redis always uses the last processed\n# line as value of a configuration directive, you'd better put includes\n# at the beginning of this file to avoid overwriting config change at runtime.\n#\n# If instead you are interested in using includes to override configuration\n# options, it is better to use include as the last line.\n#\n# Included paths may contain wildcards. All files matching the wildcards will\n# be included in alphabetical order.\n# Note that if an include path contains a wildcards but no files match it when\n# the server is started, the include statement will be ignored and no error will\n# be emitted. It is safe, therefore, to include wildcard files from empty\n# directories.\n#\n# include /path/to/local.conf\n# include /path/to/other.conf\n# include /path/to/fragments/*.conf\n#\n\n################################## MODULES #####################################\n\n# Load modules at startup. If the server is not able to load modules\n# it will abort. It is possible to use multiple loadmodule directives.\n#\n# loadmodule /path/to/my_module.so\n# loadmodule /path/to/other_module.so\n\n################################## NETWORK #####################################\n\n# By default, if no \"bind\" configuration directive is specified, Redis listens\n# for connections from all available network interfaces on the host machine.\n# It is possible to listen to just one or multiple selected interfaces using\n# the \"bind\" configuration directive, followed by one or more IP addresses.\n# Each address can be prefixed by \"-\", which means that redis will not fail to\n# start if the address is not available. Being not available only refers to\n# addresses that does not correspond to any network interface. Addresses that\n# are already in use will always fail, and unsupported protocols will always BE\n# silently skipped.\n#\n# Examples:\n#\n# xbind 192.168.1.100 10.0.0.1 # listens on two specific IPv4 addresses\n# xbind 127.0.0.1 ::1 # listens on loopback IPv4 and IPv6\n# xbind * -::* # like the default, all available interfaces\n#\n# ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the\n# internet, binding to all the interfaces is dangerous and will expose the\n# instance to everybody on the internet. So by default we uncomment the\n# following bind directive, that will force Redis to listen only on the\n# IPv4 and IPv6 (if available) loopback interface addresses (this means Redis\n# will only be able to accept client connections from the same host that it is\n# running on).\n#\n# IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES\n# COMMENT OUT THE FOLLOWING LINE.\n#\n# You will also need to set a password unless you explicitly disable protected\n# mode.\n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nbind 127.0.0.1\n\n# By default, outgoing connections (from replica to master, from Sentinel to\n# instances, cluster bus, etc.) are not bound to a specific local address. In\n# most cases, this means the operating system will handle that based on routing\n# and the interface through which the connection goes out.\n#\n# Using bind-source-addr it is possible to configure a specific address to bind\n# to, which may also affect how the connection gets routed.\n#\n# Example:\n#\n# bind-source-addr 10.0.0.1\n\n# Protected mode is a layer of security protection, in order to avoid that\n# Redis instances left open on the internet are accessed and exploited.\n#\n# When protected mode is on and the default user has no password, the server\n# only accepts local connections from the IPv4 address (127.0.0.1), IPv6 address\n# (::1) or Unix domain sockets.\n#\n# By default protected mode is enabled. You should disable it only if\n# you are sure you want clients from other hosts to connect to Redis\n# even if no authentication is configured.\nprotected-mode yes\n\n# Redis uses default hardened security configuration directives to reduce the\n# attack surface on innocent users. Therefore, several sensitive configuration\n# directives are immutable, and some potentially-dangerous commands are blocked.\n#\n# Configuration directives that control files that Redis writes to (e.g., 'dir'\n# and 'dbfilename') and that aren't usually modified during runtime\n# are protected by making them immutable.\n#\n# Commands that can increase the attack surface of Redis and that aren't usually\n# called by users are blocked by default.\n#\n# These can be exposed to either all connections or just local ones by setting\n# each of the configs listed below to either of these values:\n#\n# no - Block for any connection (remain immutable)\n# yes - Allow for any connection (no protection)\n# local - Allow only for local connections. Ones originating from the\n# IPv4 address (127.0.0.1), IPv6 address (::1) or Unix domain sockets.\n#\n# enable-protected-configs no\n# enable-debug-command no\n# enable-module-command no\n\n# Accept connections on the specified port, default is 6379 (IANA #815344).\n# If port 0 is specified Redis will not listen on a TCP socket.\nport 6379\n\n# TCP listen() backlog.\n#\n# In high requests-per-second environments you need a high backlog in order\n# to avoid slow clients connection issues. Note that the Linux kernel\n# will silently truncate it to the value of /proc/sys/net/core/somaxconn so\n# make sure to raise both the value of somaxconn and tcp_max_syn_backlog\n# in order to get the desired effect.\ntcp-backlog 511\n\n# Unix socket.\n#\n# Specify the path for the Unix socket that will be used to listen for\n# incoming connections. There is no default, so Redis will not listen\n# on a unix socket when not specified.\n#\n# unixsocket /run/redis/redis.sock\n# unixsocketperm 777\n\n# Close the connection after a client is idle for N seconds (0 to disable)\ntimeout 900\n\n# TCP keepalive.\n#\n# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence\n# of communication. This is useful for two reasons:\n#\n# 1) Detect dead peers.\n# 2) Force network equipment in the middle to consider the connection to be\n# alive.\n#\n# On Linux, the specified value (in seconds) is the period used to send ACKs.\n# Note that to close the connection the double of the time is needed.\n# On other kernels the period depends on the kernel configuration.\n#\n# A reasonable value for this option is 300 seconds, which is the new\n# Redis default starting with Redis 3.2.1.\ntcp-keepalive 300\n\n# Apply OS-specific mechanism to mark the listening socket with the specified\n# ID, to support advanced routing and filtering capabilities.\n#\n# On Linux, the ID represents a connection mark.\n# On FreeBSD, the ID represents a socket cookie ID.\n# On OpenBSD, the ID represents a route table ID.\n#\n# The default value is 0, which implies no marking is required.\n# socket-mark-id 0\n\n################################# TLS/SSL #####################################\n\n# By default, TLS/SSL is disabled. To enable it, the \"tls-port\" configuration\n# directive can be used to define TLS-listening ports. To enable TLS on the\n# default port, use:\n#\n# port 0\n# tls-port 6379\n\n# Configure a X.509 certificate and private key to use for authenticating the\n# server to connected clients, masters or cluster peers. These files should be\n# PEM formatted.\n#\n# tls-cert-file redis.crt\n# tls-key-file redis.key\n#\n# If the key file is encrypted using a passphrase, it can be included here\n# as well.\n#\n# tls-key-file-pass secret\n\n# Normally Redis uses the same certificate for both server functions (accepting\n# connections) and client functions (replicating from a master, establishing\n# cluster bus connections, etc.).\n#\n# Sometimes certificates are issued with attributes that designate them as\n# client-only or server-only certificates. In that case it may be desired to use\n# different certificates for incoming (server) and outgoing (client)\n# connections. To do that, use the following directives:\n#\n# tls-client-cert-file client.crt\n# tls-client-key-file client.key\n#\n# If the key file is encrypted using a passphrase, it can be included here\n# as well.\n#\n# tls-client-key-file-pass secret\n\n# Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange,\n# required by older versions of OpenSSL (<3.0). Newer versions do not require\n# this configuration and recommend against it.\n#\n# tls-dh-params-file redis.dh\n\n# Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL\n# clients and peers. Redis requires an explicit configuration of at least one\n# of these, and will not implicitly use the system wide configuration.\n#\n# tls-ca-cert-file ca.crt\n# tls-ca-cert-dir /etc/ssl/certs\n\n# By default, clients (including replica servers) on a TLS port are required\n# to authenticate using valid client side certificates.\n#\n# If \"no\" is specified, client certificates are not required and not accepted.\n# If \"optional\" is specified, client certificates are accepted and must be\n# valid if provided, but are not required.\n#\n# tls-auth-clients no\n# tls-auth-clients optional\n\n# By default, a Redis replica does not attempt to establish a TLS connection\n# with its master.\n#\n# Use the following directive to enable TLS on replication links.\n#\n# tls-replication yes\n\n# By default, the Redis Cluster bus uses a plain TCP connection. To enable\n# TLS for the bus protocol, use the following directive:\n#\n# tls-cluster yes\n\n# By default, only TLSv1.2 and TLSv1.3 are enabled and it is highly recommended\n# that older formally deprecated versions are kept disabled to reduce the attack surface.\n# You can explicitly specify TLS versions to support.\n# Allowed values are case insensitive and include \"TLSv1\", \"TLSv1.1\", \"TLSv1.2\",\n# \"TLSv1.3\" (OpenSSL >= 1.1.1) or any combination.\n# To enable only TLSv1.2 and TLSv1.3, use:\n#\n# tls-protocols \"TLSv1.2 TLSv1.3\"\n\n# Configure allowed ciphers. See the ciphers(1ssl) manpage for more information\n# about the syntax of this string.\n#\n# Note: this configuration applies only to <= TLSv1.2.\n#\n# tls-ciphers DEFAULT:!MEDIUM\n\n# Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more\n# information about the syntax of this string, and specifically for TLSv1.3\n# ciphersuites.\n#\n# tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256\n\n# When choosing a cipher, use the server's preference instead of the client\n# preference. By default, the server follows the client's preference.\n#\n# tls-prefer-server-ciphers yes\n\n# By default, TLS session caching is enabled to allow faster and less expensive\n# reconnections by clients that support it. Use the following directive to disable\n# caching.\n#\n# tls-session-caching no\n\n# Change the default number of TLS sessions cached. A zero value sets the cache\n# to unlimited size. The default size is 20480.\n#\n# tls-session-cache-size 5000\n\n# Change the default timeout of cached TLS sessions. The default timeout is 300\n# seconds.\n#\n# tls-session-cache-timeout 60\n\n################################# GENERAL #####################################\n\n# By default Redis does not run as a daemon. Use 'yes' if you need it.\n# Note that Redis will write a pid file in /run/redis.pid when daemonized.\n# When Redis is supervised by upstart or systemd, this parameter has no impact.\ndaemonize yes\n\n# If you run Redis from upstart or systemd, Redis can interact with your\n# supervision tree. Options:\n# supervised no - no supervision interaction\n# supervised upstart - signal upstart by putting Redis into SIGSTOP mode\n# requires \"expect stop\" in your upstart job config\n# supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET\n# on startup, and updating Redis status on a regular\n# basis.\n# supervised auto - detect upstart or systemd method based on\n# UPSTART_JOB or NOTIFY_SOCKET environment variables\n# Note: these supervision methods only signal \"process is ready.\"\n# They do not enable continuous pings back to your supervisor.\n#\n# The default is \"no\". To run under upstart/systemd, you can simply uncomment\n# the line below:\n#\n# supervised auto\n\n# If a pid file is specified, Redis writes it where specified at startup\n# and removes it at exit.\n#\n# When the server runs non daemonized, no pid file is created if none is\n# specified in the configuration. When the server is daemonized, the pid file\n# is used even if not specified, defaulting to \"/run/redis.pid\".\n#\n# Creating a pid file is best effort: if Redis is not able to create it\n# nothing bad happens, the server will start and run normally.\n#\n# Note that on modern Linux systems \"/run/redis.pid\" is more conforming\n# and should be used instead.\npidfile /run/redis/redis.pid\n\n# Specify the server verbosity level.\n# This can be one of:\n# debug (a lot of information, useful for development/testing)\n# verbose (many rarely useful info, but not a mess like the debug level)\n# notice (moderately verbose, what you want in production probably)\n# warning (only very important / critical messages are logged)\nloglevel warning\n\n# Specify the log file name. Also the empty string can be used to force\n# Redis to log on the standard output. Note that if you use standard\n# output for logging but daemonize, logs will be sent to /dev/null\nlogfile /var/log/redis/redis-server.log\n\n# To enable logging to the system logger, just set 'syslog-enabled' to yes,\n# and optionally update the other syslog parameters to suit your needs.\n# syslog-enabled no\n\n# Specify the syslog identity.\n# syslog-ident redis\n\n# Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.\n# syslog-facility local0\n\n# To disable the built in crash log, which will possibly produce cleaner core\n# dumps when they are needed, uncomment the following:\n#\n# crash-log-enabled no\n\n# To disable the fast memory check that's run as part of the crash log, which\n# will possibly let redis terminate sooner, uncomment the following:\n#\n# crash-memcheck-enabled no\n\n# Set the number of databases. The default database is DB 0, you can select\n# a different one on a per-connection basis using SELECT where\n# dbid is a number between 0 and 'databases'-1\ndatabases 8\n\n# By default Redis shows an ASCII art logo only when started to log to the\n# standard output and if the standard output is a TTY and syslog logging is\n# disabled. Basically this means that normally a logo is displayed only in\n# interactive sessions.\n#\n# However it is possible to force the pre-4.0 behavior and always show a\n# ASCII art logo in startup logs by setting the following option to yes.\nalways-show-logo no\n\n# By default, Redis modifies the process title (as seen in 'top' and 'ps') to\n# provide some runtime information. It is possible to disable this and leave\n# the process name as executed by setting the following to no.\nset-proc-title yes\n\n# When changing the process title, Redis uses the following template to construct\n# the modified title.\n#\n# Template variables are specified in curly brackets. The following variables are\n# supported:\n#\n# {title} Name of process as executed if parent, or type of child process.\n# {listen-addr} Bind address or '*' followed by TCP or TLS port listening on, or\n# Unix socket if only that's available.\n# {server-mode} Special mode, i.e. \"[sentinel]\" or \"[cluster]\".\n# {port} TCP port listening on, or 0.\n# {tls-port} TLS port listening on, or 0.\n# {unixsocket} Unix domain socket listening on, or \"\".\n# {config-file} Name of configuration file used.\n#\nproc-title-template \"{title} {listen-addr} {server-mode}\"\n\n################################ SNAPSHOTTING ################################\n\n# Save the DB to disk.\n#\n# save [ ...]\n#\n# Redis will save the DB if the given number of seconds elapsed and it\n# surpassed the given number of write operations against the DB.\n#\n# Snapshotting can be completely disabled with a single empty string argument\n# as in following example:\n#\n# save \"\"\n#\n# Unless specified otherwise, by default Redis will save the DB:\n# * After 3600 seconds (an hour) if at least 1 change was performed\n# * After 300 seconds (5 minutes) if at least 100 changes were performed\n# * After 60 seconds if at least 10000 changes were performed\n#\n# You can set these explicitly by uncommenting the following line.\n#\n# save 3600 1 300 100 60 10000\n\n# By default Redis will stop accepting writes if RDB snapshots are enabled\n# (at least one save point) and the latest background save failed.\n# This will make the user aware (in a hard way) that data is not persisting\n# on disk properly, otherwise chances are that no one will notice and some\n# disaster will happen.\n#\n# If the background saving process will start working again Redis will\n# automatically allow writes again.\n#\n# However if you have setup your proper monitoring of the Redis server\n# and persistence, you may want to disable this feature so that Redis will\n# continue to work as usual even if there are problems with disk,\n# permissions, and so forth.\nstop-writes-on-bgsave-error no\n\n# Compress string objects using LZF when dump .rdb databases?\n# By default compression is enabled as it's almost always a win.\n# If you want to save some CPU in the saving child set it to 'no' but\n# the dataset will likely be bigger if you have compressible values or keys.\nrdbcompression yes\n\n# Since version 5 of RDB a CRC64 checksum is placed at the end of the file.\n# This makes the format more resistant to corruption but there is a performance\n# hit to pay (around 10%) when saving and loading RDB files, so you can disable it\n# for maximum performances.\n#\n# RDB files created with checksum disabled have a checksum of zero that will\n# tell the loading code to skip the check.\nrdbchecksum no\n\n# Enables or disables full sanitization checks for ziplist and listpack etc when\n# loading an RDB or RESTORE payload. This reduces the chances of a assertion or\n# crash later on while processing commands.\n# Options:\n# no - Never perform full sanitization\n# yes - Always perform full sanitization\n# clients - Perform full sanitization only for user connections.\n# Excludes: RDB files, RESTORE commands received from the master\n# connection, and client connections which have the\n# skip-sanitize-payload ACL flag.\n# The default should be 'clients' but since it currently affects cluster\n# resharding via MIGRATE, it is temporarily set to 'no' by default.\n#\n# sanitize-dump-payload no\n\n# The filename where to dump the DB\ndbfilename dump.rdb\n\n# Remove RDB files used by replication in instances without persistence\n# enabled. By default this option is disabled, however there are environments\n# where for regulations or other security concerns, RDB files persisted on\n# disk by masters in order to feed replicas, or stored on disk by replicas\n# in order to load them for the initial synchronization, should be deleted\n# ASAP. Note that this option ONLY WORKS in instances that have both AOF\n# and RDB persistence disabled, otherwise is completely ignored.\n#\n# An alternative (and sometimes better) way to obtain the same effect is\n# to use diskless replication on both master and replicas instances. However\n# in the case of replicas, diskless is not always an option.\nrdb-del-sync-files no\n\n# The working directory.\n#\n# The DB will be written inside this directory, with the filename specified\n# above using the 'dbfilename' configuration directive.\n#\n# The Append Only File will also be created inside this directory.\n#\n# Note that you must specify a directory here, not a file name.\ndir /var/lib/redis/\n\n################################# REPLICATION #################################\n\n# Master-Replica replication. Use replicaof to make a Redis instance a copy of\n# another Redis server. A few things to understand ASAP about Redis replication.\n#\n# +------------------+ +---------------+\n# | Master | ---> | Replica |\n# | (receive writes) | | (exact copy) |\n# +------------------+ +---------------+\n#\n# 1) Redis replication is asynchronous, but you can configure a master to\n# stop accepting writes if it appears to be not connected with at least\n# a given number of replicas.\n# 2) Redis replicas are able to perform a partial resynchronization with the\n# master if the replication link is lost for a relatively small amount of\n# time. You may want to configure the replication backlog size (see the next\n# sections of this file) with a sensible value depending on your needs.\n# 3) Replication is automatic and does not need user intervention. After a\n# network partition replicas automatically try to reconnect to masters\n# and resynchronize with them.\n#\n# replicaof \n\n# If the master is password protected (using the \"requirepass\" configuration\n# directive below) it is possible to tell the replica to authenticate before\n# starting the replication synchronization process, otherwise the master will\n# refuse the replica request.\n#\n# masterauth \n#\n# However this is not enough if you are using Redis ACLs (for Redis version\n# 6 or greater), and the default user is not capable of running the PSYNC\n# command and/or other commands needed for replication. In this case it's\n# better to configure a special user to use with replication, and specify the\n# masteruser configuration as such:\n#\n# masteruser \n#\n# When masteruser is specified, the replica will authenticate against its\n# master using the new AUTH form: AUTH .\n\n# When a replica loses its connection with the master, or when the replication\n# is still in progress, the replica can act in two different ways:\n#\n# 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will\n# still reply to client requests, possibly with out of date data, or the\n# data set may just be empty if this is the first synchronization.\n#\n# 2) If replica-serve-stale-data is set to 'no' the replica will reply with error\n# \"MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'\"\n# to all data access commands, excluding commands such as:\n# INFO, REPLICAOF, AUTH, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE,\n# UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST,\n# HOST and LATENCY.\n#\nreplica-serve-stale-data yes\n\n# You can configure a replica instance to accept writes or not. Writing against\n# a replica instance may be useful to store some ephemeral data (because data\n# written on a replica will be easily deleted after resync with the master) but\n# may also cause problems if clients are writing to it because of a\n# misconfiguration.\n#\n# Since Redis 2.6 by default replicas are read-only.\n#\n# Note: read only replicas are not designed to be exposed to untrusted clients\n# on the internet. It's just a protection layer against misuse of the instance.\n# Still a read only replica exports by default all the administrative commands\n# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve\n# security of read only replicas using 'rename-command' to shadow all the\n# administrative / dangerous commands.\nreplica-read-only yes\n\n# Replication SYNC strategy: disk or socket.\n#\n# New replicas and reconnecting replicas that are not able to continue the\n# replication process just receiving differences, need to do what is called a\n# \"full synchronization\". An RDB file is transmitted from the master to the\n# replicas.\n#\n# The transmission can happen in two different ways:\n#\n# 1) Disk-backed: The Redis master creates a new process that writes the RDB\n# file on disk. Later the file is transferred by the parent\n# process to the replicas incrementally.\n# 2) Diskless: The Redis master creates a new process that directly writes the\n# RDB file to replica sockets, without touching the disk at all.\n#\n# With disk-backed replication, while the RDB file is generated, more replicas\n# can be queued and served with the RDB file as soon as the current child\n# producing the RDB file finishes its work. With diskless replication instead\n# once the transfer starts, new replicas arriving will be queued and a new\n# transfer will start when the current one terminates.\n#\n# When diskless replication is used, the master waits a configurable amount of\n# time (in seconds) before starting the transfer in the hope that multiple\n# replicas will arrive and the transfer can be parallelized.\n#\n# With slow disks and fast (large bandwidth) networks, diskless replication\n# works better.\nrepl-diskless-sync yes\n\n# When diskless replication is enabled, it is possible to configure the delay\n# the server waits in order to spawn the child that transfers the RDB via socket\n# to the replicas.\n#\n# This is important since once the transfer starts, it is not possible to serve\n# new replicas arriving, that will be queued for the next RDB transfer, so the\n# server waits a delay in order to let more replicas arrive.\n#\n# The delay is specified in seconds, and by default is 5 seconds. To disable\n# it entirely just set it to 0 seconds and the transfer will start ASAP.\nrepl-diskless-sync-delay 5\n\n# When diskless replication is enabled with a delay, it is possible to let\n# the replication start before the maximum delay is reached if the maximum\n# number of replicas expected have connected. Default of 0 means that the\n# maximum is not defined and Redis will wait the full delay.\nrepl-diskless-sync-max-replicas 0\n\n# -----------------------------------------------------------------------------\n# WARNING: RDB diskless load is experimental. Since in this setup the replica\n# does not immediately store an RDB on disk, it may cause data loss during\n# failovers. RDB diskless load + Redis modules not handling I/O reads may also\n# cause Redis to abort in case of I/O errors during the initial synchronization\n# stage with the master. Use only if you know what you are doing.\n# -----------------------------------------------------------------------------\n#\n# Replica can load the RDB it reads from the replication link directly from the\n# socket, or store the RDB to a file and read that file after it was completely\n# received from the master.\n#\n# In many cases the disk is slower than the network, and storing and loading\n# the RDB file may increase replication time (and even increase the master's\n# Copy on Write memory and replica buffers).\n# However, parsing the RDB file directly from the socket may mean that we have\n# to flush the contents of the current database before the full rdb was\n# received. For this reason we have the following options:\n#\n# \"disabled\" - Don't use diskless load (store the rdb file to the disk first)\n# \"on-empty-db\" - Use diskless load only when it is completely safe.\n# \"swapdb\" - Keep current db contents in RAM while parsing the data directly\n# from the socket. Replicas in this mode can keep serving current\n# data set while replication is in progress, except for cases where\n# they can't recognize master as having a data set from same\n# replication history.\n# Note that this requires sufficient memory, if you don't have it,\n# you risk an OOM kill.\nrepl-diskless-load disabled\n\n# Master send PINGs to its replicas in a predefined interval. It's possible to\n# change this interval with the repl_ping_replica_period option. The default\n# value is 10 seconds.\n#\n# repl-ping-replica-period 10\n\n# The following option sets the replication timeout for:\n#\n# 1) Bulk transfer I/O during SYNC, from the point of view of replica.\n# 2) Master timeout from the point of view of replicas (data, pings).\n# 3) Replica timeout from the point of view of masters (REPLCONF ACK pings).\n#\n# It is important to make sure that this value is greater than the value\n# specified for repl-ping-replica-period otherwise a timeout will be detected\n# every time there is low traffic between the master and the replica. The default\n# value is 60 seconds.\n#\n# repl-timeout 60\n\n# Disable TCP_NODELAY on the replica socket after SYNC?\n#\n# If you select \"yes\" Redis will use a smaller number of TCP packets and\n# less bandwidth to send data to replicas. But this can add a delay for\n# the data to appear on the replica side, up to 40 milliseconds with\n# Linux kernels using a default configuration.\n#\n# If you select \"no\" the delay for data to appear on the replica side will\n# be reduced but more bandwidth will be used for replication.\n#\n# By default we optimize for low latency, but in very high traffic conditions\n# or when the master and replicas are many hops away, turning this to \"yes\" may\n# be a good idea.\nrepl-disable-tcp-nodelay no\n\n# Set the replication backlog size. The backlog is a buffer that accumulates\n# replica data when replicas are disconnected for some time, so that when a\n# replica wants to reconnect again, often a full resync is not needed, but a\n# partial resync is enough, just passing the portion of data the replica\n# missed while disconnected.\n#\n# The bigger the replication backlog, the longer the replica can endure the\n# disconnect and later be able to perform a partial resynchronization.\n#\n# The backlog is only allocated if there is at least one replica connected.\n#\n# repl-backlog-size 1mb\n\n# After a master has no connected replicas for some time, the backlog will be\n# freed. The following option configures the amount of seconds that need to\n# elapse, starting from the time the last replica disconnected, for the backlog\n# buffer to be freed.\n#\n# Note that replicas never free the backlog for timeout, since they may be\n# promoted to masters later, and should be able to correctly \"partially\n# resynchronize\" with other replicas: hence they should always accumulate backlog.\n#\n# A value of 0 means to never release the backlog.\n#\n# repl-backlog-ttl 3600\n\n# The replica priority is an integer number published by Redis in the INFO\n# output. It is used by Redis Sentinel in order to select a replica to promote\n# into a master if the master is no longer working correctly.\n#\n# A replica with a low priority number is considered better for promotion, so\n# for instance if there are three replicas with priority 10, 100, 25 Sentinel\n# will pick the one with priority 10, that is the lowest.\n#\n# However a special priority of 0 marks the replica as not able to perform the\n# role of master, so a replica with priority of 0 will never be selected by\n# Redis Sentinel for promotion.\n#\n# By default the priority is 100.\nreplica-priority 100\n\n# The propagation error behavior controls how Redis will behave when it is\n# unable to handle a command being processed in the replication stream from a master\n# or processed while reading from an AOF file. Errors that occur during propagation\n# are unexpected, and can cause data inconsistency. However, there are edge cases\n# in earlier versions of Redis where it was possible for the server to replicate or persist\n# commands that would fail on future versions. For this reason the default behavior\n# is to ignore such errors and continue processing commands.\n#\n# If an application wants to ensure there is no data divergence, this configuration\n# should be set to 'panic' instead. The value can also be set to 'panic-on-replicas'\n# to only panic when a replica encounters an error on the replication stream. One of\n# these two panic values will become the default value in the future once there are\n# sufficient safety mechanisms in place to prevent false positive crashes.\n#\n# propagation-error-behavior ignore\n\n# Replica ignore disk write errors controls the behavior of a replica when it is\n# unable to persist a write command received from its master to disk. By default,\n# this configuration is set to 'no' and will crash the replica in this condition.\n# It is not recommended to change this default, however in order to be compatible\n# with older versions of Redis this config can be toggled to 'yes' which will just\n# log a warning and execute the write command it got from the master.\n#\n# replica-ignore-disk-write-errors no\n\n# -----------------------------------------------------------------------------\n# By default, Redis Sentinel includes all replicas in its reports. A replica\n# can be excluded from Redis Sentinel's announcements. An unannounced replica\n# will be ignored by the 'sentinel replicas ' command and won't be\n# exposed to Redis Sentinel's clients.\n#\n# This option does not change the behavior of replica-priority. Even with\n# replica-announced set to 'no', the replica can be promoted to master. To\n# prevent this behavior, set replica-priority to 0.\n#\n# replica-announced yes\n\n# It is possible for a master to stop accepting writes if there are less than\n# N replicas connected, having a lag less or equal than M seconds.\n#\n# The N replicas need to be in \"online\" state.\n#\n# The lag in seconds, that must be <= the specified value, is calculated from\n# the last ping received from the replica, that is usually sent every second.\n#\n# This option does not GUARANTEE that N replicas will accept the write, but\n# will limit the window of exposure for lost writes in case not enough replicas\n# are available, to the specified number of seconds.\n#\n# For example to require at least 3 replicas with a lag <= 10 seconds use:\n#\n# min-replicas-to-write 3\n# min-replicas-max-lag 10\n#\n# Setting one or the other to 0 disables the feature.\n#\n# By default min-replicas-to-write is set to 0 (feature disabled) and\n# min-replicas-max-lag is set to 10.\n\n# A Redis master is able to list the address and port of the attached\n# replicas in different ways. For example the \"INFO replication\" section\n# offers this information, which is used, among other tools, by\n# Redis Sentinel in order to discover replica instances.\n# Another place where this info is available is in the output of the\n# \"ROLE\" command of a master.\n#\n# The listed IP address and port normally reported by a replica is\n# obtained in the following way:\n#\n# IP: The address is auto detected by checking the peer address\n# of the socket used by the replica to connect with the master.\n#\n# Port: The port is communicated by the replica during the replication\n# handshake, and is normally the port that the replica is using to\n# listen for connections.\n#\n# However when port forwarding or Network Address Translation (NAT) is\n# used, the replica may actually be reachable via different IP and port\n# pairs. The following two options can be used by a replica in order to\n# report to its master a specific set of IP and port, so that both INFO\n# and ROLE will report those values.\n#\n# There is no need to use both the options if you need to override just\n# the port or the IP address.\n#\n# replica-announce-ip 5.5.5.5\n# replica-announce-port 1234\n\n############################### KEYS TRACKING #################################\n\n# Redis implements server assisted support for client side caching of values.\n# This is implemented using an invalidation table that remembers, using\n# a radix key indexed by key name, what clients have which keys. In turn\n# this is used in order to send invalidation messages to clients. Please\n# check this page to understand more about the feature:\n#\n# https://redis.io/topics/client-side-caching\n#\n# When tracking is enabled for a client, all the read only queries are assumed\n# to be cached: this will force Redis to store information in the invalidation\n# table. When keys are modified, such information is flushed away, and\n# invalidation messages are sent to the clients. However if the workload is\n# heavily dominated by reads, Redis could use more and more memory in order\n# to track the keys fetched by many clients.\n#\n# For this reason it is possible to configure a maximum fill value for the\n# invalidation table. By default it is set to 1M of keys, and once this limit\n# is reached, Redis will start to evict keys in the invalidation table\n# even if they were not modified, just to reclaim memory: this will in turn\n# force the clients to invalidate the cached values. Basically the table\n# maximum size is a trade off between the memory you want to spend server\n# side to track information about who cached what, and the ability of clients\n# to retain cached objects in memory.\n#\n# If you set the value to 0, it means there are no limits, and Redis will\n# retain as many keys as needed in the invalidation table.\n# In the \"stats\" INFO section, you can find information about the number of\n# keys in the invalidation table at every given moment.\n#\n# Note: when key tracking is used in broadcasting mode, no memory is used\n# in the server side so this setting is useless.\n#\n# tracking-table-max-keys 1000000\n\n################################## SECURITY ###################################\n\n# Warning: since Redis is pretty fast, an outside user can try up to\n# 1 million passwords per second against a modern box. This means that you\n# should use very strong passwords, otherwise they will be very easy to break.\n# Note that because the password is really a shared secret between the client\n# and the server, and should not be memorized by any human, the password\n# can be easily a long string from /dev/urandom or whatever, so by using a\n# long and unguessable password no brute force attack will be possible.\n\n# Redis ACL users are defined in the following format:\n#\n# user ... acl rules ...\n#\n# For example:\n#\n# user worker +@list +@connection ~jobs:* on >ffa9203c493aa99\n#\n# The special username \"default\" is used for new connections. If this user\n# has the \"nopass\" rule, then new connections will be immediately authenticated\n# as the \"default\" user without the need of any password provided via the\n# AUTH command. Otherwise if the \"default\" user is not flagged with \"nopass\"\n# the connections will start in not authenticated state, and will require\n# AUTH (or the HELLO command AUTH option) in order to be authenticated and\n# start to work.\n#\n# The ACL rules that describe what a user can do are the following:\n#\n# on Enable the user: it is possible to authenticate as this user.\n# off Disable the user: it's no longer possible to authenticate\n# with this user, however the already authenticated connections\n# will still work.\n# skip-sanitize-payload RESTORE dump-payload sanitization is skipped.\n# sanitize-payload RESTORE dump-payload is sanitized (default).\n# + Allow the execution of that command.\n# May be used with `|` for allowing subcommands (e.g \"+config|get\")\n# - Disallow the execution of that command.\n# May be used with `|` for blocking subcommands (e.g \"-config|set\")\n# +@ Allow the execution of all the commands in such category\n# with valid categories are like @admin, @set, @sortedset, ...\n# and so forth, see the full list in the server.c file where\n# the Redis command table is described and defined.\n# The special category @all means all the commands, but currently\n# present in the server, and that will be loaded in the future\n# via modules.\n# +|first-arg Allow a specific first argument of an otherwise\n# disabled command. It is only supported on commands with\n# no sub-commands, and is not allowed as negative form\n# like -SELECT|1, only additive starting with \"+\". This\n# feature is deprecated and may be removed in the future.\n# allcommands Alias for +@all. Note that it implies the ability to execute\n# all the future commands loaded via the modules system.\n# nocommands Alias for -@all.\n# ~ Add a pattern of keys that can be mentioned as part of\n# commands. For instance ~* allows all the keys. The pattern\n# is a glob-style pattern like the one of KEYS.\n# It is possible to specify multiple patterns.\n# %R~ Add key read pattern that specifies which keys can be read\n# from.\n# %W~ Add key write pattern that specifies which keys can be\n# written to.\n# allkeys Alias for ~*\n# resetkeys Flush the list of allowed keys patterns.\n# & Add a glob-style pattern of Pub/Sub channels that can be\n# accessed by the user. It is possible to specify multiple channel\n# patterns.\n# allchannels Alias for &*\n# resetchannels Flush the list of allowed channel patterns.\n# > Add this password to the list of valid password for the user.\n# For example >mypass will add \"mypass\" to the list.\n# This directive clears the \"nopass\" flag (see later).\n# < Remove this password from the list of valid passwords.\n# nopass All the set passwords of the user are removed, and the user\n# is flagged as requiring no password: it means that every\n# password will work against this user. If this directive is\n# used for the default user, every new connection will be\n# immediately authenticated with the default user without\n# any explicit AUTH command required. Note that the \"resetpass\"\n# directive will clear this condition.\n# resetpass Flush the list of allowed passwords. Moreover removes the\n# \"nopass\" status. After \"resetpass\" the user has no associated\n# passwords and there is no way to authenticate without adding\n# some password (or setting it as \"nopass\" later).\n# reset Performs the following actions: resetpass, resetkeys, off,\n# -@all. The user returns to the same state it has immediately\n# after its creation.\n# () Create a new selector with the options specified within the\n# parentheses and attach it to the user. Each option should be\n# space separated. The first character must be ( and the last\n# character must be ).\n# clearselectors Remove all of the currently attached selectors.\n# Note this does not change the \"root\" user permissions,\n# which are the permissions directly applied onto the\n# user (outside the parentheses).\n#\n# ACL rules can be specified in any order: for instance you can start with\n# passwords, then flags, or key patterns. However note that the additive\n# and subtractive rules will CHANGE MEANING depending on the ordering.\n# For instance see the following example:\n#\n# user alice on +@all -DEBUG ~* >somepassword\n#\n# This will allow \"alice\" to use all the commands with the exception of the\n# DEBUG command, since +@all added all the commands to the set of the commands\n# alice can use, and later DEBUG was removed. However if we invert the order\n# of two ACL rules the result will be different:\n#\n# user alice on -DEBUG +@all ~* >somepassword\n#\n# Now DEBUG was removed when alice had yet no commands in the set of allowed\n# commands, later all the commands are added, so the user will be able to\n# execute everything.\n#\n# Basically ACL rules are processed left-to-right.\n#\n# The following is a list of command categories and their meanings:\n# * keyspace - Writing or reading from keys, databases, or their metadata\n# in a type agnostic way. Includes DEL, RESTORE, DUMP, RENAME, EXISTS, DBSIZE,\n# KEYS, EXPIRE, TTL, FLUSHALL, etc. Commands that may modify the keyspace,\n# key or metadata will also have `write` category. Commands that only read\n# the keyspace, key or metadata will have the `read` category.\n# * read - Reading from keys (values or metadata). Note that commands that don't\n# interact with keys, will not have either `read` or `write`.\n# * write - Writing to keys (values or metadata)\n# * admin - Administrative commands. Normal applications will never need to use\n# these. Includes REPLICAOF, CONFIG, DEBUG, SAVE, MONITOR, ACL, SHUTDOWN, etc.\n# * dangerous - Potentially dangerous (each should be considered with care for\n# various reasons). This includes FLUSHALL, MIGRATE, RESTORE, SORT, KEYS,\n# CLIENT, DEBUG, INFO, CONFIG, SAVE, REPLICAOF, etc.\n# * connection - Commands affecting the connection or other connections.\n# This includes AUTH, SELECT, COMMAND, CLIENT, ECHO, PING, etc.\n# * blocking - Potentially blocking the connection until released by another\n# command.\n# * fast - Fast O(1) commands. May loop on the number of arguments, but not the\n# number of elements in the key.\n# * slow - All commands that are not Fast.\n# * pubsub - PUBLISH / SUBSCRIBE related\n# * transaction - WATCH / MULTI / EXEC related commands.\n# * scripting - Scripting related.\n# * set - Data type: sets related.\n# * sortedset - Data type: zsets related.\n# * list - Data type: lists related.\n# * hash - Data type: hashes related.\n# * string - Data type: strings related.\n# * bitmap - Data type: bitmaps related.\n# * hyperloglog - Data type: hyperloglog related.\n# * geo - Data type: geo related.\n# * stream - Data type: streams related.\n#\n# For more information about ACL configuration please refer to\n# the Redis web site at https://redis.io/topics/acl\n\n# ACL LOG\n#\n# The ACL Log tracks failed commands and authentication events associated\n# with ACLs. The ACL Log is useful to troubleshoot failed commands blocked\n# by ACLs. The ACL Log is stored in memory. You can reclaim memory with\n# ACL LOG RESET. Define the maximum entry length of the ACL Log below.\nacllog-max-len 128\n\n# Using an external ACL file\n#\n# Instead of configuring users here in this file, it is possible to use\n# a stand-alone file just listing users. The two methods cannot be mixed:\n# if you configure users here and at the same time you activate the external\n# ACL file, the server will refuse to start.\n#\n# The format of the external ACL user file is exactly the same as the\n# format that is used inside redis.conf to describe users.\n#\n# aclfile /etc/redis/users.acl\n\n# IMPORTANT NOTE: starting with Redis 6 \"requirepass\" is just a compatibility\n# layer on top of the new ACL system. The option effect will be just setting\n# the password for the default user. Clients will still authenticate using\n# AUTH as usually, or more explicitly with AUTH default \n# if they follow the new protocol: both will work.\n#\n# The requirepass is not compatible with aclfile option and the ACL LOAD\n# command, these will cause requirepass to be ignored.\n#\n# requirepass isfoobared\n\n# New users are initialized with restrictive permissions by default, via the\n# equivalent of this ACL rule 'off resetkeys -@all'. Starting with Redis 6.2, it\n# is possible to manage access to Pub/Sub channels with ACL rules as well. The\n# default Pub/Sub channels permission if new users is controlled by the\n# acl-pubsub-default configuration directive, which accepts one of these values:\n#\n# allchannels: grants access to all Pub/Sub channels\n# resetchannels: revokes access to all Pub/Sub channels\n#\n# From Redis 7.0, acl-pubsub-default defaults to 'resetchannels' permission.\n#\n# acl-pubsub-default resetchannels\n\n# Command renaming (DEPRECATED).\n#\n# ------------------------------------------------------------------------\n# WARNING: avoid using this option if possible. Instead use ACLs to remove\n# commands from the default user, and put them only in some admin user you\n# create for administrative purposes.\n# ------------------------------------------------------------------------\n#\n# It is possible to change the name of dangerous commands in a shared\n# environment. For instance the CONFIG command may be renamed into something\n# hard to guess so that it will still be available for internal-use tools\n# but not available for general clients.\n#\n# Example:\n#\n# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52\n#\n# It is also possible to completely kill a command by renaming it into\n# an empty string:\n#\n# rename-command CONFIG \"\"\n#\n# Please note that changing the name of commands that are logged into the\n# AOF file or transmitted to replicas may cause problems.\n\n################################### CLIENTS ####################################\n\n# Set the max number of connected clients at the same time. By default\n# this limit is set to 10000 clients, however if the Redis server is not\n# able to configure the process file limit to allow for the specified limit\n# the max number of allowed clients is set to the current file limit\n# minus 32 (as Redis reserves a few file descriptors for internal uses).\n#\n# Once the limit is reached Redis will close all the new connections sending\n# an error 'max number of clients reached'.\n#\n# IMPORTANT: When Redis Cluster is used, the max number of connections is also\n# shared with the cluster bus: every node in the cluster will use two\n# connections, one incoming and another outgoing. It is important to size the\n# limit accordingly in case of very large clusters.\n#\nmaxclients 4000\n\n############################## MEMORY MANAGEMENT ################################\n\n# Set a memory usage limit to the specified amount of bytes.\n# When the memory limit is reached Redis will try to remove keys\n# according to the eviction policy selected (see maxmemory-policy).\n#\n# If Redis can't remove keys according to the policy, or if the policy is\n# set to 'noeviction', Redis will start to reply with errors to commands\n# that would use more memory, like SET, LPUSH, and so on, and will continue\n# to reply to read-only commands like GET.\n#\n# This option is usually useful when using Redis as an LRU or LFU cache, or to\n# set a hard memory limit for an instance (using the 'noeviction' policy).\n#\n# WARNING: If you have replicas attached to an instance with maxmemory on,\n# the size of the output buffers needed to feed the replicas are subtracted\n# from the used memory count, so that network problems / resyncs will\n# not trigger a loop where keys are evicted, and in turn the output\n# buffer of replicas is full with DELs of keys evicted triggering the deletion\n# of more keys, and so forth until the database is completely emptied.\n#\n# In short... if you have replicas attached it is suggested that you set a lower\n# limit for maxmemory so that there is some free RAM on the system for replica\n# output buffers (but this is not needed if the policy is 'noeviction').\n#\nmaxmemory 88MB\n\n# MAXMEMORY POLICY: how Redis will select what to remove when maxmemory\n# is reached. You can select one from the following behaviors:\n#\n# volatile-lru -> Evict using approximated LRU, only keys with an expire set.\n# allkeys-lru -> Evict any key using approximated LRU.\n# volatile-lfu -> Evict using approximated LFU, only keys with an expire set.\n# allkeys-lfu -> Evict any key using approximated LFU.\n# volatile-random -> Remove a random key having an expire set.\n# allkeys-random -> Remove a random key, any key.\n# volatile-ttl -> Remove the key with the nearest expire time (minor TTL)\n# noeviction -> Don't evict anything, just return an error on write operations.\n#\n# LRU means Least Recently Used\n# LFU means Least Frequently Used\n#\n# Both LRU, LFU and volatile-ttl are implemented using approximated\n# randomized algorithms.\n#\n# Note: with any of the above policies, when there are no suitable keys for\n# eviction, Redis will return an error on write operations that require\n# more memory. These are usually commands that create new keys, add data or\n# modify existing keys. A few examples are: SET, INCR, HSET, LPUSH, SUNIONSTORE,\n# SORT (due to the STORE argument), and EXEC (if the transaction includes any\n# command that requires memory).\n#\n# The default is: noeviction\n#\nmaxmemory-policy allkeys-lru\n\n# LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated\n# algorithms (in order to save memory), so you can tune it for speed or\n# accuracy. By default Redis will check five keys and pick the one that was\n# used least recently, you can change the sample size using the following\n# configuration directive.\n#\n# The default of 5 produces good enough results. 10 Approximates very closely\n# true LRU but costs more CPU. 3 is faster but not very accurate.\n#\n# maxmemory-samples 5\n\n# Eviction processing is designed to function well with the default setting.\n# If there is an unusually large amount of write traffic, this value may need to\n# be increased. Decreasing this value may reduce latency at the risk of\n# eviction processing effectiveness\n# 0 = minimum latency, 10 = default, 100 = process without regard to latency\n#\n# maxmemory-eviction-tenacity 10\n\n# Starting from Redis 5, by default a replica will ignore its maxmemory setting\n# (unless it is promoted to master after a failover or manually). It means\n# that the eviction of keys will be just handled by the master, sending the\n# DEL commands to the replica as keys evict in the master side.\n#\n# This behavior ensures that masters and replicas stay consistent, and is usually\n# what you want, however if your replica is writable, or you want the replica\n# to have a different memory setting, and you are sure all the writes performed\n# to the replica are idempotent, then you may change this default (but be sure\n# to understand what you are doing).\n#\n# Note that since the replica by default does not evict, it may end using more\n# memory than the one set via maxmemory (there are certain buffers that may\n# be larger on the replica, or data structures may sometimes take more memory\n# and so forth). So make sure you monitor your replicas and make sure they\n# have enough memory to never hit a real out-of-memory condition before the\n# master hits the configured maxmemory setting.\n#\n# replica-ignore-maxmemory yes\n\n# Redis reclaims expired keys in two ways: upon access when those keys are\n# found to be expired, and also in background, in what is called the\n# \"active expire key\". The key space is slowly and interactively scanned\n# looking for expired keys to reclaim, so that it is possible to free memory\n# of keys that are expired and will never be accessed again in a short time.\n#\n# The default effort of the expire cycle will try to avoid having more than\n# ten percent of expired keys still in memory, and will try to avoid consuming\n# more than 25% of total memory and to add latency to the system. However\n# it is possible to increase the expire \"effort\" that is normally set to\n# \"1\", to a greater value, up to the value \"10\". At its maximum value the\n# system will use more CPU, longer cycles (and technically may introduce\n# more latency), and will tolerate less already expired keys still present\n# in the system. It's a tradeoff between memory, CPU and latency.\n#\n# active-expire-effort 1\n\n############################# LAZY FREEING ####################################\n\n# Redis has two primitives to delete keys. One is called DEL and is a blocking\n# deletion of the object. It means that the server stops processing new commands\n# in order to reclaim all the memory associated with an object in a synchronous\n# way. If the key deleted is associated with a small object, the time needed\n# in order to execute the DEL command is very small and comparable to most other\n# O(1) or O(log_N) commands in Redis. However if the key is associated with an\n# aggregated value containing millions of elements, the server can block for\n# a long time (even seconds) in order to complete the operation.\n#\n# For the above reasons Redis also offers non blocking deletion primitives\n# such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and\n# FLUSHDB commands, in order to reclaim memory in background. Those commands\n# are executed in constant time. Another thread will incrementally free the\n# object in the background as fast as possible.\n#\n# DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled.\n# It's up to the design of the application to understand when it is a good\n# idea to use one or the other. However the Redis server sometimes has to\n# delete keys or flush the whole database as a side effect of other operations.\n# Specifically Redis deletes objects independently of a user call in the\n# following scenarios:\n#\n# 1) On eviction, because of the maxmemory and maxmemory policy configurations,\n# in order to make room for new data, without going over the specified\n# memory limit.\n# 2) Because of expire: when a key with an associated time to live (see the\n# EXPIRE command) must be deleted from memory.\n# 3) Because of a side effect of a command that stores data on a key that may\n# already exist. For example the RENAME command may delete the old key\n# content when it is replaced with another one. Similarly SUNIONSTORE\n# or SORT with STORE option may delete existing keys. The SET command\n# itself removes any old content of the specified key in order to replace\n# it with the specified string.\n# 4) During replication, when a replica performs a full resynchronization with\n# its master, the content of the whole database is removed in order to\n# load the RDB file just transferred.\n#\n# In all the above cases the default is to delete objects in a blocking way,\n# like if DEL was called. However you can configure each case specifically\n# in order to instead release memory in a non-blocking way like if UNLINK\n# was called, using the following configuration directives.\n\nlazyfree-lazy-eviction yes\nlazyfree-lazy-expire yes\nlazyfree-lazy-server-del yes\nreplica-lazy-flush yes\n\n# It is also possible, for the case when to replace the user code DEL calls\n# with UNLINK calls is not easy, to modify the default behavior of the DEL\n# command to act exactly like UNLINK, using the following configuration\n# directive:\n\nlazyfree-lazy-user-del yes\n\n# FLUSHDB, FLUSHALL, SCRIPT FLUSH and FUNCTION FLUSH support both asynchronous and synchronous\n# deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the\n# commands. When neither flag is passed, this directive will be used to determine\n# if the data should be deleted asynchronously.\n\nlazyfree-lazy-user-flush yes\n\n################################ THREADED I/O #################################\n\n# Redis is mostly single threaded, however there are certain threaded\n# operations such as UNLINK, slow I/O accesses and other things that are\n# performed on side threads.\n#\n# Now it is also possible to handle Redis clients socket reads and writes\n# in different I/O threads. Since especially writing is so slow, normally\n# Redis users use pipelining in order to speed up the Redis performances per\n# core, and spawn multiple instances in order to scale more. Using I/O\n# threads it is possible to easily speedup two times Redis without resorting\n# to pipelining nor sharding of the instance.\n#\n# By default threading is disabled, we suggest enabling it only in machines\n# that have at least 4 or more cores, leaving at least one spare core.\n# Using more than 8 threads is unlikely to help much. We also recommend using\n# threaded I/O only if you actually have performance problems, with Redis\n# instances being able to use a quite big percentage of CPU time, otherwise\n# there is no point in using this feature.\n#\n# So for instance if you have a four cores boxes, try to use 2 or 3 I/O\n# threads, if you have a 8 cores, try to use 6 threads. In order to\n# enable I/O threads use the following configuration directive:\n#\n# io-threads 4\n#\n# Setting io-threads to 1 will just use the main thread as usual.\n# When I/O threads are enabled, we only use threads for writes, that is\n# to thread the write(2) syscall and transfer the client buffers to the\n# socket. However it is also possible to enable threading of reads and\n# protocol parsing using the following configuration directive, by setting\n# it to yes:\n#\n# io-threads-do-reads no\n#\n# Usually threading reads doesn't help much.\n#\n# NOTE 1: This configuration directive cannot be changed at runtime via\n# CONFIG SET. Also, this feature currently does not work when SSL is\n# enabled.\n#\n# NOTE 2: If you want to test the Redis speedup using redis-benchmark, make\n# sure you also run the benchmark itself in threaded mode, using the\n# --threads option to match the number of Redis threads, otherwise you'll not\n# be able to notice the improvements.\n\n############################ KERNEL OOM CONTROL ##############################\n\n# On Linux, it is possible to hint the kernel OOM killer on what processes\n# should be killed first when out of memory.\n#\n# Enabling this feature makes Redis actively control the oom_score_adj value\n# for all its processes, depending on their role. The default scores will\n# attempt to have background child processes killed before all others, and\n# replicas killed before masters.\n#\n# Redis supports these options:\n#\n# no: Don't make changes to oom-score-adj (default).\n# yes: Alias to \"relative\" see below.\n# absolute: Values in oom-score-adj-values are written as is to the kernel.\n# relative: Values are used relative to the initial value of oom_score_adj when\n# the server starts and are then clamped to a range of -1000 to 1000.\n# Because typically the initial value is 0, they will often match the\n# absolute values.\noom-score-adj no\n\n# When oom-score-adj is used, this directive controls the specific values used\n# for master, replica and background child processes. Values range -2000 to\n# 2000 (higher means more likely to be killed).\n#\n# Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities)\n# can freely increase their value, but not decrease it below its initial\n# settings. This means that setting oom-score-adj to \"relative\" and setting the\n# oom-score-adj-values to positive values will always succeed.\noom-score-adj-values 0 200 800\n\n\n#################### KERNEL transparent hugepage CONTROL ######################\n\n# Usually the kernel Transparent Huge Pages control is set to \"madvise\" or\n# or \"never\" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which\n# case this config has no effect. On systems in which it is set to \"always\",\n# redis will attempt to disable it specifically for the redis process in order\n# to avoid latency problems specifically with fork(2) and CoW.\n# If for some reason you prefer to keep it enabled, you can set this config to\n# \"no\" and the kernel global to \"always\".\n\ndisable-thp yes\n\n############################## APPEND ONLY MODE ###############################\n\n# By default Redis asynchronously dumps the dataset on disk. This mode is\n# good enough in many applications, but an issue with the Redis process or\n# a power outage may result into a few minutes of writes lost (depending on\n# the configured save points).\n#\n# The Append Only File is an alternative persistence mode that provides\n# much better durability. For instance using the default data fsync policy\n# (see later in the config file) Redis can lose just one second of writes in a\n# dramatic event like a server power outage, or a single write if something\n# wrong with the Redis process itself happens, but the operating system is\n# still running correctly.\n#\n# AOF and RDB persistence can be enabled at the same time without problems.\n# If the AOF is enabled on startup Redis will load the AOF, that is the file\n# with the better durability guarantees.\n#\n# Please check https://redis.io/topics/persistence for more information.\n\nappendonly no\n\n# The base name of the append only file.\n#\n# Redis 7 and newer use a set of append-only files to persist the dataset\n# and changes applied to it. There are two basic types of files in use:\n#\n# - Base files, which are a snapshot representing the complete state of the\n# dataset at the time the file was created. Base files can be either in\n# the form of RDB (binary serialized) or AOF (textual commands).\n# - Incremental files, which contain additional commands that were applied\n# to the dataset following the previous file.\n#\n# In addition, manifest files are used to track the files and the order in\n# which they were created and should be applied.\n#\n# Append-only file names are created by Redis following a specific pattern.\n# The file name's prefix is based on the 'appendfilename' configuration\n# parameter, followed by additional information about the sequence and type.\n#\n# For example, if appendfilename is set to appendonly.aof, the following file\n# names could be derived:\n#\n# - appendonly.aof.1.base.rdb as a base file.\n# - appendonly.aof.1.incr.aof, appendonly.aof.2.incr.aof as incremental files.\n# - appendonly.aof.manifest as a manifest file.\n\nappendfilename \"appendonly.aof\"\n\n# For convenience, Redis stores all persistent append-only files in a dedicated\n# directory. The name of the directory is determined by the appenddirname\n# configuration parameter.\n\nappenddirname \"appendonlydir\"\n\n# The fsync() call tells the Operating System to actually write data on disk\n# instead of waiting for more data in the output buffer. Some OS will really flush\n# data on disk, some other OS will just try to do it ASAP.\n#\n# Redis supports three different modes:\n#\n# no: don't fsync, just let the OS flush the data when it wants. Faster.\n# always: fsync after every write to the append only log. Slow, Safest.\n# everysec: fsync only one time every second. Compromise.\n#\n# The default is \"everysec\", as that's usually the right compromise between\n# speed and data safety. It's up to you to understand if you can relax this to\n# \"no\" that will let the operating system flush the output buffer when\n# it wants, for better performances (but if you can live with the idea of\n# some data loss consider the default persistence mode that's snapshotting),\n# or on the contrary, use \"always\" that's very slow but a bit safer than\n# everysec.\n#\n# More details please check the following article:\n# http://antirez.com/post/redis-persistence-demystified.html\n#\n# If unsure, use \"everysec\".\n\n# appendfsync always\nappendfsync everysec\n# appendfsync no\n\n# When the AOF fsync policy is set to always or everysec, and a background\n# saving process (a background save or AOF log background rewriting) is\n# performing a lot of I/O against the disk, in some Linux configurations\n# Redis may block too long on the fsync() call. Note that there is no fix for\n# this currently, as even performing fsync in a different thread will block\n# our synchronous write(2) call.\n#\n# In order to mitigate this problem it's possible to use the following option\n# that will prevent fsync() from being called in the main process while a\n# BGSAVE or BGREWRITEAOF is in progress.\n#\n# This means that while another child is saving, the durability of Redis is\n# the same as \"appendfsync no\". In practical terms, this means that it is\n# possible to lose up to 30 seconds of log in the worst scenario (with the\n# default Linux settings).\n#\n# If you have latency problems turn this to \"yes\". Otherwise leave it as\n# \"no\" that is the safest pick from the point of view of durability.\n\nno-appendfsync-on-rewrite no\n\n# Automatic rewrite of the append only file.\n# Redis is able to automatically rewrite the log file implicitly calling\n# BGREWRITEAOF when the AOF log size grows by the specified percentage.\n#\n# This is how it works: Redis remembers the size of the AOF file after the\n# latest rewrite (if no rewrite has happened since the restart, the size of\n# the AOF at startup is used).\n#\n# This base size is compared to the current size. If the current size is\n# bigger than the specified percentage, the rewrite is triggered. Also\n# you need to specify a minimal size for the AOF file to be rewritten, this\n# is useful to avoid rewriting the AOF file even if the percentage increase\n# is reached but it is still pretty small.\n#\n# Specify a percentage of zero in order to disable the automatic AOF\n# rewrite feature.\n\nauto-aof-rewrite-percentage 100\nauto-aof-rewrite-min-size 64mb\n\n# An AOF file may be found to be truncated at the end during the Redis\n# startup process, when the AOF data gets loaded back into memory.\n# This may happen when the system where Redis is running\n# crashes, especially when an ext4 filesystem is mounted without the\n# data=ordered option (however this can't happen when Redis itself\n# crashes or aborts but the operating system still works correctly).\n#\n# Redis can either exit with an error when this happens, or load as much\n# data as possible (the default now) and start if the AOF file is found\n# to be truncated at the end. The following option controls this behavior.\n#\n# If aof-load-truncated is set to yes, a truncated AOF file is loaded and\n# the Redis server starts emitting a log to inform the user of the event.\n# Otherwise if the option is set to no, the server aborts with an error\n# and refuses to start. When the option is set to no, the user requires\n# to fix the AOF file using the \"redis-check-aof\" utility before to restart\n# the server.\n#\n# Note that if the AOF file will be found to be corrupted in the middle\n# the server will still exit with an error. This option only applies when\n# Redis will try to read more data from the AOF file but not enough bytes\n# will be found.\naof-load-truncated yes\n\n# Redis can create append-only base files in either RDB or AOF formats. Using\n# the RDB format is always faster and more efficient, and disabling it is only\n# supported for backward compatibility purposes.\naof-use-rdb-preamble yes\n\n# Redis supports recording timestamp annotations in the AOF to support restoring\n# the data from a specific point-in-time. However, using this capability changes\n# the AOF format in a way that may not be compatible with existing AOF parsers.\naof-timestamp-enabled no\n\n################################ SHUTDOWN #####################################\n\n# Maximum time to wait for replicas when shutting down, in seconds.\n#\n# During shut down, a grace period allows any lagging replicas to catch up with\n# the latest replication offset before the master exists. This period can\n# prevent data loss, especially for deployments without configured disk backups.\n#\n# The 'shutdown-timeout' value is the grace period's duration in seconds. It is\n# only applicable when the instance has replicas. To disable the feature, set\n# the value to 0.\n#\n# shutdown-timeout 10\n\n# When Redis receives a SIGINT or SIGTERM, shutdown is initiated and by default\n# an RDB snapshot is written to disk in a blocking operation if save points are configured.\n# The options used on signaled shutdown can include the following values:\n# default: Saves RDB snapshot only if save points are configured.\n# Waits for lagging replicas to catch up.\n# save: Forces a DB saving operation even if no save points are configured.\n# nosave: Prevents DB saving operation even if one or more save points are configured.\n# now: Skips waiting for lagging replicas.\n# force: Ignores any errors that would normally prevent the server from exiting.\n#\n# Any combination of values is allowed as long as \"save\" and \"nosave\" are not set simultaneously.\n# Example: \"nosave force now\"\n#\n# shutdown-on-sigint default\n# shutdown-on-sigterm default\n\n################ NON-DETERMINISTIC LONG BLOCKING COMMANDS #####################\n\n# Maximum time in milliseconds for EVAL scripts, functions and in some cases\n# modules' commands before Redis can start processing or rejecting other clients.\n#\n# If the maximum execution time is reached Redis will start to reply to most\n# commands with a BUSY error.\n#\n# In this state Redis will only allow a handful of commands to be executed.\n# For instance, SCRIPT KILL, FUNCTION KILL, SHUTDOWN NOSAVE and possibly some\n# module specific 'allow-busy' commands.\n#\n# SCRIPT KILL and FUNCTION KILL will only be able to stop a script that did not\n# yet call any write commands, so SHUTDOWN NOSAVE may be the only way to stop\n# the server in the case a write command was already issued by the script when\n# the user doesn't want to wait for the natural termination of the script.\n#\n# The default is 5 seconds. It is possible to set it to 0 or a negative value\n# to disable this mechanism (uninterrupted execution). Note that in the past\n# this config had a different name, which is now an alias, so both of these do\n# the same:\n# lua-time-limit 5000\n# busy-reply-threshold 5000\n\n################################ REDIS CLUSTER ###############################\n\n# Normal Redis instances can't be part of a Redis Cluster; only nodes that are\n# started as cluster nodes can. In order to start a Redis instance as a\n# cluster node enable the cluster support uncommenting the following:\n#\n# cluster-enabled yes\n\n# Every cluster node has a cluster configuration file. This file is not\n# intended to be edited by hand. It is created and updated by Redis nodes.\n# Every Redis Cluster node requires a different cluster configuration file.\n# Make sure that instances running in the same system do not have\n# overlapping cluster configuration file names.\n#\n# cluster-config-file nodes-6379.conf\n\n# Cluster node timeout is the amount of milliseconds a node must be unreachable\n# for it to be considered in failure state.\n# Most other internal time limits are a multiple of the node timeout.\n#\n# cluster-node-timeout 15000\n\n# The cluster port is the port that the cluster bus will listen for inbound connections on. When set\n# to the default value, 0, it will be bound to the command port + 10000. Setting this value requires\n# you to specify the cluster bus port when executing cluster meet.\n# cluster-port 0\n\n# A replica of a failing master will avoid to start a failover if its data\n# looks too old.\n#\n# There is no simple way for a replica to actually have an exact measure of\n# its \"data age\", so the following two checks are performed:\n#\n# 1) If there are multiple replicas able to failover, they exchange messages\n# in order to try to give an advantage to the replica with the best\n# replication offset (more data from the master processed).\n# Replicas will try to get their rank by offset, and apply to the start\n# of the failover a delay proportional to their rank.\n#\n# 2) Every single replica computes the time of the last interaction with\n# its master. This can be the last ping or command received (if the master\n# is still in the \"connected\" state), or the time that elapsed since the\n# disconnection with the master (if the replication link is currently down).\n# If the last interaction is too old, the replica will not try to failover\n# at all.\n#\n# The point \"2\" can be tuned by user. Specifically a replica will not perform\n# the failover if, since the last interaction with the master, the time\n# elapsed is greater than:\n#\n# (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period\n#\n# So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor\n# is 10, and assuming a default repl-ping-replica-period of 10 seconds, the\n# replica will not try to failover if it was not able to talk with the master\n# for longer than 310 seconds.\n#\n# A large cluster-replica-validity-factor may allow replicas with too old data to failover\n# a master, while a too small value may prevent the cluster from being able to\n# elect a replica at all.\n#\n# For maximum availability, it is possible to set the cluster-replica-validity-factor\n# to a value of 0, which means, that replicas will always try to failover the\n# master regardless of the last time they interacted with the master.\n# (However they'll always try to apply a delay proportional to their\n# offset rank).\n#\n# Zero is the only value able to guarantee that when all the partitions heal\n# the cluster will always be able to continue.\n#\n# cluster-replica-validity-factor 10\n\n# Cluster replicas are able to migrate to orphaned masters, that are masters\n# that are left without working replicas. This improves the cluster ability\n# to resist to failures as otherwise an orphaned master can't be failed over\n# in case of failure if it has no working replicas.\n#\n# Replicas migrate to orphaned masters only if there are still at least a\n# given number of other working replicas for their old master. This number\n# is the \"migration barrier\". A migration barrier of 1 means that a replica\n# will migrate only if there is at least 1 other working replica for its master\n# and so forth. It usually reflects the number of replicas you want for every\n# master in your cluster.\n#\n# Default is 1 (replicas migrate only if their masters remain with at least\n# one replica). To disable migration just set it to a very large value or\n# set cluster-allow-replica-migration to 'no'.\n# A value of 0 can be set but is useful only for debugging and dangerous\n# in production.\n#\n# cluster-migration-barrier 1\n\n# Turning off this option allows to use less automatic cluster configuration.\n# It both disables migration to orphaned masters and migration from masters\n# that became empty.\n#\n# Default is 'yes' (allow automatic migrations).\n#\n# cluster-allow-replica-migration yes\n\n# By default Redis Cluster nodes stop accepting queries if they detect there\n# is at least a hash slot uncovered (no available node is serving it).\n# This way if the cluster is partially down (for example a range of hash slots\n# are no longer covered) all the cluster becomes, eventually, unavailable.\n# It automatically returns available as soon as all the slots are covered again.\n#\n# However sometimes you want the subset of the cluster which is working,\n# to continue to accept queries for the part of the key space that is still\n# covered. In order to do so, just set the cluster-require-full-coverage\n# option to no.\n#\n# cluster-require-full-coverage yes\n\n# This option, when set to yes, prevents replicas from trying to failover its\n# master during master failures. However the replica can still perform a\n# manual failover, if forced to do so.\n#\n# This is useful in different scenarios, especially in the case of multiple\n# data center operations, where we want one side to never be promoted if not\n# in the case of a total DC failure.\n#\n# cluster-replica-no-failover no\n\n# This option, when set to yes, allows nodes to serve read traffic while the\n# cluster is in a down state, as long as it believes it owns the slots.\n#\n# This is useful for two cases. The first case is for when an application\n# doesn't require consistency of data during node failures or network partitions.\n# One example of this is a cache, where as long as the node has the data it\n# should be able to serve it.\n#\n# The second use case is for configurations that don't meet the recommended\n# three shards but want to enable cluster mode and scale later. A\n# master outage in a 1 or 2 shard configuration causes a read/write outage to the\n# entire cluster without this option set, with it set there is only a write outage.\n# Without a quorum of masters, slot ownership will not change automatically.\n#\n# cluster-allow-reads-when-down no\n\n# This option, when set to yes, allows nodes to serve pubsub shard traffic while\n# the cluster is in a down state, as long as it believes it owns the slots.\n#\n# This is useful if the application would like to use the pubsub feature even when\n# the cluster global stable state is not OK. If the application wants to make sure only\n# one shard is serving a given channel, this feature should be kept as yes.\n#\n# cluster-allow-pubsubshard-when-down yes\n\n# Cluster link send buffer limit is the limit on the memory usage of an individual\n# cluster bus link's send buffer in bytes. Cluster links would be freed if they exceed\n# this limit. This is to primarily prevent send buffers from growing unbounded on links\n# toward slow peers (E.g. PubSub messages being piled up).\n# This limit is disabled by default. Enable this limit when 'mem_cluster_links' INFO field\n# and/or 'send-buffer-allocated' entries in the 'CLUSTER LINKS` command output continuously increase.\n# Minimum limit of 1gb is recommended so that cluster link buffer can fit in at least a single\n# PubSub message by default. (client-query-buffer-limit default value is 1gb)\n#\n# cluster-link-sendbuf-limit 0\n\n# Clusters can configure their announced hostname using this config. This is a common use case for\n# applications that need to use TLS Server Name Indication (SNI) or dealing with DNS based\n# routing. By default this value is only shown as additional metadata in the CLUSTER SLOTS\n# command, but can be changed using 'cluster-preferred-endpoint-type' config. This value is\n# communicated along the clusterbus to all nodes, setting it to an empty string will remove\n# the hostname and also propagate the removal.\n#\n# cluster-announce-hostname \"\"\n\n# Clusters can advertise how clients should connect to them using either their IP address,\n# a user defined hostname, or by declaring they have no endpoint. Which endpoint is\n# shown as the preferred endpoint is set by using the cluster-preferred-endpoint-type\n# config with values 'ip', 'hostname', or 'unknown-endpoint'. This value controls how\n# the endpoint returned for MOVED/ASKING requests as well as the first field of CLUSTER SLOTS.\n# If the preferred endpoint type is set to hostname, but no announced hostname is set, a '?'\n# will be returned instead.\n#\n# When a cluster advertises itself as having an unknown endpoint, it's indicating that\n# the server doesn't know how clients can reach the cluster. This can happen in certain\n# networking situations where there are multiple possible routes to the node, and the\n# server doesn't know which one the client took. In this case, the server is expecting\n# the client to reach out on the same endpoint it used for making the last request, but use\n# the port provided in the response.\n#\n# cluster-preferred-endpoint-type ip\n\n# In order to setup your cluster make sure to read the documentation\n# available at https://redis.io web site.\n\n########################## CLUSTER DOCKER/NAT support ########################\n\n# In certain deployments, Redis Cluster nodes address discovery fails, because\n# addresses are NAT-ted or because ports are forwarded (the typical case is\n# Docker and other containers).\n#\n# In order to make Redis Cluster working in such environments, a static\n# configuration where each node knows its public address is needed. The\n# following four options are used for this scope, and are:\n#\n# * cluster-announce-ip\n# * cluster-announce-port\n# * cluster-announce-tls-port\n# * cluster-announce-bus-port\n#\n# Each instructs the node about its address, client ports (for connections\n# without and with TLS) and cluster message bus port. The information is then\n# published in the header of the bus packets so that other nodes will be able to\n# correctly map the address of the node publishing the information.\n#\n# If cluster-tls is set to yes and cluster-announce-tls-port is omitted or set\n# to zero, then cluster-announce-port refers to the TLS port. Note also that\n# cluster-announce-tls-port has no effect if cluster-tls is set to no.\n#\n# If the above options are not used, the normal Redis Cluster auto-detection\n# will be used instead.\n#\n# Note that when remapped, the bus port may not be at the fixed offset of\n# clients port + 10000, so you can specify any port and bus-port depending\n# on how they get remapped. If the bus-port is not set, a fixed offset of\n# 10000 will be used as usual.\n#\n# Example:\n#\n# cluster-announce-ip 10.1.1.5\n# cluster-announce-tls-port 6379\n# cluster-announce-port 0\n# cluster-announce-bus-port 6380\n\n################################## SLOW LOG ###################################\n\n# The Redis Slow Log is a system to log queries that exceeded a specified\n# execution time. The execution time does not include the I/O operations\n# like talking with the client, sending the reply and so forth,\n# but just the time needed to actually execute the command (this is the only\n# stage of command execution where the thread is blocked and can not serve\n# other requests in the meantime).\n#\n# You can configure the slow log with two parameters: one tells Redis\n# what is the execution time, in microseconds, to exceed in order for the\n# command to get logged, and the other parameter is the length of the\n# slow log. When a new command is logged the oldest one is removed from the\n# queue of logged commands.\n\n# The following time is expressed in microseconds, so 1000000 is equivalent\n# to one second. Note that a negative number disables the slow log, while\n# a value of zero forces the logging of every command.\nslowlog-log-slower-than 10000\n\n# There is no limit to this length. Just be aware that it will consume memory.\n# You can reclaim memory used by the slow log with SLOWLOG RESET.\nslowlog-max-len 128\n\n################################ LATENCY MONITOR ##############################\n\n# The Redis latency monitoring subsystem samples different operations\n# at runtime in order to collect data related to possible sources of\n# latency of a Redis instance.\n#\n# Via the LATENCY command this information is available to the user that can\n# print graphs and obtain reports.\n#\n# The system only logs operations that were performed in a time equal or\n# greater than the amount of milliseconds specified via the\n# latency-monitor-threshold configuration directive. When its value is set\n# to zero, the latency monitor is turned off.\n#\n# By default latency monitoring is disabled since it is mostly not needed\n# if you don't have latency issues, and collecting data has a performance\n# impact, that while very small, can be measured under big load. Latency\n# monitoring can easily be enabled at runtime using the command\n# \"CONFIG SET latency-monitor-threshold \" if needed.\nlatency-monitor-threshold 0\n\n################################ LATENCY TRACKING ##############################\n\n# The Redis extended latency monitoring tracks the per command latencies and enables\n# exporting the percentile distribution via the INFO latencystats command,\n# and cumulative latency distributions (histograms) via the LATENCY command.\n#\n# By default, the extended latency monitoring is enabled since the overhead\n# of keeping track of the command latency is very small.\n# latency-tracking yes\n\n# By default the exported latency percentiles via the INFO latencystats command\n# are the p50, p99, and p999.\n# latency-tracking-info-percentiles 50 99 99.9\n\n############################# EVENT NOTIFICATION ##############################\n\n# Redis can notify Pub/Sub clients about events happening in the key space.\n# This feature is documented at https://redis.io/topics/notifications\n#\n# For instance if keyspace events notification is enabled, and a client\n# performs a DEL operation on key \"foo\" stored in the Database 0, two\n# messages will be published via Pub/Sub:\n#\n# PUBLISH __keyspace@0__:foo del\n# PUBLISH __keyevent@0__:del foo\n#\n# It is possible to select the events that Redis will notify among a set\n# of classes. Every class is identified by a single character:\n#\n# K Keyspace events, published with __keyspace@__ prefix.\n# E Keyevent events, published with __keyevent@__ prefix.\n# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ...\n# $ String commands\n# l List commands\n# s Set commands\n# h Hash commands\n# z Sorted set commands\n# x Expired events (events generated every time a key expires)\n# e Evicted events (events generated when a key is evicted for maxmemory)\n# n New key events (Note: not included in the 'A' class)\n# t Stream commands\n# d Module key type events\n# m Key-miss events (Note: It is not included in the 'A' class)\n# A Alias for g$lshzxetd, so that the \"AKE\" string means all the events\n# (Except key-miss events which are excluded from 'A' due to their\n# unique nature).\n#\n# The \"notify-keyspace-events\" takes as argument a string that is composed\n# of zero or multiple characters. The empty string means that notifications\n# are disabled.\n#\n# Example: to enable list and generic events, from the point of view of the\n# event name, use:\n#\n# notify-keyspace-events Elg\n#\n# Example 2: to get the stream of the expired keys subscribing to channel\n# name __keyevent@0__:expired use:\n#\n# notify-keyspace-events Ex\n#\n# By default all notifications are disabled because most users don't need\n# this feature and the feature has some overhead. Note that if you don't\n# specify at least one of K or E, no events will be delivered.\nnotify-keyspace-events \"\"\n\n############################### ADVANCED CONFIG ###############################\n\n# Hashes are encoded using a memory efficient data structure when they have a\n# small number of entries, and the biggest entry does not exceed a given\n# threshold. These thresholds can be configured using the following directives.\nhash-max-listpack-entries 512\nhash-max-listpack-value 64\n\n# Lists are also encoded in a special way to save a lot of space.\n# The number of entries allowed per internal list node can be specified\n# as a fixed maximum size or a maximum number of elements.\n# For a fixed maximum size, use -5 through -1, meaning:\n# -5: max size: 64 Kb <-- not recommended for normal workloads\n# -4: max size: 32 Kb <-- not recommended\n# -3: max size: 16 Kb <-- probably not recommended\n# -2: max size: 8 Kb <-- good\n# -1: max size: 4 Kb <-- good\n# Positive numbers mean store up to _exactly_ that number of elements\n# per list node.\n# The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size),\n# but if your use case is unique, adjust the settings as necessary.\nlist-max-listpack-size -2\n\n# Lists may also be compressed.\n# Compress depth is the number of quicklist ziplist nodes from *each* side of\n# the list to *exclude* from compression. The head and tail of the list\n# are always uncompressed for fast push/pop operations. Settings are:\n# 0: disable all list compression\n# 1: depth 1 means \"don't start compressing until after 1 node into the list,\n# going from either the head or tail\"\n# So: [head]->node->node->...->node->[tail]\n# [head], [tail] will always be uncompressed; inner nodes will compress.\n# 2: [head]->[next]->node->node->...->node->[prev]->[tail]\n# 2 here means: don't compress head or head->next or tail->prev or tail,\n# but compress all nodes between them.\n# 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail]\n# etc.\nlist-compress-depth 0\n\n# Sets have a special encoding in just one case: when a set is composed\n# of just strings that happen to be integers in radix 10 in the range\n# of 64 bit signed integers.\n# The following configuration setting sets the limit in the size of the\n# set in order to use this special memory saving encoding.\nset-max-intset-entries 512\n\n# Similarly to hashes and lists, sorted sets are also specially encoded in\n# order to save a lot of space. This encoding is only used when the length and\n# elements of a sorted set are below the following limits:\nzset-max-listpack-entries 128\nzset-max-listpack-value 64\n\n# HyperLogLog sparse representation bytes limit. The limit includes the\n# 16 bytes header. When an HyperLogLog using the sparse representation crosses\n# this limit, it is converted into the dense representation.\n#\n# A value greater than 16000 is totally useless, since at that point the\n# dense representation is more memory efficient.\n#\n# The suggested value is ~ 3000 in order to have the benefits of\n# the space efficient encoding without slowing down too much PFADD,\n# which is O(N) with the sparse encoding. The value can be raised to\n# ~ 10000 when CPU is not a concern, but space is, and the data set is\n# composed of many HyperLogLogs with cardinality in the 0 - 15000 range.\nhll-sparse-max-bytes 3000\n\n# Streams macro node max size / items. The stream data structure is a radix\n# tree of big nodes that encode multiple items inside. Using this configuration\n# it is possible to configure how big a single node can be in bytes, and the\n# maximum number of items it may contain before switching to a new node when\n# appending new stream entries. If any of the following settings are set to\n# zero, the limit is ignored, so for instance it is possible to set just a\n# max entries limit by setting max-bytes to 0 and max-entries to the desired\n# value.\nstream-node-max-bytes 4096\nstream-node-max-entries 100\n\n# Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in\n# order to help rehashing the main Redis hash table (the one mapping top-level\n# keys to values). The hash table implementation Redis uses (see dict.c)\n# performs a lazy rehashing: the more operation you run into a hash table\n# that is rehashing, the more rehashing \"steps\" are performed, so if the\n# server is idle the rehashing is never complete and some more memory is used\n# by the hash table.\n#\n# The default is to use this millisecond 10 times every second in order to\n# actively rehash the main dictionaries, freeing memory when possible.\n#\n# If unsure:\n# use \"activerehashing no\" if you have hard latency requirements and it is\n# not a good thing in your environment that Redis can reply from time to time\n# to queries with 2 milliseconds delay.\n#\n# use \"activerehashing yes\" if you don't have such hard requirements but\n# want to free memory asap when possible.\nactiverehashing yes\n\n# The client output buffer limits can be used to force disconnection of clients\n# that are not reading data from the server fast enough for some reason (a\n# common reason is that a Pub/Sub client can't consume messages as fast as the\n# publisher can produce them).\n#\n# The limit can be set differently for the three different classes of clients:\n#\n# normal -> normal clients including MONITOR clients\n# replica -> replica clients\n# pubsub -> clients subscribed to at least one pubsub channel or pattern\n#\n# The syntax of every client-output-buffer-limit directive is the following:\n#\n# client-output-buffer-limit \n#\n# A client is immediately disconnected once the hard limit is reached, or if\n# the soft limit is reached and remains reached for the specified number of\n# seconds (continuously).\n# So for instance if the hard limit is 32 megabytes and the soft limit is\n# 16 megabytes / 10 seconds, the client will get disconnected immediately\n# if the size of the output buffers reach 32 megabytes, but will also get\n# disconnected if the client reaches 16 megabytes and continuously overcomes\n# the limit for 10 seconds.\n#\n# By default normal clients are not limited because they don't receive data\n# without asking (in a push way), but just after a request, so only\n# asynchronous clients may create a scenario where data is requested faster\n# than it can read.\n#\n# Instead there is a default limit for pubsub and replica clients, since\n# subscribers and replicas receive data in a push fashion.\n#\n# Note that it doesn't make sense to set the replica clients output buffer\n# limit lower than the repl-backlog-size config (partial sync will succeed\n# and then replica will get disconnected).\n# Such a configuration is ignored (the size of repl-backlog-size will be used).\n# This doesn't have memory consumption implications since the replica client\n# will share the backlog buffers memory.\n#\n# Both the hard or the soft limit can be disabled by setting them to zero.\nclient-output-buffer-limit normal 0 0 0\nclient-output-buffer-limit replica 256mb 64mb 60\nclient-output-buffer-limit pubsub 32mb 8mb 60\n\n# Client query buffers accumulate new commands. They are limited to a fixed\n# amount by default in order to avoid that a protocol desynchronization (for\n# instance due to a bug in the client) will lead to unbound memory usage in\n# the query buffer. However you can configure it here if you have very special\n# needs, such us huge multi/exec requests or alike.\n#\n# client-query-buffer-limit 1gb\n\n# In some scenarios client connections can hog up memory leading to OOM\n# errors or data eviction. To avoid this we can cap the accumulated memory\n# used by all client connections (all pubsub and normal clients). Once we\n# reach that limit connections will be dropped by the server freeing up\n# memory. The server will attempt to drop the connections using the most\n# memory first. We call this mechanism \"client eviction\".\n#\n# Client eviction is configured using the maxmemory-clients setting as follows:\n# 0 - client eviction is disabled (default)\n#\n# A memory value can be used for the client eviction threshold,\n# for example:\n# maxmemory-clients 1g\n#\n# A percentage value (between 1% and 100%) means the client eviction threshold\n# is based on a percentage of the maxmemory setting. For example to set client\n# eviction at 5% of maxmemory:\n# maxmemory-clients 5%\n\n# In the Redis protocol, bulk requests, that are, elements representing single\n# strings, are normally limited to 512 mb. However you can change this limit\n# here, but must be 1mb or greater\n#\n# proto-max-bulk-len 512mb\n\n# Redis calls an internal function to perform many background tasks, like\n# closing connections of clients in timeout, purging expired keys that are\n# never requested, and so forth.\n#\n# Not all tasks are performed with the same frequency, but Redis checks for\n# tasks to perform according to the specified \"hz\" value.\n#\n# By default \"hz\" is set to 10. Raising the value will use more CPU when\n# Redis is idle, but at the same time will make Redis more responsive when\n# there are many keys expiring at the same time, and timeouts may be\n# handled with more precision.\n#\n# The range is between 1 and 500, however a value over 100 is usually not\n# a good idea. Most users should use the default of 10 and raise this up to\n# 100 only in environments where very low latency is required.\nhz 10\n\n# Normally it is useful to have an HZ value which is proportional to the\n# number of clients connected. This is useful in order, for instance, to\n# avoid too many clients are processed for each background task invocation\n# in order to avoid latency spikes.\n#\n# Since the default HZ value by default is conservatively set to 10, Redis\n# offers, and enables by default, the ability to use an adaptive HZ value\n# which will temporarily raise when there are many connected clients.\n#\n# When dynamic HZ is enabled, the actual configured HZ will be used\n# as a baseline, but multiples of the configured HZ value will be actually\n# used as needed once more clients are connected. In this way an idle\n# instance will use very little CPU time while a busy instance will be\n# more responsive.\ndynamic-hz yes\n\n# When a child rewrites the AOF file, if the following option is enabled\n# the file will be fsync-ed every 4 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\naof-rewrite-incremental-fsync yes\n\n# When redis saves RDB file, if the following option is enabled\n# the file will be fsync-ed every 4 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\nrdb-save-incremental-fsync yes\n\n# Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good\n# idea to start with the default settings and only change them after investigating\n# how to improve the performances and how the keys LFU change over time, which\n# is possible to inspect via the OBJECT FREQ command.\n#\n# There are two tunable parameters in the Redis LFU implementation: the\n# counter logarithm factor and the counter decay time. It is important to\n# understand what the two parameters mean before changing them.\n#\n# The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis\n# uses a probabilistic increment with logarithmic behavior. Given the value\n# of the old counter, when a key is accessed, the counter is incremented in\n# this way:\n#\n# 1. A random number R between 0 and 1 is extracted.\n# 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1).\n# 3. The counter is incremented only if R < P.\n#\n# The default lfu-log-factor is 10. This is a table of how the frequency\n# counter changes with a different number of accesses with different\n# logarithmic factors:\n#\n# +--------+------------+------------+------------+------------+------------+\n# | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits |\n# +--------+------------+------------+------------+------------+------------+\n# | 0 | 104 | 255 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 1 | 18 | 49 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 10 | 10 | 18 | 142 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 100 | 8 | 11 | 49 | 143 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n#\n# NOTE: The above table was obtained by running the following commands:\n#\n# redis-benchmark -n 1000000 incr foo\n# redis-cli object freq foo\n#\n# NOTE 2: The counter initial value is 5 in order to give new objects a chance\n# to accumulate hits.\n#\n# The counter decay time is the time, in minutes, that must elapse in order\n# for the key counter to be divided by two (or decremented if it has a value\n# less <= 10).\n#\n# The default value for the lfu-decay-time is 1. A special value of 0 means to\n# decay the counter every time it happens to be scanned.\n#\n# lfu-log-factor 10\n# lfu-decay-time 1\n\n########################### ACTIVE DEFRAGMENTATION #######################\n#\n# What is active defragmentation?\n# -------------------------------\n#\n# Active (online) defragmentation allows a Redis server to compact the\n# spaces left between small allocations and deallocations of data in memory,\n# thus allowing to reclaim back memory.\n#\n# Fragmentation is a natural process that happens with every allocator (but\n# less so with Jemalloc, fortunately) and certain workloads. Normally a server\n# restart is needed in order to lower the fragmentation, or at least to flush\n# away all the data and create it again. However thanks to this feature\n# implemented by Oran Agra for Redis 4.0 this process can happen at runtime\n# in a \"hot\" way, while the server is running.\n#\n# Basically when the fragmentation is over a certain level (see the\n# configuration options below) Redis will start to create new copies of the\n# values in contiguous memory regions by exploiting certain specific Jemalloc\n# features (in order to understand if an allocation is causing fragmentation\n# and to allocate it in a better place), and at the same time, will release the\n# old copies of the data. This process, repeated incrementally for all the keys\n# will cause the fragmentation to drop back to normal values.\n#\n# Important things to understand:\n#\n# 1. This feature is disabled by default, and only works if you compiled Redis\n# to use the copy of Jemalloc we ship with the source code of Redis.\n# This is the default with Linux builds.\n#\n# 2. You never need to enable this feature if you don't have fragmentation\n# issues.\n#\n# 3. Once you experience fragmentation, you can enable this feature when\n# needed with the command \"CONFIG SET activedefrag yes\".\n#\n# The configuration parameters are able to fine tune the behavior of the\n# defragmentation process. If you are not sure about what they mean it is\n# a good idea to leave the defaults untouched.\n\n# Active defragmentation is disabled by default\n# activedefrag no\n\n# Minimum amount of fragmentation waste to start active defrag\n# active-defrag-ignore-bytes 100mb\n\n# Minimum percentage of fragmentation to start active defrag\n# active-defrag-threshold-lower 10\n\n# Maximum percentage of fragmentation at which we use maximum effort\n# active-defrag-threshold-upper 100\n\n# Minimal effort for defrag in CPU percentage, to be used when the lower\n# threshold is reached\n# active-defrag-cycle-min 1\n\n# Maximal effort for defrag in CPU percentage, to be used when the upper\n# threshold is reached\n# active-defrag-cycle-max 25\n\n# Maximum number of set/hash/zset/list fields that will be processed from\n# the main dictionary scan\n# active-defrag-max-scan-fields 1000\n\n# Jemalloc background thread for purging will be enabled by default\njemalloc-bg-thread yes\n\n# It is possible to pin different threads and processes of Redis to specific\n# CPUs in your system, in order to maximize the performances of the server.\n# This is useful both in order to pin different Redis threads in different\n# CPUs, but also in order to make sure that multiple Redis instances running\n# in the same host will be pinned to different CPUs.\n#\n# Normally you can do this using the \"taskset\" command, however it is also\n# possible to this via Redis configuration directly, both in Linux and FreeBSD.\n#\n# You can pin the server/IO threads, bio threads, aof rewrite child process, and\n# the bgsave child process. The syntax to specify the cpu list is the same as\n# the taskset command:\n#\n# Set redis server/io threads to cpu affinity 0,2,4,6:\n# server_cpulist 0-7:2\n#\n# Set bio threads to cpu affinity 1,3:\n# bio_cpulist 1,3\n#\n# Set aof rewrite child process to cpu affinity 8,9,10,11:\n# aof_rewrite_cpulist 8-11\n#\n# Set bgsave child process to cpu affinity 1,10,11\n# bgsave_cpulist 1,10-11\n\n# In some cases redis will emit warnings and even refuse to start if it detects\n# that the system is in bad state, it is possible to suppress these warnings\n# by setting the following config which takes a space delimited list of warnings\n# to suppress\n#\n# ignore-warnings ARM64-COW-BUG\n" }, { "path": "aegir/conf/solr9/analysis-extras.mod", "content": "# Solr module: analysis-extras\nname=analysis-extras\nlib.dir=../../modules/analysis-extras/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/analytics.mod", "content": "# Solr module: analytics\nname=analytics\nlib.dir=../../modules/analytics/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/clustering.mod", "content": "# Solr module: clustering\nname=clustering\nlib.dir=../../modules/clustering/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/cross-dc.mod", "content": "# Solr module: cross-dc\nname=cross-dc\nlib.dir=../../modules/cross-dc/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/extraction.mod", "content": "# Solr module: extraction\nname=extraction\nlib.dir=../../modules/extraction/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/gcs-repository.mod", "content": "# Solr module: gcs-repository\nname=gcs-repository\nlib.dir=../../modules/gcs-repository/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/hadoop-auth.mod", "content": "# Solr module: hadoop-auth\nname=hadoop-auth\nlib.dir=../../modules/hadoop-auth/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/hdfs.mod", "content": "# Solr module: hdfs\nname=hdfs\nlib.dir=../../modules/hdfs/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/jaegertracer-configurator.mod", "content": "# Solr module: jaegertracer-configurator\nname=jaegertracer-configurator\nlib.dir=../../modules/jaegertracer-configurator/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/jwt-auth.mod", "content": "# Solr module: jwt-auth\nname=jwt-auth\nlib.dir=../../modules/jwt-auth/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/langid.mod", "content": "# Solr module: langid\nname=langid\nlib.dir=../../modules/langid/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/llm.mod", "content": "# Solr module: llm\nname=llm\nlib.dir=../../modules/llm/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/ltr.mod", "content": "# Solr module: ltr\nname=ltr\nlib.dir=../../modules/ltr/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/opentelemetry.mod", "content": "# Solr module: opentelemetry\nname=opentelemetry\nlib.dir=../../modules/opentelemetry/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/s3-repository.mod", "content": "# Solr module: s3-repository\nname=s3-repository\nlib.dir=../../modules/s3-repository/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/scripting.mod", "content": "# Solr module: scripting\nname=scripting\nlib.dir=../../modules/scripting/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/solr9/sql.mod", "content": "# Solr module: sql\nname=sql\nlib.dir=../../modules/sql/lib\nclass=org.apache.solr.core.SolrResourceLoader\n" }, { "path": "aegir/conf/tpl/migration.html", "content": "\n\nServer Migration\n\n\n\n\n\n\n\n

\"Server

\n

We are performing server migration and will be back shortly

\n
\n\n\n" }, { "path": "aegir/conf/tpl/robots.txt", "content": "#\n# robots.txt\n#\n# This file is to prevent the crawling and indexing of certain parts\n# of your site by web crawlers and spiders run by sites like Yahoo!\n# and Google. By telling these \"robots\" where not to go on your site,\n# you save bandwidth and server resources.\n#\n# This file will be ignored unless it is at the root of your host:\n# Used: http://example.com/robots.txt\n# Ignored: http://example.com/site/robots.txt\n#\n# For more information about the robots.txt standard, see:\n# http://www.robotstxt.org/robotstxt.html\n#\n# For syntax checking, see:\n# http://www.sxw.org.uk/computing/robots/check.html\n\nUser-agent: *\nCrawl-delay: 10\n# CSS, JS, Images\nAllow: /misc/*.css$\nAllow: /misc/*.css?\nAllow: /misc/*.js$\nAllow: /misc/*.js?\nAllow: /misc/*.gif\nAllow: /misc/*.jpg\nAllow: /misc/*.jpeg\nAllow: /misc/*.png\nAllow: /modules/*.css$\nAllow: /modules/*.css?\nAllow: /modules/*.js$\nAllow: /modules/*.js?\nAllow: /modules/*.gif\nAllow: /modules/*.jpg\nAllow: /modules/*.jpeg\nAllow: /modules/*.png\nAllow: /profiles/*.css$\nAllow: /profiles/*.css?\nAllow: /profiles/*.js$\nAllow: /profiles/*.js?\nAllow: /profiles/*.gif\nAllow: /profiles/*.jpg\nAllow: /profiles/*.jpeg\nAllow: /profiles/*.png\nAllow: /themes/*.css$\nAllow: /themes/*.css?\nAllow: /themes/*.js$\nAllow: /themes/*.js?\nAllow: /themes/*.gif\nAllow: /themes/*.jpg\nAllow: /themes/*.jpeg\nAllow: /themes/*.png\n# Directories\nDisallow: /includes/\nDisallow: /misc/\nDisallow: /modules/\nDisallow: /profiles/\nDisallow: /scripts/\nDisallow: /themes/\n# Files\nDisallow: /boost_stats.php\nDisallow: /CHANGELOG.txt\nDisallow: /cron.php\nDisallow: /INSTALL.mysql.txt\nDisallow: /INSTALL.pgsql.txt\nDisallow: /INSTALL.sqlite.txt\nDisallow: /install.php\nDisallow: /INSTALL.txt\nDisallow: /LICENSE.txt\nDisallow: /MAINTAINERS.txt\nDisallow: /update.php\nDisallow: /UPGRADE.txt\nDisallow: /xmlrpc.php\n# Paths (clean URLs)\nDisallow: /admin/\nDisallow: /comment/reply/\nDisallow: /filter/tips/\nDisallow: /node/add/\nDisallow: /search/\nDisallow: /user/register/\nDisallow: /user/password/\nDisallow: /user/login/\nDisallow: /user/logout/\n# Paths (no clean URLs)\nDisallow: /?q=admin/\nDisallow: /?q=comment/reply/\nDisallow: /?q=filter/tips/\nDisallow: /?q=node/add/\nDisallow: /?q=search/\nDisallow: /?q=user/password/\nDisallow: /?q=user/register/\nDisallow: /?q=user/login/\nDisallow: /?q=user/logout/\n" }, { "path": "aegir/conf/tpl/setupmail.txt", "content": "Hello,\n\nWelcome to your new Ægir control panel, designed for easy Drupal multi-site deployment, development, and management.\n\nYour Ægir control panel [version boa.version] is available at:\n\nhttps://aegir.url.name\n\nThis Email Covers:\n1. Logging into your Ægir control panel\n2. Deploying Ægir default websites\n3. Adding modules & themes\n4. Managing your databases\n5. Advanced user information\n6. Articles and video tutorials\n\nPlease read this email thoroughly. It contains important information required to properly leverage all your available Ægir features.\n\n----------------------------------------\n1. LOGGING INTO YOUR AEGIR CONTROL PANEL\n----------------------------------------\n\nTo access your control panel, visit this URL: https://aegir.url.name\n\nIf your account has been migrated, use the previous username and password you have already used before, or reset your password using your email address as your username at: https://aegir.url.name/user/password\n\nPlease double-check your spam folder to ensure all emails are delivered.\n\n----------------------------------------\n2. DEPLOYING YOUR WEBSITES\n----------------------------------------\n\nLog into the control panel and start exploring how Ægir works. We are ready to assist and guide you step by step, so please don’t hesitate to ask questions!\n\nTo create a new site:\n1. Click the Add Site tab.\n2. After adding a site, click the Home icon on the site's node in Ægir to access the admin area.\n\nIf the Home icon no longer links to the one-time login page, run the \"Reset password\" task on the site's node, and once complete, click the Home icon again.\n\nFor more details on site import and platform management, refer to:\n- Import Your Sites to Ægir: https://omega8.cc/import-your-sites-to-aegir-in-8-easy-steps-109\n- Add Custom Platform: https://omega8.cc/how-to-add-custom-platform-properly-140\n- Drupal Site Upgrade Workflow: https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298\n\nTo make a site \"live\" using any domain name, point its A or CNAME DNS record to your Ægir instance public IP address:\n\nyourdomain.com. IN A 166.84.6.231\nsubdomain.yourdomain.com. IN CNAME aegir.url.name.\n\nFor test sites, use any subdomain in *.aegir.url.name, e.g., http://atrium.aegir.url.name.\n\nNeed assistance with site import? Contact us: https://omega8.cc/contact\n\n----------------------------------------\n3. ADDING MODULES & THEMES\n----------------------------------------\n\nTo add modules/themes:\n1. Log into your FTPS/SSH/SFTP account:\n\nhost: aegir.url.name\nuser: dragon.ftp\npass: FN8rXcQn\nport: 21 (FTPS)\nport: 22 (SSH/SFTP)\n\n2. Type \"help\" when logged in via SSH to see all available shell commands.\n3. Change your password via SSH with the \"passwd\" command every 3 months.\n\nNote: Use Explicit TLS mode with port 21 for FTPS and port 22 for SFTP (unless your Ægir instance uses a non-standard SSH port).\n\nRefer to Compatible FTP-SSL/TLS Clients: https://omega8.cc/dev/ftp-tls.txt for more information.\n\n----------------------------------------\n4. MANAGING YOUR DATABASES\n----------------------------------------\n\nManage your databases via the Adminer Manager web interface, using credentials available in each site's drushrc.php file:\n\nAdminer Manager URL: https://aegir.url.name/sqladmin/\n\nNote: Keep the SSH session active with a continuous command (e.g., ping -i 30 google.com) to maintain database access.\n\nUse a desktop SQL manager that supports SSH tunneling, as remote access over MySQL port 3306 is not available for security reasons. For a video tutorial, visit: http://bit.ly/om8rsql\n\nYou can also manage databases via command line with Drush commands or tools like mysql and mysqldump.\n\n----------------------------------------\n5. ADVANCED USER INFORMATION\n----------------------------------------\n\nHow-To Information: Check the built-in docs in your account at ~/static/control/README.txt.\n\nDirectory Information:\n- Your home directory contains subdirectories in ~/platforms for different platform releases.\n- Use symlinks in ~/clients/client-name/ to find all your sites directly.\n\nCustom Platform Information:\n- Upload custom Drupal platforms to ~/static/platforms in separate subdirectories.\n- Enable custom platforms via the \"Add platform\" option in your Ægir control panel.\n\nNote: Only Pressflow (LTS) core-based platforms are allowed for Drupal 6.x versions; standard Drupal core can be used for Drupal 7 and newer versions.\n\n----------------------------------------\n6. ARTICLES & VIDEO TUTORIALS\n----------------------------------------\n\nVideo Tutorials: http://bit.ly/aegir8cc\n\nSite Import & Development:\n- Development Library: https://learn.omega8.cc/library/development\n- Good to Know: https://learn.omega8.cc/library/good-to-know\n\nPerformance Information:\n- Performance Library: https://learn.omega8.cc/library/performance\n- Tips & Tricks: https://learn.omega8.cc/library/tips-and-tricks\n\nUseful Hints: Problems & Solutions: https://learn.omega8.cc/library/problems-solutions\n\nRecommended Articles:\n- Biggest Misunderstanding Ever: https://learn.omega8.cc/the-biggest-misunderstanding-ever-122\n- Best Recipes for Disaster: https://learn.omega8.cc/the-best-recipes-for-disaster-139\n- Good Habits to Learn: https://learn.omega8.cc/are-there-any-specific-good-habits-to-learn-116\n\nFor further assistance, contact us: https://omega8.cc/contact\n\nThank you,\nThe Omega8.cc Team\n\n" }, { "path": "aegir/conf/tpl/uc.html", "content": "\n\nUnder Construction\n\n\n\n\n\n\n\n

\"Under

\n
\n\n\n" }, { "path": "aegir/conf/tpl/upgrademail.txt", "content": "Hello,\n\nWe are pleased to inform you that your Ægir instance has been successfully upgraded to our new HTTP/3 Edition [boa.version]\n\n@=> The future of 100% Open Source Drupal hosting is brighter than ever!\n\nWith BOA-5.9.1 PRO/LTS, we proudly deliver full HTTP/3 and KTLS support — a fundamental change in the way modern browsers communicate with modern HTTPS web servers — along with the latest OpenSSL 3.5 LTS, which made it possible, and many critical security and bug fixes related to system components.\n\n@=> Key Improvements Explained\n\nHTTP/3 and KTLS support. If you run Drupal sites that should feel fast and responsive (and stay that way during spikes), this is genuinely good news. Why is this a big deal? What should visitors notice?\n\n Read the full story: https://github.com/omega8cc/boa/tree/5.x-dev/HTTP3.md\n\n@=> Usage disk/sql limits x2 + Aero and Archive plans added to hosted BOA\n\nIt's worth mentioning that our hosted BOA plans have received a huge upgrade: several new locations have been added around the world, our vendors are now local (instead of the previous US-only hyperscalers), and an entirely new Archive Tier has been added for those looking to host collections of low-traffic sites at low cost.\n\n Take a look if you are interested: https://omega8.cc/hosted\n\n@=> Going Local with Infrastructure\n\nWe’ve expanded our network considerably to meet the growing expectations of the Data Sovereignty movement. This isn’t just about adding more cities to our hosting map — it’s also about going local with infrastructure wherever we can. We no longer rely solely on big-name vendors and hyperscalers. Instead, we’re gradually migrating to local providers and data centers in every country where we offer hosted BOA for Drupal.\n\nFor example, in Canada you can now choose not only Toronto, but also Montreal, Calgary, and Vancouver. In Australia, it’s no longer just Sydney — we also offer Adelaide, Brisbane, and Perth. We’ve also added an excellent facility in New Zealand. Of course, we continue to support our original Singapore location and still offer EU, UK, and US options.\n\n@=> 4 NEW, 12 UPDATED, 32 TOTAL Drupal distros/platforms available\n\nWhile most of you typically build your own codebases/platforms with Composer these days, we still deliver a list of 32 platforms ready to use in your Ægir.\n\nSince these platforms are updated only with BOA releases, they are not really intended for production use per se, because you typically need a faster lifecycle to keep your sites secure.\n\nHowever, they provide a wide range of testing playgrounds, because you can install only those you wish to test or use, and reinstall if needed, with the help of our BOA-only feature that allows you to upgrade your Ægir on demand with two simple control files, as described in the built-in docs you can always find in ~/static/control/README.txt.\n\nThe complete list of 32 can be found at:\n\n https://github.com/omega8cc/boa/blob/5.x-dev/docs/PLATFORMS.md\n\n@=> You can access your upgraded Ægir instance at the following URL:\n\n https://aegir.url.name\n\n@=> For detailed information about the upgrade, please refer to:\n\n BOA Changelog: https://bit.ly/boa-changelog\n\n@=> Please check also the built-in documentation in your account:\n\n ~/static/control/README.txt\n\nThank you for choosing Ægir!\n\nBest regards,\nThe BOA Dev Team\n" }, { "path": "aegir/conf/valkey/valkey-server", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides:\t\tvalkey-server\n# Required-Start:\t$syslog $remote_fs\n# Required-Stop:\t$syslog $remote_fs\n# Should-Start:\t\t$local_fs\n# Should-Stop:\t\t$local_fs\n# Default-Start:\t2 3 4 5\n# Default-Stop:\t\t0 1 6\n# Short-Description: valkey-server - Persistent key-value db\n# Description: valkey-server - Persistent key-value db\n### END INIT INFO\n\nPATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin\nDAEMON=/usr/bin/valkey-server\nDAEMON_ARGS=/etc/valkey/valkey.conf\nNAME=valkey-server\nDESC=valkey-server\nPIDFILE=/run/valkey/valkey.pid\n\ntest -x $DAEMON || exit 0\n\n[ -d /run/valkey ] || mkdir -p /run/valkey\n[ -d /run/valkey ] && chown -R valkey:valkey /run/valkey\n\nmaxclients=$(awk '/^[ \\t]*maxclients[ \\t]/ { print $2 }' /etc/valkey/valkey.conf)\nif [ ! -z \"$maxclients\" ] && [ \"$maxclients\" -gt 992 ]; then\n ulimit -n $((maxclients+32))\nfi\n\ncase \"$1\" in\n start)\n\techo -n \"Starting $DESC: \"\n\ttouch $PIDFILE\n\tchown valkey:valkey $PIDFILE\n\tif start-stop-daemon --start --quiet --umask 007 --pidfile $PIDFILE --chuid valkey:valkey --exec $DAEMON -- $DAEMON_ARGS\n\tthen\n\t\techo \"$NAME.\"\n\telse\n\t\techo \"failed\"\n\tfi\n\t;;\n stop)\n\techo -n \"Stopping $DESC: \"\n\tif start-stop-daemon --stop --retry 8 --quiet --oknodo --pidfile $PIDFILE --exec $DAEMON\n\tthen\n\t\techo \"$NAME.\"\n\telse\n\t\techo \"failed\"\n\tfi\n\trm -f $PIDFILE\n\tsleep 1\n\t;;\n\n restart|force-reload)\n\t${0} stop\n\t${0} start\n\t;;\n\n reload)\n echo -n \"Reloading service ${NAME}...\"\n if [ ! -r ${PIDFILE} ]; then\n echo \"warning, no pid file found - ${NAME} is not running ?\"\n exit 1\n fi\n kill -USR2 `cat ${PIDFILE}`\n echo \" done\"\n\t;;\n\n status)\n\techo -n \"$DESC is \"\n\tif start-stop-daemon --stop --quiet --signal 0 --name ${NAME} --pidfile ${PIDFILE}\n\tthen\n\t\techo \"running\"\n\telse\n\t\techo \"not running\"\n\t\texit 1\n\tfi\n\t;;\n\n *)\n\techo \"Usage: service $NAME {start|stop|restart|reload|force-reload}\" >&2\n\texit 1\n\t;;\nesac\n\nexit 0\n" }, { "path": "aegir/conf/valkey/valkey7.conf", "content": "# Valkey configuration file example.\n#\n# Note that in order to read the configuration file, the server must be\n# started with the file path as first argument:\n#\n# ./valkey-server /path/to/valkey.conf\n\n# Note on units: when memory size is needed, it is possible to specify\n# it in the usual form of 1k 5GB 4M and so forth:\n#\n# 1k => 1000 bytes\n# 1kb => 1024 bytes\n# 1m => 1000000 bytes\n# 1mb => 1024*1024 bytes\n# 1g => 1000000000 bytes\n# 1gb => 1024*1024*1024 bytes\n#\n# units are case insensitive so 1GB 1Gb 1gB are all the same.\n\n################################## INCLUDES ###################################\n\n# Include one or more other config files here. This is useful if you\n# have a standard template that goes to all servers but also need\n# to customize a few per-server settings. Include files can include\n# other files, so use this wisely.\n#\n# Note that option \"include\" won't be rewritten by command \"CONFIG REWRITE\"\n# from admin or Sentinel. Since the server always uses the last processed\n# line as value of a configuration directive, you'd better put includes\n# at the beginning of this file to avoid overwriting config change at runtime.\n#\n# If instead you are interested in using includes to override configuration\n# options, it is better to use include as the last line.\n#\n# Included paths may contain wildcards. All files matching the wildcards will\n# be included in alphabetical order.\n# Note that if an include path contains a wildcards but no files match it when\n# the server is started, the include statement will be ignored and no error will\n# be emitted. It is safe, therefore, to include wildcard files from empty\n# directories.\n#\n# include /path/to/local.conf\n# include /path/to/other.conf\n# include /path/to/fragments/*.conf\n#\n\n################################## MODULES #####################################\n\n# Load modules at startup. If the server is not able to load modules\n# it will abort. It is possible to use multiple loadmodule directives.\n#\n# loadmodule /path/to/my_module.so\n# loadmodule /path/to/other_module.so\n\n################################## NETWORK #####################################\n\n# By default, if no \"bind\" configuration directive is specified, the server listens\n# for connections from all available network interfaces on the host machine.\n# It is possible to listen to just one or multiple selected interfaces using\n# the \"bind\" configuration directive, followed by one or more IP addresses.\n# Each address can be prefixed by \"-\", which means that the server will not fail to\n# start if the address is not available. Being not available only refers to\n# addresses that does not correspond to any network interface. Addresses that\n# are already in use will always fail, and unsupported protocols will always be\n# silently skipped.\n#\n# Examples:\n#\n# xbind 192.168.1.100 10.0.0.1 # listens on two specific IPv4 addresses\n# xbind 127.0.0.1 ::1 # listens on loopback IPv4 and IPv6\n# xbind * -::* # like the default, all available interfaces\n#\n# ~~~ WARNING ~~~ If the computer running the server is directly exposed to the\n# internet, binding to all the interfaces is dangerous and will expose the\n# instance to everybody on the internet. So by default we uncomment the\n# following bind directive, that will force the server to listen only on the\n# IPv4 and IPv6 (if available) loopback interface addresses (this means the server\n# will only be able to accept client connections from the same host that it is\n# running on).\n#\n# IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES\n# COMMENT OUT THE FOLLOWING LINE.\n#\n# You will also need to set a password unless you explicitly disable protected\n# mode.\n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nbind 127.0.0.1\n\n# By default, outgoing connections (from replica to master, from Sentinel to\n# instances, cluster bus, etc.) are not bound to a specific local address. In\n# most cases, this means the operating system will handle that based on routing\n# and the interface through which the connection goes out.\n#\n# Using bind-source-addr it is possible to configure a specific address to bind\n# to, which may also affect how the connection gets routed.\n#\n# Example:\n#\n# bind-source-addr 10.0.0.1\n\n# Protected mode is a layer of security protection, in order to avoid that\n# the server instances left open on the internet are accessed and exploited.\n#\n# When protected mode is on and the default user has no password, the server\n# only accepts local connections from the IPv4 address (127.0.0.1), IPv6 address\n# (::1) or Unix domain sockets.\n#\n# By default protected mode is enabled. You should disable it only if\n# you are sure you want clients from other hosts to connect to the server\n# even if no authentication is configured.\nprotected-mode yes\n\n# The server uses default hardened security configuration directives to reduce the\n# attack surface on innocent users. Therefore, several sensitive configuration\n# directives are immutable, and some potentially-dangerous commands are blocked.\n#\n# Configuration directives that control files that the server writes to (e.g., 'dir'\n# and 'dbfilename') and that aren't usually modified during runtime\n# are protected by making them immutable.\n#\n# Commands that can increase the attack surface of the server and that aren't usually\n# called by users are blocked by default.\n#\n# These can be exposed to either all connections or just local ones by setting\n# each of the configs listed below to either of these values:\n#\n# no - Block for any connection (remain immutable)\n# yes - Allow for any connection (no protection)\n# local - Allow only for local connections. Ones originating from the\n# IPv4 address (127.0.0.1), IPv6 address (::1) or Unix domain sockets.\n#\n# enable-protected-configs no\n# enable-debug-command no\n# enable-module-command no\n\n# Accept connections on the specified port, default is 6379 (IANA #815344).\n# If port 0 is specified the server will not listen on a TCP socket.\nport 6379\n\n# TCP listen() backlog.\n#\n# In high requests-per-second environments you need a high backlog in order\n# to avoid slow clients connection issues. Note that the Linux kernel\n# will silently truncate it to the value of /proc/sys/net/core/somaxconn so\n# make sure to raise both the value of somaxconn and tcp_max_syn_backlog\n# in order to get the desired effect.\ntcp-backlog 511\n\n# Unix socket.\n#\n# Specify the path for the Unix socket that will be used to listen for\n# incoming connections. There is no default, so the server will not listen\n# on a unix socket when not specified.\n#\n# unixsocket /run/valkey/valkey.sock\n# unixsocketperm 777\n\n# Close the connection after a client is idle for N seconds (0 to disable)\ntimeout 900\n\n# TCP keepalive.\n#\n# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence\n# of communication. This is useful for two reasons:\n#\n# 1) Detect dead peers.\n# 2) Force network equipment in the middle to consider the connection to be\n# alive.\n#\n# On Linux, the specified value (in seconds) is the period used to send ACKs.\n# Note that to close the connection the double of the time is needed.\n# On other kernels the period depends on the kernel configuration.\ntcp-keepalive 300\n\n# Apply OS-specific mechanism to mark the listening socket with the specified\n# ID, to support advanced routing and filtering capabilities.\n#\n# On Linux, the ID represents a connection mark.\n# On FreeBSD, the ID represents a socket cookie ID.\n# On OpenBSD, the ID represents a route table ID.\n#\n# The default value is 0, which implies no marking is required.\n# socket-mark-id 0\n\n################################# TLS/SSL #####################################\n\n# By default, TLS/SSL is disabled. To enable it, the \"tls-port\" configuration\n# directive can be used to define TLS-listening ports. To enable TLS on the\n# default port, use:\n#\n# port 0\n# tls-port 6379\n\n# Configure a X.509 certificate and private key to use for authenticating the\n# server to connected clients, masters or cluster peers. These files should be\n# PEM formatted.\n#\n# tls-cert-file valkey.crt\n# tls-key-file valkey.key\n#\n# If the key file is encrypted using a passphrase, it can be included here\n# as well.\n#\n# tls-key-file-pass secret\n\n# Normally the server uses the same certificate for both server functions (accepting\n# connections) and client functions (replicating from a master, establishing\n# cluster bus connections, etc.).\n#\n# Sometimes certificates are issued with attributes that designate them as\n# client-only or server-only certificates. In that case it may be desired to use\n# different certificates for incoming (server) and outgoing (client)\n# connections. To do that, use the following directives:\n#\n# tls-client-cert-file client.crt\n# tls-client-key-file client.key\n#\n# If the key file is encrypted using a passphrase, it can be included here\n# as well.\n#\n# tls-client-key-file-pass secret\n\n# Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange,\n# required by older versions of OpenSSL (<3.0). Newer versions do not require\n# this configuration and recommend against it.\n#\n# tls-dh-params-file valkey.dh\n\n# Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL\n# clients and peers. The server requires an explicit configuration of at least one\n# of these, and will not implicitly use the system wide configuration.\n#\n# tls-ca-cert-file ca.crt\n# tls-ca-cert-dir /etc/ssl/certs\n\n# By default, clients (including replica servers) on a TLS port are required\n# to authenticate using valid client side certificates.\n#\n# If \"no\" is specified, client certificates are not required and not accepted.\n# If \"optional\" is specified, client certificates are accepted and must be\n# valid if provided, but are not required.\n#\n# tls-auth-clients no\n# tls-auth-clients optional\n\n# By default, a replica does not attempt to establish a TLS connection\n# with its master.\n#\n# Use the following directive to enable TLS on replication links.\n#\n# tls-replication yes\n\n# By default, the cluster bus uses a plain TCP connection. To enable\n# TLS for the bus protocol, use the following directive:\n#\n# tls-cluster yes\n\n# By default, only TLSv1.2 and TLSv1.3 are enabled and it is highly recommended\n# that older formally deprecated versions are kept disabled to reduce the attack surface.\n# You can explicitly specify TLS versions to support.\n# Allowed values are case insensitive and include \"TLSv1\", \"TLSv1.1\", \"TLSv1.2\",\n# \"TLSv1.3\" (OpenSSL >= 1.1.1) or any combination.\n# To enable only TLSv1.2 and TLSv1.3, use:\n#\n# tls-protocols \"TLSv1.2 TLSv1.3\"\n\n# Configure allowed ciphers. See the ciphers(1ssl) manpage for more information\n# about the syntax of this string.\n#\n# Note: this configuration applies only to <= TLSv1.2.\n#\n# tls-ciphers DEFAULT:!MEDIUM\n\n# Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more\n# information about the syntax of this string, and specifically for TLSv1.3\n# ciphersuites.\n#\n# tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256\n\n# When choosing a cipher, use the server's preference instead of the client\n# preference. By default, the server follows the client's preference.\n#\n# tls-prefer-server-ciphers yes\n\n# By default, TLS session caching is enabled to allow faster and less expensive\n# reconnections by clients that support it. Use the following directive to disable\n# caching.\n#\n# tls-session-caching no\n\n# Change the default number of TLS sessions cached. A zero value sets the cache\n# to unlimited size. The default size is 20480.\n#\n# tls-session-cache-size 5000\n\n# Change the default timeout of cached TLS sessions. The default timeout is 300\n# seconds.\n#\n# tls-session-cache-timeout 60\n\n################################# GENERAL #####################################\n\n# By default the server does not run as a daemon. Use 'yes' if you need it.\n# Note that the server will write a pid file in /run/valkey/valkey.pid when daemonized.\n# When the server is supervised by upstart or systemd, this parameter has no impact.\ndaemonize yes\n\n# If you run the server from upstart or systemd, the server can interact with your\n# supervision tree. Options:\n# supervised no - no supervision interaction\n# supervised upstart - signal upstart by putting the server into SIGSTOP mode\n# requires \"expect stop\" in your upstart job config\n# supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET\n# on startup, and updating the server status on a regular\n# basis.\n# supervised auto - detect upstart or systemd method based on\n# UPSTART_JOB or NOTIFY_SOCKET environment variables\n# Note: these supervision methods only signal \"process is ready.\"\n# They do not enable continuous pings back to your supervisor.\n#\n# The default is \"no\". To run under upstart/systemd, you can simply uncomment\n# the line below:\n#\n# supervised auto\n\n# If a pid file is specified, the server writes it where specified at startup\n# and removes it at exit.\n#\n# When the server runs non daemonized, no pid file is created if none is\n# specified in the configuration. When the server is daemonized, the pid file\n# is used even if not specified, defaulting to \"/run/valkey/valkey.pid\".\n#\n# Creating a pid file is best effort: if the server is not able to create it\n# nothing bad happens, the server will start and run normally.\n#\n# Note that on modern Linux systems \"/run/valkey/valkey.pid\" is more conforming\n# and should be used instead.\npidfile /run/valkey/valkey.pid\n\n# Specify the server verbosity level.\n# This can be one of:\n# debug (a lot of information, useful for development/testing)\n# verbose (many rarely useful info, but not a mess like the debug level)\n# notice (moderately verbose, what you want in production probably)\n# warning (only very important / critical messages are logged)\n# nothing (nothing is logged)\nloglevel warning\n\n# Specify the log file name. Also the empty string can be used to force\n# the server to log on the standard output. Note that if you use standard\n# output for logging but daemonize, logs will be sent to /dev/null\nlogfile /var/log/valkey/valkey-server.log\n\n# To enable logging to the system logger, just set 'syslog-enabled' to yes,\n# and optionally update the other syslog parameters to suit your needs.\n# syslog-enabled no\n\n# Specify the syslog identity.\n# syslog-ident valkey\n\n# Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.\n# syslog-facility local0\n\n# To disable the built in crash log, which will possibly produce cleaner core\n# dumps when they are needed, uncomment the following:\n#\n# crash-log-enabled no\n\n# To disable the fast memory check that's run as part of the crash log, which\n# will possibly let the server terminate sooner, uncomment the following:\n#\n# crash-memcheck-enabled no\n\n# Set the number of databases. The default database is DB 0, you can select\n# a different one on a per-connection basis using SELECT where\n# dbid is a number between 0 and 'databases'-1\ndatabases 8\n\n# By default the server shows an ASCII art logo only when started to log to the\n# standard output and if the standard output is a TTY and syslog logging is\n# disabled. Basically this means that normally a logo is displayed only in\n# interactive sessions.\n#\n# However it is possible to force the pre-4.0 behavior and always show a\n# ASCII art logo in startup logs by setting the following option to yes.\nalways-show-logo no\n\n# By default, the server modifies the process title (as seen in 'top' and 'ps') to\n# provide some runtime information. It is possible to disable this and leave\n# the process name as executed by setting the following to no.\nset-proc-title yes\n\n# When changing the process title, the server uses the following template to construct\n# the modified title.\n#\n# Template variables are specified in curly brackets. The following variables are\n# supported:\n#\n# {title} Name of process as executed if parent, or type of child process.\n# {listen-addr} Bind address or '*' followed by TCP or TLS port listening on, or\n# Unix socket if only that's available.\n# {server-mode} Special mode, i.e. \"[sentinel]\" or \"[cluster]\".\n# {port} TCP port listening on, or 0.\n# {tls-port} TLS port listening on, or 0.\n# {unixsocket} Unix domain socket listening on, or \"\".\n# {config-file} Name of configuration file used.\n#\nproc-title-template \"{title} {listen-addr} {server-mode}\"\n\n# Set the local environment which is used for string comparison operations, and\n# also affect the performance of Lua scripts. Empty String indicates the locale\n# is derived from the environment variables.\nlocale-collate \"\"\n\n################################ SNAPSHOTTING ################################\n\n# Save the DB to disk.\n#\n# save [ ...]\n#\n# The server will save the DB if the given number of seconds elapsed and it\n# surpassed the given number of write operations against the DB.\n#\n# Snapshotting can be completely disabled with a single empty string argument\n# as in following example:\n#\n# save \"\"\n#\n# Unless specified otherwise, by default the server will save the DB:\n# * After 3600 seconds (an hour) if at least 1 change was performed\n# * After 300 seconds (5 minutes) if at least 100 changes were performed\n# * After 60 seconds if at least 10000 changes were performed\n#\n# You can set these explicitly by uncommenting the following line.\n#\n# save 3600 1 300 100 60 10000\n\n# By default the server will stop accepting writes if RDB snapshots are enabled\n# (at least one save point) and the latest background save failed.\n# This will make the user aware (in a hard way) that data is not persisting\n# on disk properly, otherwise chances are that no one will notice and some\n# disaster will happen.\n#\n# If the background saving process will start working again, the server will\n# automatically allow writes again.\n#\n# However if you have setup your proper monitoring of the server\n# and persistence, you may want to disable this feature so that the server will\n# continue to work as usual even if there are problems with disk,\n# permissions, and so forth.\nstop-writes-on-bgsave-error no\n\n# Compress string objects using LZF when dump .rdb databases?\n# By default compression is enabled as it's almost always a win.\n# If you want to save some CPU in the saving child set it to 'no' but\n# the dataset will likely be bigger if you have compressible values or keys.\nrdbcompression yes\n\n# Since version 5 of RDB a CRC64 checksum is placed at the end of the file.\n# This makes the format more resistant to corruption but there is a performance\n# hit to pay (around 10%) when saving and loading RDB files, so you can disable it\n# for maximum performances.\n#\n# RDB files created with checksum disabled have a checksum of zero that will\n# tell the loading code to skip the check.\nrdbchecksum no\n\n# Enables or disables full sanitization checks for ziplist and listpack etc when\n# loading an RDB or RESTORE payload. This reduces the chances of a assertion or\n# crash later on while processing commands.\n# Options:\n# no - Never perform full sanitization\n# yes - Always perform full sanitization\n# clients - Perform full sanitization only for user connections.\n# Excludes: RDB files, RESTORE commands received from the master\n# connection, and client connections which have the\n# skip-sanitize-payload ACL flag.\n# The default should be 'clients' but since it currently affects cluster\n# resharding via MIGRATE, it is temporarily set to 'no' by default.\n#\n# sanitize-dump-payload no\n\n# The filename where to dump the DB\ndbfilename dump.rdb\n\n# Remove RDB files used by replication in instances without persistence\n# enabled. By default this option is disabled, however there are environments\n# where for regulations or other security concerns, RDB files persisted on\n# disk by masters in order to feed replicas, or stored on disk by replicas\n# in order to load them for the initial synchronization, should be deleted\n# ASAP. Note that this option ONLY WORKS in instances that have both AOF\n# and RDB persistence disabled, otherwise is completely ignored.\n#\n# An alternative (and sometimes better) way to obtain the same effect is\n# to use diskless replication on both master and replicas instances. However\n# in the case of replicas, diskless is not always an option.\nrdb-del-sync-files no\n\n# The working directory.\n#\n# The DB will be written inside this directory, with the filename specified\n# above using the 'dbfilename' configuration directive.\n#\n# The Append Only File will also be created inside this directory.\n#\n# Note that you must specify a directory here, not a file name.\ndir /var/lib/valkey/\n\n################################# REPLICATION #################################\n\n# Master-Replica replication. Use replicaof to make a server a copy of\n# another server. A few things to understand ASAP about replication.\n#\n# +------------------+ +---------------+\n# | Master | ---> | Replica |\n# | (receive writes) | | (exact copy) |\n# +------------------+ +---------------+\n#\n# 1) Replication is asynchronous, but you can configure a master to\n# stop accepting writes if it appears to be not connected with at least\n# a given number of replicas.\n# 2) Replicas are able to perform a partial resynchronization with the\n# master if the replication link is lost for a relatively small amount of\n# time. You may want to configure the replication backlog size (see the next\n# sections of this file) with a sensible value depending on your needs.\n# 3) Replication is automatic and does not need user intervention. After a\n# network partition replicas automatically try to reconnect to masters\n# and resynchronize with them.\n#\n# replicaof \n\n# If the master is password protected (using the \"requirepass\" configuration\n# directive below) it is possible to tell the replica to authenticate before\n# starting the replication synchronization process, otherwise the master will\n# refuse the replica request.\n#\n# masterauth \n#\n# However this is not enough if you are using ACLs\n# and the default user is not capable of running the PSYNC\n# command and/or other commands needed for replication. In this case it's\n# better to configure a special user to use with replication, and specify the\n# masteruser configuration as such:\n#\n# masteruser \n#\n# When masteruser is specified, the replica will authenticate against its\n# master using the new AUTH form: AUTH .\n\n# When a replica loses its connection with the master, or when the replication\n# is still in progress, the replica can act in two different ways:\n#\n# 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will\n# still reply to client requests, possibly with out of date data, or the\n# data set may just be empty if this is the first synchronization.\n#\n# 2) If replica-serve-stale-data is set to 'no' the replica will reply with error\n# \"MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'\"\n# to all data access commands, excluding commands such as:\n# INFO, REPLICAOF, AUTH, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE,\n# UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST,\n# HOST and LATENCY.\n#\nreplica-serve-stale-data yes\n\n# You can configure a replica instance to accept writes or not. Writing against\n# a replica instance may be useful to store some ephemeral data (because data\n# written on a replica will be easily deleted after resync with the master) but\n# may also cause problems if clients are writing to it because of a\n# misconfiguration.\n#\n# By default, replicas are read-only.\n#\n# Note: read only replicas are not designed to be exposed to untrusted clients\n# on the internet. It's just a protection layer against misuse of the instance.\n# Still a read only replica exports by default all the administrative commands\n# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve\n# security of read only replicas using 'rename-command' to shadow all the\n# administrative / dangerous commands.\nreplica-read-only yes\n\n# Replication SYNC strategy: disk or socket.\n#\n# New replicas and reconnecting replicas that are not able to continue the\n# replication process just receiving differences, need to do what is called a\n# \"full synchronization\". An RDB file is transmitted from the master to the\n# replicas.\n#\n# The transmission can happen in two different ways:\n#\n# 1) Disk-backed: The master creates a new process that writes the RDB\n# file on disk. Later the file is transferred by the parent\n# process to the replicas incrementally.\n# 2) Diskless: The master creates a new process that directly writes the\n# RDB file to replica sockets, without touching the disk at all.\n#\n# With disk-backed replication, while the RDB file is generated, more replicas\n# can be queued and served with the RDB file as soon as the current child\n# producing the RDB file finishes its work. With diskless replication instead\n# once the transfer starts, new replicas arriving will be queued and a new\n# transfer will start when the current one terminates.\n#\n# When diskless replication is used, the master waits a configurable amount of\n# time (in seconds) before starting the transfer in the hope that multiple\n# replicas will arrive and the transfer can be parallelized.\n#\n# With slow disks and fast (large bandwidth) networks, diskless replication\n# works better.\nrepl-diskless-sync yes\n\n# When diskless replication is enabled, it is possible to configure the delay\n# the server waits in order to spawn the child that transfers the RDB via socket\n# to the replicas.\n#\n# This is important since once the transfer starts, it is not possible to serve\n# new replicas arriving, that will be queued for the next RDB transfer, so the\n# server waits a delay in order to let more replicas arrive.\n#\n# The delay is specified in seconds, and by default is 5 seconds. To disable\n# it entirely just set it to 0 seconds and the transfer will start ASAP.\nrepl-diskless-sync-delay 5\n\n# When diskless replication is enabled with a delay, it is possible to let\n# the replication start before the maximum delay is reached if the maximum\n# number of replicas expected have connected. Default of 0 means that the\n# maximum is not defined and the server will wait the full delay.\nrepl-diskless-sync-max-replicas 0\n\n# -----------------------------------------------------------------------------\n# WARNING: Since in this setup the replica does not immediately store an RDB on\n# disk, it may cause data loss during failovers. RDB diskless load + server\n# modules not handling I/O reads may cause the server to abort in case of I/O errors\n# during the initial synchronization stage with the master.\n# -----------------------------------------------------------------------------\n#\n# Replica can load the RDB it reads from the replication link directly from the\n# socket, or store the RDB to a file and read that file after it was completely\n# received from the master.\n#\n# In many cases the disk is slower than the network, and storing and loading\n# the RDB file may increase replication time (and even increase the master's\n# Copy on Write memory and replica buffers).\n# However, when parsing the RDB file directly from the socket, in order to avoid\n# data loss it's only safe to flush the current dataset when the new dataset is\n# fully loaded in memory, resulting in higher memory usage.\n# For this reason we have the following options:\n#\n# \"disabled\" - Don't use diskless load (store the rdb file to the disk first)\n# \"swapdb\" - Keep current db contents in RAM while parsing the data directly\n# from the socket. Replicas in this mode can keep serving current\n# dataset while replication is in progress, except for cases where\n# they can't recognize master as having a data set from same\n# replication history.\n# Note that this requires sufficient memory, if you don't have it,\n# you risk an OOM kill.\n# \"on-empty-db\" - Use diskless load only when current dataset is empty. This is\n# safer and avoid having old and new dataset loaded side by side\n# during replication.\nrepl-diskless-load disabled\n\n# Master send PINGs to its replicas in a predefined interval. It's possible to\n# change this interval with the repl_ping_replica_period option. The default\n# value is 10 seconds.\n#\n# repl-ping-replica-period 10\n\n# The following option sets the replication timeout for:\n#\n# 1) Bulk transfer I/O during SYNC, from the point of view of replica.\n# 2) Master timeout from the point of view of replicas (data, pings).\n# 3) Replica timeout from the point of view of masters (REPLCONF ACK pings).\n#\n# It is important to make sure that this value is greater than the value\n# specified for repl-ping-replica-period otherwise a timeout will be detected\n# every time there is low traffic between the master and the replica. The default\n# value is 60 seconds.\n#\n# repl-timeout 60\n\n# Disable TCP_NODELAY on the replica socket after SYNC?\n#\n# If you select \"yes\", the server will use a smaller number of TCP packets and\n# less bandwidth to send data to replicas. But this can add a delay for\n# the data to appear on the replica side, up to 40 milliseconds with\n# Linux kernels using a default configuration.\n#\n# If you select \"no\" the delay for data to appear on the replica side will\n# be reduced but more bandwidth will be used for replication.\n#\n# By default we optimize for low latency, but in very high traffic conditions\n# or when the master and replicas are many hops away, turning this to \"yes\" may\n# be a good idea.\nrepl-disable-tcp-nodelay no\n\n# Set the replication backlog size. The backlog is a buffer that accumulates\n# replica data when replicas are disconnected for some time, so that when a\n# replica wants to reconnect again, often a full resync is not needed, but a\n# partial resync is enough, just passing the portion of data the replica\n# missed while disconnected.\n#\n# The bigger the replication backlog, the longer the replica can endure the\n# disconnect and later be able to perform a partial resynchronization.\n#\n# The backlog is only allocated if there is at least one replica connected.\n#\n# repl-backlog-size 1mb\n\n# After a master has no connected replicas for some time, the backlog will be\n# freed. The following option configures the amount of seconds that need to\n# elapse, starting from the time the last replica disconnected, for the backlog\n# buffer to be freed.\n#\n# Note that replicas never free the backlog for timeout, since they may be\n# promoted to masters later, and should be able to correctly \"partially\n# resynchronize\" with other replicas: hence they should always accumulate backlog.\n#\n# A value of 0 means to never release the backlog.\n#\n# repl-backlog-ttl 3600\n\n# The replica priority is an integer number published by the server in the INFO\n# output. It is used by Sentinel in order to select a replica to promote\n# into a master if the master is no longer working correctly.\n#\n# A replica with a low priority number is considered better for promotion, so\n# for instance if there are three replicas with priority 10, 100, 25 Sentinel\n# will pick the one with priority 10, that is the lowest.\n#\n# However a special priority of 0 marks the replica as not able to perform the\n# role of master, so a replica with priority of 0 will never be selected by\n# Sentinel for promotion.\n#\n# By default the priority is 100.\nreplica-priority 100\n\n# The propagation error behavior controls how the server will behave when it is\n# unable to handle a command being processed in the replication stream from a master\n# or processed while reading from an AOF file. Errors that occur during propagation\n# are unexpected, and can cause data inconsistency.\n#\n# If an application wants to ensure there is no data divergence, this configuration\n# should be set to 'panic' instead. The value can also be set to 'panic-on-replicas'\n# to only panic when a replica encounters an error on the replication stream. One of\n# these two panic values will become the default value in the future once there are\n# sufficient safety mechanisms in place to prevent false positive crashes.\n#\n# propagation-error-behavior ignore\n\n# Replica ignore disk write errors controls the behavior of a replica when it is\n# unable to persist a write command received from its master to disk. By default,\n# this configuration is set to 'no' and will crash the replica in this condition.\n# It is not recommended to change this default.\n#\n# replica-ignore-disk-write-errors no\n\n# -----------------------------------------------------------------------------\n# By default, Sentinel includes all replicas in its reports. A replica\n# can be excluded from Sentinel's announcements. An unannounced replica\n# will be ignored by the 'sentinel replicas ' command and won't be\n# exposed to Sentinel's clients.\n#\n# This option does not change the behavior of replica-priority. Even with\n# replica-announced set to 'no', the replica can be promoted to master. To\n# prevent this behavior, set replica-priority to 0.\n#\n# replica-announced yes\n\n# It is possible for a master to stop accepting writes if there are less than\n# N replicas connected, having a lag less or equal than M seconds.\n#\n# The N replicas need to be in \"online\" state.\n#\n# The lag in seconds, that must be <= the specified value, is calculated from\n# the last ping received from the replica, that is usually sent every second.\n#\n# This option does not GUARANTEE that N replicas will accept the write, but\n# will limit the window of exposure for lost writes in case not enough replicas\n# are available, to the specified number of seconds.\n#\n# For example to require at least 3 replicas with a lag <= 10 seconds use:\n#\n# min-replicas-to-write 3\n# min-replicas-max-lag 10\n#\n# Setting one or the other to 0 disables the feature.\n#\n# By default min-replicas-to-write is set to 0 (feature disabled) and\n# min-replicas-max-lag is set to 10.\n\n# A master is able to list the address and port of the attached\n# replicas in different ways. For example the \"INFO replication\" section\n# offers this information, which is used, among other tools, by\n# Sentinel in order to discover replica instances.\n# Another place where this info is available is in the output of the\n# \"ROLE\" command of a master.\n#\n# The listed IP address and port normally reported by a replica is\n# obtained in the following way:\n#\n# IP: The address is auto detected by checking the peer address\n# of the socket used by the replica to connect with the master.\n#\n# Port: The port is communicated by the replica during the replication\n# handshake, and is normally the port that the replica is using to\n# listen for connections.\n#\n# However when port forwarding or Network Address Translation (NAT) is\n# used, the replica may actually be reachable via different IP and port\n# pairs. The following two options can be used by a replica in order to\n# report to its master a specific set of IP and port, so that both INFO\n# and ROLE will report those values.\n#\n# There is no need to use both the options if you need to override just\n# the port or the IP address.\n#\n# replica-announce-ip 5.5.5.5\n# replica-announce-port 1234\n\n############################### KEYS TRACKING #################################\n\n# The client side caching of values is assisted via server-side support.\n# This is implemented using an invalidation table that remembers, using\n# a radix key indexed by key name, what clients have which keys. In turn\n# this is used in order to send invalidation messages to clients. Please\n# check this page to understand more about the feature:\n#\n# https://valkey.io/topics/client-side-caching\n#\n# When tracking is enabled for a client, all the read only queries are assumed\n# to be cached: this will force the server to store information in the invalidation\n# table. When keys are modified, such information is flushed away, and\n# invalidation messages are sent to the clients. However if the workload is\n# heavily dominated by reads, the server could use more and more memory in order\n# to track the keys fetched by many clients.\n#\n# For this reason it is possible to configure a maximum fill value for the\n# invalidation table. By default it is set to 1M of keys, and once this limit\n# is reached, the server will start to evict keys in the invalidation table\n# even if they were not modified, just to reclaim memory: this will in turn\n# force the clients to invalidate the cached values. Basically the table\n# maximum size is a trade off between the memory you want to spend server\n# side to track information about who cached what, and the ability of clients\n# to retain cached objects in memory.\n#\n# If you set the value to 0, it means there are no limits, and the server will\n# retain as many keys as needed in the invalidation table.\n# In the \"stats\" INFO section, you can find information about the number of\n# keys in the invalidation table at every given moment.\n#\n# Note: when key tracking is used in broadcasting mode, no memory is used\n# in the server side so this setting is useless.\n#\n# tracking-table-max-keys 1000000\n\n################################## SECURITY ###################################\n\n# Warning: since the server is pretty fast, an outside user can try up to\n# 1 million passwords per second against a modern box. This means that you\n# should use very strong passwords, otherwise they will be very easy to break.\n# Note that because the password is really a shared secret between the client\n# and the server, and should not be memorized by any human, the password\n# can be easily a long string from /dev/urandom or whatever, so by using a\n# long and unguessable password no brute force attack will be possible.\n\n# ACL users are defined in the following format:\n#\n# user ... acl rules ...\n#\n# For example:\n#\n# user worker +@list +@connection ~jobs:* on >ffa9203c493aa99\n#\n# The special username \"default\" is used for new connections. If this user\n# has the \"nopass\" rule, then new connections will be immediately authenticated\n# as the \"default\" user without the need of any password provided via the\n# AUTH command. Otherwise if the \"default\" user is not flagged with \"nopass\"\n# the connections will start in not authenticated state, and will require\n# AUTH (or the HELLO command AUTH option) in order to be authenticated and\n# start to work.\n#\n# The ACL rules that describe what a user can do are the following:\n#\n# on Enable the user: it is possible to authenticate as this user.\n# off Disable the user: it's no longer possible to authenticate\n# with this user, however the already authenticated connections\n# will still work.\n# skip-sanitize-payload RESTORE dump-payload sanitization is skipped.\n# sanitize-payload RESTORE dump-payload is sanitized (default).\n# + Allow the execution of that command.\n# May be used with `|` for allowing subcommands (e.g \"+config|get\")\n# - Disallow the execution of that command.\n# May be used with `|` for blocking subcommands (e.g \"-config|set\")\n# +@ Allow the execution of all the commands in such category\n# with valid categories are like @admin, @set, @sortedset, ...\n# and so forth, see the full list in the server.c file where\n# the server command table is described and defined.\n# The special category @all means all the commands, but currently\n# present in the server, and that will be loaded in the future\n# via modules.\n# +|first-arg Allow a specific first argument of an otherwise\n# disabled command. It is only supported on commands with\n# no sub-commands, and is not allowed as negative form\n# like -SELECT|1, only additive starting with \"+\". This\n# feature is deprecated and may be removed in the future.\n# allcommands Alias for +@all. Note that it implies the ability to execute\n# all the future commands loaded via the modules system.\n# nocommands Alias for -@all.\n# ~ Add a pattern of keys that can be mentioned as part of\n# commands. For instance ~* allows all the keys. The pattern\n# is a glob-style pattern like the one of KEYS.\n# It is possible to specify multiple patterns.\n# %R~ Add key read pattern that specifies which keys can be read\n# from.\n# %W~ Add key write pattern that specifies which keys can be\n# written to.\n# allkeys Alias for ~*\n# resetkeys Flush the list of allowed keys patterns.\n# & Add a glob-style pattern of Pub/Sub channels that can be\n# accessed by the user. It is possible to specify multiple channel\n# patterns.\n# allchannels Alias for &*\n# resetchannels Flush the list of allowed channel patterns.\n# > Add this password to the list of valid password for the user.\n# For example >mypass will add \"mypass\" to the list.\n# This directive clears the \"nopass\" flag (see later).\n# < Remove this password from the list of valid passwords.\n# nopass All the set passwords of the user are removed, and the user\n# is flagged as requiring no password: it means that every\n# password will work against this user. If this directive is\n# used for the default user, every new connection will be\n# immediately authenticated with the default user without\n# any explicit AUTH command required. Note that the \"resetpass\"\n# directive will clear this condition.\n# resetpass Flush the list of allowed passwords. Moreover removes the\n# \"nopass\" status. After \"resetpass\" the user has no associated\n# passwords and there is no way to authenticate without adding\n# some password (or setting it as \"nopass\" later).\n# reset Performs the following actions: resetpass, resetkeys, resetchannels,\n# allchannels (if acl-pubsub-default is set), off, clearselectors, -@all.\n# The user returns to the same state it has immediately after its creation.\n# () Create a new selector with the options specified within the\n# parentheses and attach it to the user. Each option should be\n# space separated. The first character must be ( and the last\n# character must be ).\n# clearselectors Remove all of the currently attached selectors.\n# Note this does not change the \"root\" user permissions,\n# which are the permissions directly applied onto the\n# user (outside the parentheses).\n#\n# ACL rules can be specified in any order: for instance you can start with\n# passwords, then flags, or key patterns. However note that the additive\n# and subtractive rules will CHANGE MEANING depending on the ordering.\n# For instance see the following example:\n#\n# user alice on +@all -DEBUG ~* >somepassword\n#\n# This will allow \"alice\" to use all the commands with the exception of the\n# DEBUG command, since +@all added all the commands to the set of the commands\n# alice can use, and later DEBUG was removed. However if we invert the order\n# of two ACL rules the result will be different:\n#\n# user alice on -DEBUG +@all ~* >somepassword\n#\n# Now DEBUG was removed when alice had yet no commands in the set of allowed\n# commands, later all the commands are added, so the user will be able to\n# execute everything.\n#\n# Basically ACL rules are processed left-to-right.\n#\n# The following is a list of command categories and their meanings:\n# * keyspace - Writing or reading from keys, databases, or their metadata\n# in a type agnostic way. Includes DEL, RESTORE, DUMP, RENAME, EXISTS, DBSIZE,\n# KEYS, EXPIRE, TTL, FLUSHALL, etc. Commands that may modify the keyspace,\n# key or metadata will also have `write` category. Commands that only read\n# the keyspace, key or metadata will have the `read` category.\n# * read - Reading from keys (values or metadata). Note that commands that don't\n# interact with keys, will not have either `read` or `write`.\n# * write - Writing to keys (values or metadata)\n# * admin - Administrative commands. Normal applications will never need to use\n# these. Includes REPLICAOF, CONFIG, DEBUG, SAVE, MONITOR, ACL, SHUTDOWN, etc.\n# * dangerous - Potentially dangerous (each should be considered with care for\n# various reasons). This includes FLUSHALL, MIGRATE, RESTORE, SORT, KEYS,\n# CLIENT, DEBUG, INFO, CONFIG, SAVE, REPLICAOF, etc.\n# * connection - Commands affecting the connection or other connections.\n# This includes AUTH, SELECT, COMMAND, CLIENT, ECHO, PING, etc.\n# * blocking - Potentially blocking the connection until released by another\n# command.\n# * fast - Fast O(1) commands. May loop on the number of arguments, but not the\n# number of elements in the key.\n# * slow - All commands that are not Fast.\n# * pubsub - PUBLISH / SUBSCRIBE related\n# * transaction - WATCH / MULTI / EXEC related commands.\n# * scripting - Scripting related.\n# * set - Data type: sets related.\n# * sortedset - Data type: zsets related.\n# * list - Data type: lists related.\n# * hash - Data type: hashes related.\n# * string - Data type: strings related.\n# * bitmap - Data type: bitmaps related.\n# * hyperloglog - Data type: hyperloglog related.\n# * geo - Data type: geo related.\n# * stream - Data type: streams related.\n#\n# For more information about ACL configuration please refer to\n# the Valkey web site at https://valkey.io/topics/acl\n\n# ACL LOG\n#\n# The ACL Log tracks failed commands and authentication events associated\n# with ACLs. The ACL Log is useful to troubleshoot failed commands blocked\n# by ACLs. The ACL Log is stored in memory. You can reclaim memory with\n# ACL LOG RESET. Define the maximum entry length of the ACL Log below.\nacllog-max-len 128\n\n# Using an external ACL file\n#\n# Instead of configuring users here in this file, it is possible to use\n# a stand-alone file just listing users. The two methods cannot be mixed:\n# if you configure users here and at the same time you activate the external\n# ACL file, the server will refuse to start.\n#\n# The format of the external ACL user file is exactly the same as the\n# format that is used inside valkey.conf to describe users.\n#\n# aclfile /etc/valkey/users.acl\n\n# IMPORTANT NOTE: \"requirepass\" is just a compatibility\n# layer on top of the new ACL system. The option effect will be just setting\n# the password for the default user. Clients will still authenticate using\n# AUTH as usually, or more explicitly with AUTH default \n# if they follow the new protocol: both will work.\n#\n# The requirepass is not compatible with aclfile option and the ACL LOAD\n# command, these will cause requirepass to be ignored.\n#\n\nuser default on >isfoobared allcommands allkeys\n\n# The default Pub/Sub channels permission for new users is controlled by the\n# acl-pubsub-default configuration directive, which accepts one of these values:\n#\n# allchannels: grants access to all Pub/Sub channels\n# resetchannels: revokes access to all Pub/Sub channels\n#\n# acl-pubsub-default defaults to 'resetchannels' permission.\n#\n# acl-pubsub-default resetchannels\n\n# Command renaming (DEPRECATED).\n#\n# ------------------------------------------------------------------------\n# WARNING: avoid using this option if possible. Instead use ACLs to remove\n# commands from the default user, and put them only in some admin user you\n# create for administrative purposes.\n# ------------------------------------------------------------------------\n#\n# It is possible to change the name of dangerous commands in a shared\n# environment. For instance the CONFIG command may be renamed into something\n# hard to guess so that it will still be available for internal-use tools\n# but not available for general clients.\n#\n# Example:\n#\n# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52\n#\n# It is also possible to completely kill a command by renaming it into\n# an empty string:\n#\n# rename-command CONFIG \"\"\n#\n# Please note that changing the name of commands that are logged into the\n# AOF file or transmitted to replicas may cause problems.\n\n################################### CLIENTS ####################################\n\n# Set the max number of connected clients at the same time. By default\n# this limit is set to 10000 clients, however if the server is not\n# able to configure the process file limit to allow for the specified limit\n# the max number of allowed clients is set to the current file limit\n# minus 32 (as the server reserves a few file descriptors for internal uses).\n#\n# Once the limit is reached the server will close all the new connections sending\n# an error 'max number of clients reached'.\n#\n# IMPORTANT: With a cluster-enabled setup, the max number of connections is also\n# shared with the cluster bus: every node in the cluster will use two\n# connections, one incoming and another outgoing. It is important to size the\n# limit accordingly in case of very large clusters.\n#\nmaxclients 4000\n\n############################## MEMORY MANAGEMENT ################################\n\n# Set a memory usage limit to the specified amount of bytes.\n# When the memory limit is reached the server will try to remove keys\n# according to the eviction policy selected (see maxmemory-policy).\n#\n# If the server can't remove keys according to the policy, or if the policy is\n# set to 'noeviction', the server will start to reply with errors to commands\n# that would use more memory, like SET, LPUSH, and so on, and will continue\n# to reply to read-only commands like GET.\n#\n# This option is usually useful when using the server as an LRU or LFU cache, or to\n# set a hard memory limit for an instance (using the 'noeviction' policy).\n#\n# WARNING: If you have replicas attached to an instance with maxmemory on,\n# the size of the output buffers needed to feed the replicas are subtracted\n# from the used memory count, so that network problems / resyncs will\n# not trigger a loop where keys are evicted, and in turn the output\n# buffer of replicas is full with DELs of keys evicted triggering the deletion\n# of more keys, and so forth until the database is completely emptied.\n#\n# In short... if you have replicas attached it is suggested that you set a lower\n# limit for maxmemory so that there is some free RAM on the system for replica\n# output buffers (but this is not needed if the policy is 'noeviction').\n#\nmaxmemory 88MB\n\n# MAXMEMORY POLICY: how the server will select what to remove when maxmemory\n# is reached. You can select one from the following behaviors:\n#\n# volatile-lru -> Evict using approximated LRU, only keys with an expire set.\n# allkeys-lru -> Evict any key using approximated LRU.\n# volatile-lfu -> Evict using approximated LFU, only keys with an expire set.\n# allkeys-lfu -> Evict any key using approximated LFU.\n# volatile-random -> Remove a random key having an expire set.\n# allkeys-random -> Remove a random key, any key.\n# volatile-ttl -> Remove the key with the nearest expire time (minor TTL)\n# noeviction -> Don't evict anything, just return an error on write operations.\n#\n# LRU means Least Recently Used\n# LFU means Least Frequently Used\n#\n# Both LRU, LFU and volatile-ttl are implemented using approximated\n# randomized algorithms.\n#\n# Note: with any of the above policies, when there are no suitable keys for\n# eviction, the server will return an error on write operations that require\n# more memory. These are usually commands that create new keys, add data or\n# modify existing keys. A few examples are: SET, INCR, HSET, LPUSH, SUNIONSTORE,\n# SORT (due to the STORE argument), and EXEC (if the transaction includes any\n# command that requires memory).\n#\n# The default is: noeviction\n#\nmaxmemory-policy allkeys-lru\n\n# LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated\n# algorithms (in order to save memory), so you can tune it for speed or\n# accuracy. By default the server will check five keys and pick the one that was\n# used least recently, you can change the sample size using the following\n# configuration directive.\n#\n# The default of 5 produces good enough results. 10 Approximates very closely\n# true LRU but costs more CPU. 3 is faster but not very accurate.\n#\n# maxmemory-samples 5\n\n# Eviction processing is designed to function well with the default setting.\n# If there is an unusually large amount of write traffic, this value may need to\n# be increased. Decreasing this value may reduce latency at the risk of\n# eviction processing effectiveness\n# 0 = minimum latency, 10 = default, 100 = process without regard to latency\n#\n# maxmemory-eviction-tenacity 10\n\n# By default a replica will ignore its maxmemory setting\n# (unless it is promoted to master after a failover or manually). It means\n# that the eviction of keys will be just handled by the master, sending the\n# DEL commands to the replica as keys evict in the master side.\n#\n# This behavior ensures that masters and replicas stay consistent, and is usually\n# what you want, however if your replica is writable, or you want the replica\n# to have a different memory setting, and you are sure all the writes performed\n# to the replica are idempotent, then you may change this default (but be sure\n# to understand what you are doing).\n#\n# Note that since the replica by default does not evict, it may end using more\n# memory than the one set via maxmemory (there are certain buffers that may\n# be larger on the replica, or data structures may sometimes take more memory\n# and so forth). So make sure you monitor your replicas and make sure they\n# have enough memory to never hit a real out-of-memory condition before the\n# master hits the configured maxmemory setting.\n#\n# replica-ignore-maxmemory yes\n\n# The server reclaims expired keys in two ways: upon access when those keys are\n# found to be expired, and also in background, in what is called the\n# \"active expire key\". The key space is slowly and interactively scanned\n# looking for expired keys to reclaim, so that it is possible to free memory\n# of keys that are expired and will never be accessed again in a short time.\n#\n# The default effort of the expire cycle will try to avoid having more than\n# ten percent of expired keys still in memory, and will try to avoid consuming\n# more than 25% of total memory and to add latency to the system. However\n# it is possible to increase the expire \"effort\" that is normally set to\n# \"1\", to a greater value, up to the value \"10\". At its maximum value the\n# system will use more CPU, longer cycles (and technically may introduce\n# more latency), and will tolerate less already expired keys still present\n# in the system. It's a tradeoff between memory, CPU and latency.\n#\n# active-expire-effort 1\n\n############################# LAZY FREEING ####################################\n\n# The server has two primitives to delete keys. One is called DEL and is a blocking\n# deletion of the object. It means that the server stops processing new commands\n# in order to reclaim all the memory associated with an object in a synchronous\n# way. If the key deleted is associated with a small object, the time needed\n# in order to execute the DEL command is very small and comparable to most other\n# O(1) or O(log_N) commands in the server. However if the key is associated with an\n# aggregated value containing millions of elements, the server can block for\n# a long time (even seconds) in order to complete the operation.\n#\n# For the above reasons the server also offers non blocking deletion primitives\n# such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and\n# FLUSHDB commands, in order to reclaim memory in background. Those commands\n# are executed in constant time. Another thread will incrementally free the\n# object in the background as fast as possible.\n#\n# DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled.\n# It's up to the design of the application to understand when it is a good\n# idea to use one or the other. However the server sometimes has to\n# delete keys or flush the whole database as a side effect of other operations.\n# Specifically the server deletes objects independently of a user call in the\n# following scenarios:\n#\n# 1) On eviction, because of the maxmemory and maxmemory policy configurations,\n# in order to make room for new data, without going over the specified\n# memory limit.\n# 2) Because of expire: when a key with an associated time to live (see the\n# EXPIRE command) must be deleted from memory.\n# 3) Because of a side effect of a command that stores data on a key that may\n# already exist. For example the RENAME command may delete the old key\n# content when it is replaced with another one. Similarly SUNIONSTORE\n# or SORT with STORE option may delete existing keys. The SET command\n# itself removes any old content of the specified key in order to replace\n# it with the specified string.\n# 4) During replication, when a replica performs a full resynchronization with\n# its master, the content of the whole database is removed in order to\n# load the RDB file just transferred.\n#\n# In all the above cases the default is to delete objects in a blocking way,\n# like if DEL was called. However you can configure each case specifically\n# in order to instead release memory in a non-blocking way like if UNLINK\n# was called, using the following configuration directives.\n\nlazyfree-lazy-eviction yes\nlazyfree-lazy-expire yes\nlazyfree-lazy-server-del yes\nreplica-lazy-flush yes\n\n# It is also possible, for the case when to replace the user code DEL calls\n# with UNLINK calls is not easy, to modify the default behavior of the DEL\n# command to act exactly like UNLINK, using the following configuration\n# directive:\n\nlazyfree-lazy-user-del yes\n\n# FLUSHDB, FLUSHALL, SCRIPT FLUSH and FUNCTION FLUSH support both asynchronous and synchronous\n# deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the\n# commands. When neither flag is passed, this directive will be used to determine\n# if the data should be deleted asynchronously.\n\nlazyfree-lazy-user-flush yes\n\n################################ THREADED I/O #################################\n\n# The server is mostly single threaded, however there are certain threaded\n# operations such as UNLINK, slow I/O accesses and other things that are\n# performed on side threads.\n#\n# Now it is also possible to handle the server clients socket reads and writes\n# in different I/O threads. Since especially writing is so slow, normally\n# users use pipelining in order to speed up the server performances per\n# core, and spawn multiple instances in order to scale more. Using I/O\n# threads it is possible to easily speedup two times the server without resorting\n# to pipelining nor sharding of the instance.\n#\n# By default threading is disabled, we suggest enabling it only in machines\n# that have at least 4 or more cores, leaving at least one spare core.\n# Using more than 8 threads is unlikely to help much. We also recommend using\n# threaded I/O only if you actually have performance problems, with\n# instances being able to use a quite big percentage of CPU time, otherwise\n# there is no point in using this feature.\n#\n# So for instance if you have a four cores boxes, try to use 2 or 3 I/O\n# threads, if you have a 8 cores, try to use 6 threads. In order to\n# enable I/O threads use the following configuration directive:\n#\n# io-threads 4\n#\n# Setting io-threads to 1 will just use the main thread as usual.\n# When I/O threads are enabled, we only use threads for writes, that is\n# to thread the write(2) syscall and transfer the client buffers to the\n# socket. However it is also possible to enable threading of reads and\n# protocol parsing using the following configuration directive, by setting\n# it to yes:\n#\n# io-threads-do-reads no\n#\n# Usually threading reads doesn't help much.\n#\n# NOTE 1: This configuration directive cannot be changed at runtime via\n# CONFIG SET. Also, this feature currently does not work when SSL is\n# enabled.\n#\n# NOTE 2: If you want to test the server speedup using valkey-benchmark, make\n# sure you also run the benchmark itself in threaded mode, using the\n# --threads option to match the number of server threads, otherwise you'll not\n# be able to notice the improvements.\n\n############################ KERNEL OOM CONTROL ##############################\n\n# On Linux, it is possible to hint the kernel OOM killer on what processes\n# should be killed first when out of memory.\n#\n# Enabling this feature makes the server actively control the oom_score_adj value\n# for all its processes, depending on their role. The default scores will\n# attempt to have background child processes killed before all others, and\n# replicas killed before masters.\n#\n# The server supports these options:\n#\n# no: Don't make changes to oom-score-adj (default).\n# yes: Alias to \"relative\" see below.\n# absolute: Values in oom-score-adj-values are written as is to the kernel.\n# relative: Values are used relative to the initial value of oom_score_adj when\n# the server starts and are then clamped to a range of -1000 to 1000.\n# Because typically the initial value is 0, they will often match the\n# absolute values.\noom-score-adj no\n\n# When oom-score-adj is used, this directive controls the specific values used\n# for master, replica and background child processes. Values range -2000 to\n# 2000 (higher means more likely to be killed).\n#\n# Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities)\n# can freely increase their value, but not decrease it below its initial\n# settings. This means that setting oom-score-adj to \"relative\" and setting the\n# oom-score-adj-values to positive values will always succeed.\noom-score-adj-values 0 200 800\n\n\n#################### KERNEL transparent hugepage CONTROL ######################\n\n# Usually the kernel Transparent Huge Pages control is set to \"madvise\" or\n# \"never\" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which\n# case this config has no effect. On systems in which it is set to \"always\",\n# the server will attempt to disable it specifically for the server process in order\n# to avoid latency problems specifically with fork(2) and CoW.\n# If for some reason you prefer to keep it enabled, you can set this config to\n# \"no\" and the kernel global to \"always\".\n\ndisable-thp yes\n\n############################## APPEND ONLY MODE ###############################\n\n# By default the server asynchronously dumps the dataset on disk. This mode is\n# good enough in many applications, but an issue with the server process or\n# a power outage may result into a few minutes of writes lost (depending on\n# the configured save points).\n#\n# The Append Only File is an alternative persistence mode that provides\n# much better durability. For instance using the default data fsync policy\n# (see later in the config file) the server can lose just one second of writes in a\n# dramatic event like a server power outage, or a single write if something\n# wrong with the process itself happens, but the operating system is\n# still running correctly.\n#\n# AOF and RDB persistence can be enabled at the same time without problems.\n# If the AOF is enabled on startup the server will load the AOF, that is the file\n# with the better durability guarantees.\n#\n# Please check https://valkey.io/topics/persistence for more information.\n\nappendonly no\n\n# The base name of the append only file.\n#\n# The server uses a set of append-only files to persist the dataset\n# and changes applied to it. There are two basic types of files in use:\n#\n# - Base files, which are a snapshot representing the complete state of the\n# dataset at the time the file was created. Base files can be either in\n# the form of RDB (binary serialized) or AOF (textual commands).\n# - Incremental files, which contain additional commands that were applied\n# to the dataset following the previous file.\n#\n# In addition, manifest files are used to track the files and the order in\n# which they were created and should be applied.\n#\n# Append-only file names are created by the server following a specific pattern.\n# The file name's prefix is based on the 'appendfilename' configuration\n# parameter, followed by additional information about the sequence and type.\n#\n# For example, if appendfilename is set to appendonly.aof, the following file\n# names could be derived:\n#\n# - appendonly.aof.1.base.rdb as a base file.\n# - appendonly.aof.1.incr.aof, appendonly.aof.2.incr.aof as incremental files.\n# - appendonly.aof.manifest as a manifest file.\n\nappendfilename \"appendonly.aof\"\n\n# For convenience, the server stores all persistent append-only files in a dedicated\n# directory. The name of the directory is determined by the appenddirname\n# configuration parameter.\n\nappenddirname \"appendonlydir\"\n\n# The fsync() call tells the Operating System to actually write data on disk\n# instead of waiting for more data in the output buffer. Some OS will really flush\n# data on disk, some other OS will just try to do it ASAP.\n#\n# The server supports three different modes:\n#\n# no: don't fsync, just let the OS flush the data when it wants. Faster.\n# always: fsync after every write to the append only log. Slow, Safest.\n# everysec: fsync only one time every second. Compromise.\n#\n# The default is \"everysec\", as that's usually the right compromise between\n# speed and data safety. It's up to you to understand if you can relax this to\n# \"no\" that will let the operating system flush the output buffer when\n# it wants, for better performances (but if you can live with the idea of\n# some data loss consider the default persistence mode that's snapshotting),\n# or on the contrary, use \"always\" that's very slow but a bit safer than\n# everysec.\n#\n# More details please check the following article:\n# http://antirez.com/post/redis-persistence-demystified.html\n#\n# If unsure, use \"everysec\".\n\n# appendfsync always\nappendfsync everysec\n# appendfsync no\n\n# When the AOF fsync policy is set to always or everysec, and a background\n# saving process (a background save or AOF log background rewriting) is\n# performing a lot of I/O against the disk, in some Linux configurations\n# the server may block too long on the fsync() call. Note that there is no fix for\n# this currently, as even performing fsync in a different thread will block\n# our synchronous write(2) call.\n#\n# In order to mitigate this problem it's possible to use the following option\n# that will prevent fsync() from being called in the main process while a\n# BGSAVE or BGREWRITEAOF is in progress.\n#\n# This means that while another child is saving, the durability of the server is\n# the same as \"appendfsync no\". In practical terms, this means that it is\n# possible to lose up to 30 seconds of log in the worst scenario (with the\n# default Linux settings).\n#\n# If you have latency problems turn this to \"yes\". Otherwise leave it as\n# \"no\" that is the safest pick from the point of view of durability.\n\nno-appendfsync-on-rewrite no\n\n# Automatic rewrite of the append only file.\n# The server is able to automatically rewrite the log file implicitly calling\n# BGREWRITEAOF when the AOF log size grows by the specified percentage.\n#\n# This is how it works: The server remembers the size of the AOF file after the\n# latest rewrite (if no rewrite has happened since the restart, the size of\n# the AOF at startup is used).\n#\n# This base size is compared to the current size. If the current size is\n# bigger than the specified percentage, the rewrite is triggered. Also\n# you need to specify a minimal size for the AOF file to be rewritten, this\n# is useful to avoid rewriting the AOF file even if the percentage increase\n# is reached but it is still pretty small.\n#\n# Specify a percentage of zero in order to disable the automatic AOF\n# rewrite feature.\n\nauto-aof-rewrite-percentage 100\nauto-aof-rewrite-min-size 64mb\n\n# An AOF file may be found to be truncated at the end during the server\n# startup process, when the AOF data gets loaded back into memory.\n# This may happen when the system where the server is running\n# crashes, especially when an ext4 filesystem is mounted without the\n# data=ordered option (however this can't happen when the server itself\n# crashes or aborts but the operating system still works correctly).\n#\n# The server can either exit with an error when this happens, or load as much\n# data as possible (the default now) and start if the AOF file is found\n# to be truncated at the end. The following option controls this behavior.\n#\n# If aof-load-truncated is set to yes, a truncated AOF file is loaded and\n# the server starts emitting a log to inform the user of the event.\n# Otherwise if the option is set to no, the server aborts with an error\n# and refuses to start. When the option is set to no, the user requires\n# to fix the AOF file using the \"valkey-check-aof\" utility before to restart\n# the server.\n#\n# Note that if the AOF file will be found to be corrupted in the middle\n# the server will still exit with an error. This option only applies when\n# the server will try to read more data from the AOF file but not enough bytes\n# will be found.\naof-load-truncated yes\n\n# The server can create append-only base files in either RDB or AOF formats. Using\n# the RDB format is always faster and more efficient, and disabling it is only\n# supported for backward compatibility purposes.\naof-use-rdb-preamble yes\n\n# The server supports recording timestamp annotations in the AOF to support restoring\n# the data from a specific point-in-time. However, using this capability changes\n# the AOF format in a way that may not be compatible with existing AOF parsers.\naof-timestamp-enabled no\n\n################################ SHUTDOWN #####################################\n\n# Maximum time to wait for replicas when shutting down, in seconds.\n#\n# During shut down, a grace period allows any lagging replicas to catch up with\n# the latest replication offset before the master exits. This period can\n# prevent data loss, especially for deployments without configured disk backups.\n#\n# The 'shutdown-timeout' value is the grace period's duration in seconds. It is\n# only applicable when the instance has replicas. To disable the feature, set\n# the value to 0.\n#\n# shutdown-timeout 10\n\n# When the server receives a SIGINT or SIGTERM, shutdown is initiated and by default\n# an RDB snapshot is written to disk in a blocking operation if save points are configured.\n# The options used on signaled shutdown can include the following values:\n# default: Saves RDB snapshot only if save points are configured.\n# Waits for lagging replicas to catch up.\n# save: Forces a DB saving operation even if no save points are configured.\n# nosave: Prevents DB saving operation even if one or more save points are configured.\n# now: Skips waiting for lagging replicas.\n# force: Ignores any errors that would normally prevent the server from exiting.\n#\n# Any combination of values is allowed as long as \"save\" and \"nosave\" are not set simultaneously.\n# Example: \"nosave force now\"\n#\n# shutdown-on-sigint default\n# shutdown-on-sigterm default\n\n################ NON-DETERMINISTIC LONG BLOCKING COMMANDS #####################\n\n# Maximum time in milliseconds for EVAL scripts, functions and in some cases\n# modules' commands before the server can start processing or rejecting other clients.\n#\n# If the maximum execution time is reached the server will start to reply to most\n# commands with a BUSY error.\n#\n# In this state the server will only allow a handful of commands to be executed.\n# For instance, SCRIPT KILL, FUNCTION KILL, SHUTDOWN NOSAVE and possibly some\n# module specific 'allow-busy' commands.\n#\n# SCRIPT KILL and FUNCTION KILL will only be able to stop a script that did not\n# yet call any write commands, so SHUTDOWN NOSAVE may be the only way to stop\n# the server in the case a write command was already issued by the script when\n# the user doesn't want to wait for the natural termination of the script.\n#\n# The default is 5 seconds. It is possible to set it to 0 or a negative value\n# to disable this mechanism (uninterrupted execution). Note that in the past\n# this config had a different name, which is now an alias, so both of these do\n# the same:\n# lua-time-limit 5000\n# busy-reply-threshold 5000\n\n################################ VALKEY CLUSTER ###############################\n\n# Normal server instances can't be part of a cluster; only nodes that are\n# started as cluster nodes can. In order to start a server instance as a\n# cluster node enable the cluster support uncommenting the following:\n#\n# cluster-enabled yes\n\n# Every cluster node has a cluster configuration file. This file is not\n# intended to be edited by hand. It is created and updated by each node.\n# Every cluster node requires a different cluster configuration file.\n# Make sure that instances running in the same system do not have\n# overlapping cluster configuration file names.\n#\n# cluster-config-file nodes-6379.conf\n\n# Cluster node timeout is the amount of milliseconds a node must be unreachable\n# for it to be considered in failure state.\n# Most other internal time limits are a multiple of the node timeout.\n#\n# cluster-node-timeout 15000\n\n# The cluster port is the port that the cluster bus will listen for inbound connections on. When set\n# to the default value, 0, it will be bound to the command port + 10000. Setting this value requires\n# you to specify the cluster bus port when executing cluster meet.\n# cluster-port 0\n\n# A replica of a failing master will avoid to start a failover if its data\n# looks too old.\n#\n# There is no simple way for a replica to actually have an exact measure of\n# its \"data age\", so the following two checks are performed:\n#\n# 1) If there are multiple replicas able to failover, they exchange messages\n# in order to try to give an advantage to the replica with the best\n# replication offset (more data from the master processed).\n# Replicas will try to get their rank by offset, and apply to the start\n# of the failover a delay proportional to their rank.\n#\n# 2) Every single replica computes the time of the last interaction with\n# its master. This can be the last ping or command received (if the master\n# is still in the \"connected\" state), or the time that elapsed since the\n# disconnection with the master (if the replication link is currently down).\n# If the last interaction is too old, the replica will not try to failover\n# at all.\n#\n# The point \"2\" can be tuned by user. Specifically a replica will not perform\n# the failover if, since the last interaction with the master, the time\n# elapsed is greater than:\n#\n# (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period\n#\n# So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor\n# is 10, and assuming a default repl-ping-replica-period of 10 seconds, the\n# replica will not try to failover if it was not able to talk with the master\n# for longer than 310 seconds.\n#\n# A large cluster-replica-validity-factor may allow replicas with too old data to failover\n# a master, while a too small value may prevent the cluster from being able to\n# elect a replica at all.\n#\n# For maximum availability, it is possible to set the cluster-replica-validity-factor\n# to a value of 0, which means, that replicas will always try to failover the\n# master regardless of the last time they interacted with the master.\n# (However they'll always try to apply a delay proportional to their\n# offset rank).\n#\n# Zero is the only value able to guarantee that when all the partitions heal\n# the cluster will always be able to continue.\n#\n# cluster-replica-validity-factor 10\n\n# Cluster replicas are able to migrate to orphaned masters, that are masters\n# that are left without working replicas. This improves the cluster ability\n# to resist to failures as otherwise an orphaned master can't be failed over\n# in case of failure if it has no working replicas.\n#\n# Replicas migrate to orphaned masters only if there are still at least a\n# given number of other working replicas for their old master. This number\n# is the \"migration barrier\". A migration barrier of 1 means that a replica\n# will migrate only if there is at least 1 other working replica for its master\n# and so forth. It usually reflects the number of replicas you want for every\n# master in your cluster.\n#\n# Default is 1 (replicas migrate only if their masters remain with at least\n# one replica). To disable migration just set it to a very large value or\n# set cluster-allow-replica-migration to 'no'.\n# A value of 0 can be set but is useful only for debugging and dangerous\n# in production.\n#\n# cluster-migration-barrier 1\n\n# Turning off this option allows to use less automatic cluster configuration.\n# It both disables migration to orphaned masters and migration from masters\n# that became empty.\n#\n# Default is 'yes' (allow automatic migrations).\n#\n# cluster-allow-replica-migration yes\n\n# By default cluster nodes stop accepting queries if they detect there\n# is at least a hash slot uncovered (no available node is serving it).\n# This way if the cluster is partially down (for example a range of hash slots\n# are no longer covered) all the cluster becomes, eventually, unavailable.\n# It automatically returns available as soon as all the slots are covered again.\n#\n# However sometimes you want the subset of the cluster which is working,\n# to continue to accept queries for the part of the key space that is still\n# covered. In order to do so, just set the cluster-require-full-coverage\n# option to no.\n#\n# cluster-require-full-coverage yes\n\n# This option, when set to yes, prevents replicas from trying to failover its\n# master during master failures. However the replica can still perform a\n# manual failover, if forced to do so.\n#\n# This is useful in different scenarios, especially in the case of multiple\n# data center operations, where we want one side to never be promoted if not\n# in the case of a total DC failure.\n#\n# cluster-replica-no-failover no\n\n# This option, when set to yes, allows nodes to serve read traffic while the\n# cluster is in a down state, as long as it believes it owns the slots.\n#\n# This is useful for two cases. The first case is for when an application\n# doesn't require consistency of data during node failures or network partitions.\n# One example of this is a cache, where as long as the node has the data it\n# should be able to serve it.\n#\n# The second use case is for configurations that don't meet the recommended\n# three shards but want to enable cluster mode and scale later. A\n# master outage in a 1 or 2 shard configuration causes a read/write outage to the\n# entire cluster without this option set, with it set there is only a write outage.\n# Without a quorum of masters, slot ownership will not change automatically.\n#\n# cluster-allow-reads-when-down no\n\n# This option, when set to yes, allows nodes to serve pubsub shard traffic while\n# the cluster is in a down state, as long as it believes it owns the slots.\n#\n# This is useful if the application would like to use the pubsub feature even when\n# the cluster global stable state is not OK. If the application wants to make sure only\n# one shard is serving a given channel, this feature should be kept as yes.\n#\n# cluster-allow-pubsubshard-when-down yes\n\n# Cluster link send buffer limit is the limit on the memory usage of an individual\n# cluster bus link's send buffer in bytes. Cluster links would be freed if they exceed\n# this limit. This is to primarily prevent send buffers from growing unbounded on links\n# toward slow peers (E.g. PubSub messages being piled up).\n# This limit is disabled by default. Enable this limit when 'mem_cluster_links' INFO field\n# and/or 'send-buffer-allocated' entries in the 'CLUSTER LINKS` command output continuously increase.\n# Minimum limit of 1gb is recommended so that cluster link buffer can fit in at least a single\n# PubSub message by default. (client-query-buffer-limit default value is 1gb)\n#\n# cluster-link-sendbuf-limit 0\n\n# Clusters can configure their announced hostname using this config. This is a common use case for\n# applications that need to use TLS Server Name Indication (SNI) or dealing with DNS based\n# routing. By default this value is only shown as additional metadata in the CLUSTER SLOTS\n# command, but can be changed using 'cluster-preferred-endpoint-type' config. This value is\n# communicated along the clusterbus to all nodes, setting it to an empty string will remove\n# the hostname and also propagate the removal.\n#\n# cluster-announce-hostname \"\"\n\n# Clusters can configure an optional nodename to be used in addition to the node ID for\n# debugging and admin information. This name is broadcasted between nodes, so will be used\n# in addition to the node ID when reporting cross node events such as node failures.\n# cluster-announce-human-nodename \"\"\n\n# Clusters can advertise how clients should connect to them using either their IP address,\n# a user defined hostname, or by declaring they have no endpoint. Which endpoint is\n# shown as the preferred endpoint is set by using the cluster-preferred-endpoint-type\n# config with values 'ip', 'hostname', or 'unknown-endpoint'. This value controls how\n# the endpoint returned for MOVED/ASKING requests as well as the first field of CLUSTER SLOTS.\n# If the preferred endpoint type is set to hostname, but no announced hostname is set, a '?'\n# will be returned instead.\n#\n# When a cluster advertises itself as having an unknown endpoint, it's indicating that\n# the server doesn't know how clients can reach the cluster. This can happen in certain\n# networking situations where there are multiple possible routes to the node, and the\n# server doesn't know which one the client took. In this case, the server is expecting\n# the client to reach out on the same endpoint it used for making the last request, but use\n# the port provided in the response.\n#\n# cluster-preferred-endpoint-type ip\n\n# In order to setup your cluster make sure to read the documentation\n# available at https://valkey.io web site.\n\n########################## CLUSTER DOCKER/NAT support ########################\n\n# In certain deployments, cluster node's address discovery fails, because\n# addresses are NAT-ted or because ports are forwarded (the typical case is\n# Docker and other containers).\n#\n# In order to make a cluster work in such environments, a static\n# configuration where each node knows its public address is needed. The\n# following four options are used for this scope, and are:\n#\n# * cluster-announce-ip\n# * cluster-announce-port\n# * cluster-announce-tls-port\n# * cluster-announce-bus-port\n#\n# Each instructs the node about its address, client ports (for connections\n# without and with TLS) and cluster message bus port. The information is then\n# published in the header of the bus packets so that other nodes will be able to\n# correctly map the address of the node publishing the information.\n#\n# If tls-cluster is set to yes and cluster-announce-tls-port is omitted or set\n# to zero, then cluster-announce-port refers to the TLS port. Note also that\n# cluster-announce-tls-port has no effect if tls-cluster is set to no.\n#\n# If the above options are not used, the normal cluster auto-detection\n# will be used instead.\n#\n# Note that when remapped, the bus port may not be at the fixed offset of\n# clients port + 10000, so you can specify any port and bus-port depending\n# on how they get remapped. If the bus-port is not set, a fixed offset of\n# 10000 will be used as usual.\n#\n# Example:\n#\n# cluster-announce-ip 10.1.1.5\n# cluster-announce-tls-port 6379\n# cluster-announce-port 0\n# cluster-announce-bus-port 6380\n\n################################## SLOW LOG ###################################\n\n# The server Slow Log is a system to log queries that exceeded a specified\n# execution time. The execution time does not include the I/O operations\n# like talking with the client, sending the reply and so forth,\n# but just the time needed to actually execute the command (this is the only\n# stage of command execution where the thread is blocked and can not serve\n# other requests in the meantime).\n#\n# You can configure the slow log with two parameters: one tells the server\n# what is the execution time, in microseconds, to exceed in order for the\n# command to get logged, and the other parameter is the length of the\n# slow log. When a new command is logged the oldest one is removed from the\n# queue of logged commands.\n\n# The following time is expressed in microseconds, so 1000000 is equivalent\n# to one second. Note that a negative number disables the slow log, while\n# a value of zero forces the logging of every command.\nslowlog-log-slower-than 10000\n\n# There is no limit to this length. Just be aware that it will consume memory.\n# You can reclaim memory used by the slow log with SLOWLOG RESET.\nslowlog-max-len 128\n\n################################ LATENCY MONITOR ##############################\n\n# The server latency monitoring subsystem samples different operations\n# at runtime in order to collect data related to possible sources of\n# latency of a server instance.\n#\n# Via the LATENCY command this information is available to the user that can\n# print graphs and obtain reports.\n#\n# The system only logs operations that were performed in a time equal or\n# greater than the amount of milliseconds specified via the\n# latency-monitor-threshold configuration directive. When its value is set\n# to zero, the latency monitor is turned off.\n#\n# By default latency monitoring is disabled since it is mostly not needed\n# if you don't have latency issues, and collecting data has a performance\n# impact, that while very small, can be measured under big load. Latency\n# monitoring can easily be enabled at runtime using the command\n# \"CONFIG SET latency-monitor-threshold \" if needed.\nlatency-monitor-threshold 0\n\n################################ LATENCY TRACKING ##############################\n\n# The server's extended latency monitoring tracks the per command latencies and enables\n# exporting the percentile distribution via the INFO latencystats command,\n# and cumulative latency distributions (histograms) via the LATENCY command.\n#\n# By default, the extended latency monitoring is enabled since the overhead\n# of keeping track of the command latency is very small.\n# latency-tracking yes\n\n# By default the exported latency percentiles via the INFO latencystats command\n# are the p50, p99, and p999.\n# latency-tracking-info-percentiles 50 99 99.9\n\n############################# EVENT NOTIFICATION ##############################\n\n# The server can notify Pub/Sub clients about events happening in the key space.\n# This feature is documented at https://valkey.io/topics/notifications\n#\n# For instance if keyspace events notification is enabled, and a client\n# performs a DEL operation on key \"foo\" stored in the Database 0, two\n# messages will be published via Pub/Sub:\n#\n# PUBLISH __keyspace@0__:foo del\n# PUBLISH __keyevent@0__:del foo\n#\n# It is possible to select the events that the server will notify among a set\n# of classes. Every class is identified by a single character:\n#\n# K Keyspace events, published with __keyspace@__ prefix.\n# E Keyevent events, published with __keyevent@__ prefix.\n# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ...\n# $ String commands\n# l List commands\n# s Set commands\n# h Hash commands\n# z Sorted set commands\n# x Expired events (events generated every time a key expires)\n# e Evicted events (events generated when a key is evicted for maxmemory)\n# n New key events (Note: not included in the 'A' class)\n# t Stream commands\n# d Module key type events\n# m Key-miss events (Note: It is not included in the 'A' class)\n# A Alias for g$lshzxetd, so that the \"AKE\" string means all the events\n# (Except key-miss events which are excluded from 'A' due to their\n# unique nature).\n#\n# The \"notify-keyspace-events\" takes as argument a string that is composed\n# of zero or multiple characters. The empty string means that notifications\n# are disabled.\n#\n# Example: to enable list and generic events, from the point of view of the\n# event name, use:\n#\n# notify-keyspace-events Elg\n#\n# Example 2: to get the stream of the expired keys subscribing to channel\n# name __keyevent@0__:expired use:\n#\n# notify-keyspace-events Ex\n#\n# By default all notifications are disabled because most users don't need\n# this feature and the feature has some overhead. Note that if you don't\n# specify at least one of K or E, no events will be delivered.\nnotify-keyspace-events \"\"\n\n############################### ADVANCED CONFIG ###############################\n\n# Hashes are encoded using a memory efficient data structure when they have a\n# small number of entries, and the biggest entry does not exceed a given\n# threshold. These thresholds can be configured using the following directives.\nhash-max-listpack-entries 512\nhash-max-listpack-value 64\n\n# Lists are also encoded in a special way to save a lot of space.\n# The number of entries allowed per internal list node can be specified\n# as a fixed maximum size or a maximum number of elements.\n# For a fixed maximum size, use -5 through -1, meaning:\n# -5: max size: 64 Kb <-- not recommended for normal workloads\n# -4: max size: 32 Kb <-- not recommended\n# -3: max size: 16 Kb <-- probably not recommended\n# -2: max size: 8 Kb <-- good\n# -1: max size: 4 Kb <-- good\n# Positive numbers mean store up to _exactly_ that number of elements\n# per list node.\n# The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size),\n# but if your use case is unique, adjust the settings as necessary.\nlist-max-listpack-size -2\n\n# Lists may also be compressed.\n# Compress depth is the number of quicklist ziplist nodes from *each* side of\n# the list to *exclude* from compression. The head and tail of the list\n# are always uncompressed for fast push/pop operations. Settings are:\n# 0: disable all list compression\n# 1: depth 1 means \"don't start compressing until after 1 node into the list,\n# going from either the head or tail\"\n# So: [head]->node->node->...->node->[tail]\n# [head], [tail] will always be uncompressed; inner nodes will compress.\n# 2: [head]->[next]->node->node->...->node->[prev]->[tail]\n# 2 here means: don't compress head or head->next or tail->prev or tail,\n# but compress all nodes between them.\n# 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail]\n# etc.\nlist-compress-depth 0\n\n# Sets have a special encoding when a set is composed\n# of just strings that happen to be integers in radix 10 in the range\n# of 64 bit signed integers.\n# The following configuration setting sets the limit in the size of the\n# set in order to use this special memory saving encoding.\nset-max-intset-entries 512\n\n# Sets containing non-integer values are also encoded using a memory efficient\n# data structure when they have a small number of entries, and the biggest entry\n# does not exceed a given threshold. These thresholds can be configured using\n# the following directives.\nset-max-listpack-entries 128\nset-max-listpack-value 64\n\n# Similarly to hashes and lists, sorted sets are also specially encoded in\n# order to save a lot of space. This encoding is only used when the length and\n# elements of a sorted set are below the following limits:\nzset-max-listpack-entries 128\nzset-max-listpack-value 64\n\n# HyperLogLog sparse representation bytes limit. The limit includes the\n# 16 bytes header. When a HyperLogLog using the sparse representation crosses\n# this limit, it is converted into the dense representation.\n#\n# A value greater than 16000 is totally useless, since at that point the\n# dense representation is more memory efficient.\n#\n# The suggested value is ~ 3000 in order to have the benefits of\n# the space efficient encoding without slowing down too much PFADD,\n# which is O(N) with the sparse encoding. The value can be raised to\n# ~ 10000 when CPU is not a concern, but space is, and the data set is\n# composed of many HyperLogLogs with cardinality in the 0 - 15000 range.\nhll-sparse-max-bytes 3000\n\n# Streams macro node max size / items. The stream data structure is a radix\n# tree of big nodes that encode multiple items inside. Using this configuration\n# it is possible to configure how big a single node can be in bytes, and the\n# maximum number of items it may contain before switching to a new node when\n# appending new stream entries. If any of the following settings are set to\n# zero, the limit is ignored, so for instance it is possible to set just a\n# max entries limit by setting max-bytes to 0 and max-entries to the desired\n# value.\nstream-node-max-bytes 4096\nstream-node-max-entries 100\n\n# Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in\n# order to help rehashing the main server hash table (the one mapping top-level\n# keys to values). The hash table implementation the server uses (see dict.c)\n# performs a lazy rehashing: the more operation you run into a hash table\n# that is rehashing, the more rehashing \"steps\" are performed, so if the\n# server is idle the rehashing is never complete and some more memory is used\n# by the hash table.\n#\n# The default is to use this millisecond 10 times every second in order to\n# actively rehash the main dictionaries, freeing memory when possible.\n#\n# If unsure:\n# use \"activerehashing no\" if you have hard latency requirements and it is\n# not a good thing in your environment that the server can reply from time to time\n# to queries with 2 milliseconds delay.\n#\n# use \"activerehashing yes\" if you don't have such hard requirements but\n# want to free memory asap when possible.\nactiverehashing yes\n\n# The client output buffer limits can be used to force disconnection of clients\n# that are not reading data from the server fast enough for some reason (a\n# common reason is that a Pub/Sub client can't consume messages as fast as the\n# publisher can produce them).\n#\n# The limit can be set differently for the three different classes of clients:\n#\n# normal -> normal clients including MONITOR clients\n# replica -> replica clients\n# pubsub -> clients subscribed to at least one pubsub channel or pattern\n#\n# The syntax of every client-output-buffer-limit directive is the following:\n#\n# client-output-buffer-limit \n#\n# A client is immediately disconnected once the hard limit is reached, or if\n# the soft limit is reached and remains reached for the specified number of\n# seconds (continuously).\n# So for instance if the hard limit is 32 megabytes and the soft limit is\n# 16 megabytes / 10 seconds, the client will get disconnected immediately\n# if the size of the output buffers reach 32 megabytes, but will also get\n# disconnected if the client reaches 16 megabytes and continuously overcomes\n# the limit for 10 seconds.\n#\n# By default normal clients are not limited because they don't receive data\n# without asking (in a push way), but just after a request, so only\n# asynchronous clients may create a scenario where data is requested faster\n# than it can read.\n#\n# Instead there is a default limit for pubsub and replica clients, since\n# subscribers and replicas receive data in a push fashion.\n#\n# Note that it doesn't make sense to set the replica clients output buffer\n# limit lower than the repl-backlog-size config (partial sync will succeed\n# and then replica will get disconnected).\n# Such a configuration is ignored (the size of repl-backlog-size will be used).\n# This doesn't have memory consumption implications since the replica client\n# will share the backlog buffers memory.\n#\n# Both the hard or the soft limit can be disabled by setting them to zero.\nclient-output-buffer-limit normal 0 0 0\nclient-output-buffer-limit replica 256mb 64mb 60\nclient-output-buffer-limit pubsub 32mb 8mb 60\n\n# Client query buffers accumulate new commands. They are limited to a fixed\n# amount by default in order to avoid that a protocol desynchronization (for\n# instance due to a bug in the client) will lead to unbound memory usage in\n# the query buffer. However you can configure it here if you have very special\n# needs, such us huge multi/exec requests or alike.\n#\n# client-query-buffer-limit 1gb\n\n# In some scenarios client connections can hog up memory leading to OOM\n# errors or data eviction. To avoid this we can cap the accumulated memory\n# used by all client connections (all pubsub and normal clients). Once we\n# reach that limit connections will be dropped by the server freeing up\n# memory. The server will attempt to drop the connections using the most\n# memory first. We call this mechanism \"client eviction\".\n#\n# Client eviction is configured using the maxmemory-clients setting as follows:\n# 0 - client eviction is disabled (default)\n#\n# A memory value can be used for the client eviction threshold,\n# for example:\n# maxmemory-clients 1g\n#\n# A percentage value (between 1% and 100%) means the client eviction threshold\n# is based on a percentage of the maxmemory setting. For example to set client\n# eviction at 5% of maxmemory:\n# maxmemory-clients 5%\n\n# In the server protocol, bulk requests, that are, elements representing single\n# strings, are normally limited to 512 mb. However you can change this limit\n# here, but must be 1mb or greater\n#\n# proto-max-bulk-len 512mb\n\n# The server calls an internal function to perform many background tasks, like\n# closing connections of clients in timeout, purging expired keys that are\n# never requested, and so forth.\n#\n# Not all tasks are performed with the same frequency, but the server checks for\n# tasks to perform according to the specified \"hz\" value.\n#\n# By default \"hz\" is set to 10. Raising the value will use more CPU when\n# the server is idle, but at the same time will make the server more responsive when\n# there are many keys expiring at the same time, and timeouts may be\n# handled with more precision.\n#\n# The range is between 1 and 500, however a value over 100 is usually not\n# a good idea. Most users should use the default of 10 and raise this up to\n# 100 only in environments where very low latency is required.\nhz 10\n\n# Normally it is useful to have an HZ value which is proportional to the\n# number of clients connected. This is useful in order, for instance, to\n# avoid too many clients are processed for each background task invocation\n# in order to avoid latency spikes.\n#\n# Since the default HZ value by default is conservatively set to 10, the server\n# offers, and enables by default, the ability to use an adaptive HZ value\n# which will temporarily raise when there are many connected clients.\n#\n# When dynamic HZ is enabled, the actual configured HZ will be used\n# as a baseline, but multiples of the configured HZ value will be actually\n# used as needed once more clients are connected. In this way an idle\n# instance will use very little CPU time while a busy instance will be\n# more responsive.\ndynamic-hz yes\n\n# When a child rewrites the AOF file, if the following option is enabled\n# the file will be fsync-ed every 4 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\naof-rewrite-incremental-fsync yes\n\n# When the server saves RDB file, if the following option is enabled\n# the file will be fsync-ed every 4 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\nrdb-save-incremental-fsync yes\n\n# The server's LFU eviction (see maxmemory setting) can be tuned. However it is a good\n# idea to start with the default settings and only change them after investigating\n# how to improve the performances and how the keys LFU change over time, which\n# is possible to inspect via the OBJECT FREQ command.\n#\n# There are two tunable parameters in the server LFU implementation: the\n# counter logarithm factor and the counter decay time. It is important to\n# understand what the two parameters mean before changing them.\n#\n# The LFU counter is just 8 bits per key, it's maximum value is 255, so the server\n# uses a probabilistic increment with logarithmic behavior. Given the value\n# of the old counter, when a key is accessed, the counter is incremented in\n# this way:\n#\n# 1. A random number R between 0 and 1 is extracted.\n# 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1).\n# 3. The counter is incremented only if R < P.\n#\n# The default lfu-log-factor is 10. This is a table of how the frequency\n# counter changes with a different number of accesses with different\n# logarithmic factors:\n#\n# +--------+------------+------------+------------+------------+------------+\n# | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits |\n# +--------+------------+------------+------------+------------+------------+\n# | 0 | 104 | 255 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 1 | 18 | 49 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 10 | 10 | 18 | 142 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 100 | 8 | 11 | 49 | 143 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n#\n# NOTE: The above table was obtained by running the following commands:\n#\n# valkey-benchmark -n 1000000 incr foo\n# valkey-cli object freq foo\n#\n# NOTE 2: The counter initial value is 5 in order to give new objects a chance\n# to accumulate hits.\n#\n# The counter decay time is the time, in minutes, that must elapse in order\n# for the key counter to be decremented.\n#\n# The default value for the lfu-decay-time is 1. A special value of 0 means we\n# will never decay the counter.\n#\n# lfu-log-factor 10\n# lfu-decay-time 1\n\n########################### ACTIVE DEFRAGMENTATION #######################\n#\n# What is active defragmentation?\n# -------------------------------\n#\n# Active (online) defragmentation allows a server to compact the\n# spaces left between small allocations and deallocations of data in memory,\n# thus allowing to reclaim back memory.\n#\n# Fragmentation is a natural process that happens with every allocator (but\n# less so with Jemalloc, fortunately) and certain workloads. Normally a server\n# restart is needed in order to lower the fragmentation, or at least to flush\n# away all the data and create it again. However thanks to this feature\n# implemented by Oran Agra, this process can happen at runtime\n# in a \"hot\" way, while the server is running.\n#\n# Basically when the fragmentation is over a certain level (see the\n# configuration options below) the server will start to create new copies of the\n# values in contiguous memory regions by exploiting certain specific Jemalloc\n# features (in order to understand if an allocation is causing fragmentation\n# and to allocate it in a better place), and at the same time, will release the\n# old copies of the data. This process, repeated incrementally for all the keys\n# will cause the fragmentation to drop back to normal values.\n#\n# Important things to understand:\n#\n# 1. This feature is disabled by default, and only works if you compiled the server\n# to use the copy of Jemalloc we ship with the source code of the server.\n# This is the default with Linux builds.\n#\n# 2. You never need to enable this feature if you don't have fragmentation\n# issues.\n#\n# 3. Once you experience fragmentation, you can enable this feature when\n# needed with the command \"CONFIG SET activedefrag yes\".\n#\n# The configuration parameters are able to fine tune the behavior of the\n# defragmentation process. If you are not sure about what they mean it is\n# a good idea to leave the defaults untouched.\n\n# Active defragmentation is disabled by default\n# activedefrag no\n\n# Minimum amount of fragmentation waste to start active defrag\n# active-defrag-ignore-bytes 100mb\n\n# Minimum percentage of fragmentation to start active defrag\n# active-defrag-threshold-lower 10\n\n# Maximum percentage of fragmentation at which we use maximum effort\n# active-defrag-threshold-upper 100\n\n# Minimal effort for defrag in CPU percentage, to be used when the lower\n# threshold is reached\n# active-defrag-cycle-min 1\n\n# Maximal effort for defrag in CPU percentage, to be used when the upper\n# threshold is reached\n# active-defrag-cycle-max 25\n\n# Maximum number of set/hash/zset/list fields that will be processed from\n# the main dictionary scan\n# active-defrag-max-scan-fields 1000\n\n# Jemalloc background thread for purging will be enabled by default\njemalloc-bg-thread yes\n\n# It is possible to pin different threads and processes of the server to specific\n# CPUs in your system, in order to maximize the performances of the server.\n# This is useful both in order to pin different server threads in different\n# CPUs, but also in order to make sure that multiple server instances running\n# in the same host will be pinned to different CPUs.\n#\n# Normally you can do this using the \"taskset\" command, however it is also\n# possible to do this via the server configuration directly, both in Linux and FreeBSD.\n#\n# You can pin the server/IO threads, bio threads, aof rewrite child process, and\n# the bgsave child process. The syntax to specify the cpu list is the same as\n# the taskset command:\n#\n# Set redis server/io threads to cpu affinity 0,2,4,6:\n# server_cpulist 0-7:2\n#\n# Set bio threads to cpu affinity 1,3:\n# bio_cpulist 1,3\n#\n# Set aof rewrite child process to cpu affinity 8,9,10,11:\n# aof_rewrite_cpulist 8-11\n#\n# Set bgsave child process to cpu affinity 1,10,11\n# bgsave_cpulist 1,10-11\n\n# In some cases the server will emit warnings and even refuse to start if it detects\n# that the system is in bad state, it is possible to suppress these warnings\n# by setting the following config which takes a space delimited list of warnings\n# to suppress\n#\n# ignore-warnings ARM64-COW-BUG\n" }, { "path": "aegir/conf/valkey/valkey8.conf", "content": "# Valkey configuration file example.\n#\n# Note that in order to read the configuration file, the server must be\n# started with the file path as first argument:\n#\n# ./valkey-server /path/to/valkey.conf\n\n# Note on units: when memory size is needed, it is possible to specify\n# it in the usual form of 1k 5GB 4M and so forth:\n#\n# 1k => 1000 bytes\n# 1kb => 1024 bytes\n# 1m => 1000000 bytes\n# 1mb => 1024*1024 bytes\n# 1g => 1000000000 bytes\n# 1gb => 1024*1024*1024 bytes\n#\n# units are case insensitive so 1GB 1Gb 1gB are all the same.\n\n################################## INCLUDES ###################################\n\n# Include one or more other config files here. This is useful if you\n# have a standard template that goes to all servers but also need\n# to customize a few per-server settings. Include files can include\n# other files, so use this wisely.\n#\n# Note that option \"include\" won't be rewritten by command \"CONFIG REWRITE\"\n# from admin or Sentinel. Since the server always uses the last processed\n# line as value of a configuration directive, you'd better put includes\n# at the beginning of this file to avoid overwriting config change at runtime.\n#\n# If instead you are interested in using includes to override configuration\n# options, it is better to use include as the last line.\n#\n# Included paths may contain wildcards. All files matching the wildcards will\n# be included in alphabetical order.\n# Note that if an include path contains a wildcards but no files match it when\n# the server is started, the include statement will be ignored and no error will\n# be emitted. It is safe, therefore, to include wildcard files from empty\n# directories.\n#\n# include /path/to/local.conf\n# include /path/to/other.conf\n# include /path/to/fragments/*.conf\n#\n\n################################## MODULES #####################################\n\n# Load modules at startup. If the server is not able to load modules\n# it will abort. It is possible to use multiple loadmodule directives.\n#\n# loadmodule /path/to/my_module.so\n# loadmodule /path/to/other_module.so\n# loadmodule /path/to/args_module.so [arg [arg ...]]\n\n################################## NETWORK #####################################\n\n# By default, if no \"bind\" configuration directive is specified, the server listens\n# for connections from all available network interfaces on the host machine.\n# It is possible to listen to just one or multiple selected interfaces using\n# the \"bind\" configuration directive, followed by one or more IP addresses.\n# Each address can be prefixed by \"-\", which means that the server will not fail to\n# start if the address is not available. Being not available only refers to\n# addresses that does not correspond to any network interface. Addresses that\n# are already in use will always fail, and unsupported protocols will always be\n# silently skipped.\n#\n# Examples:\n#\n# xbind 192.168.1.100 10.0.0.1 # listens on two specific IPv4 addresses\n# xbind 127.0.0.1 ::1 # listens on loopback IPv4 and IPv6\n# xbind * -::* # like the default, all available interfaces\n#\n# ~~~ WARNING ~~~ If the computer running the server is directly exposed to the\n# internet, binding to all the interfaces is dangerous and will expose the\n# instance to everybody on the internet. So by default we uncomment the\n# following bind directive, that will force the server to listen only on the\n# IPv4 and IPv6 (if available) loopback interface addresses (this means the server\n# will only be able to accept client connections from the same host that it is\n# running on).\n#\n# IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES\n# COMMENT OUT THE FOLLOWING LINE.\n#\n# You will also need to set a password unless you explicitly disable protected\n# mode.\n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nbind 127.0.0.1\n\n# By default, outgoing connections (from replica to primary, from Sentinel to\n# instances, cluster bus, etc.) are not bound to a specific local address. In\n# most cases, this means the operating system will handle that based on routing\n# and the interface through which the connection goes out.\n#\n# Using bind-source-addr it is possible to configure a specific address to bind\n# to, which may also affect how the connection gets routed.\n#\n# Example:\n#\n# bind-source-addr 10.0.0.1\n\n# Protected mode is a layer of security protection, in order to avoid that\n# the server instances left open on the internet are accessed and exploited.\n#\n# When protected mode is on and the default user has no password, the server\n# only accepts local connections from the IPv4 address (127.0.0.1), IPv6 address\n# (::1) or Unix domain sockets.\n#\n# By default protected mode is enabled. You should disable it only if\n# you are sure you want clients from other hosts to connect to the server\n# even if no authentication is configured.\nprotected-mode yes\n\n# The server uses default hardened security configuration directives to reduce the\n# attack surface on innocent users. Therefore, several sensitive configuration\n# directives are immutable, and some potentially-dangerous commands are blocked.\n#\n# Configuration directives that control files that the server writes to (e.g., 'dir'\n# and 'dbfilename') and that aren't usually modified during runtime\n# are protected by making them immutable.\n#\n# Commands that can increase the attack surface of the server and that aren't usually\n# called by users are blocked by default.\n#\n# These can be exposed to either all connections or just local ones by setting\n# each of the configs listed below to either of these values:\n#\n# no - Block for any connection (remain immutable)\n# yes - Allow for any connection (no protection)\n# local - Allow only for local connections. Ones originating from the\n# IPv4 address (127.0.0.1), IPv6 address (::1) or Unix domain sockets.\n#\n# enable-protected-configs no\n# enable-debug-command no\n# enable-module-command no\n\n# Accept connections on the specified port, default is 6379 (IANA #815344).\n# If port 0 is specified the server will not listen on a TCP socket.\nport 6379\n\n# TCP listen() backlog.\n#\n# In high requests-per-second environments you need a high backlog in order\n# to avoid slow clients connection issues. Note that the Linux kernel\n# will silently truncate it to the value of /proc/sys/net/core/somaxconn so\n# make sure to raise both the value of somaxconn and tcp_max_syn_backlog\n# in order to get the desired effect.\ntcp-backlog 511\n\n# Unix socket.\n#\n# Specify the path for the Unix socket that will be used to listen for\n# incoming connections. There is no default, so the server will not listen\n# on a unix socket when not specified.\n#\n# unixsocket /run/valkey/valkey.sock\n# unixsocketgroup valkey\n# unixsocketperm 777\n\n# Close the connection after a client is idle for N seconds (0 to disable)\ntimeout 900\n\n# TCP keepalive.\n#\n# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence\n# of communication. This is useful for two reasons:\n#\n# 1) Detect dead peers.\n# 2) Force network equipment in the middle to consider the connection to be\n# alive.\n#\n# On Linux, the specified value (in seconds) is the period used to send ACKs.\n# Note that to close the connection the double of the time is needed.\n# On other kernels the period depends on the kernel configuration.\ntcp-keepalive 300\n\n# Apply OS-specific mechanism to mark the listening socket with the specified\n# ID, to support advanced routing and filtering capabilities.\n#\n# On Linux, the ID represents a connection mark.\n# On FreeBSD, the ID represents a socket cookie ID.\n# On OpenBSD, the ID represents a route table ID.\n#\n# The default value is 0, which implies no marking is required.\n# socket-mark-id 0\n\n################################# TLS/SSL #####################################\n\n# By default, TLS/SSL is disabled. To enable it, the \"tls-port\" configuration\n# directive can be used to define TLS-listening ports. To enable TLS on the\n# default port, use:\n#\n# port 0\n# tls-port 6379\n\n# Configure a X.509 certificate and private key to use for authenticating the\n# server to connected clients, primaries or cluster peers. These files should be\n# PEM formatted.\n#\n# tls-cert-file valkey.crt\n# tls-key-file valkey.key\n#\n# If the key file is encrypted using a passphrase, it can be included here\n# as well.\n#\n# tls-key-file-pass secret\n\n# Normally the server uses the same certificate for both server functions (accepting\n# connections) and client functions (replicating from a primary, establishing\n# cluster bus connections, etc.).\n#\n# Sometimes certificates are issued with attributes that designate them as\n# client-only or server-only certificates. In that case it may be desired to use\n# different certificates for incoming (server) and outgoing (client)\n# connections. To do that, use the following directives:\n#\n# tls-client-cert-file client.crt\n# tls-client-key-file client.key\n#\n# If the key file is encrypted using a passphrase, it can be included here\n# as well.\n#\n# tls-client-key-file-pass secret\n\n# Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange,\n# required by older versions of OpenSSL (<3.0). Newer versions do not require\n# this configuration and recommend against it.\n#\n# tls-dh-params-file valkey.dh\n\n# Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL\n# clients and peers. The server requires an explicit configuration of at least one\n# of these, and will not implicitly use the system wide configuration.\n#\n# tls-ca-cert-file ca.crt\n# tls-ca-cert-dir /etc/ssl/certs\n\n# By default, clients (including replica servers) on a TLS port are required\n# to authenticate using valid client side certificates.\n#\n# If \"no\" is specified, client certificates are not required and not accepted.\n# If \"optional\" is specified, client certificates are accepted and must be\n# valid if provided, but are not required.\n#\n# tls-auth-clients no\n# tls-auth-clients optional\n\n# By default, a replica does not attempt to establish a TLS connection\n# with its primary.\n#\n# Use the following directive to enable TLS on replication links.\n#\n# tls-replication yes\n\n# By default, the cluster bus uses a plain TCP connection. To enable\n# TLS for the bus protocol, use the following directive:\n#\n# tls-cluster yes\n\n# By default, only TLSv1.2 and TLSv1.3 are enabled and it is highly recommended\n# that older formally deprecated versions are kept disabled to reduce the attack surface.\n# You can explicitly specify TLS versions to support.\n# Allowed values are case insensitive and include \"TLSv1\", \"TLSv1.1\", \"TLSv1.2\",\n# \"TLSv1.3\" (OpenSSL >= 1.1.1) or any combination.\n# To enable only TLSv1.2 and TLSv1.3, use:\n#\n# tls-protocols \"TLSv1.2 TLSv1.3\"\n\n# Configure allowed ciphers. See the ciphers(1ssl) manpage for more information\n# about the syntax of this string.\n#\n# Note: this configuration applies only to <= TLSv1.2.\n#\n# tls-ciphers DEFAULT:!MEDIUM\n\n# Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more\n# information about the syntax of this string, and specifically for TLSv1.3\n# ciphersuites.\n#\n# tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256\n\n# When choosing a cipher, use the server's preference instead of the client\n# preference. By default, the server follows the client's preference.\n#\n# tls-prefer-server-ciphers yes\n\n# By default, TLS session caching is enabled to allow faster and less expensive\n# reconnections by clients that support it. Use the following directive to disable\n# caching.\n#\n# tls-session-caching no\n\n# Change the default number of TLS sessions cached. A zero value sets the cache\n# to unlimited size. The default size is 20480.\n#\n# tls-session-cache-size 5000\n\n# Change the default timeout of cached TLS sessions. The default timeout is 300\n# seconds.\n#\n# tls-session-cache-timeout 60\n\n################################### RDMA ######################################\n\n# Valkey Over RDMA is experimental, it may be changed or be removed in any minor or major version.\n# By default, RDMA is disabled. To enable it, the \"rdma-port\" configuration\n# directive can be used to define RDMA-listening ports.\n#\n# rdma-port 6379\n# rdma-bind 192.168.1.100\n\n# The RDMA receive transfer buffer is 1M by default. It can be set between 64K and 16M.\n# Note that page size aligned size is preferred.\n#\n# rdma-rx-size 1048576\n\n# The RDMA completion queue will use the completion vector to signal completion events\n# via hardware interrupts. A large number of hardware interrupts can affect CPU performance.\n# It is possible to tune the performance using rdma-completion-vector.\n#\n# Example 1. a) Pin hardware interrupt vectors [0, 3] to CPU [0, 3].\n# b) Set CPU affinity for valkey to CPU [4, X].\n# c) Any valkey server uses a random RDMA completion vector [-1].\n# All valkey servers will not affect each other and will be isolated from kernel interrupts.\n#\n# SYS SYS SYS SYS VALKEY VALKEY VALKEY\n# | | | | | | |\n# CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 ... CPUX\n# | | | |\n# INTR0 INTR1 INTR2 INTR3\n#\n# Example 2. a) 1:1 pin hardware interrupt vectors [0, X] to CPU [0, X].\n# b) Set CPU affinity for valkey [M] to CPU [M].\n# c) Valkey server [M] uses RDMA completion vector [M].\n# A single CPU [M] handles hardware interrupts, the RDMA completion vector [M],\n# and the valkey server [M] within its context only.\n# This avoids overhead and function calls across multiple CPUs, fully isolating\n# each valkey server from one another.\n#\n# VALKEY VALKEY VALKEY VALKEY VALKEY VALKEY VALKEY\n# | | | | | | |\n# CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 ... CPUX\n# | | | | | | |\n# INTR0 INTR1 INTR2 INTR3 INTR4 INTR5 INTRX\n#\n# Use 0 and positive numbers to specify the RDMA completion vector, or specify -1 to allow\n# the server to use a random vector for a new connection. The default vector is -1.\n#\n# rdma-completion-vector 0\n\n################################# GENERAL #####################################\n\n# By default the server does not run as a daemon. Use 'yes' if you need it.\n# Note that the server will write a pid file in /run/valkey/valkey.pid when daemonized.\n# When the server is supervised by upstart or systemd, this parameter has no impact.\ndaemonize yes\n\n# If you run the server from upstart or systemd, the server can interact with your\n# supervision tree. Options:\n# supervised no - no supervision interaction\n# supervised upstart - signal upstart by putting the server into SIGSTOP mode\n# requires \"expect stop\" in your upstart job config\n# supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET\n# on startup, and updating the server status on a regular\n# basis.\n# supervised auto - detect upstart or systemd method based on\n# UPSTART_JOB or NOTIFY_SOCKET environment variables\n# Note: these supervision methods only signal \"process is ready.\"\n# They do not enable continuous pings back to your supervisor.\n#\n# The default is \"no\". To run under upstart/systemd, you can simply uncomment\n# the line below:\n#\n# supervised auto\n\n# If a pid file is specified, the server writes it where specified at startup\n# and removes it at exit.\n#\n# When the server runs non daemonized, no pid file is created if none is\n# specified in the configuration. When the server is daemonized, the pid file\n# is used even if not specified, defaulting to \"/run/valkey/valkey.pid\".\n#\n# Creating a pid file is best effort: if the server is not able to create it\n# nothing bad happens, the server will start and run normally.\n#\n# Note that on modern Linux systems \"/run/valkey/valkey.pid\" is more conforming\n# and should be used instead.\npidfile /run/valkey/valkey.pid\n\n# Specify the server verbosity level.\n# This can be one of:\n# debug (a lot of information, useful for development/testing)\n# verbose (many rarely useful info, but not a mess like the debug level)\n# notice (moderately verbose, what you want in production probably)\n# warning (only very important / critical messages are logged)\n# nothing (nothing is logged)\nloglevel warning\n\n# Specify the logging format.\n# This can be one of:\n#\n# - legacy: the default, traditional log format\n# - logfmt: a structured log format; see https://www.brandur.org/logfmt\n#\n# log-format legacy\n\n# Specify the timestamp format used in logs using 'log-timestamp-format'.\n#\n# - legacy: default format\n# - iso8601: ISO 8601 extended date and time with time zone, on the form\n# yyyy-mm-ddThh:mm:ss.sss±hh:mm\n# - milliseconds: milliseconds since the epoch\n#\n# log-timestamp-format legacy\n\n# Specify the log file name. Also the empty string can be used to force\n# the server to log on the standard output. Note that if you use standard\n# output for logging but daemonize, logs will be sent to /dev/null\nlogfile /var/log/valkey/valkey-server.log\n\n# To enable logging to the system logger, just set 'syslog-enabled' to yes,\n# and optionally update the other syslog parameters to suit your needs.\n# syslog-enabled no\n\n# Specify the syslog identity.\n# syslog-ident valkey\n\n# Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.\n# syslog-facility local0\n\n# To disable the built in crash log, which will possibly produce cleaner core\n# dumps when they are needed, uncomment the following:\n#\n# crash-log-enabled no\n\n# To disable the fast memory check that's run as part of the crash log, which\n# will possibly let the server terminate sooner, uncomment the following:\n#\n# crash-memcheck-enabled no\n\n# Set the number of databases. The default database is DB 0, you can select\n# a different one on a per-connection basis using SELECT where\n# dbid is a number between 0 and 'databases'-1\ndatabases 8\n\n# By default the server shows an ASCII art logo only when started to log to the\n# standard output and if the standard output is a TTY and syslog logging is\n# disabled. Basically this means that normally a logo is displayed only in\n# interactive sessions.\n#\n# However it is possible to force the pre-4.0 behavior and always show a\n# ASCII art logo in startup logs by setting the following option to yes.\nalways-show-logo no\n\n# User data, including keys, values, client names, and ACL usernames, can be\n# logged as part of assertions and other error cases. To prevent sensitive user\n# information, such as PII, from being recorded in the server log file, this\n# user data is hidden from the log by default. If you need to log user data for\n# debugging or troubleshooting purposes, you can disable this feature by\n# changing the config value to no.\nhide-user-data-from-log yes\n\n# By default, the server modifies the process title (as seen in 'top' and 'ps') to\n# provide some runtime information. It is possible to disable this and leave\n# the process name as executed by setting the following to no.\nset-proc-title yes\n\n# When changing the process title, the server uses the following template to construct\n# the modified title.\n#\n# Template variables are specified in curly brackets. The following variables are\n# supported:\n#\n# {title} Name of process as executed if parent, or type of child process.\n# {listen-addr} Bind address or '*' followed by TCP or TLS port listening on, or\n# Unix socket if only that's available.\n# {server-mode} Special mode, i.e. \"[sentinel]\" or \"[cluster]\".\n# {port} TCP port listening on, or 0.\n# {tls-port} TLS port listening on, or 0.\n# {unixsocket} Unix domain socket listening on, or \"\".\n# {config-file} Name of configuration file used.\n#\nproc-title-template \"{title} {listen-addr} {server-mode}\"\n\n# Set the local environment which is used for string comparison operations, and\n# also affect the performance of Lua scripts. Empty String indicates the locale\n# is derived from the environment variables.\nlocale-collate \"\"\n\n# Valkey is largely compatible with Redis OSS, apart from a few cases where\n# Valkey identifies itself itself as \"Valkey\" rather than \"Redis\". Extended\n# Redis OSS compatibility mode makes Valkey pretend to be Redis. Enable this\n# only if you have problems with tools or clients. This is a temporary\n# configuration added in Valkey 8.0 and is scheduled to have no effect in Valkey\n# 9.0 and be completely removed in Valkey 10.0.\n#\nextended-redis-compatibility yes\n\n################################ SNAPSHOTTING ################################\n\n# Save the DB to disk.\n#\n# save [ ...]\n#\n# The server will save the DB if the given number of seconds elapsed and it\n# surpassed the given number of write operations against the DB.\n#\n# Snapshotting can be completely disabled with a single empty string argument\n# as in following example:\n#\n# save \"\"\n#\n# Unless specified otherwise, by default the server will save the DB:\n# * After 3600 seconds (an hour) if at least 1 change was performed\n# * After 300 seconds (5 minutes) if at least 100 changes were performed\n# * After 60 seconds if at least 10000 changes were performed\n#\n# You can set these explicitly by uncommenting the following line.\n#\n# save 3600 1 300 100 60 10000\n\n# By default the server will stop accepting writes if RDB snapshots are enabled\n# (at least one save point) and the latest background save failed.\n# This will make the user aware (in a hard way) that data is not persisting\n# on disk properly, otherwise chances are that no one will notice and some\n# disaster will happen.\n#\n# If the background saving process will start working again, the server will\n# automatically allow writes again.\n#\n# However if you have setup your proper monitoring of the server\n# and persistence, you may want to disable this feature so that the server will\n# continue to work as usual even if there are problems with disk,\n# permissions, and so forth.\nstop-writes-on-bgsave-error no\n\n# Compress string objects using LZF when dump .rdb databases?\n# By default compression is enabled as it's almost always a win.\n# If you want to save some CPU in the saving child set it to 'no' but\n# the dataset will likely be bigger if you have compressible values or keys.\nrdbcompression yes\n\n# Since version 5 of RDB a CRC64 checksum is placed at the end of the file.\n# This makes the format more resistant to corruption but there is a performance\n# hit to pay (around 10%) when saving and loading RDB files, so you can disable it\n# for maximum performances.\n#\n# RDB files created with checksum disabled have a checksum of zero that will\n# tell the loading code to skip the check.\nrdbchecksum no\n\n# Valkey can try to load an RDB dump produced by a future version of Valkey.\n# This can only work on a best-effort basis, because future RDB versions may\n# contain information that's not known to the current version. If no new features\n# are used, it may be possible to import the data produced by a later version,\n# but loading is aborted if unknown information is encountered. Possible values\n# are 'strict' and 'relaxed'. This also applies to replication and the RESTORE\n# command.\nrdb-version-check relaxed\n\n# Enables or disables full sanitization checks for ziplist and listpack etc when\n# loading an RDB or RESTORE payload. This reduces the chances of a assertion or\n# crash later on while processing commands.\n# Options:\n# no - Never perform full sanitization\n# yes - Always perform full sanitization\n# clients - Perform full sanitization only for user connections.\n# Excludes: RDB files, RESTORE commands received from the primary\n# connection, and client connections which have the\n# skip-sanitize-payload ACL flag.\n# The default should be 'clients' but since it currently affects cluster\n# resharding via MIGRATE, it is temporarily set to 'no' by default.\n#\n# sanitize-dump-payload no\n\n# The filename where to dump the DB\ndbfilename dump.rdb\n\n# Remove RDB files used by replication in instances without persistence\n# enabled. By default this option is disabled, however there are environments\n# where for regulations or other security concerns, RDB files persisted on\n# disk by primaries in order to feed replicas, or stored on disk by replicas\n# in order to load them for the initial synchronization, should be deleted\n# ASAP. Note that this option ONLY WORKS in instances that have both AOF\n# and RDB persistence disabled, otherwise is completely ignored.\n#\n# An alternative (and sometimes better) way to obtain the same effect is\n# to use diskless replication on both primary and replicas instances. However\n# in the case of replicas, diskless is not always an option.\nrdb-del-sync-files no\n\n# The working directory.\n#\n# The server log is written relative this directory, if the 'logfile'\n# configuration directive is a relative path.\n#\n# The DB will be written inside this directory, with the filename specified\n# above using the 'dbfilename' configuration directive.\n#\n# The Append Only File will also be created inside this directory.\n#\n# The Cluster config file is written relative this directory, if the\n# 'cluster-config-file' configuration directive is a relative path.\n#\n# Note that you must specify a directory here, not a file name.\n# Note that modifying 'dir' during runtime may have unexpected behavior,\n# for example when a child process is running, related file operations may\n# have unexpected effects.\ndir /var/lib/valkey/\n\n################################# REPLICATION #################################\n\n# Master-Replica replication. Use replicaof to make a server a copy of\n# another server. A few things to understand ASAP about replication.\n#\n# +------------------+ +---------------+\n# | Master | ---> | Replica |\n# | (receive writes) | | (exact copy) |\n# +------------------+ +---------------+\n#\n# 1) Replication is asynchronous, but you can configure a primary to\n# stop accepting writes if it appears to be not connected with at least\n# a given number of replicas.\n# 2) Replicas are able to perform a partial resynchronization with the\n# primary if the replication link is lost for a relatively small amount of\n# time. You may want to configure the replication backlog size (see the next\n# sections of this file) with a sensible value depending on your needs.\n# 3) Replication is automatic and does not need user intervention. After a\n# network partition replicas automatically try to reconnect to primaries\n# and resynchronize with them.\n#\n# replicaof \n\n# If the primary is password protected (using the \"requirepass\" configuration\n# directive below) it is possible to tell the replica to authenticate before\n# starting the replication synchronization process, otherwise the primary will\n# refuse the replica request.\n#\n# primaryauth \n#\n# However this is not enough if you are using ACLs\n# and the default user is not capable of running the PSYNC\n# command and/or other commands needed for replication. In this case it's\n# better to configure a special user to use with replication, and specify the\n# primaryuser configuration as such:\n#\n# primaryuser \n#\n# When primaryuser is specified, the replica will authenticate against its\n# primary using the new AUTH form: AUTH .\n\n# When a replica loses its connection with the primary, or when the replication\n# is still in progress, the replica can act in two different ways:\n#\n# 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will\n# still reply to client requests, possibly with out of date data, or the\n# data set may just be empty if this is the first synchronization.\n#\n# 2) If replica-serve-stale-data is set to 'no' the replica will reply with error\n# \"MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'\"\n# to all data access commands, excluding commands such as:\n# INFO, REPLICAOF, AUTH, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE,\n# UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST,\n# HOST and LATENCY.\n#\nreplica-serve-stale-data yes\n\n# You can configure a replica instance to accept writes or not. Writing against\n# a replica instance may be useful to store some ephemeral data (because data\n# written on a replica will be easily deleted after resync with the primary) but\n# may also cause problems if clients are writing to it because of a\n# misconfiguration.\n#\n# By default, replicas are read-only.\n#\n# Note: read only replicas are not designed to be exposed to untrusted clients\n# on the internet. It's just a protection layer against misuse of the instance.\n# Still a read only replica exports by default all the administrative commands\n# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve\n# security of read only replicas using 'rename-command' to shadow all the\n# administrative / dangerous commands.\nreplica-read-only yes\n\n# Replication SYNC strategy: disk or socket.\n#\n# New replicas and reconnecting replicas that are not able to continue the\n# replication process just receiving differences, need to do what is called a\n# \"full synchronization\". An RDB file is transmitted from the primary to the\n# replicas.\n#\n# The transmission can happen in two different ways:\n#\n# 1) Disk-backed: The primary creates a new process that writes the RDB\n# file on disk. Later the file is transferred by the parent\n# process to the replicas incrementally.\n# 2) Diskless: The primary creates a new process that directly writes the\n# RDB file to replica sockets, without touching the disk at all.\n#\n# With disk-backed replication, while the RDB file is generated, more replicas\n# can be queued and served with the RDB file as soon as the current child\n# producing the RDB file finishes its work. With diskless replication instead\n# once the transfer starts, new replicas arriving will be queued and a new\n# transfer will start when the current one terminates.\n#\n# When diskless replication is used, the primary waits a configurable amount of\n# time (in seconds) before starting the transfer in the hope that multiple\n# replicas will arrive and the transfer can be parallelized.\n#\n# With slow disks and fast (large bandwidth) networks, diskless replication\n# works better.\nrepl-diskless-sync yes\n\n# When diskless replication is enabled, it is possible to configure the delay\n# the server waits in order to spawn the child that transfers the RDB via socket\n# to the replicas.\n#\n# This is important since once the transfer starts, it is not possible to serve\n# new replicas arriving, that will be queued for the next RDB transfer, so the\n# server waits a delay in order to let more replicas arrive.\n#\n# The delay is specified in seconds, and by default is 5 seconds. To disable\n# it entirely just set it to 0 seconds and the transfer will start ASAP.\nrepl-diskless-sync-delay 5\n\n# When diskless replication is enabled with a delay, it is possible to let\n# the replication start before the maximum delay is reached if the maximum\n# number of replicas expected have connected. Default of 0 means that the\n# maximum is not defined and the server will wait the full delay.\nrepl-diskless-sync-max-replicas 0\n\n# -----------------------------------------------------------------------------\n# WARNING: Since in this setup the replica does not immediately store an RDB on\n# disk, it may cause data loss during failovers. RDB diskless load + server\n# modules not handling I/O reads may cause the server to abort in case of I/O errors\n# during the initial synchronization stage with the primary.\n# -----------------------------------------------------------------------------\n#\n# Replica can load the RDB it reads from the replication link directly from the\n# socket, or store the RDB to a file and read that file after it was completely\n# received from the primary.\n#\n# In many cases the disk is slower than the network, and storing and loading\n# the RDB file may increase replication time (and even increase the primary's\n# Copy on Write memory and replica buffers).\n# However, when parsing the RDB file directly from the socket, in order to avoid\n# data loss it's only safe to flush the current dataset when the new dataset is\n# fully loaded in memory, resulting in higher memory usage.\n# For this reason we have the following options:\n#\n# \"disabled\" - Don't use diskless load (store the rdb file to the disk first)\n# \"swapdb\" - Keep current db contents in RAM while parsing the data directly\n# from the socket. Replicas in this mode can keep serving current\n# dataset while replication is in progress, except for cases where\n# they can't recognize primary as having a data set from same\n# replication history.\n# Note that this requires sufficient memory, if you don't have it,\n# you risk an OOM kill.\n# \"on-empty-db\" - Use diskless load only when current dataset is empty. This is\n# safer and avoid having old and new dataset loaded side by side\n# during replication.\n# \"flush-before-load\" - [dangerous] Flush all data before parsing. Note that if\n# there's a problem before the replication succeeded you may\n# lose all your data.\nrepl-diskless-load disabled\n\n# This dual channel replication sync feature optimizes the full synchronization process\n# between a primary and its replicas. When enabled, it reduces both memory and CPU load\n# on the primary server.\n#\n# How it works:\n# 1. During full sync, instead of accumulating replication data on the primary server,\n# the data is sent directly to the syncing replica.\n# 2. The primary's background save (bgsave) process streams the RDB snapshot directly\n# to the replica over a separate connection.\n#\n# Tradeoff:\n# While this approach reduces load on the primary, it shifts the burden of storing\n# the replication buffer to the replica. This means the replica must have sufficient\n# memory to accommodate the buffer during synchronization. However, this tradeoff is\n# generally beneficial as it prevents potential performance degradation on the primary\n# server, which is typically handling more critical operations.\n#\n# When toggling this configuration on or off during an ongoing synchronization process,\n# it does not change the already running sync method. The new configuration will take\n# effect only for subsequent synchronization processes.\n\ndual-channel-replication-enabled no\n\n# Master send PINGs to its replicas in a predefined interval. It's possible to\n# change this interval with the repl_ping_replica_period option. The default\n# value is 10 seconds.\n#\n# repl-ping-replica-period 10\n\n# The following option sets the replication timeout for:\n#\n# 1) Bulk transfer I/O during SYNC, from the point of view of replica.\n# 2) Master timeout from the point of view of replicas (data, pings).\n# 3) Replica timeout from the point of view of primaries (REPLCONF ACK pings).\n#\n# It is important to make sure that this value is greater than the value\n# specified for repl-ping-replica-period otherwise a timeout will be detected\n# every time there is low traffic between the primary and the replica. The default\n# value is 60 seconds.\n#\n# repl-timeout 60\n\n# Disable TCP_NODELAY on the replica socket after SYNC?\n#\n# If you select \"yes\", the server will use a smaller number of TCP packets and\n# less bandwidth to send data to replicas. But this can add a delay for\n# the data to appear on the replica side, up to 40 milliseconds with\n# Linux kernels using a default configuration.\n#\n# If you select \"no\" the delay for data to appear on the replica side will\n# be reduced but more bandwidth will be used for replication.\n#\n# By default we optimize for low latency, but in very high traffic conditions\n# or when the primary and replicas are many hops away, turning this to \"yes\" may\n# be a good idea.\nrepl-disable-tcp-nodelay no\n\n# Set the replication backlog size. The backlog is a buffer that accumulates\n# replica data when replicas are disconnected for some time, so that when a\n# replica wants to reconnect again, often a full resync is not needed, but a\n# partial resync is enough, just passing the portion of data the replica\n# missed while disconnected.\n#\n# The bigger the replication backlog, the longer the replica can endure the\n# disconnect and later be able to perform a partial resynchronization.\n#\n# The backlog is only allocated if there is at least one replica connected.\n#\n# repl-backlog-size 1mb\n\n# After a primary has no connected replicas for some time, the backlog will be\n# freed. The following option configures the amount of seconds that need to\n# elapse, starting from the time the last replica disconnected, for the backlog\n# buffer to be freed.\n#\n# Note that replicas never free the backlog for timeout, since they may be\n# promoted to primaries later, and should be able to correctly \"partially\n# resynchronize\" with other replicas: hence they should always accumulate backlog.\n#\n# A value of 0 means to never release the backlog.\n#\n# repl-backlog-ttl 3600\n\n# The replica priority is an integer number published by the server in the INFO\n# output. It is used by Sentinel in order to select a replica to promote\n# into a primary if the primary is no longer working correctly.\n#\n# A replica with a low priority number is considered better for promotion, so\n# for instance if there are three replicas with priority 10, 100, 25 Sentinel\n# will pick the one with priority 10, that is the lowest.\n#\n# However a special priority of 0 marks the replica as not able to perform the\n# role of primary, so a replica with priority of 0 will never be selected by\n# Sentinel for promotion.\n#\n# By default the priority is 100.\nreplica-priority 100\n\n# The propagation error behavior controls how the server will behave when it is\n# unable to handle a command being processed in the replication stream from a primary\n# or processed while reading from an AOF file. Errors that occur during propagation\n# are unexpected, and can cause data inconsistency.\n#\n# If an application wants to ensure there is no data divergence, this configuration\n# should be set to 'panic' instead. The value can also be set to 'panic-on-replicas'\n# to only panic when a replica encounters an error on the replication stream. One of\n# these two panic values will become the default value in the future once there are\n# sufficient safety mechanisms in place to prevent false positive crashes.\n#\n# propagation-error-behavior ignore\n\n# Replica ignore disk write errors controls the behavior of a replica when it is\n# unable to persist a write command received from its primary to disk. By default,\n# this configuration is set to 'no' and will crash the replica in this condition.\n# It is not recommended to change this default.\n#\n# replica-ignore-disk-write-errors no\n\n# Make the primary forbid expiration and eviction.\n# This is useful for sync tools, because expiration and eviction may cause the data corruption.\n# Sync tools can mark their connections as importing source by CLIENT IMPORT-SOURCE.\n# NOTICE: Clients should avoid writing the same key on the source server and the destination server.\n#\n# import-mode no\n\n# -----------------------------------------------------------------------------\n# By default, Sentinel includes all replicas in its reports. A replica\n# can be excluded from Sentinel's announcements. An unannounced replica\n# will be ignored by the 'sentinel replicas ' command and won't be\n# exposed to Sentinel's clients.\n#\n# This option does not change the behavior of replica-priority. Even with\n# replica-announced set to 'no', the replica can be promoted to primary. To\n# prevent this behavior, set replica-priority to 0.\n#\n# replica-announced yes\n\n# It is possible for a primary to stop accepting writes if there are less than\n# N replicas connected, having a lag less or equal than M seconds.\n#\n# The N replicas need to be in \"online\" state.\n#\n# The lag in seconds, that must be <= the specified value, is calculated from\n# the last ping received from the replica, that is usually sent every second.\n#\n# This option does not GUARANTEE that N replicas will accept the write, but\n# will limit the window of exposure for lost writes in case not enough replicas\n# are available, to the specified number of seconds.\n#\n# For example to require at least 3 replicas with a lag <= 10 seconds use:\n#\n# min-replicas-to-write 3\n# min-replicas-max-lag 10\n#\n# Setting one or the other to 0 disables the feature.\n#\n# By default min-replicas-to-write is set to 0 (feature disabled) and\n# min-replicas-max-lag is set to 10.\n\n# A primary is able to list the address and port of the attached\n# replicas in different ways. For example the \"INFO replication\" section\n# offers this information, which is used, among other tools, by\n# Sentinel in order to discover replica instances.\n# Another place where this info is available is in the output of the\n# \"ROLE\" command of a primary.\n#\n# The listed IP address and port normally reported by a replica is\n# obtained in the following way:\n#\n# IP: The address is auto detected by checking the peer address\n# of the socket used by the replica to connect with the primary.\n#\n# Port: The port is communicated by the replica during the replication\n# handshake, and is normally the port that the replica is using to\n# listen for connections.\n#\n# However when port forwarding or Network Address Translation (NAT) is\n# used, the replica may actually be reachable via different IP and port\n# pairs. The following two options can be used by a replica in order to\n# report to its primary a specific set of IP and port, so that both INFO\n# and ROLE will report those values.\n#\n# There is no need to use both the options if you need to override just\n# the port or the IP address.\n#\n# replica-announce-ip 5.5.5.5\n# replica-announce-port 1234\n\n############################### KEYS TRACKING #################################\n\n# The client side caching of values is assisted via server-side support.\n# This is implemented using an invalidation table that remembers, using\n# a radix key indexed by key name, what clients have which keys. In turn\n# this is used in order to send invalidation messages to clients. Please\n# check this page to understand more about the feature:\n#\n# https://valkey.io/topics/client-side-caching\n#\n# When tracking is enabled for a client, all the read only queries are assumed\n# to be cached: this will force the server to store information in the invalidation\n# table. When keys are modified, such information is flushed away, and\n# invalidation messages are sent to the clients. However if the workload is\n# heavily dominated by reads, the server could use more and more memory in order\n# to track the keys fetched by many clients.\n#\n# For this reason it is possible to configure a maximum fill value for the\n# invalidation table. By default it is set to 1M of keys, and once this limit\n# is reached, the server will start to evict keys in the invalidation table\n# even if they were not modified, just to reclaim memory: this will in turn\n# force the clients to invalidate the cached values. Basically the table\n# maximum size is a trade off between the memory you want to spend server\n# side to track information about who cached what, and the ability of clients\n# to retain cached objects in memory.\n#\n# If you set the value to 0, it means there are no limits, and the server will\n# retain as many keys as needed in the invalidation table.\n# In the \"stats\" INFO section, you can find information about the number of\n# keys in the invalidation table at every given moment.\n#\n# Note: when key tracking is used in broadcasting mode, no memory is used\n# in the server side so this setting is useless.\n#\n# tracking-table-max-keys 1000000\n\n################################## SECURITY ###################################\n\n# Warning: since the server is pretty fast, an outside user can try up to\n# 1 million passwords per second against a modern box. This means that you\n# should use very strong passwords, otherwise they will be very easy to break.\n# Note that because the password is really a shared secret between the client\n# and the server, and should not be memorized by any human, the password\n# can be easily a long string from /dev/urandom or whatever, so by using a\n# long and unguessable password no brute force attack will be possible.\n\n# ACL users are defined in the following format:\n#\n# user ... acl rules ...\n#\n# For example:\n#\n# user worker +@list +@connection ~jobs:* on >ffa9203c493aa99\n#\n# The special username \"default\" is used for new connections. If this user\n# has the \"nopass\" rule, then new connections will be immediately authenticated\n# as the \"default\" user without the need of any password provided via the\n# AUTH command. Otherwise if the \"default\" user is not flagged with \"nopass\"\n# the connections will start in not authenticated state, and will require\n# AUTH (or the HELLO command AUTH option) in order to be authenticated and\n# start to work.\n#\n# The ACL rules that describe what a user can do are the following:\n#\n# on Enable the user: it is possible to authenticate as this user.\n# off Disable the user: it's no longer possible to authenticate\n# with this user, however the already authenticated connections\n# will still work.\n# skip-sanitize-payload RESTORE dump-payload sanitization is skipped.\n# sanitize-payload RESTORE dump-payload is sanitized (default).\n# + Allow the execution of that command.\n# May be used with `|` for allowing subcommands (e.g \"+config|get\")\n# - Disallow the execution of that command.\n# May be used with `|` for blocking subcommands (e.g \"-config|set\")\n# +@ Allow the execution of all the commands in such category\n# with valid categories are like @admin, @set, @sortedset, ...\n# and so forth, see the full list in the server.c file where\n# the server command table is described and defined.\n# The special category @all means all the commands, but currently\n# present in the server, and that will be loaded in the future\n# via modules.\n# +|first-arg Allow a specific first argument of an otherwise\n# disabled command. It is only supported on commands with\n# no sub-commands, and is not allowed as negative form\n# like -SELECT|1, only additive starting with \"+\". This\n# feature is deprecated and may be removed in the future.\n# allcommands Alias for +@all. Note that it implies the ability to execute\n# all the future commands loaded via the modules system.\n# nocommands Alias for -@all.\n# ~ Add a pattern of keys that can be mentioned as part of\n# commands. For instance ~* allows all the keys. The pattern\n# is a glob-style pattern like the one of KEYS.\n# It is possible to specify multiple patterns.\n# %R~ Add key read pattern that specifies which keys can be read\n# from.\n# %W~ Add key write pattern that specifies which keys can be\n# written to.\n# allkeys Alias for ~*\n# resetkeys Flush the list of allowed keys patterns.\n# & Add a glob-style pattern of Pub/Sub channels that can be\n# accessed by the user. It is possible to specify multiple channel\n# patterns.\n# allchannels Alias for &*\n# resetchannels Flush the list of allowed channel patterns.\n# > Add this password to the list of valid password for the user.\n# For example >mypass will add \"mypass\" to the list.\n# This directive clears the \"nopass\" flag (see later).\n# < Remove this password from the list of valid passwords.\n# nopass All the set passwords of the user are removed, and the user\n# is flagged as requiring no password: it means that every\n# password will work against this user. If this directive is\n# used for the default user, every new connection will be\n# immediately authenticated with the default user without\n# any explicit AUTH command required. Note that the \"resetpass\"\n# directive will clear this condition.\n# resetpass Flush the list of allowed passwords. Moreover removes the\n# \"nopass\" status. After \"resetpass\" the user has no associated\n# passwords and there is no way to authenticate without adding\n# some password (or setting it as \"nopass\" later).\n# reset Performs the following actions: resetpass, resetkeys, resetchannels,\n# allchannels (if acl-pubsub-default is set), off, clearselectors, -@all.\n# The user returns to the same state it has immediately after its creation.\n# () Create a new selector with the options specified within the\n# parentheses and attach it to the user. Each option should be\n# space separated. The first character must be ( and the last\n# character must be ).\n# clearselectors Remove all of the currently attached selectors.\n# Note this does not change the \"root\" user permissions,\n# which are the permissions directly applied onto the\n# user (outside the parentheses).\n#\n# ACL rules can be specified in any order: for instance you can start with\n# passwords, then flags, or key patterns. However note that the additive\n# and subtractive rules will CHANGE MEANING depending on the ordering.\n# For instance see the following example:\n#\n# user alice on +@all -DEBUG ~* >somepassword\n#\n# This will allow \"alice\" to use all the commands with the exception of the\n# DEBUG command, since +@all added all the commands to the set of the commands\n# alice can use, and later DEBUG was removed. However if we invert the order\n# of two ACL rules the result will be different:\n#\n# user alice on -DEBUG +@all ~* >somepassword\n#\n# Now DEBUG was removed when alice had yet no commands in the set of allowed\n# commands, later all the commands are added, so the user will be able to\n# execute everything.\n#\n# Basically ACL rules are processed left-to-right.\n#\n# The following is a list of command categories and their meanings:\n# * keyspace - Writing or reading from keys, databases, or their metadata\n# in a type agnostic way. Includes DEL, RESTORE, DUMP, RENAME, EXISTS, DBSIZE,\n# KEYS, EXPIRE, TTL, FLUSHALL, etc. Commands that may modify the keyspace,\n# key or metadata will also have `write` category. Commands that only read\n# the keyspace, key or metadata will have the `read` category.\n# * read - Reading from keys (values or metadata). Note that commands that don't\n# interact with keys, will not have either `read` or `write`.\n# * write - Writing to keys (values or metadata)\n# * admin - Administrative commands. Normal applications will never need to use\n# these. Includes REPLICAOF, CONFIG, DEBUG, SAVE, MONITOR, ACL, SHUTDOWN, etc.\n# * dangerous - Potentially dangerous (each should be considered with care for\n# various reasons). This includes FLUSHALL, MIGRATE, RESTORE, SORT, KEYS,\n# CLIENT, DEBUG, INFO, CONFIG, SAVE, REPLICAOF, etc.\n# * connection - Commands affecting the connection or other connections.\n# This includes AUTH, SELECT, COMMAND, CLIENT, ECHO, PING, etc.\n# * blocking - Potentially blocking the connection until released by another\n# command.\n# * fast - Fast O(1) commands. May loop on the number of arguments, but not the\n# number of elements in the key.\n# * slow - All commands that are not Fast.\n# * pubsub - PUBLISH / SUBSCRIBE related\n# * transaction - WATCH / MULTI / EXEC related commands.\n# * scripting - Scripting related.\n# * set - Data type: sets related.\n# * sortedset - Data type: zsets related.\n# * list - Data type: lists related.\n# * hash - Data type: hashes related.\n# * string - Data type: strings related.\n# * bitmap - Data type: bitmaps related.\n# * hyperloglog - Data type: hyperloglog related.\n# * geo - Data type: geo related.\n# * stream - Data type: streams related.\n#\n# For more information about ACL configuration please refer to\n# the Valkey web site at https://valkey.io/topics/acl\n\n# ACL LOG\n#\n# The ACL Log tracks failed commands and authentication events associated\n# with ACLs. The ACL Log is useful to troubleshoot failed commands blocked\n# by ACLs. The ACL Log is stored in memory. You can reclaim memory with\n# ACL LOG RESET. Define the maximum entry length of the ACL Log below.\nacllog-max-len 128\n\n# Using an external ACL file\n#\n# Instead of configuring users here in this file, it is possible to use\n# a stand-alone file just listing users. The two methods cannot be mixed:\n# if you configure users here and at the same time you activate the external\n# ACL file, the server will refuse to start.\n#\n# The format of the external ACL user file is exactly the same as the\n# format that is used inside valkey.conf to describe users.\n#\n# aclfile /etc/valkey/users.acl\n\n# IMPORTANT NOTE: \"requirepass\" is just a compatibility\n# layer on top of the new ACL system. The option effect will be just setting\n# the password for the default user. Clients will still authenticate using\n# AUTH as usually, or more explicitly with AUTH default \n# if they follow the new protocol: both will work.\n#\n# The requirepass is not compatible with aclfile option and the ACL LOAD\n# command, these will cause requirepass to be ignored.\n#\n\nuser default on >isfoobared allcommands allkeys\n\n# The default Pub/Sub channels permission for new users is controlled by the\n# acl-pubsub-default configuration directive, which accepts one of these values:\n#\n# allchannels: grants access to all Pub/Sub channels\n# resetchannels: revokes access to all Pub/Sub channels\n#\n# acl-pubsub-default defaults to 'resetchannels' permission.\n#\n# acl-pubsub-default resetchannels\n\n# Command renaming (DEPRECATED).\n#\n# ------------------------------------------------------------------------\n# WARNING: avoid using this option if possible. Instead use ACLs to remove\n# commands from the default user, and put them only in some admin user you\n# create for administrative purposes.\n# ------------------------------------------------------------------------\n#\n# It is possible to change the name of dangerous commands in a shared\n# environment. For instance the CONFIG command may be renamed into something\n# hard to guess so that it will still be available for internal-use tools\n# but not available for general clients.\n#\n# Example:\n#\n# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52\n#\n# It is also possible to completely kill a command by renaming it into\n# an empty string:\n#\n# rename-command CONFIG \"\"\n#\n# Please note that changing the name of commands that are logged into the\n# AOF file or transmitted to replicas may cause problems.\n\n################################### CLIENTS ####################################\n\n# Set the max number of connected clients at the same time. By default\n# this limit is set to 10000 clients, however if the server is not\n# able to configure the process file limit to allow for the specified limit\n# the max number of allowed clients is set to the current file limit\n# minus 32 (as the server reserves a few file descriptors for internal uses).\n#\n# Once the limit is reached the server will close all the new connections sending\n# an error 'max number of clients reached'.\n#\n# IMPORTANT: With a cluster-enabled setup, the max number of connections is also\n# shared with the cluster bus: every node in the cluster will use two\n# connections, one incoming and another outgoing. It is important to size the\n# limit accordingly in case of very large clusters.\n#\nmaxclients 4000\n\n############################## MEMORY MANAGEMENT ################################\n\n# Set a memory usage limit to the specified amount of bytes.\n# When the memory limit is reached the server will try to remove keys\n# according to the eviction policy selected (see maxmemory-policy).\n#\n# If the server can't remove keys according to the policy, or if the policy is\n# set to 'noeviction', the server will start to reply with errors to commands\n# that would use more memory, like SET, LPUSH, and so on, and will continue\n# to reply to read-only commands like GET.\n#\n# This option is usually useful when using the server as an LRU or LFU cache, or to\n# set a hard memory limit for an instance (using the 'noeviction' policy).\n#\n# WARNING: If you have replicas attached to an instance with maxmemory on,\n# the size of the output buffers needed to feed the replicas are subtracted\n# from the used memory count, so that network problems / resyncs will\n# not trigger a loop where keys are evicted, and in turn the output\n# buffer of replicas is full with DELs of keys evicted triggering the deletion\n# of more keys, and so forth until the database is completely emptied.\n#\n# In short... if you have replicas attached it is suggested that you set a lower\n# limit for maxmemory so that there is some free RAM on the system for replica\n# output buffers (but this is not needed if the policy is 'noeviction').\n#\nmaxmemory 88MB\n\n# MAXMEMORY POLICY: how the server will select what to remove when maxmemory\n# is reached. You can select one from the following behaviors:\n#\n# volatile-lru -> Evict using approximated LRU, only keys with an expire set.\n# allkeys-lru -> Evict any key using approximated LRU.\n# volatile-lfu -> Evict using approximated LFU, only keys with an expire set.\n# allkeys-lfu -> Evict any key using approximated LFU.\n# volatile-random -> Remove a random key having an expire set.\n# allkeys-random -> Remove a random key, any key.\n# volatile-ttl -> Remove the key with the nearest expire time (minor TTL)\n# noeviction -> Don't evict anything, just return an error on write operations.\n#\n# LRU means Least Recently Used\n# LFU means Least Frequently Used\n#\n# Both LRU, LFU and volatile-ttl are implemented using approximated\n# randomized algorithms.\n#\n# Note: with any of the above policies, when there are no suitable keys for\n# eviction, the server will return an error on write operations that require\n# more memory. These are usually commands that create new keys, add data or\n# modify existing keys. A few examples are: SET, INCR, HSET, LPUSH, SUNIONSTORE,\n# SORT (due to the STORE argument), and EXEC (if the transaction includes any\n# command that requires memory).\n#\n# The default is: noeviction\n#\nmaxmemory-policy allkeys-lru\n\n# LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated\n# algorithms (in order to save memory), so you can tune it for speed or\n# accuracy. By default the server will check five keys and pick the one that was\n# used least recently, you can change the sample size using the following\n# configuration directive.\n#\n# The default of 5 produces good enough results. 10 Approximates very closely\n# true LRU but costs more CPU. 3 is faster but not very accurate. The maximum\n# value that can be set is 64.\n#\n# maxmemory-samples 5\n\n# Eviction processing is designed to function well with the default setting.\n# If there is an unusually large amount of write traffic, this value may need to\n# be increased. Decreasing this value may reduce latency at the risk of\n# eviction processing effectiveness\n# 0 = minimum latency, 10 = default, 100 = process without regard to latency\n#\n# maxmemory-eviction-tenacity 10\n\n# By default a replica will ignore its maxmemory setting\n# (unless it is promoted to primary after a failover or manually). It means\n# that the eviction of keys will be just handled by the primary, sending the\n# DEL commands to the replica as keys evict in the primary side.\n#\n# This behavior ensures that primaries and replicas stay consistent, and is usually\n# what you want, however if your replica is writable, or you want the replica\n# to have a different memory setting, and you are sure all the writes performed\n# to the replica are idempotent, then you may change this default (but be sure\n# to understand what you are doing).\n#\n# Note that since the replica by default does not evict, it may end using more\n# memory than the one set via maxmemory (there are certain buffers that may\n# be larger on the replica, or data structures may sometimes take more memory\n# and so forth). So make sure you monitor your replicas and make sure they\n# have enough memory to never hit a real out-of-memory condition before the\n# primary hits the configured maxmemory setting.\n#\n# replica-ignore-maxmemory yes\n\n# The server reclaims expired keys in two ways: upon access when those keys are\n# found to be expired, and also in the background, in what is called the\n# \"active expire key\". The key space is slowly and incrementally scanned\n# looking for expired keys to reclaim, so that it is possible to free memory\n# of keys that are expired and will never be accessed again in a short time.\n#\n# The default effort of the expire cycle will try to avoid having more than\n# ten percent of expired keys still in memory, and will try to avoid consuming\n# more than 25% of total memory and to add latency to the system. However\n# it is possible to increase the expire \"effort\" that is normally set to\n# \"1\", to a greater value, up to the value \"10\". At its maximum value the\n# system will use more CPU, longer cycles (and technically may introduce\n# more latency), and will tolerate less already expired keys still present\n# in the system. It's a tradeoff between memory, CPU and latency.\n#\n# active-expire-effort 1\n\n############################# LAZY FREEING ####################################\n\n# When keys are deleted, the served has historically freed their memory using\n# blocking operations. It means that the server stopped processing new commands\n# in order to reclaim all the memory associated with an object in a synchronous\n# way. If the key deleted is associated with a small object, the time needed\n# in order to execute the DEL command is very small and comparable to most other\n# O(1) or O(log_N) commands in the server. However if the key is associated with an\n# aggregated value containing millions of elements, the server can block for\n# a long time (even seconds) in order to complete the operation.\n#\n# For the above reasons, lazy freeing (or asynchronous freeing), has been\n# introduced. With lazy freeing, keys are deleted in constant time. Another\n# thread will incrementally free the object in the background as fast as\n# possible.\n#\n# Starting from Valkey 8.0, lazy freeing is enabled by default. It is possible\n# to retain the synchronous freeing behaviour by setting the lazyfree related\n# configuration directives to 'no'.\n\n# Commands like DEL, FLUSHALL and FLUSHDB delete keys, but the server can also\n# delete keys or flush the whole database as a side effect of other operations.\n# Specifically the server deletes objects independently of a user call in the\n# following scenarios:\n#\n# 1) On eviction, because of the maxmemory and maxmemory policy configurations,\n# in order to make room for new data, without going over the specified\n# memory limit.\n# 2) Because of expire: when a key with an associated time to live (see the\n# EXPIRE command) must be deleted from memory.\n# 3) Because of a side effect of a command that stores data on a key that may\n# already exist. For example the RENAME command may delete the old key\n# content when it is replaced with another one. Similarly SUNIONSTORE\n# or SORT with STORE option may delete existing keys. The SET command\n# itself removes any old content of the specified key in order to replace\n# it with the specified string.\n# 4) During replication, when a replica performs a full resynchronization with\n# its primary, the content of the whole database is removed in order to\n# load the RDB file just transferred.\n#\n# In all the above cases, the default is to release memory in a non-blocking\n# way.\n\nlazyfree-lazy-eviction yes\nlazyfree-lazy-expire yes\nlazyfree-lazy-server-del yes\nreplica-lazy-flush yes\n\n# For keys deleted using the DEL command, lazy freeing is controlled by the\n# configuration directive 'lazyfree-lazy-user-del'. The default is 'yes'. The\n# UNLINK command is identical to the DEL command, except that UNLINK always\n# frees the memory lazily, regardless of this configuration directive:\n\nlazyfree-lazy-user-del yes\n\n# FLUSHDB, FLUSHALL, SCRIPT FLUSH and FUNCTION FLUSH support both asynchronous and synchronous\n# deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the\n# commands. When neither flag is passed, this directive will be used to determine\n# if the data should be deleted asynchronously.\n#\n# When a replica performs a node reset via CLUSTER RESET, the entire\n# database content is removed to allow the node to become an empty primary.\n# This directive also determines whether the data should be deleted asynchronously.\n#\n# There are many problems with running flush synchronously. Even in single CPU\n# environments, the thread managers should balance between the freeing and\n# serving incoming requests. The default value is yes.\n\nlazyfree-lazy-user-flush yes\n\n################################ THREADED I/O #################################\n\n# The server is mostly single threaded, however there are certain threaded\n# operations such as UNLINK, slow I/O accesses and other things that are\n# performed on side threads.\n#\n# Now it is also possible to handle the server clients socket reads and writes\n# in different I/O threads. Since especially writing is so slow, normally\n# users use pipelining in order to speed up the server performances per\n# core, and spawn multiple instances in order to scale more. Using I/O\n# threads it is possible to easily speedup two times the server without resorting\n# to pipelining nor sharding of the instance.\n#\n# By default threading is disabled, we suggest enabling it only in machines\n# that have at least 3 or more cores, leaving at least one spare core.\n# We also recommend using threaded I/O only if you actually have performance problems, with\n# instances being able to use a quite big percentage of CPU time, otherwise\n# there is no point in using this feature.\n#\n# So for instance if you have a four cores boxes, try to use 2 or 3 I/O\n# threads, if you have a 8 cores, try to use 6 threads. In order to\n# enable I/O threads use the following configuration directive:\n#\n# io-threads 4\n#\n# Setting io-threads to 1 will just use the main thread as usual.\n# When I/O threads are enabled, we use threads for reads and writes, that is\n# to thread the write and read syscall and transfer the client buffers to the\n# socket and to enable threading of reads and protocol parsing.\n#\n# When multiple commands are parsed by the I/O threads and ready for execution,\n# we take advantage of knowing the next set of commands and prefetch their\n# required dictionary entries in a batch. This reduces memory access costs.\n#\n# The optimal batch size depends on the specific workflow of the user.\n# The default batch size is 16, which can be modified using the\n# 'prefetch-batch-max-size' config.\n#\n# When the config is set to 0, prefetching is disabled.\n#\n# prefetch-batch-max-size 16\n#\n# NOTE:\n# 1. The 'io-threads-do-reads' config is deprecated and has no effect. Please\n# avoid using this config if possible.\n#\n# 2. If you want to test the server speedup using valkey-benchmark, make\n# sure you also run the benchmark itself in threaded mode, using the\n# --threads option to match the number of server threads, otherwise you'll not\n# be able to notice the improvements.\n\n############################ KERNEL OOM CONTROL ##############################\n\n# On Linux, it is possible to hint the kernel OOM killer on what processes\n# should be killed first when out of memory.\n#\n# Enabling this feature makes the server actively control the oom_score_adj value\n# for all its processes, depending on their role. The default scores will\n# attempt to have background child processes killed before all others, and\n# replicas killed before primaries.\n#\n# The server supports these options:\n#\n# no: Don't make changes to oom-score-adj (default).\n# yes: Alias to \"relative\" see below.\n# absolute: Values in oom-score-adj-values are written as is to the kernel.\n# relative: Values are used relative to the initial value of oom_score_adj when\n# the server starts and are then clamped to a range of -1000 to 1000.\n# Because typically the initial value is 0, they will often match the\n# absolute values.\noom-score-adj no\n\n# When oom-score-adj is used, this directive controls the specific values used\n# for primary, replica and background child processes. Values range -2000 to\n# 2000 (higher means more likely to be killed).\n#\n# Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities)\n# can freely increase their value, but not decrease it below its initial\n# settings. This means that setting oom-score-adj to \"relative\" and setting the\n# oom-score-adj-values to positive values will always succeed.\noom-score-adj-values 0 200 800\n\n\n#################### KERNEL transparent hugepage CONTROL ######################\n\n# Usually the kernel Transparent Huge Pages control is set to \"madvise\" or\n# \"never\" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which\n# case this config has no effect. On systems in which it is set to \"always\",\n# the server will attempt to disable it specifically for the server process in order\n# to avoid latency problems specifically with fork(2) and CoW.\n# If for some reason you prefer to keep it enabled, you can set this config to\n# \"no\" and the kernel global to \"always\".\n\ndisable-thp yes\n\n############################## APPEND ONLY MODE ###############################\n\n# By default the server asynchronously dumps the dataset on disk. This mode is\n# good enough in many applications, but an issue with the server process or\n# a power outage may result into a few minutes of writes lost (depending on\n# the configured save points).\n#\n# The Append Only File is an alternative persistence mode that provides\n# much better durability. For instance using the default data fsync policy\n# (see later in the config file) the server can lose just one second of writes in a\n# dramatic event like a server power outage, or a single write if something\n# wrong with the process itself happens, but the operating system is\n# still running correctly.\n#\n# AOF and RDB persistence can be enabled at the same time without problems.\n# If the AOF is enabled on startup the server will load the AOF, that is the file\n# with the better durability guarantees.\n#\n# Note that changing this value in a config file of an existing database and\n# restarting the server can lead to data loss. A conversion needs to be done\n# by setting it via CONFIG command on a live server first.\n#\n# Please check https://valkey.io/topics/persistence for more information.\n\nappendonly no\n\n# The base name of the append only file.\n#\n# The server uses a set of append-only files to persist the dataset\n# and changes applied to it. There are two basic types of files in use:\n#\n# - Base files, which are a snapshot representing the complete state of the\n# dataset at the time the file was created. Base files can be either in\n# the form of RDB (binary serialized) or AOF (textual commands).\n# - Incremental files, which contain additional commands that were applied\n# to the dataset following the previous file.\n#\n# In addition, manifest files are used to track the files and the order in\n# which they were created and should be applied.\n#\n# Append-only file names are created by the server following a specific pattern.\n# The file name's prefix is based on the 'appendfilename' configuration\n# parameter, followed by additional information about the sequence and type.\n#\n# For example, if appendfilename is set to appendonly.aof, the following file\n# names could be derived:\n#\n# - appendonly.aof.1.base.rdb as a base file.\n# - appendonly.aof.1.incr.aof, appendonly.aof.2.incr.aof as incremental files.\n# - appendonly.aof.manifest as a manifest file.\n\nappendfilename \"appendonly.aof\"\n\n# For convenience, the server stores all persistent append-only files in a dedicated\n# directory. The name of the directory is determined by the appenddirname\n# configuration parameter.\n\nappenddirname \"appendonlydir\"\n\n# The fsync() call tells the Operating System to actually write data on disk\n# instead of waiting for more data in the output buffer. Some OS will really flush\n# data on disk, some other OS will just try to do it ASAP.\n#\n# The server supports three different modes:\n#\n# no: don't fsync, just let the OS flush the data when it wants. Faster.\n# always: fsync after every write to the append only log. Slow, Safest.\n# everysec: fsync only one time every second. Compromise.\n#\n# The default is \"everysec\", as that's usually the right compromise between\n# speed and data safety. It's up to you to understand if you can relax this to\n# \"no\" that will let the operating system flush the output buffer when\n# it wants, for better performances (but if you can live with the idea of\n# some data loss consider the default persistence mode that's snapshotting),\n# or on the contrary, use \"always\" that's very slow but a bit safer than\n# everysec.\n#\n# More details please check the following article:\n# http://antirez.com/post/redis-persistence-demystified.html\n#\n# If unsure, use \"everysec\".\n\n# appendfsync always\nappendfsync everysec\n# appendfsync no\n\n# When the AOF fsync policy is set to always or everysec, and a background\n# saving process (a background save or AOF log background rewriting) is\n# performing a lot of I/O against the disk, in some Linux configurations\n# the server may block too long on the fsync() call. Note that there is no fix for\n# this currently, as even performing fsync in a different thread will block\n# our synchronous write(2) call.\n#\n# In order to mitigate this problem it's possible to use the following option\n# that will prevent fsync() from being called in the main process while a\n# BGSAVE or BGREWRITEAOF is in progress.\n#\n# This means that while another child is saving, the durability of the server is\n# the same as \"appendfsync no\". In practical terms, this means that it is\n# possible to lose up to 30 seconds of log in the worst scenario (with the\n# default Linux settings).\n#\n# If you have latency problems turn this to \"yes\". Otherwise leave it as\n# \"no\" that is the safest pick from the point of view of durability.\n\nno-appendfsync-on-rewrite no\n\n# Automatic rewrite of the append only file.\n# The server is able to automatically rewrite the log file implicitly calling\n# BGREWRITEAOF when the AOF log size grows by the specified percentage.\n#\n# This is how it works: The server remembers the size of the AOF file after the\n# latest rewrite (if no rewrite has happened since the restart, the size of\n# the AOF at startup is used).\n#\n# This base size is compared to the current size. If the current size is\n# bigger than the specified percentage, the rewrite is triggered. Also\n# you need to specify a minimal size for the AOF file to be rewritten, this\n# is useful to avoid rewriting the AOF file even if the percentage increase\n# is reached but it is still pretty small.\n#\n# Specify a percentage of zero in order to disable the automatic AOF\n# rewrite feature.\n\nauto-aof-rewrite-percentage 100\nauto-aof-rewrite-min-size 64mb\n\n# An AOF file may be found to be truncated at the end during the server\n# startup process, when the AOF data gets loaded back into memory.\n# This may happen when the system where the server is running\n# crashes, especially when an ext4 filesystem is mounted without the\n# data=ordered option (however this can't happen when the server itself\n# crashes or aborts but the operating system still works correctly).\n#\n# The server can either exit with an error when this happens, or load as much\n# data as possible (the default now) and start if the AOF file is found\n# to be truncated at the end. The following option controls this behavior.\n#\n# If aof-load-truncated is set to yes, a truncated AOF file is loaded and\n# the server starts emitting a log to inform the user of the event.\n# Otherwise if the option is set to no, the server aborts with an error\n# and refuses to start. When the option is set to no, the user requires\n# to fix the AOF file using the \"valkey-check-aof\" utility before to restart\n# the server.\n#\n# Note that if the AOF file will be found to be corrupted in the middle\n# the server will still exit with an error. This option only applies when\n# the server will try to read more data from the AOF file but not enough bytes\n# will be found.\naof-load-truncated yes\n\n# The server can create append-only base files in either RDB or AOF formats. Using\n# the RDB format is always faster and more efficient, and disabling it is only\n# supported for backward compatibility purposes.\naof-use-rdb-preamble yes\n\n# The server supports recording timestamp annotations in the AOF to support restoring\n# the data from a specific point-in-time. However, using this capability changes\n# the AOF format in a way that may not be compatible with existing AOF parsers.\naof-timestamp-enabled no\n\n################################ SHUTDOWN #####################################\n\n# Maximum time to wait for replicas when shutting down, in seconds.\n#\n# During shut down, a grace period allows any lagging replicas to catch up with\n# the latest replication offset before the primary exits. This period can\n# prevent data loss, especially for deployments without configured disk backups.\n#\n# The 'shutdown-timeout' value is the grace period's duration in seconds. It is\n# only applicable when the instance has replicas. To disable the feature, set\n# the value to 0.\n#\n# shutdown-timeout 10\n\n# When the server receives a SIGINT or SIGTERM, shutdown is initiated and by default\n# an RDB snapshot is written to disk in a blocking operation if save points are configured.\n# The options used on signaled shutdown can include the following values:\n# default: Saves RDB snapshot only if save points are configured.\n# Waits for lagging replicas to catch up.\n# save: Forces a DB saving operation even if no save points are configured.\n# nosave: Prevents DB saving operation even if one or more save points are configured.\n# now: Skips waiting for lagging replicas.\n# force: Ignores any errors that would normally prevent the server from exiting.\n#\n# Any combination of values is allowed as long as \"save\" and \"nosave\" are not set simultaneously.\n# Example: \"nosave force now\"\n#\n# shutdown-on-sigint default\n# shutdown-on-sigterm default\n\n################ NON-DETERMINISTIC LONG BLOCKING COMMANDS #####################\n\n# Maximum time in milliseconds for EVAL scripts, functions and in some cases\n# modules' commands before the server can start processing or rejecting other clients.\n#\n# If the maximum execution time is reached the server will start to reply to most\n# commands with a BUSY error.\n#\n# In this state the server will only allow a handful of commands to be executed.\n# For instance, SCRIPT KILL, FUNCTION KILL, SHUTDOWN NOSAVE and possibly some\n# module specific 'allow-busy' commands.\n#\n# SCRIPT KILL and FUNCTION KILL will only be able to stop a script that did not\n# yet call any write commands, so SHUTDOWN NOSAVE may be the only way to stop\n# the server in the case a write command was already issued by the script when\n# the user doesn't want to wait for the natural termination of the script.\n#\n# The default is 5 seconds. It is possible to set it to 0 or a negative value\n# to disable this mechanism (uninterrupted execution). Note that in the past\n# this config had a different name, which is now an alias, so both of these do\n# the same:\n# lua-time-limit 5000\n# busy-reply-threshold 5000\n\n################################ VALKEY CLUSTER ###############################\n\n# Normal server instances can't be part of a cluster; only nodes that are\n# started as cluster nodes can. In order to start a server instance as a\n# cluster node enable the cluster support uncommenting the following:\n#\n# cluster-enabled yes\n\n# Every cluster node has a cluster configuration file. This file is not\n# intended to be edited by hand. It is created and updated by each node.\n# Every cluster node requires a different cluster configuration file.\n# Make sure that instances running in the same system do not have\n# overlapping cluster configuration file names.\n#\n# cluster-config-file nodes-6379.conf\n\n# Cluster node timeout is the amount of milliseconds a node must be unreachable\n# for it to be considered in failure state.\n# Most other internal time limits are a multiple of the node timeout.\n#\n# cluster-node-timeout 15000\n\n# The cluster port is the port that the cluster bus will listen for inbound connections on. When set\n# to the default value, 0, it will be bound to the command port + 10000. Setting this value requires\n# you to specify the cluster bus port when executing cluster meet.\n# cluster-port 0\n\n# A replica of a failing primary will avoid to start a failover if its data\n# looks too old.\n#\n# There is no simple way for a replica to actually have an exact measure of\n# its \"data age\", so the following two checks are performed:\n#\n# 1) If there are multiple replicas able to failover, they exchange messages\n# in order to try to give an advantage to the replica with the best\n# replication offset (more data from the primary processed).\n# Replicas will try to get their rank by offset, and apply to the start\n# of the failover a delay proportional to their rank.\n#\n# 2) Every single replica computes the time of the last interaction with\n# its primary. This can be the last ping or command received (if the primary\n# is still in the \"connected\" state), or the time that elapsed since the\n# disconnection with the primary (if the replication link is currently down).\n# If the last interaction is too old, the replica will not try to failover\n# at all.\n#\n# The point \"2\" can be tuned by user. Specifically a replica will not perform\n# the failover if, since the last interaction with the primary, the time\n# elapsed is greater than:\n#\n# (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period\n#\n# So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor\n# is 10, and assuming a default repl-ping-replica-period of 10 seconds, the\n# replica will not try to failover if it was not able to talk with the primary\n# for longer than 310 seconds.\n#\n# A large cluster-replica-validity-factor may allow replicas with too old data to failover\n# a primary, while a too small value may prevent the cluster from being able to\n# elect a replica at all.\n#\n# For maximum availability, it is possible to set the cluster-replica-validity-factor\n# to a value of 0, which means, that replicas will always try to failover the\n# primary regardless of the last time they interacted with the primary.\n# (However they'll always try to apply a delay proportional to their\n# offset rank).\n#\n# Zero is the only value able to guarantee that when all the partitions heal\n# the cluster will always be able to continue.\n#\n# cluster-replica-validity-factor 10\n\n# Cluster replicas are able to migrate to orphaned primaries, that are primaries\n# that are left without working replicas. This improves the cluster ability\n# to resist to failures as otherwise an orphaned primary can't be failed over\n# in case of failure if it has no working replicas.\n#\n# Replicas migrate to orphaned primaries only if there are still at least a\n# given number of other working replicas for their old primary. This number\n# is the \"migration barrier\". A migration barrier of 1 means that a replica\n# will migrate only if there is at least 1 other working replica for its primary\n# and so forth. It usually reflects the number of replicas you want for every\n# primary in your cluster.\n#\n# Default is 1 (replicas migrate only if their primaries remain with at least\n# one replica). To disable migration just set it to a very large value or\n# set cluster-allow-replica-migration to 'no'.\n# A value of 0 can be set but is useful only for debugging and dangerous\n# in production.\n#\n# cluster-migration-barrier 1\n\n# Turning off this option allows to use less automatic cluster configuration.\n# It disables migration of replicas to orphaned primaries. Masters that become\n# empty due to losing their last slots to another primary will not automatically\n# replicate from the primary that took over their last slots. Instead, they will\n# remain as empty primaries without any slots.\n#\n# Default is 'yes' (allow automatic migrations).\n#\n# cluster-allow-replica-migration yes\n\n# By default cluster nodes stop accepting queries if they detect there\n# is at least a hash slot uncovered (no available node is serving it).\n# This way if the cluster is partially down (for example a range of hash slots\n# are no longer covered) all the cluster becomes, eventually, unavailable.\n# It automatically returns available as soon as all the slots are covered again.\n#\n# However sometimes you want the subset of the cluster which is working,\n# to continue to accept queries for the part of the key space that is still\n# covered. In order to do so, just set the cluster-require-full-coverage\n# option to no.\n#\n# cluster-require-full-coverage yes\n\n# This option, when set to yes, prevents replicas from trying to failover its\n# primary during primary failures. However the replica can still perform a\n# manual failover, if forced to do so.\n#\n# This is useful in different scenarios, especially in the case of multiple\n# data center operations, where we want one side to never be promoted if not\n# in the case of a total DC failure.\n#\n# cluster-replica-no-failover no\n\n# The timeout in milliseconds for cluster manual failover. If a manual failover\n# does not complete within the specified time, both the replica and the primary\n# will abort it.\n#\n# A manual failover is a special kind of failover that is usually executed when\n# there are no actual failures, and we wish to swap the current primary with one\n# of its replicas in a safe way, without any window for data loss.\n#\n# To avoid data loss, the primary and the replica need to wait for each other for\n# a period of time, the primary need to pause the clients writes to stop processing\n# traffic. The default failover timeout is 5000ms, it is possible to configure the\n# timeout and decide how long the primary will pause in the worst case scenario,\n# i.e. the manual failover timed out due to the insufficient votes.\n#\n# Check https://valkey.io/commands/cluster-failover/ for more information.\n#\n# cluster-manual-failover-timeout 5000\n\n# This option, when set to yes, allows nodes to serve read traffic while the\n# cluster is in a down state, as long as it believes it owns the slots.\n#\n# This is useful for two cases. The first case is for when an application\n# doesn't require consistency of data during node failures or network partitions.\n# One example of this is a cache, where as long as the node has the data it\n# should be able to serve it.\n#\n# The second use case is for configurations that don't meet the recommended\n# three shards but want to enable cluster mode and scale later. A\n# primary outage in a 1 or 2 shard configuration causes a read/write outage to the\n# entire cluster without this option set, with it set there is only a write outage.\n# Without a quorum of primaries, slot ownership will not change automatically.\n#\n# cluster-allow-reads-when-down no\n\n# This option, when set to yes, allows nodes to serve pubsub shard traffic while\n# the cluster is in a down state, as long as it believes it owns the slots.\n#\n# This is useful if the application would like to use the pubsub feature even when\n# the cluster global stable state is not OK. If the application wants to make sure only\n# one shard is serving a given channel, this feature should be kept as yes.\n#\n# cluster-allow-pubsubshard-when-down yes\n\n# Cluster link send buffer limit is the limit on the memory usage of an individual\n# cluster bus link's send buffer in bytes. Cluster links would be freed if they exceed\n# this limit. This is to primarily prevent send buffers from growing unbounded on links\n# toward slow peers (E.g. PubSub messages being piled up).\n# This limit is disabled by default. Enable this limit when 'mem_cluster_links' INFO field\n# and/or 'send-buffer-allocated' entries in the 'CLUSTER LINKS` command output continuously increase.\n# Minimum limit of 1gb is recommended so that cluster link buffer can fit in at least a single\n# PubSub message by default. (client-query-buffer-limit default value is 1gb)\n#\n# cluster-link-sendbuf-limit 0\n\n# Clusters can configure their announced hostname using this config. This is a common use case for\n# applications that need to use TLS Server Name Indication (SNI) or dealing with DNS based\n# routing. By default this value is only shown as additional metadata in the CLUSTER SLOTS\n# command, but can be changed using 'cluster-preferred-endpoint-type' config. This value is\n# communicated along the clusterbus to all nodes, setting it to an empty string will remove\n# the hostname and also propagate the removal.\n#\n# cluster-announce-hostname \"\"\n\n# Clusters can configure an optional nodename to be used in addition to the node ID for\n# debugging and admin information. This name is broadcasted between nodes, so will be used\n# in addition to the node ID when reporting cross node events such as node failures.\n# cluster-announce-human-nodename \"\"\n\n# Clusters can advertise how clients should connect to them using either their IP address,\n# a user defined hostname, or by declaring they have no endpoint. Which endpoint is\n# shown as the preferred endpoint is set by using the cluster-preferred-endpoint-type\n# config with values 'ip', 'hostname', or 'unknown-endpoint'. This value controls how\n# the endpoint returned for MOVED/ASKING requests as well as the first field of CLUSTER SLOTS.\n# If the preferred endpoint type is set to hostname, but no announced hostname is set, a '?'\n# will be returned instead.\n#\n# When a cluster advertises itself as having an unknown endpoint, it's indicating that\n# the server doesn't know how clients can reach the cluster. This can happen in certain\n# networking situations where there are multiple possible routes to the node, and the\n# server doesn't know which one the client took. In this case, the server is expecting\n# the client to reach out on the same endpoint it used for making the last request, but use\n# the port provided in the response.\n#\n# cluster-preferred-endpoint-type ip\n\n# The cluster blacklist is used when removing a node from the cluster completely.\n# When CLUSTER FORGET is called for a node, that node is put into the blacklist for\n# some time so that when gossip messages are received from other nodes that still\n# remember it, it is not re-added. This gives time for CLUSTER FORGET to be sent to\n# every node in the cluster. The blacklist TTL is 60 seconds by default, which should\n# be sufficient for most clusters, but you may considering increasing this if you see\n# nodes getting re-added while using CLUSTER FORGET.\n#\n# cluster-blacklist-ttl 60\n\n# Clusters can be configured to track per-slot resource statistics,\n# which are accessible by the CLUSTER SLOT-STATS command.\n#\n# By default, the 'cluster-slot-stats-enabled' is disabled, and only 'key-count' is captured.\n# By enabling the 'cluster-slot-stats-enabled' config, the cluster will begin to capture advanced statistics.\n# These statistics can be leveraged to assess general slot usage trends, identify hot / cold slots,\n# migrate slots for a balanced cluster workload, and / or re-write application logic to better utilize slots.\n#\n# cluster-slot-stats-enabled no\n\n# In order to setup your cluster make sure to read the documentation\n# available at https://valkey.io web site.\n\n########################## CLUSTER DOCKER/NAT support ########################\n\n# In certain deployments, cluster node's address discovery fails, because\n# addresses are NAT-ted or because ports are forwarded (the typical case is\n# Docker and other containers).\n#\n# In order to make a cluster work in such environments, a static\n# configuration where each node knows its public address is needed. The\n# following options are used for this scope, and are:\n#\n# * cluster-announce-ip\n# * cluster-announce-client-ipv4\n# * cluster-announce-client-ipv6\n# * cluster-announce-port\n# * cluster-announce-tls-port\n# * cluster-announce-bus-port\n#\n# Each instructs the node about its address, possibly other addresses to expose\n# to clients, client ports (for connections without and with TLS) and cluster\n# message bus port. The information is then published in the bus packets so that\n# other nodes will be able to correctly map the address of the node publishing\n# the information.\n#\n# If tls-cluster is set to yes and cluster-announce-tls-port is omitted or set\n# to zero, then cluster-announce-port refers to the TLS port. Note also that\n# cluster-announce-tls-port has no effect if tls-cluster is set to no.\n#\n# If cluster-announce-client-ipv4 and cluster-announce-client-ipv6 are omitted,\n# then cluster-announce-ip is exposed to clients.\n#\n# If the above options are not used, the normal cluster auto-detection\n# will be used instead.\n#\n# Note that when remapped, the bus port may not be at the fixed offset of\n# clients port + 10000, so you can specify any port and bus-port depending\n# on how they get remapped. If the bus-port is not set, a fixed offset of\n# 10000 will be used as usual.\n#\n# Example:\n#\n# cluster-announce-ip 10.1.1.5\n# cluster-announce-client-ipv4 123.123.123.5\n# cluster-announce-client-ipv6 2001:db8::8a2e:370:7334\n# cluster-announce-tls-port 6379\n# cluster-announce-port 0\n# cluster-announce-bus-port 6380\n\n################################## COMMAND LOG ###################################\n\n# The Command Log system is used to record commands that consume significant resources\n# during server operation, including CPU, memory, and network bandwidth.\n# These commands and the data they access may lead to abnormal instance operations,\n# the commandlog can help users quickly and intuitively locate issues.\n#\n# Currently, three types of command logs are supported:\n#\n# SLOW: Logs commands that exceed a specified execution time. This excludes time spent\n# on I/O operations like client communication and focuses solely on the command's\n# processing time, where the main thread is blocked.\n#\n# LARGE-REQUEST: Logs commands with requests exceeding a defined size. This helps\n# identify potentially problematic commands that send excessive data to the server.\n#\n# LARGE-REPLY: Logs commands that generate replies exceeding a defined size. This\n# helps identify commands that return unusually large amounts of data, which may\n# impact network performance or client processing.\n#\n# Each log type has two key parameters:\n# 1. A threshold value that determines when a command is logged. This threshold is specific\n# to the type of log (e.g., execution time, request size, or reply size). A negative value disables\n# logging. A value of 0 logs all commands.\n# 2. A maximum length that specifies the number of entries to retain in the log. Increasing\n# the length allows more entries to be stored but consumes additional memory. To clear all\n# entries for a specific log type and reclaim memory, use the `COMMANDLOG RESET`\n# subcommand followed by the log type.\n#\n# SLOW Command Logs\n# The SLOW log records commands that exceed a specified execution time. The execution time\n# does not include I/O operations, such as client communication or sending responses.\n# It only measures the time spent executing the command, during which the thread is blocked\n# and cannot handle other requests.\n#\n# The threshold is measured in microseconds.\n#\n# Backward Compatibility: The parameter `slowlog-log-slower-than` is still supported but\n# deprecated in favor of `commandlog-slow-execution`.\ncommandlog-execution-slower-than 10000\n# There is no limit to this length. Just be aware that it will consume memory.\n# You can reclaim memory used by the slow log with SLOWLOG RESET or COMMANDLOG RESET SLOW.\ncommandlog-slow-execution-max-len 128\n#\n# LARGE_REQUEST Command Logs\n# The LARGE_REQUEST log tracks commands with requests exceeding a specified size. The request size\n# includes the command itself and all its arguments. For example, in `SET KEY VALUE`, the size is\n# determined by the combined size of the key and value. Commands that consume excessive network\n# bandwidth or query buffer space are recorded here.\n#\n# The threshold is measured in bytes.\ncommandlog-request-larger-than 1048576\n# Record the number of commands.\ncommandlog-large-request-max-len 128\n#\n# LARGE_REPLY Command Logs\n# The LARGE_REPLY log records commands that produce replies exceeding a specified size. These replies\n# may consume significant network bandwidth or client output buffer space. Examples include commands\n# like `KEYS` or `HGETALL` that return large datasets. Even a `GET` command may qualify if the value\n# is substantial.\n#\n# The threshold is measured in bytes.\ncommandlog-reply-larger-than 1048576\ncommandlog-large-reply-max-len 128\n\n################################ LATENCY MONITOR ##############################\n\n# The server latency monitoring subsystem samples different operations\n# at runtime in order to collect data related to possible sources of\n# latency of a server instance.\n#\n# Via the LATENCY command this information is available to the user that can\n# print graphs and obtain reports.\n#\n# The system only logs operations that were performed in a time equal or\n# greater than the amount of milliseconds specified via the\n# latency-monitor-threshold configuration directive. When its value is set\n# to zero, the latency monitor is turned off.\n#\n# By default latency monitoring is disabled since it is mostly not needed\n# if you don't have latency issues, and collecting data has a performance\n# impact, that while very small, can be measured under big load. Latency\n# monitoring can easily be enabled at runtime using the command\n# \"CONFIG SET latency-monitor-threshold \" if needed.\nlatency-monitor-threshold 0\n\n################################ LATENCY TRACKING ##############################\n\n# The server's extended latency monitoring tracks the per command latencies and enables\n# exporting the percentile distribution via the INFO latencystats command,\n# and cumulative latency distributions (histograms) via the LATENCY command.\n#\n# By default, the extended latency monitoring is enabled since the overhead\n# of keeping track of the command latency is very small.\n# latency-tracking yes\n\n# By default the exported latency percentiles via the INFO latencystats command\n# are the p50, p99, and p999.\n# latency-tracking-info-percentiles 50 99 99.9\n\n############################# EVENT NOTIFICATION ##############################\n\n# The server can notify Pub/Sub clients about events happening in the key space.\n# This feature is documented at https://valkey.io/topics/notifications\n#\n# For instance if keyspace events notification is enabled, and a client\n# performs a DEL operation on key \"foo\" stored in the Database 0, two\n# messages will be published via Pub/Sub:\n#\n# PUBLISH __keyspace@0__:foo del\n# PUBLISH __keyevent@0__:del foo\n#\n# It is possible to select the events that the server will notify among a set\n# of classes. Every class is identified by a single character:\n#\n# K Keyspace events, published with __keyspace@__ prefix.\n# E Keyevent events, published with __keyevent@__ prefix.\n# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ...\n# $ String commands\n# l List commands\n# s Set commands\n# h Hash commands\n# z Sorted set commands\n# x Expired events (events generated every time a key expires)\n# e Evicted events (events generated when a key is evicted for maxmemory)\n# n New key events (Note: not included in the 'A' class)\n# t Stream commands\n# d Module key type events\n# m Key-miss events (Note: It is not included in the 'A' class)\n# A Alias for g$lshzxetd, so that the \"AKE\" string means all the events\n# (Except key-miss events which are excluded from 'A' due to their\n# unique nature).\n#\n# The \"notify-keyspace-events\" takes as argument a string that is composed\n# of zero or multiple characters. The empty string means that notifications\n# are disabled.\n#\n# Example: to enable list and generic events, from the point of view of the\n# event name, use:\n#\n# notify-keyspace-events Elg\n#\n# Example 2: to get the stream of the expired keys subscribing to channel\n# name __keyevent@0__:expired use:\n#\n# notify-keyspace-events Ex\n#\n# By default all notifications are disabled because most users don't need\n# this feature and the feature has some overhead. Note that if you don't\n# specify at least one of K or E, no events will be delivered.\nnotify-keyspace-events \"\"\n\n############################### ADVANCED CONFIG ###############################\n\n# Hashes are encoded using a memory efficient data structure when they have a\n# small number of entries, and the biggest entry does not exceed a given\n# threshold. These thresholds can be configured using the following directives.\nhash-max-listpack-entries 512\nhash-max-listpack-value 64\n\n# Lists are also encoded in a special way to save a lot of space.\n# The number of entries allowed per internal list node can be specified\n# as a fixed maximum size or a maximum number of elements.\n# For a fixed maximum size, use -5 through -1, meaning:\n# -5: max size: 64 Kb <-- not recommended for normal workloads\n# -4: max size: 32 Kb <-- not recommended\n# -3: max size: 16 Kb <-- probably not recommended\n# -2: max size: 8 Kb <-- good\n# -1: max size: 4 Kb <-- good\n# Positive numbers mean store up to _exactly_ that number of elements\n# per list node.\n# The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size),\n# but if your use case is unique, adjust the settings as necessary.\nlist-max-listpack-size -2\n\n# Lists may also be compressed.\n# Compress depth is the number of quicklist ziplist nodes from *each* side of\n# the list to *exclude* from compression. The head and tail of the list\n# are always uncompressed for fast push/pop operations. Settings are:\n# 0: disable all list compression\n# 1: depth 1 means \"don't start compressing until after 1 node into the list,\n# going from either the head or tail\"\n# So: [head]->node->node->...->node->[tail]\n# [head], [tail] will always be uncompressed; inner nodes will compress.\n# 2: [head]->[next]->node->node->...->node->[prev]->[tail]\n# 2 here means: don't compress head or head->next or tail->prev or tail,\n# but compress all nodes between them.\n# 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail]\n# etc.\nlist-compress-depth 0\n\n# Sets have a special encoding when a set is composed\n# of just strings that happen to be integers in radix 10 in the range\n# of 64 bit signed integers.\n# The following configuration setting sets the limit in the size of the\n# set in order to use this special memory saving encoding.\nset-max-intset-entries 512\n\n# Sets containing non-integer values are also encoded using a memory efficient\n# data structure when they have a small number of entries, and the biggest entry\n# does not exceed a given threshold. These thresholds can be configured using\n# the following directives.\nset-max-listpack-entries 128\nset-max-listpack-value 64\n\n# Similarly to hashes and lists, sorted sets are also specially encoded in\n# order to save a lot of space. This encoding is only used when the length and\n# elements of a sorted set are below the following limits:\nzset-max-listpack-entries 128\nzset-max-listpack-value 64\n\n# HyperLogLog sparse representation bytes limit. The limit includes the\n# 16 bytes header. When a HyperLogLog using the sparse representation crosses\n# this limit, it is converted into the dense representation.\n#\n# A value greater than 16000 is totally useless, since at that point the\n# dense representation is more memory efficient.\n#\n# The suggested value is ~ 3000 in order to have the benefits of\n# the space efficient encoding without slowing down too much PFADD,\n# which is O(N) with the sparse encoding. The value can be raised to\n# ~ 10000 when CPU is not a concern, but space is, and the data set is\n# composed of many HyperLogLogs with cardinality in the 0 - 15000 range.\nhll-sparse-max-bytes 3000\n\n# Streams macro node max size / items. The stream data structure is a radix\n# tree of big nodes that encode multiple items inside. Using this configuration\n# it is possible to configure how big a single node can be in bytes, and the\n# maximum number of items it may contain before switching to a new node when\n# appending new stream entries. If any of the following settings are set to\n# zero, the limit is ignored, so for instance it is possible to set just a\n# max entries limit by setting max-bytes to 0 and max-entries to the desired\n# value.\nstream-node-max-bytes 4096\nstream-node-max-entries 100\n\n# Active rehashing uses 1% of the CPU time to help perform incremental rehashing\n# of the main server hash tables, the ones mapping top-level keys to values.\n#\n# If active rehashing is disabled and rehashing is needed, a hash table is\n# rehashed one \"step\" on every operation performed on the hash table (add, find,\n# etc.), so if the server is idle, the rehashing may never complete and some\n# more memory is used by the hash tables. Active rehashing helps prevent this.\n#\n# Active rehashing runs as a background task. Depending on the value of 'hz',\n# the frequency at which the server performs background tasks, active rehashing\n# can cause the server to freeze for a short time. For example, if 'hz' is set\n# to 10, active rehashing runs for up to one millisecond every 100 milliseconds.\n# If a freeze of one millisecond is not acceptable, you can increase 'hz' to let\n# active rehashing run more often. If instead 'hz' is set to 100, active\n# rehashing runs up to only 100 microseconds every 10 milliseconds. The total is\n# still 1% of the time.\nactiverehashing yes\n\n# The client output buffer limits can be used to force disconnection of clients\n# that are not reading data from the server fast enough for some reason (a\n# common reason is that a Pub/Sub client can't consume messages as fast as the\n# publisher can produce them).\n#\n# The limit can be set differently for the three different classes of clients:\n#\n# normal -> normal clients including MONITOR clients\n# replica -> replica clients\n# pubsub -> clients subscribed to at least one pubsub channel or pattern\n#\n# The syntax of every client-output-buffer-limit directive is the following:\n#\n# client-output-buffer-limit \n#\n# A client is immediately disconnected once the hard limit is reached, or if\n# the soft limit is reached and remains reached for the specified number of\n# seconds (continuously).\n# So for instance if the hard limit is 32 megabytes and the soft limit is\n# 16 megabytes / 10 seconds, the client will get disconnected immediately\n# if the size of the output buffers reach 32 megabytes, but will also get\n# disconnected if the client reaches 16 megabytes and continuously overcomes\n# the limit for 10 seconds.\n#\n# By default normal clients are not limited because they don't receive data\n# without asking (in a push way), but just after a request, so only\n# asynchronous clients may create a scenario where data is requested faster\n# than it can read.\n#\n# Instead there is a default limit for pubsub and replica clients, since\n# subscribers and replicas receive data in a push fashion.\n#\n# Note that it doesn't make sense to set the replica clients output buffer\n# limit lower than the repl-backlog-size config (partial sync will succeed\n# and then replica will get disconnected).\n# Such a configuration is ignored (the size of repl-backlog-size will be used).\n# This doesn't have memory consumption implications since the replica client\n# will share the backlog buffers memory.\n#\n# Both the hard or the soft limit can be disabled by setting them to zero.\nclient-output-buffer-limit normal 0 0 0\nclient-output-buffer-limit replica 256mb 64mb 60\nclient-output-buffer-limit pubsub 32mb 8mb 60\n\n# Client query buffers accumulate new commands. They are limited to a fixed\n# amount by default in order to avoid that a protocol desynchronization (for\n# instance due to a bug in the client) will lead to unbound memory usage in\n# the query buffer. However you can configure it here if you have very special\n# needs, such as a command with huge argument, or huge multi/exec requests or alike.\n#\n# client-query-buffer-limit 1gb\n\n# In some scenarios client connections can hog up memory leading to OOM\n# errors or data eviction. To avoid this we can cap the accumulated memory\n# used by all client connections (all pubsub and normal clients). Once we\n# reach that limit connections will be dropped by the server freeing up\n# memory. The server will attempt to drop the connections using the most\n# memory first. We call this mechanism \"client eviction\".\n#\n# Client eviction is configured using the maxmemory-clients setting as follows:\n# 0 - client eviction is disabled (default)\n#\n# A memory value can be used for the client eviction threshold,\n# for example:\n# maxmemory-clients 1g\n#\n# A percentage value (between 1% and 100%) means the client eviction threshold\n# is based on a percentage of the maxmemory setting. For example to set client\n# eviction at 5% of maxmemory:\n# maxmemory-clients 5%\n\n# In the server protocol, bulk requests, that are, elements representing single\n# strings, are normally limited to 512 mb. However you can change this limit\n# here, but must be 1mb or greater\n#\n# proto-max-bulk-len 512mb\n\n# The server calls an internal function to perform many background tasks, like\n# closing connections of clients in timeout, purging expired keys that are\n# never requested, and so forth.\n#\n# Not all tasks are performed with the same frequency, but the server checks for\n# tasks to perform according to the specified \"hz\" value.\n#\n# By default \"hz\" is set to 10. Raising the value will use more CPU when\n# the server is idle, but at the same time will make the server more responsive when\n# there are many keys expiring at the same time, and timeouts may be\n# handled with more precision.\n#\n# The range is between 1 and 500, however a value over 100 is usually not\n# a good idea. Most users should use the default of 10 and raise this up to\n# 100 only in environments where very low latency is required.\nhz 10\n\n# When a child rewrites the AOF file, if the following option is enabled\n# the file will be fsync-ed every 4 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\naof-rewrite-incremental-fsync yes\n\n# When the server saves RDB file, if the following option is enabled\n# the file will be fsync-ed every 4 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\nrdb-save-incremental-fsync yes\n\n# The server's LFU eviction (see maxmemory setting) can be tuned. However it is a good\n# idea to start with the default settings and only change them after investigating\n# how to improve the performances and how the keys LFU change over time, which\n# is possible to inspect via the OBJECT FREQ command.\n#\n# There are two tunable parameters in the server LFU implementation: the\n# counter logarithm factor and the counter decay time. It is important to\n# understand what the two parameters mean before changing them.\n#\n# The LFU counter is just 8 bits per key, it's maximum value is 255, so the server\n# uses a probabilistic increment with logarithmic behavior. Given the value\n# of the old counter, when a key is accessed, the counter is incremented in\n# this way:\n#\n# 1. A random number R between 0 and 1 is extracted.\n# 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1).\n# 3. The counter is incremented only if R < P.\n#\n# The default lfu-log-factor is 10. This is a table of how the frequency\n# counter changes with a different number of accesses with different\n# logarithmic factors:\n#\n# +--------+------------+------------+------------+------------+------------+\n# | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits |\n# +--------+------------+------------+------------+------------+------------+\n# | 0 | 104 | 255 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 1 | 18 | 49 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 10 | 10 | 18 | 142 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 100 | 8 | 11 | 49 | 143 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n#\n# NOTE: The above table was obtained by running the following commands:\n#\n# valkey-benchmark -n 1000000 incr foo\n# valkey-cli object freq foo\n#\n# NOTE 2: The counter initial value is 5 in order to give new objects a chance\n# to accumulate hits.\n#\n# The counter decay time is the time, in minutes, that must elapse in order\n# for the key counter to be decremented.\n#\n# The default value for the lfu-decay-time is 1. A special value of 0 means we\n# will never decay the counter.\n#\n# lfu-log-factor 10\n# lfu-decay-time 1\n\n\n# The maximum number of new client connections accepted per event-loop cycle. This configuration\n# is set independently for TLS connections.\n#\n# By default, up to 10 new connection will be accepted per event-loop cycle for normal connections\n# and up to 1 new connection per event-loop cycle for TLS connections.\n#\n# Adjusting this to a larger number can slightly improve efficiency for new connections\n# at the risk of causing timeouts for regular commands on established connections. It is\n# not advised to change this without ensuring that all clients have limited connection\n# pools and exponential backoff in the case of command/connection timeouts.\n#\n# If your application is establishing a large number of new connections per second you should\n# also consider tuning the value of tcp-backlog, which allows the kernel to buffer more\n# pending connections before dropping or rejecting connections.\n#\n# max-new-connections-per-cycle 10\n# max-new-tls-connections-per-cycle 1\n\n\n########################### ACTIVE DEFRAGMENTATION #######################\n#\n# What is active defragmentation?\n# -------------------------------\n#\n# Active (online) defragmentation allows a server to compact the\n# spaces left between small allocations and deallocations of data in memory,\n# thus allowing to reclaim back memory.\n#\n# Fragmentation is a natural process that happens with every allocator (but\n# less so with Jemalloc, fortunately) and certain workloads. Normally a server\n# restart is needed in order to lower the fragmentation, or at least to flush\n# away all the data and create it again. However thanks to this feature, this\n# process can happen at runtime in a \"hot\" way, while the server is running.\n#\n# Basically when the fragmentation is over a certain level (see the\n# configuration options below) the server will start to create new copies of the\n# values in contiguous memory regions by exploiting certain specific Jemalloc\n# features (in order to understand if an allocation is causing fragmentation\n# and to allocate it in a better place), and at the same time, will release the\n# old copies of the data. This process, repeated incrementally for all the keys\n# will cause the fragmentation to drop back to normal values.\n#\n# Important things to understand:\n#\n# 1. This feature is disabled by default, and only works if you compiled the server\n# to use the copy of Jemalloc we ship with the source code of the server.\n# This is the default with Linux builds.\n#\n# 2. You never need to enable this feature if you don't have fragmentation\n# issues.\n#\n# 3. Once you experience fragmentation, you can enable this feature when\n# needed with the command \"CONFIG SET activedefrag yes\".\n#\n# The configuration parameters are able to fine tune the behavior of the\n# defragmentation process. If you are not sure about what they mean it is\n# a good idea to leave the defaults untouched.\n\n# Active defragmentation is disabled by default\n# activedefrag no\n\n# Minimum amount of fragmentation waste to start active defrag\n# active-defrag-ignore-bytes 100mb\n\n# Minimum percentage of fragmentation to start active defrag\n# active-defrag-threshold-lower 10\n\n# Maximum percentage of fragmentation at which we use maximum effort\n# active-defrag-threshold-upper 100\n\n# Minimal effort for defrag in CPU percentage, not cycle time as the name might\n# suggest, to be used when the lower threshold is reached.\n# active-defrag-cycle-min 1\n\n# Maximal effort for defrag in CPU percentage, not cycle time as the name might\n# suggest, to be used when the upper threshold is reached.\n# active-defrag-cycle-max 25\n\n# Maximum number of set/hash/zset/list fields that will be processed from\n# the main dictionary scan\n# active-defrag-max-scan-fields 1000\n\n# The time spent (in microseconds) of the periodic active defrag process. This\n# affects the latency impact of active defrag on client commands. Smaller numbers\n# will result in less latency impact at the cost of increased defrag overhead.\n# active-defrag-cycle-us 500\n\n# Jemalloc background thread for purging will be enabled by default\njemalloc-bg-thread yes\n\n# It is possible to pin different threads and processes of the server to specific\n# CPUs in your system, in order to maximize the performances of the server.\n# This is useful both in order to pin different server threads in different\n# CPUs, but also in order to make sure that multiple server instances running\n# in the same host will be pinned to different CPUs.\n#\n# Normally you can do this using the \"taskset\" command, however it is also\n# possible to do this via the server configuration directly, both in Linux and FreeBSD.\n#\n# You can pin the server/IO threads, bio threads, aof rewrite child process, and\n# the bgsave child process. The syntax to specify the cpu list is the same as\n# the taskset command:\n#\n# Set server/io threads to cpu affinity 0,2,4,6:\n# server-cpulist 0-7:2\n#\n# Set bio threads to cpu affinity 1,3:\n# bio-cpulist 1,3\n#\n# Set aof rewrite child process to cpu affinity 8,9,10,11:\n# aof-rewrite-cpulist 8-11\n#\n# Set bgsave child process to cpu affinity 1,10,11\n# bgsave-cpulist 1,10-11\n\n# In some cases the server will emit warnings and even refuse to start if it detects\n# that the system is in bad state, it is possible to suppress these warnings\n# by setting the following config which takes a space delimited list of warnings\n# to suppress\n#\n# ignore-warnings ARM64-COW-BUG\n\n# Inform Valkey of the availability zone if running in a cloud environment. Currently\n# this is exposed in the INFO and HELLO commands for clients to use. Default is\n# the empty string.\n#\n# availability-zone \"zone-name\"\n" }, { "path": "aegir/conf/valkey/valkey9.conf", "content": "# Valkey configuration file example.\n#\n# Note that in order to read the configuration file, the server must be\n# started with the file path as first argument:\n#\n# ./valkey-server /path/to/valkey.conf\n\n# Note on units: when memory size is needed, it is possible to specify\n# it in the usual form of 1k 5GB 4M and so forth:\n#\n# 1k => 1000 bytes\n# 1kb => 1024 bytes\n# 1m => 1000000 bytes\n# 1mb => 1024*1024 bytes\n# 1g => 1000000000 bytes\n# 1gb => 1024*1024*1024 bytes\n#\n# units are case insensitive so 1GB 1Gb 1gB are all the same.\n\n################################## INCLUDES ###################################\n\n# Include one or more other config files here. This is useful if you\n# have a standard template that goes to all servers but also need\n# to customize a few per-server settings. Include files can include\n# other files, so use this wisely.\n#\n# Note that option \"include\" won't be rewritten by command \"CONFIG REWRITE\"\n# from admin or Sentinel. Since the server always uses the last processed\n# line as value of a configuration directive, you'd better put includes\n# at the beginning of this file to avoid overwriting config change at runtime.\n#\n# If instead you are interested in using includes to override configuration\n# options, it is better to use include as the last line.\n#\n# Included paths may contain wildcards. All files matching the wildcards will\n# be included in alphabetical order.\n# Note that if an include path contains a wildcards but no files match it when\n# the server is started, the include statement will be ignored and no error will\n# be emitted. It is safe, therefore, to include wildcard files from empty\n# directories.\n#\n# include /path/to/local.conf\n# include /path/to/other.conf\n# include /path/to/fragments/*.conf\n#\n\n################################## MODULES #####################################\n\n# Load modules at startup. If the server is not able to load modules\n# it will abort. It is possible to use multiple loadmodule directives.\n#\n# loadmodule /path/to/my_module.so\n# loadmodule /path/to/other_module.so\n# loadmodule /path/to/args_module.so [arg [arg ...]]\n\n################################## NETWORK #####################################\n\n# By default, if no \"bind\" configuration directive is specified, the server listens\n# for connections from all available network interfaces on the host machine.\n# It is possible to listen to just one or multiple selected interfaces using\n# the \"bind\" configuration directive, followed by one or more IP addresses.\n# Each address can be prefixed by \"-\", which means that the server will not fail to\n# start if the address is not available. Being not available only refers to\n# addresses that does not correspond to any network interface. Addresses that\n# are already in use will always fail, and unsupported protocols will always be\n# silently skipped.\n#\n# Examples:\n#\n# xbind 192.168.1.100 10.0.0.1 # listens on two specific IPv4 addresses\n# xbind 127.0.0.1 ::1 # listens on loopback IPv4 and IPv6\n# xbind * -::* # like the default, all available interfaces\n#\n# ~~~ WARNING ~~~ If the computer running the server is directly exposed to the\n# internet, binding to all the interfaces is dangerous and will expose the\n# instance to everybody on the internet. So by default we uncomment the\n# following bind directive, that will force the server to listen only on the\n# IPv4 and IPv6 (if available) loopback interface addresses (this means the server\n# will only be able to accept client connections from the same host that it is\n# running on).\n#\n# IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES\n# COMMENT OUT THE FOLLOWING LINE.\n#\n# You will also need to set a password unless you explicitly disable protected\n# mode.\n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nbind 127.0.0.1\n\n# By default, outgoing connections (from replica to primary, from Sentinel to\n# instances, cluster bus, etc.) are not bound to a specific local address. In\n# most cases, this means the operating system will handle that based on routing\n# and the interface through which the connection goes out.\n#\n# Using bind-source-addr it is possible to configure a specific address to bind\n# to, which may also affect how the connection gets routed.\n#\n# Example:\n#\n# bind-source-addr 10.0.0.1\n\n# Protected mode is a layer of security protection, in order to avoid that\n# the server instances left open on the internet are accessed and exploited.\n#\n# When protected mode is on and the default user has no password, the server\n# only accepts local connections from the IPv4 address (127.0.0.1), IPv6 address\n# (::1) or Unix domain sockets.\n#\n# By default protected mode is enabled. You should disable it only if\n# you are sure you want clients from other hosts to connect to the server\n# even if no authentication is configured.\nprotected-mode yes\n\n# The server uses default hardened security configuration directives to reduce the\n# attack surface on innocent users. Therefore, several sensitive configuration\n# directives are immutable, and some potentially-dangerous commands are blocked.\n#\n# Configuration directives that control files that the server writes to (e.g., 'dir'\n# and 'dbfilename') and that aren't usually modified during runtime\n# are protected by making them immutable.\n#\n# Commands that can increase the attack surface of the server and that aren't usually\n# called by users are blocked by default.\n#\n# These can be exposed to either all connections or just local ones by setting\n# each of the configs listed below to either of these values:\n#\n# no - Block for any connection (remain immutable)\n# yes - Allow for any connection (no protection)\n# local - Allow only for local connections. Ones originating from the\n# IPv4 address (127.0.0.1), IPv6 address (::1) or Unix domain sockets.\n#\n# enable-protected-configs no\n# enable-debug-command no\n# enable-module-command no\n\n# Accept connections on the specified port, default is 6379 (IANA #815344).\n# If port 0 is specified the server will not listen on a TCP socket.\nport 6379\n\n# TCP listen() backlog.\n#\n# In high requests-per-second environments you need a high backlog in order\n# to avoid slow clients connection issues. Note that the Linux kernel\n# will silently truncate it to the value of /proc/sys/net/core/somaxconn so\n# make sure to raise both the value of somaxconn and tcp_max_syn_backlog\n# in order to get the desired effect.\ntcp-backlog 511\n\n# Multipath TCP (MPTCP)\n#\n# MPTCP splits a single TCP connection into subflows over multiple interfaces or paths.\n# It enables bandwidth aggregation, failover, and improved reliability.\n# When set to 'yes', clients will be able to use MPTCP if requested. When not\n# requested, regular TCP can be used like before.\n# Note: MPTCP is supported in the mainline Linux kernel starting from version 5.6.\n#\n# mptcp yes\n\n# Unix socket.\n#\n# Specify the path for the Unix socket that will be used to listen for\n# incoming connections. There is no default, so the server will not listen\n# on a unix socket when not specified.\n#\n# unixsocket /run/valkey/valkey.sock\n# unixsocketgroup valkey\n# unixsocketperm 777\n\n# Close the connection after a client is idle for N seconds (0 to disable)\ntimeout 900\n\n# TCP keepalive.\n#\n# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence\n# of communication. This is useful for two reasons:\n#\n# 1) Detect dead peers.\n# 2) Force network equipment in the middle to consider the connection to be\n# alive.\n#\n# On Linux, the specified value (in seconds) is the period used to send ACKs.\n# Note that to close the connection the double of the time is needed.\n# On other kernels the period depends on the kernel configuration.\ntcp-keepalive 300\n\n# Apply OS-specific mechanism to mark the listening socket with the specified\n# ID, to support advanced routing and filtering capabilities.\n#\n# On Linux, the ID represents a connection mark.\n# On FreeBSD, the ID represents a socket cookie ID.\n# On OpenBSD, the ID represents a route table ID.\n#\n# The default value is 0, which implies no marking is required.\n# socket-mark-id 0\n\n################################# TLS/SSL #####################################\n\n# By default, TLS/SSL is disabled. To enable it, the \"tls-port\" configuration\n# directive can be used to define TLS-listening ports. To enable TLS on the\n# default port, use:\n#\n# port 0\n# tls-port 6379\n\n# Configure a X.509 certificate and private key to use for authenticating the\n# server to connected clients, primaries or cluster peers. These files should be\n# PEM formatted.\n#\n# tls-cert-file valkey.crt\n# tls-key-file valkey.key\n#\n# If the key file is encrypted using a passphrase, it can be included here\n# as well.\n#\n# tls-key-file-pass secret\n\n# Normally the server uses the same certificate for both server functions (accepting\n# connections) and client functions (replicating from a primary, establishing\n# cluster bus connections, etc.).\n#\n# Sometimes certificates are issued with attributes that designate them as\n# client-only or server-only certificates. In that case it may be desired to use\n# different certificates for incoming (server) and outgoing (client)\n# connections. To do that, use the following directives:\n#\n# tls-client-cert-file client.crt\n# tls-client-key-file client.key\n#\n# If the key file is encrypted using a passphrase, it can be included here\n# as well.\n#\n# tls-client-key-file-pass secret\n\n# Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange,\n# required by older versions of OpenSSL (<3.0). Newer versions do not require\n# this configuration and recommend against it.\n#\n# tls-dh-params-file valkey.dh\n\n# Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL\n# clients and peers. The server requires an explicit configuration of at least one\n# of these, and will not implicitly use the system wide configuration.\n#\n# tls-ca-cert-file ca.crt\n# tls-ca-cert-dir /etc/ssl/certs\n\n# By default, clients (including replica servers) on a TLS port are required\n# to authenticate using valid client side certificates.\n#\n# If \"no\" is specified, client certificates are not required and not accepted.\n# If \"optional\" is specified, client certificates are accepted and must be\n# valid if provided, but are not required.\n#\n# tls-auth-clients no\n# tls-auth-clients optional\n\n# Automatically authenticate TLS clients as Valkey users based on their\n# certificates.\n#\n# If set to a field like \"CN\", the server will extract the corresponding field\n# from the client's TLS certificate and attempt to find a Valkey user with the\n# same name. If a matching user is found, the client is automatically\n# authenticated as that user during the TLS handshake. If no matching user is\n# found, the client is connected as the unauthenticated default user. Set to\n# \"off\" to disable automatic user authentication via certificate fields.\n#\n# Supported values: CN, off. Default: off.\n#\n# tls-auth-clients-user CN\n\n# By default, a replica does not attempt to establish a TLS connection\n# with its primary.\n#\n# Use the following directive to enable TLS on replication links.\n#\n# tls-replication yes\n\n# By default, the cluster bus uses a plain TCP connection. To enable\n# TLS for the bus protocol, use the following directive:\n#\n# tls-cluster yes\n\n# By default, only TLSv1.2 and TLSv1.3 are enabled and it is highly recommended\n# that older formally deprecated versions are kept disabled to reduce the attack surface.\n# You can explicitly specify TLS versions to support.\n# Allowed values are case insensitive and include \"TLSv1\", \"TLSv1.1\", \"TLSv1.2\",\n# \"TLSv1.3\" (OpenSSL >= 1.1.1) or any combination.\n# To enable only TLSv1.2 and TLSv1.3, use:\n#\n# tls-protocols \"TLSv1.2 TLSv1.3\"\n\n# Configure allowed ciphers. See the ciphers(1ssl) manpage for more information\n# about the syntax of this string.\n#\n# Note: this configuration applies only to <= TLSv1.2.\n#\n# tls-ciphers DEFAULT:!MEDIUM\n\n# Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more\n# information about the syntax of this string, and specifically for TLSv1.3\n# ciphersuites.\n#\n# tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256\n\n# When choosing a cipher, use the server's preference instead of the client\n# preference. By default, the server follows the client's preference.\n#\n# tls-prefer-server-ciphers yes\n\n# By default, TLS session caching is enabled to allow faster and less expensive\n# reconnections by clients that support it. Use the following directive to disable\n# caching.\n#\n# tls-session-caching no\n\n# Change the default number of TLS sessions cached. A zero value sets the cache\n# to unlimited size. The default size is 20480.\n#\n# tls-session-cache-size 5000\n\n# Change the default timeout of cached TLS sessions. The default timeout is 300\n# seconds.\n#\n# tls-session-cache-timeout 60\n\n################################### RDMA ######################################\n\n# Valkey Over RDMA is experimental, it may be changed or be removed in any minor or major version.\n# By default, RDMA is disabled. To enable it, the \"rdma-port\" configuration\n# directive can be used to define RDMA-listening ports.\n#\n# rdma-port 6379\n# rdma-bind 192.168.1.100\n\n# The RDMA receive transfer buffer is 1M by default. It can be set between 64K and 16M.\n# Note that page size aligned size is preferred.\n#\n# rdma-rx-size 1048576\n\n# The RDMA completion queue will use the completion vector to signal completion events\n# via hardware interrupts. A large number of hardware interrupts can affect CPU performance.\n# It is possible to tune the performance using rdma-completion-vector.\n#\n# Example 1. a) Pin hardware interrupt vectors [0, 3] to CPU [0, 3].\n# b) Set CPU affinity for valkey to CPU [4, X].\n# c) Any valkey server uses a random RDMA completion vector [-1].\n# All valkey servers will not affect each other and will be isolated from kernel interrupts.\n#\n# SYS SYS SYS SYS VALKEY VALKEY VALKEY\n# | | | | | | |\n# CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 ... CPUX\n# | | | |\n# INTR0 INTR1 INTR2 INTR3\n#\n# Example 2. a) 1:1 pin hardware interrupt vectors [0, X] to CPU [0, X].\n# b) Set CPU affinity for valkey [M] to CPU [M].\n# c) Valkey server [M] uses RDMA completion vector [M].\n# A single CPU [M] handles hardware interrupts, the RDMA completion vector [M],\n# and the valkey server [M] within its context only.\n# This avoids overhead and function calls across multiple CPUs, fully isolating\n# each valkey server from one another.\n#\n# VALKEY VALKEY VALKEY VALKEY VALKEY VALKEY VALKEY\n# | | | | | | |\n# CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 ... CPUX\n# | | | | | | |\n# INTR0 INTR1 INTR2 INTR3 INTR4 INTR5 INTRX\n#\n# Use 0 and positive numbers to specify the RDMA completion vector, or specify -1 to allow\n# the server to use a random vector for a new connection. The default vector is -1.\n#\n# rdma-completion-vector 0\n\n################################# GENERAL #####################################\n\n# By default the server does not run as a daemon. Use 'yes' if you need it.\n# Note that the server will write a pid file in /run/valkey/valkey.pid when daemonized.\n# When the server is supervised by upstart or systemd, this parameter has no impact.\ndaemonize yes\n\n# If you run the server from upstart or systemd, the server can interact with your\n# supervision tree. Options:\n# supervised no - no supervision interaction\n# supervised upstart - signal upstart by putting the server into SIGSTOP mode\n# requires \"expect stop\" in your upstart job config\n# supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET\n# on startup, and updating the server status on a regular\n# basis.\n# supervised auto - detect upstart or systemd method based on\n# UPSTART_JOB or NOTIFY_SOCKET environment variables\n# Note: these supervision methods only signal \"process is ready.\"\n# They do not enable continuous pings back to your supervisor.\n#\n# The default is \"no\". To run under upstart/systemd, you can simply uncomment\n# the line below:\n#\n# supervised auto\n\n# If a pid file is specified, the server writes it where specified at startup\n# and removes it at exit.\n#\n# When the server runs non daemonized, no pid file is created if none is\n# specified in the configuration. When the server is daemonized, the pid file\n# is used even if not specified, defaulting to \"/run/valkey/valkey.pid\".\n#\n# Creating a pid file is best effort: if the server is not able to create it\n# nothing bad happens, the server will start and run normally.\n#\n# Note that on modern Linux systems \"/run/valkey/valkey.pid\" is more conforming\n# and should be used instead.\npidfile /run/valkey/valkey.pid\n\n# Specify the server verbosity level.\n# This can be one of:\n# debug (a lot of information, useful for development/testing)\n# verbose (many rarely useful info, but not a mess like the debug level)\n# notice (moderately verbose, what you want in production probably)\n# warning (only very important / critical messages are logged)\n# nothing (nothing is logged)\nloglevel warning\n\n# Specify the logging format.\n# This can be one of:\n#\n# - legacy: the default, traditional log format\n# - logfmt: a structured log format; see https://www.brandur.org/logfmt\n#\n# log-format legacy\n\n# Specify the timestamp format used in logs using 'log-timestamp-format'.\n#\n# - legacy: default format\n# - iso8601: ISO 8601 extended date and time with time zone, on the form\n# yyyy-mm-ddThh:mm:ss.sss±hh:mm\n# - milliseconds: milliseconds since the epoch\n#\n# log-timestamp-format legacy\n\n# Specify the log file name. Also the empty string can be used to force\n# the server to log on the standard output. Note that if you use standard\n# output for logging but daemonize, logs will be sent to /dev/null\nlogfile /var/log/valkey/valkey-server.log\n\n# To enable logging to the system logger, just set 'syslog-enabled' to yes,\n# and optionally update the other syslog parameters to suit your needs.\n# syslog-enabled no\n\n# Specify the syslog identity.\n# syslog-ident valkey\n\n# Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.\n# syslog-facility local0\n\n# To disable the built in crash log, which will possibly produce cleaner core\n# dumps when they are needed, uncomment the following:\n#\n# crash-log-enabled no\n\n# To disable the fast memory check that's run as part of the crash log, which\n# will possibly let the server terminate sooner, uncomment the following:\n#\n# crash-memcheck-enabled no\n\n# Set the number of databases. The default database is DB 0, you can select\n# a different one on a per-connection basis using SELECT where\n# dbid is a number between 0 and 'databases'-1\n# Note: This setting is ignored in cluster mode. Use `cluster-databases` instead.\ndatabases 8\n\n# By default the server shows an ASCII art logo only when started to log to the\n# standard output and if the standard output is a TTY and syslog logging is\n# disabled. Basically this means that normally a logo is displayed only in\n# interactive sessions.\n#\n# However it is possible to force the pre-4.0 behavior and always show a\n# ASCII art logo in startup logs by setting the following option to yes.\nalways-show-logo no\n\n# User data, including keys, values, client names, and ACL usernames, can be\n# logged as part of assertions and other error cases. To prevent sensitive user\n# information, such as PII, from being recorded in the server log file, this\n# user data is hidden from the log by default. If you need to log user data for\n# debugging or troubleshooting purposes, you can disable this feature by\n# changing the config value to no.\nhide-user-data-from-log yes\n\n# By default, the server modifies the process title (as seen in 'top' and 'ps') to\n# provide some runtime information. It is possible to disable this and leave\n# the process name as executed by setting the following to no.\nset-proc-title yes\n\n# When changing the process title, the server uses the following template to construct\n# the modified title.\n#\n# Template variables are specified in curly brackets. The following variables are\n# supported:\n#\n# {title} Name of process as executed if parent, or type of child process.\n# {listen-addr} Bind address or '*' followed by TCP or TLS port listening on, or\n# Unix socket if only that's available.\n# {server-mode} Special mode, i.e. \"[sentinel]\" or \"[cluster]\".\n# {port} TCP port listening on, or 0.\n# {tls-port} TLS port listening on, or 0.\n# {unixsocket} Unix domain socket listening on, or \"\".\n# {config-file} Name of configuration file used.\n#\nproc-title-template \"{title} {listen-addr} {server-mode}\"\n\n# Set the local environment which is used for string comparison operations, and\n# also affect the performance of Lua scripts. Empty String indicates the locale\n# is derived from the environment variables.\nlocale-collate \"\"\n\n# Valkey is largely compatible with Redis OSS, apart from a few cases where\n# Valkey identifies itself as \"Valkey\" rather than \"Redis\". Extended\n# Redis OSS compatibility mode makes Valkey pretend to be Redis. Enable this\n# only if you have problems with tools or clients. This is a temporary\n# configuration added in Valkey 8.0 and is scheduled to have no effect and\n# will be removed in a future version.\n#\nextended-redis-compatibility yes\n\n################################ SNAPSHOTTING ################################\n\n# Save the DB to disk.\n#\n# save [ ...]\n#\n# The server will save the DB if the given number of seconds elapsed and it\n# surpassed the given number of write operations against the DB.\n#\n# Snapshotting can be completely disabled with a single empty string argument\n# as in following example:\n#\nsave \"\"\n#\n# Unless specified otherwise, by default the server will save the DB:\n# * After 3600 seconds (an hour) if at least 1 change was performed\n# * After 300 seconds (5 minutes) if at least 100 changes were performed\n# * After 60 seconds if at least 10000 changes were performed\n#\n# You can set these explicitly by uncommenting the following line.\n#\n# save 3600 1 300 100 60 10000\n\n# By default the server will stop accepting writes if RDB snapshots are enabled\n# (at least one save point) and the latest background save failed.\n# This will make the user aware (in a hard way) that data is not persisting\n# on disk properly, otherwise chances are that no one will notice and some\n# disaster will happen.\n#\n# If the background saving process will start working again, the server will\n# automatically allow writes again.\n#\n# However if you have setup your proper monitoring of the server\n# and persistence, you may want to disable this feature so that the server will\n# continue to work as usual even if there are problems with disk,\n# permissions, and so forth.\nstop-writes-on-bgsave-error no\n\n# Compress string objects using LZF when dump .rdb databases?\n# By default compression is enabled as it's almost always a win.\n# If you want to save some CPU in the saving child set it to 'no' but\n# the dataset will likely be bigger if you have compressible values or keys.\nrdbcompression yes\n\n# Since version 5 of RDB a CRC64 checksum is placed at the end of the file.\n# This makes the format more resistant to corruption but there is a performance\n# hit to pay (around 10%) when saving and loading RDB files, so you can disable it\n# for maximum performances.\n#\n# RDB files created with checksum disabled have a checksum of zero that will\n# tell the loading code to skip the check.\nrdbchecksum no\n\n# Valkey can try to load an RDB dump produced by a future version of Valkey.\n# This can only work on a best-effort basis, because future RDB versions may\n# contain information that's not known to the current version. If no new features\n# are used, it may be possible to import the data produced by a later version,\n# but loading is aborted if unknown information is encountered. Possible values\n# are 'strict' and 'relaxed'. This also applies to replication and the RESTORE\n# command.\nrdb-version-check relaxed\n\n# Enables or disables full sanitization checks for ziplist and listpack etc when\n# loading an RDB or RESTORE payload. This reduces the chances of a assertion or\n# crash later on while processing commands.\n# Options:\n# no - Never perform full sanitization\n# yes - Always perform full sanitization\n# clients - Perform full sanitization only for user connections.\n# Excludes: RDB files, RESTORE commands received from the primary\n# connection, and client connections which have the\n# skip-sanitize-payload ACL flag.\n# The default should be 'clients' but since it currently affects cluster\n# resharding via MIGRATE, it is temporarily set to 'no' by default.\n#\n# sanitize-dump-payload no\n\n# The filename where to dump the DB\ndbfilename dump.rdb\n\n# Remove RDB files used by replication in instances without persistence\n# enabled. By default this option is disabled, however there are environments\n# where for regulations or other security concerns, RDB files persisted on\n# disk by primaries in order to feed replicas, or stored on disk by replicas\n# in order to load them for the initial synchronization, should be deleted\n# ASAP. Note that this option ONLY WORKS in instances that have both AOF\n# and RDB persistence disabled, otherwise is completely ignored.\n#\n# An alternative (and sometimes better) way to obtain the same effect is\n# to use diskless replication on both primary and replicas instances. However\n# in the case of replicas, diskless is not always an option.\nrdb-del-sync-files no\n\n# The working directory.\n#\n# The server log is written relative this directory, if the 'logfile'\n# configuration directive is a relative path.\n#\n# The DB will be written inside this directory, with the filename specified\n# above using the 'dbfilename' configuration directive.\n#\n# The Append Only File will also be created inside this directory.\n#\n# The Cluster config file is written relative this directory, if the\n# 'cluster-config-file' configuration directive is a relative path.\n#\n# Note that you must specify a directory here, not a file name.\n# Note that modifying 'dir' during runtime may have unexpected behavior,\n# for example when a child process is running, related file operations may\n# have unexpected effects.\ndir /var/lib/valkey/\n\n################################# REPLICATION #################################\n\n# Master-Replica replication. Use replicaof to make a server a copy of\n# another server. A few things to understand ASAP about replication.\n#\n# +------------------+ +---------------+\n# | Master | ---> | Replica |\n# | (receive writes) | | (exact copy) |\n# +------------------+ +---------------+\n#\n# 1) Replication is asynchronous, but you can configure a primary to\n# stop accepting writes if it appears to be not connected with at least\n# a given number of replicas.\n# 2) Replicas are able to perform a partial resynchronization with the\n# primary if the replication link is lost for a relatively small amount of\n# time. You may want to configure the replication backlog size (see the next\n# sections of this file) with a sensible value depending on your needs.\n# 3) Replication is automatic and does not need user intervention. After a\n# network partition replicas automatically try to reconnect to primaries\n# and resynchronize with them.\n#\n# replicaof \n\n# If the primary is password protected (using the \"requirepass\" configuration\n# directive below) it is possible to tell the replica to authenticate before\n# starting the replication synchronization process, otherwise the primary will\n# refuse the replica request.\n#\n# primaryauth \n#\n# However this is not enough if you are using ACLs\n# and the default user is not capable of running the PSYNC\n# command and/or other commands needed for replication. In this case it's\n# better to configure a special user to use with replication, and specify the\n# primaryuser configuration as such:\n#\n# primaryuser \n#\n# When primaryuser is specified, the replica will authenticate against its\n# primary using the new AUTH form: AUTH .\n\n# When a replica loses its connection with the primary, or when the replication\n# is still in progress, the replica can act in two different ways:\n#\n# 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will\n# still reply to client requests, possibly with out of date data, or the\n# data set may just be empty if this is the first synchronization.\n#\n# 2) If replica-serve-stale-data is set to 'no' the replica will reply with error\n# \"MASTERDOWN Link with MASTER is down and replica-serve-stale-data is set to 'no'\"\n# to all data access commands, excluding commands such as:\n# INFO, REPLICAOF, AUTH, SHUTDOWN, REPLCONF, ROLE, CONFIG, SUBSCRIBE,\n# UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, COMMAND, POST,\n# HOST and LATENCY.\n#\nreplica-serve-stale-data yes\n\n# You can configure a replica instance to accept writes or not. Writing against\n# a replica instance may be useful to store some ephemeral data (because data\n# written on a replica will be easily deleted after resync with the primary) but\n# may also cause problems if clients are writing to it because of a\n# misconfiguration.\n#\n# By default, replicas are read-only.\n#\n# Note: read only replicas are not designed to be exposed to untrusted clients\n# on the internet. It's just a protection layer against misuse of the instance.\n# Still a read only replica exports by default all the administrative commands\n# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve\n# security of read only replicas using 'rename-command' to shadow all the\n# administrative / dangerous commands.\nreplica-read-only yes\n\n# Replication SYNC strategy: disk or socket.\n#\n# New replicas and reconnecting replicas that are not able to continue the\n# replication process just receiving differences, need to do what is called a\n# \"full synchronization\". An RDB file is transmitted from the primary to the\n# replicas.\n#\n# The transmission can happen in two different ways:\n#\n# 1) Disk-backed: The primary creates a new process that writes the RDB\n# file on disk. Later the file is transferred by the parent\n# process to the replicas incrementally.\n# 2) Diskless: The primary creates a new process that directly writes the\n# RDB file to replica sockets, without touching the disk at all.\n#\n# With disk-backed replication, while the RDB file is generated, more replicas\n# can be queued and served with the RDB file as soon as the current child\n# producing the RDB file finishes its work. With diskless replication instead\n# once the transfer starts, new replicas arriving will be queued and a new\n# transfer will start when the current one terminates.\n#\n# When diskless replication is used, the primary waits a configurable amount of\n# time (in seconds) before starting the transfer in the hope that multiple\n# replicas will arrive and the transfer can be parallelized.\n#\n# With slow disks and fast (large bandwidth) networks, diskless replication\n# works better.\nrepl-diskless-sync yes\n\n# When diskless replication is enabled, it is possible to configure the delay\n# the server waits in order to spawn the child that transfers the RDB via socket\n# to the replicas.\n#\n# This is important since once the transfer starts, it is not possible to serve\n# new replicas arriving, that will be queued for the next RDB transfer, so the\n# server waits a delay in order to let more replicas arrive.\n#\n# The delay is specified in seconds, and by default is 5 seconds. To disable\n# it entirely just set it to 0 seconds and the transfer will start ASAP.\nrepl-diskless-sync-delay 5\n\n# When diskless replication is enabled with a delay, it is possible to let\n# the replication start before the maximum delay is reached if the maximum\n# number of replicas expected have connected. Default of 0 means that the\n# maximum is not defined and the server will wait the full delay.\nrepl-diskless-sync-max-replicas 0\n\n# -----------------------------------------------------------------------------\n# WARNING: Since in this setup the replica does not immediately store an RDB on\n# disk, it may cause data loss during failovers. RDB diskless load + server\n# modules not handling I/O reads may cause the server to abort in case of I/O errors\n# during the initial synchronization stage with the primary.\n# -----------------------------------------------------------------------------\n#\n# Replica can load the RDB it reads from the replication link directly from the\n# socket, or store the RDB to a file and read that file after it was completely\n# received from the primary.\n#\n# In many cases the disk is slower than the network, and storing and loading\n# the RDB file may increase replication time (and even increase the primary's\n# Copy on Write memory and replica buffers).\n# However, when parsing the RDB file directly from the socket, in order to avoid\n# data loss it's only safe to flush the current dataset when the new dataset is\n# fully loaded in memory, resulting in higher memory usage.\n# For this reason we have the following options:\n#\n# \"disabled\" - Don't use diskless load (store the rdb file to the disk first)\n# \"swapdb\" - Keep current db contents in RAM while parsing the data directly\n# from the socket. Replicas in this mode can keep serving current\n# dataset while replication is in progress, except for cases where\n# they can't recognize primary as having a data set from same\n# replication history.\n# Note that this requires sufficient memory, if you don't have it,\n# you risk an OOM kill.\n# \"on-empty-db\" - Use diskless load only when current dataset is empty. This is\n# safer and avoid having old and new dataset loaded side by side\n# during replication.\n# \"flush-before-load\" - [dangerous] Flush all data before parsing. Note that if\n# there's a problem before the replication succeeded you may\n# lose all your data.\nrepl-diskless-load disabled\n\n# This dual channel replication sync feature optimizes the full synchronization process\n# between a primary and its replicas. When enabled, it reduces both memory and CPU load\n# on the primary server.\n#\n# How it works:\n# 1. During full sync, instead of accumulating replication data on the primary server,\n# the data is sent directly to the syncing replica.\n# 2. The primary's background save (bgsave) process streams the RDB snapshot directly\n# to the replica over a separate connection.\n#\n# Tradeoff:\n# While this approach reduces load on the primary, it shifts the burden of storing\n# the replication buffer to the replica. This means the replica must have sufficient\n# memory to accommodate the buffer during synchronization. However, this tradeoff is\n# generally beneficial as it prevents potential performance degradation on the primary\n# server, which is typically handling more critical operations.\n#\n# When toggling this configuration on or off during an ongoing synchronization process,\n# it does not change the already running sync method. The new configuration will take\n# effect only for subsequent synchronization processes.\n\ndual-channel-replication-enabled no\n\n# Master send PINGs to its replicas in a predefined interval. It's possible to\n# change this interval with the repl_ping_replica_period option. The default\n# value is 10 seconds.\n#\n# repl-ping-replica-period 10\n\n# The following option sets the replication timeout for:\n#\n# 1) Bulk transfer I/O during SYNC, from the point of view of replica.\n# 2) Master timeout from the point of view of replicas (data, pings).\n# 3) Replica timeout from the point of view of primaries (REPLCONF ACK pings).\n#\n# It is important to make sure that this value is greater than the value\n# specified for repl-ping-replica-period otherwise a timeout will be detected\n# every time there is low traffic between the primary and the replica. The default\n# value is 60 seconds.\n#\n# repl-timeout 60\n\n# Disable TCP_NODELAY on the replica socket after SYNC?\n#\n# If you select \"yes\", the server will use a smaller number of TCP packets and\n# less bandwidth to send data to replicas. But this can add a delay for\n# the data to appear on the replica side, up to 40 milliseconds with\n# Linux kernels using a default configuration.\n#\n# If you select \"no\" the delay for data to appear on the replica side will\n# be reduced but more bandwidth will be used for replication.\n#\n# By default we optimize for low latency, but in very high traffic conditions\n# or when the primary and replicas are many hops away, turning this to \"yes\" may\n# be a good idea.\nrepl-disable-tcp-nodelay no\n\n# Enables MPTCP for the replica's connection to the primary.\n#\n# An MPTCP connection is established between the primary and the replica if\n# the replica has set 'repl-mptcp yes' and the primary has set 'mptcp yes'.\n# Otherwise, it will automatically and implicitly fall back to a regular TCP\n# connection.\n#\n# repl-mptcp no\n\n# Set the replication backlog size. The backlog is a buffer that accumulates\n# replica data when replicas are disconnected for some time, so that when a\n# replica wants to reconnect again, often a full resync is not needed, but a\n# partial resync is enough, just passing the portion of data the replica\n# missed while disconnected.\n#\n# The bigger the replication backlog, the longer the replica can endure the\n# disconnect and later be able to perform a partial resynchronization.\n#\n# The backlog is only allocated if there is at least one replica connected.\n#\n# repl-backlog-size 10mb\n\n# After a primary has no connected replicas for some time, the backlog will be\n# freed. The following option configures the amount of seconds that need to\n# elapse, starting from the time the last replica disconnected, for the backlog\n# buffer to be freed.\n#\n# Note that replicas never free the backlog for timeout, since they may be\n# promoted to primaries later, and should be able to correctly \"partially\n# resynchronize\" with other replicas: hence they should always accumulate backlog.\n#\n# A value of 0 means to never release the backlog.\n#\n# repl-backlog-ttl 3600\n\n# The replica priority is an integer number published by the server in the INFO\n# output. It is used by Sentinel in order to select a replica to promote\n# into a primary if the primary is no longer working correctly.\n#\n# A replica with a low priority number is considered better for promotion, so\n# for instance if there are three replicas with priority 10, 100, 25 Sentinel\n# will pick the one with priority 10, that is the lowest.\n#\n# However a special priority of 0 marks the replica as not able to perform the\n# role of primary, so a replica with priority of 0 will never be selected by\n# Sentinel for promotion.\n#\n# By default the priority is 100.\nreplica-priority 100\n\n# The propagation error behavior controls how the server will behave when it is\n# unable to handle a command being processed in the replication stream from a primary\n# or processed while reading from an AOF file. Errors that occur during propagation\n# are unexpected, and can cause data inconsistency.\n#\n# If an application wants to ensure there is no data divergence, this configuration\n# should be set to 'panic' instead. The value can also be set to 'panic-on-replicas'\n# to only panic when a replica encounters an error on the replication stream. One of\n# these two panic values will become the default value in the future once there are\n# sufficient safety mechanisms in place to prevent false positive crashes.\n#\n# propagation-error-behavior ignore\n\n# Replica ignore disk write errors controls the behavior of a replica when it is\n# unable to persist a write command received from its primary to disk. By default,\n# this configuration is set to 'no' and will crash the replica in this condition.\n# It is not recommended to change this default.\n#\n# replica-ignore-disk-write-errors no\n\n# Make the primary forbid expiration and eviction.\n# This is useful for sync tools, because expiration and eviction may cause the data corruption.\n# Sync tools can mark their connections as importing source by CLIENT IMPORT-SOURCE.\n# NOTICE: Clients should avoid writing the same key on the source server and the destination server.\n#\n# import-mode no\n\n# -----------------------------------------------------------------------------\n# By default, Sentinel includes all replicas in its reports. A replica\n# can be excluded from Sentinel's announcements. An unannounced replica\n# will be ignored by the 'sentinel replicas ' command and won't be\n# exposed to Sentinel's clients.\n#\n# This option does not change the behavior of replica-priority. Even with\n# replica-announced set to 'no', the replica can be promoted to primary. To\n# prevent this behavior, set replica-priority to 0.\n#\n# replica-announced yes\n\n# It is possible for a primary to stop accepting writes if there are less than\n# N replicas connected, having a lag less or equal than M seconds.\n#\n# The N replicas need to be in \"online\" state.\n#\n# The lag in seconds, that must be <= the specified value, is calculated from\n# the last ping received from the replica, that is usually sent every second.\n#\n# This option does not GUARANTEE that N replicas will accept the write, but\n# will limit the window of exposure for lost writes in case not enough replicas\n# are available, to the specified number of seconds.\n#\n# For example to require at least 3 replicas with a lag <= 10 seconds use:\n#\n# min-replicas-to-write 3\n# min-replicas-max-lag 10\n#\n# Setting one or the other to 0 disables the feature.\n#\n# By default min-replicas-to-write is set to 0 (feature disabled) and\n# min-replicas-max-lag is set to 10.\n\n# A primary is able to list the address and port of the attached\n# replicas in different ways. For example the \"INFO replication\" section\n# offers this information, which is used, among other tools, by\n# Sentinel in order to discover replica instances.\n# Another place where this info is available is in the output of the\n# \"ROLE\" command of a primary.\n#\n# The listed IP address and port normally reported by a replica is\n# obtained in the following way:\n#\n# IP: The address is auto detected by checking the peer address\n# of the socket used by the replica to connect with the primary.\n#\n# Port: The port is communicated by the replica during the replication\n# handshake, and is normally the port that the replica is using to\n# listen for connections.\n#\n# However when port forwarding or Network Address Translation (NAT) is\n# used, the replica may actually be reachable via different IP and port\n# pairs. The following two options can be used by a replica in order to\n# report to its primary a specific set of IP and port, so that both INFO\n# and ROLE will report those values.\n#\n# There is no need to use both the options if you need to override just\n# the port or the IP address.\n#\n# replica-announce-ip 5.5.5.5\n# replica-announce-port 1234\n\n############################### KEYS TRACKING #################################\n\n# The client side caching of values is assisted via server-side support.\n# This is implemented using an invalidation table that remembers, using\n# a radix key indexed by key name, what clients have which keys. In turn\n# this is used in order to send invalidation messages to clients. Please\n# check this page to understand more about the feature:\n#\n# https://valkey.io/topics/client-side-caching\n#\n# When tracking is enabled for a client, all the read only queries are assumed\n# to be cached: this will force the server to store information in the invalidation\n# table. When keys are modified, such information is flushed away, and\n# invalidation messages are sent to the clients. However if the workload is\n# heavily dominated by reads, the server could use more and more memory in order\n# to track the keys fetched by many clients.\n#\n# For this reason it is possible to configure a maximum fill value for the\n# invalidation table. By default it is set to 1M of keys, and once this limit\n# is reached, the server will start to evict keys in the invalidation table\n# even if they were not modified, just to reclaim memory: this will in turn\n# force the clients to invalidate the cached values. Basically the table\n# maximum size is a trade off between the memory you want to spend server\n# side to track information about who cached what, and the ability of clients\n# to retain cached objects in memory.\n#\n# If you set the value to 0, it means there are no limits, and the server will\n# retain as many keys as needed in the invalidation table.\n# In the \"stats\" INFO section, you can find information about the number of\n# keys in the invalidation table at every given moment.\n#\n# Note: when key tracking is used in broadcasting mode, no memory is used\n# in the server side so this setting is useless.\n#\n# tracking-table-max-keys 1000000\n\n################################## SECURITY ###################################\n\n# Warning: since the server is pretty fast, an outside user can try up to\n# 1 million passwords per second against a modern box. This means that you\n# should use very strong passwords, otherwise they will be very easy to break.\n# Note that because the password is really a shared secret between the client\n# and the server, and should not be memorized by any human, the password\n# can be easily a long string from /dev/urandom or whatever, so by using a\n# long and unguessable password no brute force attack will be possible.\n\n# ACL users are defined in the following format:\n#\n# user ... acl rules ...\n#\n# For example:\n#\n# user worker +@list +@connection ~jobs:* on >ffa9203c493aa99\n#\n# The special username \"default\" is used for new connections. If this user\n# has the \"nopass\" rule, then new connections will be immediately authenticated\n# as the \"default\" user without the need of any password provided via the\n# AUTH command. Otherwise if the \"default\" user is not flagged with \"nopass\"\n# the connections will start in not authenticated state, and will require\n# AUTH (or the HELLO command AUTH option) in order to be authenticated and\n# start to work.\n#\n# The ACL rules that describe what a user can do are the following:\n#\n# on Enable the user: it is possible to authenticate as this user.\n# off Disable the user: it's no longer possible to authenticate\n# with this user, however the already authenticated connections\n# will still work.\n# skip-sanitize-payload RESTORE dump-payload sanitization is skipped.\n# sanitize-payload RESTORE dump-payload is sanitized (default).\n# + Allow the execution of that command.\n# May be used with `|` for allowing subcommands (e.g \"+config|get\")\n# - Disallow the execution of that command.\n# May be used with `|` for blocking subcommands (e.g \"-config|set\")\n# +@ Allow the execution of all the commands in such category\n# with valid categories are like @admin, @set, @sortedset, ...\n# and so forth, see the full list in the server.c file where\n# the server command table is described and defined.\n# The special category @all means all the commands, but currently\n# present in the server, and that will be loaded in the future\n# via modules.\n# +|first-arg Allow a specific first argument of an otherwise\n# disabled command. It is only supported on commands with\n# no sub-commands, and is not allowed as negative form\n# like -SELECT|1, only additive starting with \"+\". This\n# feature is deprecated and may be removed in the future.\n# allcommands Alias for +@all. Note that it implies the ability to execute\n# all the future commands loaded via the modules system.\n# nocommands Alias for -@all.\n# ~ Add a pattern of keys that can be mentioned as part of\n# commands. For instance ~* allows all the keys. The pattern\n# is a glob-style pattern like the one of KEYS.\n# It is possible to specify multiple patterns.\n# %R~ Add key read pattern that specifies which keys can be read\n# from.\n# %W~ Add key write pattern that specifies which keys can be\n# written to.\n# allkeys Alias for ~*\n# resetkeys Flush the list of allowed keys patterns.\n# & Add a glob-style pattern of Pub/Sub channels that can be\n# accessed by the user. It is possible to specify multiple channel\n# patterns.\n# allchannels Alias for &*\n# resetchannels Flush the list of allowed channel patterns.\n# > Add this password to the list of valid password for the user.\n# For example >mypass will add \"mypass\" to the list.\n# This directive clears the \"nopass\" flag (see later).\n# < Remove this password from the list of valid passwords.\n# nopass All the set passwords of the user are removed, and the user\n# is flagged as requiring no password: it means that every\n# password will work against this user. If this directive is\n# used for the default user, every new connection will be\n# immediately authenticated with the default user without\n# any explicit AUTH command required. Note that the \"resetpass\"\n# directive will clear this condition.\n# resetpass Flush the list of allowed passwords. Moreover removes the\n# \"nopass\" status. After \"resetpass\" the user has no associated\n# passwords and there is no way to authenticate without adding\n# some password (or setting it as \"nopass\" later).\n# reset Performs the following actions: resetpass, resetkeys, resetchannels,\n# allchannels (if acl-pubsub-default is set), off, clearselectors, -@all.\n# The user returns to the same state it has immediately after its creation.\n# () Create a new selector with the options specified within the\n# parentheses and attach it to the user. Each option should be\n# space separated. The first character must be ( and the last\n# character must be ).\n# clearselectors Remove all of the currently attached selectors.\n# Note this does not change the \"root\" user permissions,\n# which are the permissions directly applied onto the\n# user (outside the parentheses).\n#\n# ACL rules can be specified in any order: for instance you can start with\n# passwords, then flags, or key patterns. However note that the additive\n# and subtractive rules will CHANGE MEANING depending on the ordering.\n# For instance see the following example:\n#\n# user alice on +@all -DEBUG ~* >somepassword\n#\n# This will allow \"alice\" to use all the commands with the exception of the\n# DEBUG command, since +@all added all the commands to the set of the commands\n# alice can use, and later DEBUG was removed. However if we invert the order\n# of two ACL rules the result will be different:\n#\n# user alice on -DEBUG +@all ~* >somepassword\n#\n# Now DEBUG was removed when alice had yet no commands in the set of allowed\n# commands, later all the commands are added, so the user will be able to\n# execute everything.\n#\n# Basically ACL rules are processed left-to-right.\n#\n# The following is a list of command categories and their meanings:\n# * keyspace - Writing or reading from keys, databases, or their metadata\n# in a type agnostic way. Includes DEL, RESTORE, DUMP, RENAME, EXISTS, DBSIZE,\n# KEYS, EXPIRE, TTL, FLUSHALL, etc. Commands that may modify the keyspace,\n# key or metadata will also have `write` category. Commands that only read\n# the keyspace, key or metadata will have the `read` category.\n# * read - Reading from keys (values or metadata). Note that commands that don't\n# interact with keys, will not have either `read` or `write`.\n# * write - Writing to keys (values or metadata)\n# * admin - Administrative commands. Normal applications will never need to use\n# these. Includes REPLICAOF, CONFIG, DEBUG, SAVE, MONITOR, ACL, SHUTDOWN, etc.\n# * dangerous - Potentially dangerous (each should be considered with care for\n# various reasons). This includes FLUSHALL, MIGRATE, RESTORE, SORT, KEYS,\n# CLIENT, DEBUG, INFO, CONFIG, SAVE, REPLICAOF, etc.\n# * connection - Commands affecting the connection or other connections.\n# This includes AUTH, SELECT, COMMAND, CLIENT, ECHO, PING, etc.\n# * blocking - Potentially blocking the connection until released by another\n# command.\n# * fast - Fast O(1) commands. May loop on the number of arguments, but not the\n# number of elements in the key.\n# * slow - All commands that are not Fast.\n# * pubsub - PUBLISH / SUBSCRIBE related\n# * transaction - WATCH / MULTI / EXEC related commands.\n# * scripting - Scripting related.\n# * set - Data type: sets related.\n# * sortedset - Data type: zsets related.\n# * list - Data type: lists related.\n# * hash - Data type: hashes related.\n# * string - Data type: strings related.\n# * bitmap - Data type: bitmaps related.\n# * hyperloglog - Data type: hyperloglog related.\n# * geo - Data type: geo related.\n# * stream - Data type: streams related.\n#\n# For more information about ACL configuration please refer to\n# the Valkey web site at https://valkey.io/topics/acl\n\n# ACL LOG\n#\n# The ACL Log tracks failed commands and authentication events associated\n# with ACLs. The ACL Log is useful to troubleshoot failed commands blocked\n# by ACLs. The ACL Log is stored in memory. You can reclaim memory with\n# ACL LOG RESET. Define the maximum entry length of the ACL Log below.\nacllog-max-len 128\n\n# Using an external ACL file\n#\n# Instead of configuring users here in this file, it is possible to use\n# a stand-alone file just listing users. The two methods cannot be mixed:\n# if you configure users here and at the same time you activate the external\n# ACL file, the server will refuse to start.\n#\n# The format of the external ACL user file is exactly the same as the\n# format that is used inside valkey.conf to describe users.\n#\n# aclfile /etc/valkey/users.acl\n\n# IMPORTANT NOTE: \"requirepass\" is just a compatibility\n# layer on top of the new ACL system. The option effect will be just setting\n# the password for the default user. Clients will still authenticate using\n# AUTH as usually, or more explicitly with AUTH default \n# if they follow the new protocol: both will work.\n#\n# The requirepass is not compatible with aclfile option and the ACL LOAD\n# command, these will cause requirepass to be ignored.\n#\n\nuser default on >isfoobared allcommands allkeys\n\n# The default Pub/Sub channels permission for new users is controlled by the\n# acl-pubsub-default configuration directive, which accepts one of these values:\n#\n# allchannels: grants access to all Pub/Sub channels\n# resetchannels: revokes access to all Pub/Sub channels\n#\n# acl-pubsub-default defaults to 'resetchannels' permission.\n#\n# acl-pubsub-default resetchannels\n\n# Command renaming (DEPRECATED).\n#\n# ------------------------------------------------------------------------\n# WARNING: avoid using this option if possible. Instead use ACLs to remove\n# commands from the default user, and put them only in some admin user you\n# create for administrative purposes.\n# ------------------------------------------------------------------------\n#\n# It is possible to change the name of dangerous commands in a shared\n# environment. For instance the CONFIG command may be renamed into something\n# hard to guess so that it will still be available for internal-use tools\n# but not available for general clients.\n#\n# Example:\n#\n# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52\n#\n# It is also possible to completely kill a command by renaming it into\n# an empty string:\n#\n# rename-command CONFIG \"\"\n#\n# Please note that changing the name of commands that are logged into the\n# AOF file or transmitted to replicas may cause problems.\n\n################################### CLIENTS ####################################\n\n# Set the max number of connected clients at the same time. By default\n# this limit is set to 10000 clients, however if the server is not\n# able to configure the process file limit to allow for the specified limit\n# the max number of allowed clients is set to the current file limit\n# minus 32 (as the server reserves a few file descriptors for internal uses).\n#\n# Once the limit is reached the server will close all the new connections sending\n# an error 'max number of clients reached'.\n#\n# IMPORTANT: With a cluster-enabled setup, the max number of connections is also\n# shared with the cluster bus: every node in the cluster will use two\n# connections, one incoming and another outgoing. It is important to size the\n# limit accordingly in case of very large clusters.\n#\nmaxclients 4000\n\n############################## MEMORY MANAGEMENT ################################\n\n# Set a memory usage limit to the specified amount of bytes.\n# When the memory limit is reached the server will try to remove keys\n# according to the eviction policy selected (see maxmemory-policy).\n#\n# If the server can't remove keys according to the policy, or if the policy is\n# set to 'noeviction', the server will start to reply with errors to commands\n# that would use more memory, like SET, LPUSH, and so on, and will continue\n# to reply to read-only commands like GET.\n#\n# This option is usually useful when using the server as an LRU or LFU cache, or to\n# set a hard memory limit for an instance (using the 'noeviction' policy).\n#\n# WARNING: If you have replicas attached to an instance with maxmemory on,\n# the size of the output buffers needed to feed the replicas are subtracted\n# from the used memory count, so that network problems / resyncs will\n# not trigger a loop where keys are evicted, and in turn the output\n# buffer of replicas is full with DELs of keys evicted triggering the deletion\n# of more keys, and so forth until the database is completely emptied.\n#\n# In short... if you have replicas attached it is suggested that you set a lower\n# limit for maxmemory so that there is some free RAM on the system for replica\n# output buffers (but this is not needed if the policy is 'noeviction').\n#\nmaxmemory 88MB\n\n# MAXMEMORY POLICY: how the server will select what to remove when maxmemory\n# is reached. You can select one from the following behaviors:\n#\n# volatile-lru -> Evict using approximated LRU, only keys with an expire set.\n# allkeys-lru -> Evict any key using approximated LRU.\n# volatile-lfu -> Evict using approximated LFU, only keys with an expire set.\n# allkeys-lfu -> Evict any key using approximated LFU.\n# volatile-random -> Remove a random key having an expire set.\n# allkeys-random -> Remove a random key, any key.\n# volatile-ttl -> Remove the key with the nearest expire time (minor TTL)\n# noeviction -> Don't evict anything, just return an error on write operations.\n#\n# LRU means Least Recently Used\n# LFU means Least Frequently Used\n#\n# Both LRU, LFU and volatile-ttl are implemented using approximated\n# randomized algorithms.\n#\n# Note: with any of the above policies, when there are no suitable keys for\n# eviction, the server will return an error on write operations that require\n# more memory. These are usually commands that create new keys, add data or\n# modify existing keys. A few examples are: SET, INCR, HSET, LPUSH, SUNIONSTORE,\n# SORT (due to the STORE argument), and EXEC (if the transaction includes any\n# command that requires memory).\n#\n# The default is: noeviction\n#\nmaxmemory-policy allkeys-lru\n\n# LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated\n# algorithms (in order to save memory), so you can tune it for speed or\n# accuracy. By default the server will check five keys and pick the one that was\n# used least recently, you can change the sample size using the following\n# configuration directive.\n#\n# The default of 5 produces good enough results. 10 Approximates very closely\n# true LRU but costs more CPU. 3 is faster but not very accurate. The maximum\n# value that can be set is 64.\n#\n# maxmemory-samples 5\n\n# Eviction processing is designed to function well with the default setting.\n# If there is an unusually large amount of write traffic, this value may need to\n# be increased. Decreasing this value may reduce latency at the risk of\n# eviction processing effectiveness\n# 0 = minimum latency, 10 = default, 100 = process without regard to latency\n#\n# maxmemory-eviction-tenacity 10\n\n# By default a replica will ignore its maxmemory setting\n# (unless it is promoted to primary after a failover or manually). It means\n# that the eviction of keys will be just handled by the primary, sending the\n# DEL commands to the replica as keys evict in the primary side.\n#\n# This behavior ensures that primaries and replicas stay consistent, and is usually\n# what you want, however if your replica is writable, or you want the replica\n# to have a different memory setting, and you are sure all the writes performed\n# to the replica are idempotent, then you may change this default (but be sure\n# to understand what you are doing).\n#\n# Note that since the replica by default does not evict, it may end using more\n# memory than the one set via maxmemory (there are certain buffers that may\n# be larger on the replica, or data structures may sometimes take more memory\n# and so forth). So make sure you monitor your replicas and make sure they\n# have enough memory to never hit a real out-of-memory condition before the\n# primary hits the configured maxmemory setting.\n#\n# replica-ignore-maxmemory yes\n\n# The server reclaims expired keys in two ways: upon access when those keys are\n# found to be expired, and also in the background, in what is called the\n# \"active expire key\". The key space is slowly and incrementally scanned\n# looking for expired keys to reclaim, so that it is possible to free memory\n# of keys that are expired and will never be accessed again in a short time.\n#\n# The default effort of the expire cycle will try to avoid having more than\n# ten percent of expired keys still in memory, and will try to avoid consuming\n# more than 25% of total memory and to add latency to the system. However\n# it is possible to increase the expire \"effort\" that is normally set to\n# \"1\", to a greater value, up to the value \"10\". At its maximum value the\n# system will use more CPU, longer cycles (and technically may introduce\n# more latency), and will tolerate less already expired keys still present\n# in the system. It's a tradeoff between memory, CPU and latency.\n#\n# active-expire-effort 1\n\n############################# LAZY FREEING ####################################\n\n# When keys are deleted, the served has historically freed their memory using\n# blocking operations. It means that the server stopped processing new commands\n# in order to reclaim all the memory associated with an object in a synchronous\n# way. If the key deleted is associated with a small object, the time needed\n# in order to execute the DEL command is very small and comparable to most other\n# O(1) or O(log_N) commands in the server. However if the key is associated with an\n# aggregated value containing millions of elements, the server can block for\n# a long time (even seconds) in order to complete the operation.\n#\n# For the above reasons, lazy freeing (or asynchronous freeing), has been\n# introduced. With lazy freeing, keys are deleted in constant time. Another\n# thread will incrementally free the object in the background as fast as\n# possible.\n#\n# Starting from Valkey 8.0, lazy freeing is enabled by default. It is possible\n# to retain the synchronous freeing behaviour by setting the lazyfree related\n# configuration directives to 'no'.\n\n# Commands like DEL, FLUSHALL and FLUSHDB delete keys, but the server can also\n# delete keys or flush the whole database as a side effect of other operations.\n# Specifically the server deletes objects independently of a user call in the\n# following scenarios:\n#\n# 1) On eviction, because of the maxmemory and maxmemory policy configurations,\n# in order to make room for new data, without going over the specified\n# memory limit.\n# 2) Because of expire: when a key with an associated time to live (see the\n# EXPIRE command) must be deleted from memory.\n# 3) Because of a side effect of a command that stores data on a key that may\n# already exist. For example the RENAME command may delete the old key\n# content when it is replaced with another one. Similarly SUNIONSTORE\n# or SORT with STORE option may delete existing keys. The SET command\n# itself removes any old content of the specified key in order to replace\n# it with the specified string.\n# 4) During replication, when a replica performs a full resynchronization with\n# its primary, the content of the whole database is removed in order to\n# load the RDB file just transferred.\n#\n# In all the above cases, the default is to release memory in a non-blocking\n# way.\n\nlazyfree-lazy-eviction yes\nlazyfree-lazy-expire yes\nlazyfree-lazy-server-del yes\nreplica-lazy-flush yes\n\n# For keys deleted using the DEL command, lazy freeing is controlled by the\n# configuration directive 'lazyfree-lazy-user-del'. The default is 'yes'. The\n# UNLINK command is identical to the DEL command, except that UNLINK always\n# frees the memory lazily, regardless of this configuration directive:\n\nlazyfree-lazy-user-del yes\n\n# FLUSHDB, FLUSHALL, SCRIPT FLUSH and FUNCTION FLUSH support both asynchronous and synchronous\n# deletion, which can be controlled by passing the [SYNC|ASYNC] flags into the\n# commands. When neither flag is passed, this directive will be used to determine\n# if the data should be deleted asynchronously.\n#\n# When a replica performs a node reset via CLUSTER RESET, the entire\n# database content is removed to allow the node to become an empty primary.\n# This directive also determines whether the data should be deleted asynchronously.\n#\n# There are many problems with running flush synchronously. Even in single CPU\n# environments, the thread managers should balance between the freeing and\n# serving incoming requests. The default value is yes.\n\nlazyfree-lazy-user-flush yes\n\n################################ THREADED I/O #################################\n\n# The server is mostly single threaded, however there are certain threaded\n# operations such as UNLINK, slow I/O accesses and other things that are\n# performed on side threads.\n#\n# Now it is also possible to handle the server clients socket reads and writes\n# in different I/O threads. Since especially writing is so slow, normally\n# users use pipelining in order to speed up the server performances per\n# core, and spawn multiple instances in order to scale more. Using I/O\n# threads it is possible to easily speedup two times the server without resorting\n# to pipelining nor sharding of the instance.\n#\n# By default threading is disabled, we suggest enabling it only in machines\n# that have at least 3 or more cores, leaving at least one spare core.\n# We also recommend using threaded I/O only if you actually have performance problems, with\n# instances being able to use a quite big percentage of CPU time, otherwise\n# there is no point in using this feature.\n#\n# So for instance if you have a four cores boxes, try to use 2 or 3 I/O\n# threads, if you have a 8 cores, try to use 6 threads. In order to\n# enable I/O threads use the following configuration directive:\n#\n# io-threads 4\n#\n# Setting io-threads to 1 will just use the main thread as usual.\n# When I/O threads are enabled, we use threads for reads and writes, that is\n# to thread the write and read syscall and transfer the client buffers to the\n# socket and to enable threading of reads and protocol parsing.\n#\n#\n# NOTE:\n# 1. The 'io-threads-do-reads' config is deprecated and has no effect. Please\n# avoid using this config if possible.\n#\n# 2. If you want to test the server speedup using valkey-benchmark, make\n# sure you also run the benchmark itself in threaded mode, using the\n# --threads option to match the number of server threads, otherwise you'll not\n# be able to notice the improvements.\n\n############################ KERNEL OOM CONTROL ##############################\n\n# On Linux, it is possible to hint the kernel OOM killer on what processes\n# should be killed first when out of memory.\n#\n# Enabling this feature makes the server actively control the oom_score_adj value\n# for all its processes, depending on their role. The default scores will\n# attempt to have background child processes killed before all others, and\n# replicas killed before primaries.\n#\n# The server supports these options:\n#\n# no: Don't make changes to oom-score-adj (default).\n# yes: Alias to \"relative\" see below.\n# absolute: Values in oom-score-adj-values are written as is to the kernel.\n# relative: Values are used relative to the initial value of oom_score_adj when\n# the server starts and are then clamped to a range of -1000 to 1000.\n# Because typically the initial value is 0, they will often match the\n# absolute values.\noom-score-adj no\n\n# When oom-score-adj is used, this directive controls the specific values used\n# for primary, replica and background child processes. Values range -2000 to\n# 2000 (higher means more likely to be killed).\n#\n# Unprivileged processes (not root, and without CAP_SYS_RESOURCE capabilities)\n# can freely increase their value, but not decrease it below its initial\n# settings. This means that setting oom-score-adj to \"relative\" and setting the\n# oom-score-adj-values to positive values will always succeed.\noom-score-adj-values 0 200 800\n\n\n#################### KERNEL transparent hugepage CONTROL ######################\n\n# Usually the kernel Transparent Huge Pages control is set to \"madvise\" or\n# \"never\" by default (/sys/kernel/mm/transparent_hugepage/enabled), in which\n# case this config has no effect. On systems in which it is set to \"always\",\n# the server will attempt to disable it specifically for the server process in order\n# to avoid latency problems specifically with fork(2) and CoW.\n# If for some reason you prefer to keep it enabled, you can set this config to\n# \"no\" and the kernel global to \"always\".\n\ndisable-thp yes\n\n############################## APPEND ONLY MODE ###############################\n\n# By default the server asynchronously dumps the dataset on disk. This mode is\n# good enough in many applications, but an issue with the server process or\n# a power outage may result into a few minutes of writes lost (depending on\n# the configured save points).\n#\n# The Append Only File is an alternative persistence mode that provides\n# much better durability. For instance using the default data fsync policy\n# (see later in the config file) the server can lose just one second of writes in a\n# dramatic event like a server power outage, or a single write if something\n# wrong with the process itself happens, but the operating system is\n# still running correctly.\n#\n# AOF and RDB persistence can be enabled at the same time without problems.\n# If the AOF is enabled on startup the server will load the AOF, that is the file\n# with the better durability guarantees.\n#\n# Note that changing this value in a config file of an existing database and\n# restarting the server can lead to data loss. A conversion needs to be done\n# by setting it via CONFIG command on a live server first.\n#\n# Please check https://valkey.io/topics/persistence for more information.\n\nappendonly no\n\n# The base name of the append only file.\n#\n# The server uses a set of append-only files to persist the dataset\n# and changes applied to it. There are two basic types of files in use:\n#\n# - Base files, which are a snapshot representing the complete state of the\n# dataset at the time the file was created. Base files can be either in\n# the form of RDB (binary serialized) or AOF (textual commands).\n# - Incremental files, which contain additional commands that were applied\n# to the dataset following the previous file.\n#\n# In addition, manifest files are used to track the files and the order in\n# which they were created and should be applied.\n#\n# Append-only file names are created by the server following a specific pattern.\n# The file name's prefix is based on the 'appendfilename' configuration\n# parameter, followed by additional information about the sequence and type.\n#\n# For example, if appendfilename is set to appendonly.aof, the following file\n# names could be derived:\n#\n# - appendonly.aof.1.base.rdb as a base file.\n# - appendonly.aof.1.incr.aof, appendonly.aof.2.incr.aof as incremental files.\n# - appendonly.aof.manifest as a manifest file.\n\nappendfilename \"appendonly.aof\"\n\n# For convenience, the server stores all persistent append-only files in a dedicated\n# directory. The name of the directory is determined by the appenddirname\n# configuration parameter.\n\nappenddirname \"appendonlydir\"\n\n# The fsync() call tells the Operating System to actually write data on disk\n# instead of waiting for more data in the output buffer. Some OS will really flush\n# data on disk, some other OS will just try to do it ASAP.\n#\n# The server supports three different modes:\n#\n# no: don't fsync, just let the OS flush the data when it wants. Faster.\n# always: fsync after every write to the append only log. Slow, Safest.\n# everysec: fsync only one time every second. Compromise.\n#\n# The default is \"everysec\", as that's usually the right compromise between\n# speed and data safety. It's up to you to understand if you can relax this to\n# \"no\" that will let the operating system flush the output buffer when\n# it wants, for better performances (but if you can live with the idea of\n# some data loss consider the default persistence mode that's snapshotting),\n# or on the contrary, use \"always\" that's very slow but a bit safer than\n# everysec.\n#\n# More details please check the following article:\n# http://antirez.com/post/redis-persistence-demystified.html\n#\n# If unsure, use \"everysec\".\n\n# appendfsync always\nappendfsync everysec\n# appendfsync no\n\n# When the AOF fsync policy is set to always or everysec, and a background\n# saving process (a background save or AOF log background rewriting) is\n# performing a lot of I/O against the disk, in some Linux configurations\n# the server may block too long on the fsync() call. Note that there is no fix for\n# this currently, as even performing fsync in a different thread will block\n# our synchronous write(2) call.\n#\n# In order to mitigate this problem it's possible to use the following option\n# that will prevent fsync() from being called in the main process while a\n# BGSAVE or BGREWRITEAOF is in progress.\n#\n# This means that while another child is saving, the durability of the server is\n# the same as \"appendfsync no\". In practical terms, this means that it is\n# possible to lose up to 30 seconds of log in the worst scenario (with the\n# default Linux settings).\n#\n# If you have latency problems turn this to \"yes\". Otherwise leave it as\n# \"no\" that is the safest pick from the point of view of durability.\n\nno-appendfsync-on-rewrite no\n\n# Automatic rewrite of the append only file.\n# The server is able to automatically rewrite the log file implicitly calling\n# BGREWRITEAOF when the AOF log size grows by the specified percentage.\n#\n# This is how it works: The server remembers the size of the AOF file after the\n# latest rewrite (if no rewrite has happened since the restart, the size of\n# the AOF at startup is used).\n#\n# This base size is compared to the current size. If the current size is\n# bigger than the specified percentage, the rewrite is triggered. Also\n# you need to specify a minimal size for the AOF file to be rewritten, this\n# is useful to avoid rewriting the AOF file even if the percentage increase\n# is reached but it is still pretty small.\n#\n# Specify a percentage of zero in order to disable the automatic AOF\n# rewrite feature.\n\nauto-aof-rewrite-percentage 100\nauto-aof-rewrite-min-size 64mb\n\n# An AOF file may be found to be truncated at the end during the server\n# startup process, when the AOF data gets loaded back into memory.\n# This may happen when the system where the server is running\n# crashes, especially when an ext4 filesystem is mounted without the\n# data=ordered option (however this can't happen when the server itself\n# crashes or aborts but the operating system still works correctly).\n#\n# The server can either exit with an error when this happens, or load as much\n# data as possible (the default now) and start if the AOF file is found\n# to be truncated at the end. The following option controls this behavior.\n#\n# If aof-load-truncated is set to yes, a truncated AOF file is loaded and\n# the server starts emitting a log to inform the user of the event.\n# Otherwise if the option is set to no, the server aborts with an error\n# and refuses to start. When the option is set to no, the user requires\n# to fix the AOF file using the \"valkey-check-aof\" utility before to restart\n# the server.\n#\n# Note that if the AOF file will be found to be corrupted in the middle\n# the server will still exit with an error. This option only applies when\n# the server will try to read more data from the AOF file but not enough bytes\n# will be found.\naof-load-truncated yes\n\n# The server can create append-only base files in either RDB or AOF formats. Using\n# the RDB format is always faster and more efficient, and disabling it is only\n# supported for backward compatibility purposes.\naof-use-rdb-preamble yes\n\n# The server supports recording timestamp annotations in the AOF to support restoring\n# the data from a specific point-in-time. However, using this capability changes\n# the AOF format in a way that may not be compatible with existing AOF parsers.\naof-timestamp-enabled no\n\n################################ SHUTDOWN #####################################\n\n# Maximum time to wait for replicas when shutting down, in seconds.\n#\n# During shut down, a grace period allows any lagging replicas to catch up with\n# the latest replication offset before the primary exits. This period can\n# prevent data loss, especially for deployments without configured disk backups.\n#\n# The 'shutdown-timeout' value is the grace period's duration in seconds. It is\n# only applicable when the instance has replicas. To disable the feature, set\n# the value to 0.\n#\n# shutdown-timeout 10\n\n# When the server receives a SIGINT or SIGTERM, shutdown is initiated and by default\n# an RDB snapshot is written to disk in a blocking operation if save points are configured.\n# The options used on signaled shutdown can include the following values:\n#\n# default: Saves RDB snapshot only if save points are configured.\n# Waits for lagging replicas to catch up.\n# save: Forces a DB saving operation even if no save points are configured.\n# nosave: Prevents DB saving operation even if one or more save points are configured.\n# now: Skips waiting for lagging replicas.\n# force: Ignores any errors that would normally prevent the server from exiting.\n# safe: Shut down only when safe. Note that safe cannot prevent force, in the case of\n# force, safe will print the relevant logs. The definition of safe may be different\n# in different modes. Here are the definitions:\n# * In cluster mode, it is unsafe to shut down a primary with slots, and may cause\n# the cluster to go down.\n# failover: In cluster mode, when shutting down a primary, it can proactively\n# initiate a manual failover. This promotes one of its replicas to\n# primary before shutdown, resulting in a quicker and safer transition\n# than relying on an automatic failover. For a replica to be eligible\n# for this promotion, it must be fully synchronized with the primary\n# node at the time of the shutdown signal after waiting up to the\n# configured shutdown-timeout. If no such replica is found, this\n# proactive failover will not occur.\n#\n# Any combination of values is allowed as long as \"save\" and \"nosave\" are not set simultaneously.\n# Example: \"nosave force now\"\n#\n# shutdown-on-sigint default\n# shutdown-on-sigterm default\n\n################ NON-DETERMINISTIC LONG BLOCKING COMMANDS #####################\n\n# Maximum time in milliseconds for EVAL scripts, functions and in some cases\n# modules' commands before the server can start processing or rejecting other clients.\n#\n# If the maximum execution time is reached the server will start to reply to most\n# commands with a BUSY error.\n#\n# In this state the server will only allow a handful of commands to be executed.\n# For instance, SCRIPT KILL, FUNCTION KILL, SHUTDOWN NOSAVE and possibly some\n# module specific 'allow-busy' commands.\n#\n# SCRIPT KILL and FUNCTION KILL will only be able to stop a script that did not\n# yet call any write commands, so SHUTDOWN NOSAVE may be the only way to stop\n# the server in the case a write command was already issued by the script when\n# the user doesn't want to wait for the natural termination of the script.\n#\n# The default is 5 seconds. It is possible to set it to 0 or a negative value\n# to disable this mechanism (uninterrupted execution). Note that in the past\n# this config had a different name, which is now an alias, so both of these do\n# the same:\n# lua-time-limit 5000\n# busy-reply-threshold 5000\n\n################################ VALKEY CLUSTER ###############################\n\n# Normal server instances can't be part of a cluster; only nodes that are\n# started as cluster nodes can. In order to start a server instance as a\n# cluster node enable the cluster support uncommenting the following:\n#\n# cluster-enabled yes\n\n# Every cluster node has a cluster configuration file. This file is not\n# intended to be edited by hand. It is created and updated by each node.\n# Every cluster node requires a different cluster configuration file.\n# Make sure that instances running in the same system do not have\n# overlapping cluster configuration file names.\n#\n# cluster-config-file nodes-6379.conf\n\n# Cluster node timeout is the amount of milliseconds a node must be unreachable\n# for it to be considered in failure state.\n# Most other internal time limits are a multiple of the node timeout.\n#\n# cluster-node-timeout 15000\n\n# The cluster port is the port that the cluster bus will listen for inbound connections on. When set\n# to the default value, 0, it will be bound to the command port + 10000. Setting this value requires\n# you to specify the cluster bus port when executing cluster meet.\n# cluster-port 0\n\n# A replica of a failing primary will avoid to start a failover if its data\n# looks too old.\n#\n# There is no simple way for a replica to actually have an exact measure of\n# its \"data age\", so the following two checks are performed:\n#\n# 1) If there are multiple replicas able to failover, they exchange messages\n# in order to try to give an advantage to the replica with the best\n# replication offset (more data from the primary processed).\n# Replicas will try to get their rank by offset, and apply to the start\n# of the failover a delay proportional to their rank.\n#\n# 2) Every single replica computes the time of the last interaction with\n# its primary. This can be the last ping or command received (if the primary\n# is still in the \"connected\" state), or the time that elapsed since the\n# disconnection with the primary (if the replication link is currently down).\n# If the last interaction is too old, the replica will not try to failover\n# at all.\n#\n# The point \"2\" can be tuned by user. Specifically a replica will not perform\n# the failover if, since the last interaction with the primary, the time\n# elapsed is greater than:\n#\n# (node-timeout * cluster-replica-validity-factor) + repl-ping-replica-period\n#\n# So for example if node-timeout is 30 seconds, and the cluster-replica-validity-factor\n# is 10, and assuming a default repl-ping-replica-period of 10 seconds, the\n# replica will not try to failover if it was not able to talk with the primary\n# for longer than 310 seconds.\n#\n# A large cluster-replica-validity-factor may allow replicas with too old data to failover\n# a primary, while a too small value may prevent the cluster from being able to\n# elect a replica at all.\n#\n# For maximum availability, it is possible to set the cluster-replica-validity-factor\n# to a value of 0, which means, that replicas will always try to failover the\n# primary regardless of the last time they interacted with the primary.\n# (However they'll always try to apply a delay proportional to their\n# offset rank).\n#\n# Zero is the only value able to guarantee that when all the partitions heal\n# the cluster will always be able to continue.\n#\n# cluster-replica-validity-factor 10\n\n# Cluster replicas are able to migrate to orphaned primaries, that are primaries\n# that are left without working replicas. This improves the cluster ability\n# to resist to failures as otherwise an orphaned primary can't be failed over\n# in case of failure if it has no working replicas.\n#\n# Replicas migrate to orphaned primaries only if there are still at least a\n# given number of other working replicas for their old primary. This number\n# is the \"migration barrier\". A migration barrier of 1 means that a replica\n# will migrate only if there is at least 1 other working replica for its primary\n# and so forth. It usually reflects the number of replicas you want for every\n# primary in your cluster.\n#\n# Default is 1 (replicas migrate only if their primaries remain with at least\n# one replica). To disable migration just set it to a very large value or\n# set cluster-allow-replica-migration to 'no'.\n# A value of 0 can be set but is useful only for debugging and dangerous\n# in production.\n#\n# cluster-migration-barrier 1\n\n# Turning off this option allows to use less automatic cluster configuration.\n# It disables migration of replicas to orphaned primaries. Masters that become\n# empty due to losing their last slots to another primary will not automatically\n# replicate from the primary that took over their last slots. Instead, they will\n# remain as empty primaries without any slots.\n#\n# Default is 'yes' (allow automatic migrations).\n#\n# cluster-allow-replica-migration yes\n\n# By default cluster nodes stop accepting queries if they detect there\n# is at least a hash slot uncovered (no available node is serving it).\n# This way if the cluster is partially down (for example a range of hash slots\n# are no longer covered) all the cluster becomes, eventually, unavailable.\n# It automatically returns available as soon as all the slots are covered again.\n#\n# However sometimes you want the subset of the cluster which is working,\n# to continue to accept queries for the part of the key space that is still\n# covered. In order to do so, just set the cluster-require-full-coverage\n# option to no.\n#\n# cluster-require-full-coverage yes\n\n# This option, when set to yes, prevents replicas from trying to failover its\n# primary during primary failures. However the replica can still perform a\n# manual failover, if forced to do so.\n#\n# This is useful in different scenarios, especially in the case of multiple\n# data center operations, where we want one side to never be promoted if not\n# in the case of a total DC failure.\n#\n# cluster-replica-no-failover no\n\n# The timeout in milliseconds for cluster manual failover. If a manual failover\n# does not complete within the specified time, both the replica and the primary\n# will abort it. Note that this timeout is also used for the finalization of\n# migrations initiated with the CLUSTER MIGRATESLOTS command.\n#\n# A manual failover is a special kind of failover that is usually executed when\n# there are no actual failures, and we wish to swap the current primary with one\n# of its replicas in a safe way, without any window for data loss.\n#\n# To avoid data loss, the primary and the replica need to wait for each other for\n# a period of time, the primary need to pause the clients writes to stop processing\n# traffic. The default failover timeout is 5000ms, it is possible to configure the\n# timeout and decide how long the primary will pause in the worst case scenario,\n# i.e. the manual failover timed out due to the insufficient votes.\n#\n# Check https://valkey.io/commands/cluster-failover/ for more information.\n#\n# cluster-manual-failover-timeout 5000\n\n# This option, when set to yes, allows nodes to serve read traffic while the\n# cluster is in a down state, as long as it believes it owns the slots.\n#\n# This is useful for two cases. The first case is for when an application\n# doesn't require consistency of data during node failures or network partitions.\n# One example of this is a cache, where as long as the node has the data it\n# should be able to serve it.\n#\n# The second use case is for configurations that don't meet the recommended\n# three shards but want to enable cluster mode and scale later. A\n# primary outage in a 1 or 2 shard configuration causes a read/write outage to the\n# entire cluster without this option set, with it set there is only a write outage.\n# Without a quorum of primaries, slot ownership will not change automatically.\n#\n# cluster-allow-reads-when-down no\n\n# This option, when set to yes, allows nodes to serve pubsub shard traffic while\n# the cluster is in a down state, as long as it believes it owns the slots.\n#\n# This is useful if the application would like to use the pubsub feature even when\n# the cluster global stable state is not OK. If the application wants to make sure only\n# one shard is serving a given channel, this feature should be kept as yes.\n#\n# cluster-allow-pubsubshard-when-down yes\n\n# Cluster link send buffer limit is the limit on the memory usage of an individual\n# cluster bus link's send buffer in bytes. Cluster links would be freed if they exceed\n# this limit. This is to primarily prevent send buffers from growing unbounded on links\n# toward slow peers (E.g. PubSub messages being piled up).\n# This limit is disabled by default. Enable this limit when 'mem_cluster_links' INFO field\n# and/or 'send-buffer-allocated' entries in the 'CLUSTER LINKS` command output continuously increase.\n# Minimum limit of 1gb is recommended so that cluster link buffer can fit in at least a single\n# PubSub message by default. (client-query-buffer-limit default value is 1gb)\n#\n# cluster-link-sendbuf-limit 0\n\n# Clusters can configure their announced hostname using this config. This is a common use case for\n# applications that need to use TLS Server Name Indication (SNI) or dealing with DNS based\n# routing. By default this value is only shown as additional metadata in the CLUSTER SLOTS\n# command, but can be changed using 'cluster-preferred-endpoint-type' config. This value is\n# communicated along the clusterbus to all nodes, setting it to an empty string will remove\n# the hostname and also propagate the removal.\n#\n# cluster-announce-hostname \"\"\n\n# Clusters can configure an optional nodename to be used in addition to the node ID for\n# debugging and admin information. This name is broadcasted between nodes, so will be used\n# in addition to the node ID when reporting cross node events such as node failures.\n# cluster-announce-human-nodename \"\"\n\n# Clusters can advertise how clients should connect to them using either their IP address,\n# a user defined hostname, or by declaring they have no endpoint. Which endpoint is\n# shown as the preferred endpoint is set by using the cluster-preferred-endpoint-type\n# config with values 'ip', 'hostname', or 'unknown-endpoint'. This value controls how\n# the endpoint returned for MOVED/ASKING requests as well as the first field of CLUSTER SLOTS.\n# If the preferred endpoint type is set to hostname, but no announced hostname is set, a '?'\n# will be returned instead.\n#\n# When a cluster advertises itself as having an unknown endpoint, it's indicating that\n# the server doesn't know how clients can reach the cluster. This can happen in certain\n# networking situations where there are multiple possible routes to the node, and the\n# server doesn't know which one the client took. In this case, the server is expecting\n# the client to reach out on the same endpoint it used for making the last request, but use\n# the port provided in the response.\n#\n# cluster-preferred-endpoint-type ip\n\n# The cluster blacklist is used when removing a node from the cluster completely.\n# When CLUSTER FORGET is called for a node, that node is put into the blacklist for\n# some time so that when gossip messages are received from other nodes that still\n# remember it, it is not re-added. This gives time for CLUSTER FORGET to be sent to\n# every node in the cluster. The blacklist TTL is 60 seconds by default, which should\n# be sufficient for most clusters, but you may considering increasing this if you see\n# nodes getting re-added while using CLUSTER FORGET.\n#\n# cluster-blacklist-ttl 60\n\n# Clusters can be configured to track per-slot resource statistics,\n# which are accessible by the CLUSTER SLOT-STATS command.\n#\n# By default, the 'cluster-slot-stats-enabled' is disabled, and only 'key-count' is captured.\n# By enabling the 'cluster-slot-stats-enabled' config, the cluster will begin to capture advanced statistics.\n# These statistics can be leveraged to assess general slot usage trends, identify hot / cold slots,\n# migrate slots for a balanced cluster workload, and / or re-write application logic to better utilize slots.\n#\n# cluster-slot-stats-enabled no\n\n# Slot migrations using the CLUSTER MIGRATESLOTS command will generate an in-memory migration log on both\n# the source and target nodes of the migration. These can be observed with CLUSTER GETSLOTMIGRATIONS.\n# 'cluster-slot-migration-log-max-len' allows the maximum length of this log to be specified. Only\n# migrations that are completed will be considered for removal.\n#\n# cluster-slot-migration-log-max-len 1000\n\n# During the CLUSTER MIGRATESLOTS command execution, the source node needs to pause itself and allow all\n# writes to be fully processed by the target node. The amount of data remaining in the buffer on the\n# source node when this pause happens will affect how long this pause takes.\n# 'slot-migration-max-failover-repl-bytes' allows the pause to wait until there are at most this\n# many bytes in the output buffer. Setting this to -1 will disable this limit, and 0 will require\n# no data be in the source output buffer (although this is not a guaranatee the data is fully\n# received by the target).\n#\n# slot-migration-max-failover-repl-bytes 0\n\n# In order to setup your cluster make sure to read the documentation\n# available at https://valkey.io web site.\n\n########################## CLUSTER DOCKER/NAT support ########################\n\n# In certain deployments, cluster node's address discovery fails, because\n# addresses are NAT-ted or because ports are forwarded (the typical case is\n# Docker and other containers).\n#\n# In order to make a cluster work in such environments, a static\n# configuration where each node knows its public address is needed. The\n# following options are used for this scope, and are:\n#\n# * cluster-announce-ip\n# * cluster-announce-client-ipv4\n# * cluster-announce-client-ipv6\n# * cluster-announce-port\n# * cluster-announce-tls-port\n# * cluster-announce-bus-port\n# * cluster-announce-client-port\n# * cluster-announce-client-tls-port\n#\n# Each instructs the node about its address, possibly other addresses to expose\n# to clients, client ports (for connections without and with TLS) and cluster\n# message bus port. The information is then published in the bus packets so that\n# other nodes will be able to correctly map the address of the node publishing\n# the information.\n#\n# If tls-cluster is set to yes and cluster-announce-tls-port is omitted or set\n# to zero, then cluster-announce-port refers to the TLS port. Note also that\n# cluster-announce-tls-port has no effect if tls-cluster is set to no.\n#\n# If cluster-announce-client-ipv4 and cluster-announce-client-ipv6 are omitted,\n# then cluster-announce-ip is exposed to clients.\n#\n# If the port that clients will use to connect to Valkey is different than\n# the one other valkey nodes in the cluster will connect to it on, either\n# through special networking rules or because Valkey is behind a load balancer,\n# you can configure the port that clients will see by setting\n# cluster-announce-client-port or cluster-announce-client-tls-port.\n#\n# If the above options are not used, the normal cluster auto-detection\n# will be used instead.\n#\n# Note that when remapped, the bus port may not be at the fixed offset of\n# clients port + 10000, so you can specify any port and bus-port depending\n# on how they get remapped. If the bus-port is not set, a fixed offset of\n# 10000 will be used as usual.\n#\n# Example:\n#\n# cluster-announce-ip 10.1.1.5\n# cluster-announce-client-ipv4 123.123.123.5\n# cluster-announce-client-ipv6 2001:db8::8a2e:370:7334\n# cluster-announce-tls-port 6379\n# cluster-announce-port 0\n# cluster-announce-bus-port 6380\n# cluster-announce-client-tls-port 6479\n# cluster-announce-client-port 0\n\n# Set the number of databases in cluster mode. The default database is DB 0,\n# you can select a different one on a per-connection basis using SELECT where\n# dbid is a number between 0 and 'cluster-databases'-1.\n# cluster-databases 1\n\n################################## COMMAND LOG ###################################\n\n# The Command Log system is used to record commands that consume significant resources\n# during server operation, including CPU, memory, and network bandwidth.\n# These commands and the data they access may lead to abnormal instance operations,\n# the commandlog can help users quickly and intuitively locate issues.\n#\n# Currently, three types of command logs are supported:\n#\n# SLOW: Logs commands that exceed a specified execution time. This excludes time spent\n# on I/O operations like client communication and focuses solely on the command's\n# processing time, where the main thread is blocked.\n#\n# LARGE-REQUEST: Logs commands with requests exceeding a defined size. This helps\n# identify potentially problematic commands that send excessive data to the server.\n#\n# LARGE-REPLY: Logs commands that generate replies exceeding a defined size. This\n# helps identify commands that return unusually large amounts of data, which may\n# impact network performance or client processing.\n#\n# Each log type has two key parameters:\n# 1. A threshold value that determines when a command is logged. This threshold is specific\n# to the type of log (e.g., execution time, request size, or reply size). A negative value disables\n# logging. A value of 0 logs all commands.\n# 2. A maximum length that specifies the number of entries to retain in the log. Increasing\n# the length allows more entries to be stored but consumes additional memory. To clear all\n# entries for a specific log type and reclaim memory, use the `COMMANDLOG RESET`\n# subcommand followed by the log type.\n#\n# SLOW Command Logs\n# The SLOW log records commands that exceed a specified execution time. The execution time\n# does not include I/O operations, such as client communication or sending responses.\n# It only measures the time spent executing the command, during which the thread is blocked\n# and cannot handle other requests.\n#\n# The threshold is measured in microseconds.\n#\n# Backward Compatibility: The parameters `slowlog-log-slower-than` and `slowlog-max-len`\n# are still supported but deprecated in favor of these commandlog parameters.\n#\n# The following time is expressed in microseconds, so 1000000 is equivalent to 1 second.\n# Note that -1 disables the slow log, while 0 forces logging of every command.\ncommandlog-execution-slower-than 10000\n# Record the number of commands.\n# There is no limit to this length. Just be aware that it will consume memory.\n# You can reclaim memory used by the slow log with SLOWLOG RESET or COMMANDLOG RESET SLOW.\ncommandlog-slow-execution-max-len 128\n#\n# LARGE_REQUEST Command Logs\n# The LARGE_REQUEST log tracks commands with requests exceeding a specified size. The request size\n# includes the command itself and all its arguments. For example, in `SET KEY VALUE`, the size is\n# determined by the combined size of the key and value. Commands that consume excessive network\n# bandwidth or query buffer space are recorded here.\n#\n# The threshold is measured in bytes.\n# Note that -1 disables the large request log, while 0 forces logging of every command.\ncommandlog-request-larger-than 1048576\n# Record the number of commands.\n# There is no limit to this length. Just be aware that it will consume memory.\n# You can reclaim memory used by the large request log with COMMANDLOG RESET LARGE-REQUEST.\ncommandlog-large-request-max-len 128\n#\n# LARGE_REPLY Command Logs\n# The LARGE_REPLY log records commands that produce replies exceeding a specified size. These replies\n# may consume significant network bandwidth or client output buffer space. Examples include commands\n# like `KEYS` or `HGETALL` that return large datasets. Even a `GET` command may qualify if the value\n# is substantial.\n#\n# The threshold is measured in bytes.\n# Note that -1 disables the large reply log, while 0 forces logging of every command.\n# Enabling this feature (values other than -1) has performance implications\n# when I/O threads are used due to additional tracking overhead.\n# Consider using -1 to disable if large reply monitoring is not needed.\ncommandlog-reply-larger-than 1048576\n# Record the number of commands.\n# There is no limit to this length. Just be aware that it will consume memory.\n# You can reclaim memory used by the large reply log with COMMANDLOG RESET LARGE-REPLY.\ncommandlog-large-reply-max-len 128\n\n################################ LATENCY MONITOR ##############################\n\n# The server latency monitoring subsystem samples different operations\n# at runtime in order to collect data related to possible sources of\n# latency of a server instance.\n#\n# Via the LATENCY command this information is available to the user that can\n# print graphs and obtain reports.\n#\n# The system only logs operations that were performed in a time equal or\n# greater than the amount of milliseconds specified via the\n# latency-monitor-threshold configuration directive. When its value is set\n# to zero, the latency monitor is turned off.\n#\n# By default latency monitoring is disabled since it is mostly not needed\n# if you don't have latency issues, and collecting data has a performance\n# impact, that while very small, can be measured under big load. Latency\n# monitoring can easily be enabled at runtime using the command\n# \"CONFIG SET latency-monitor-threshold \" if needed.\nlatency-monitor-threshold 0\n\n################################ LATENCY TRACKING ##############################\n\n# The server's extended latency monitoring tracks the per command latencies and enables\n# exporting the percentile distribution via the INFO latencystats command,\n# and cumulative latency distributions (histograms) via the LATENCY command.\n#\n# By default, the extended latency monitoring is enabled since the overhead\n# of keeping track of the command latency is very small.\n# latency-tracking yes\n\n# By default the exported latency percentiles via the INFO latencystats command\n# are the p50, p99, and p999.\n# latency-tracking-info-percentiles 50 99 99.9\n\n############################# EVENT NOTIFICATION ##############################\n\n# The server can notify Pub/Sub clients about events happening in the key space.\n# This feature is documented at https://valkey.io/topics/notifications\n#\n# For instance if keyspace events notification is enabled, and a client\n# performs a DEL operation on key \"foo\" stored in the Database 0, two\n# messages will be published via Pub/Sub:\n#\n# PUBLISH __keyspace@0__:foo del\n# PUBLISH __keyevent@0__:del foo\n#\n# It is possible to select the events that the server will notify among a set\n# of classes. Every class is identified by a single character:\n#\n# K Keyspace events, published with __keyspace@__ prefix.\n# E Keyevent events, published with __keyevent@__ prefix.\n# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ...\n# $ String commands\n# l List commands\n# s Set commands\n# h Hash commands\n# z Sorted set commands\n# x Expired events (events generated every time a key expires)\n# e Evicted events (events generated when a key is evicted for maxmemory)\n# n New key events (Note: not included in the 'A' class)\n# t Stream commands\n# d Module key type events\n# m Key-miss events (Note: It is not included in the 'A' class)\n# A Alias for g$lshzxetd, so that the \"AKE\" string means all the events\n# (Except key-miss events which are excluded from 'A' due to their\n# unique nature).\n#\n# The \"notify-keyspace-events\" takes as argument a string that is composed\n# of zero or multiple characters. The empty string means that notifications\n# are disabled.\n#\n# Example: to enable list and generic events, from the point of view of the\n# event name, use:\n#\n# notify-keyspace-events Elg\n#\n# Example 2: to get the stream of the expired keys subscribing to channel\n# name __keyevent@0__:expired use:\n#\n# notify-keyspace-events Ex\n#\n# By default all notifications are disabled because most users don't need\n# this feature and the feature has some overhead. Note that if you don't\n# specify at least one of K or E, no events will be delivered.\nnotify-keyspace-events \"\"\n\n############################### ADVANCED CONFIG ###############################\n\n# Hashes are encoded using a memory efficient data structure when they have a\n# small number of entries, and the biggest entry does not exceed a given\n# threshold. These thresholds can be configured using the following directives.\nhash-max-listpack-entries 512\nhash-max-listpack-value 64\n\n# Lists are also encoded in a special way to save a lot of space.\n# The number of entries allowed per internal list node can be specified\n# as a fixed maximum size or a maximum number of elements.\n# For a fixed maximum size, use -5 through -1, meaning:\n# -5: max size: 64 Kb <-- not recommended for normal workloads\n# -4: max size: 32 Kb <-- not recommended\n# -3: max size: 16 Kb <-- probably not recommended\n# -2: max size: 8 Kb <-- good\n# -1: max size: 4 Kb <-- good\n# Positive numbers mean store up to _exactly_ that number of elements\n# per list node.\n# The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size),\n# but if your use case is unique, adjust the settings as necessary.\nlist-max-listpack-size -2\n\n# Lists may also be compressed.\n# Compress depth is the number of quicklist ziplist nodes from *each* side of\n# the list to *exclude* from compression. The head and tail of the list\n# are always uncompressed for fast push/pop operations. Settings are:\n# 0: disable all list compression\n# 1: depth 1 means \"don't start compressing until after 1 node into the list,\n# going from either the head or tail\"\n# So: [head]->node->node->...->node->[tail]\n# [head], [tail] will always be uncompressed; inner nodes will compress.\n# 2: [head]->[next]->node->node->...->node->[prev]->[tail]\n# 2 here means: don't compress head or head->next or tail->prev or tail,\n# but compress all nodes between them.\n# 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail]\n# etc.\nlist-compress-depth 0\n\n# Sets have a special encoding when a set is composed\n# of just strings that happen to be integers in radix 10 in the range\n# of 64 bit signed integers.\n# The following configuration setting sets the limit in the size of the\n# set in order to use this special memory saving encoding.\nset-max-intset-entries 512\n\n# Sets containing non-integer values are also encoded using a memory efficient\n# data structure when they have a small number of entries, and the biggest entry\n# does not exceed a given threshold. These thresholds can be configured using\n# the following directives.\nset-max-listpack-entries 128\nset-max-listpack-value 64\n\n# Similarly to hashes and lists, sorted sets are also specially encoded in\n# order to save a lot of space. This encoding is only used when the length and\n# elements of a sorted set are below the following limits:\nzset-max-listpack-entries 128\nzset-max-listpack-value 64\n\n# HyperLogLog sparse representation bytes limit. The limit includes the\n# 16 bytes header. When a HyperLogLog using the sparse representation crosses\n# this limit, it is converted into the dense representation.\n#\n# A value greater than 16000 is totally useless, since at that point the\n# dense representation is more memory efficient.\n#\n# The suggested value is ~ 3000 in order to have the benefits of\n# the space efficient encoding without slowing down too much PFADD,\n# which is O(N) with the sparse encoding. The value can be raised to\n# ~ 10000 when CPU is not a concern, but space is, and the data set is\n# composed of many HyperLogLogs with cardinality in the 0 - 15000 range.\nhll-sparse-max-bytes 3000\n\n# Streams macro node max size / items. The stream data structure is a radix\n# tree of big nodes that encode multiple items inside. Using this configuration\n# it is possible to configure how big a single node can be in bytes, and the\n# maximum number of items it may contain before switching to a new node when\n# appending new stream entries. If any of the following settings are set to\n# zero, the limit is ignored, so for instance it is possible to set just a\n# max entries limit by setting max-bytes to 0 and max-entries to the desired\n# value.\nstream-node-max-bytes 4096\nstream-node-max-entries 100\n\n# Active rehashing uses 1% of the CPU time to help perform incremental rehashing\n# of the main server hash tables, the ones mapping top-level keys to values.\n#\n# If active rehashing is disabled and rehashing is needed, a hash table is\n# rehashed one \"step\" on every operation performed on the hash table (add, find,\n# etc.), so if the server is idle, the rehashing may never complete and some\n# more memory is used by the hash tables. Active rehashing helps prevent this.\n#\n# Active rehashing runs as a background task. Depending on the value of 'hz',\n# the frequency at which the server performs background tasks, active rehashing\n# can cause the server to freeze for a short time. For example, if 'hz' is set\n# to 10, active rehashing runs for up to one millisecond every 100 milliseconds.\n# If a freeze of one millisecond is not acceptable, you can increase 'hz' to let\n# active rehashing run more often. If instead 'hz' is set to 100, active\n# rehashing runs up to only 100 microseconds every 10 milliseconds. The total is\n# still 1% of the time.\nactiverehashing yes\n\n# The client output buffer limits can be used to force disconnection of clients\n# that are not reading data from the server fast enough for some reason (a\n# common reason is that a Pub/Sub client can't consume messages as fast as the\n# publisher can produce them).\n#\n# The limit can be set differently for the three different classes of clients:\n#\n# normal -> normal clients including MONITOR clients\n# replica -> replica clients\n# pubsub -> clients subscribed to at least one pubsub channel or pattern\n#\n# The syntax of every client-output-buffer-limit directive is the following:\n#\n# client-output-buffer-limit \n#\n# A client is immediately disconnected once the hard limit is reached, or if\n# the soft limit is reached and remains reached for the specified number of\n# seconds (continuously).\n# So for instance if the hard limit is 32 megabytes and the soft limit is\n# 16 megabytes / 10 seconds, the client will get disconnected immediately\n# if the size of the output buffers reach 32 megabytes, but will also get\n# disconnected if the client reaches 16 megabytes and continuously overcomes\n# the limit for 10 seconds.\n#\n# By default normal clients are not limited because they don't receive data\n# without asking (in a push way), but just after a request, so only\n# asynchronous clients may create a scenario where data is requested faster\n# than it can read.\n#\n# Instead there is a default limit for pubsub and replica clients, since\n# subscribers and replicas receive data in a push fashion.\n#\n# Note that it doesn't make sense to set the replica clients output buffer\n# limit lower than the repl-backlog-size config (partial sync will succeed\n# and then replica will get disconnected).\n# Such a configuration is ignored (the size of repl-backlog-size will be used).\n# This doesn't have memory consumption implications since the replica client\n# will share the backlog buffers memory.\n#\n# Both the hard or the soft limit can be disabled by setting them to zero.\nclient-output-buffer-limit normal 0 0 0\nclient-output-buffer-limit replica 256mb 64mb 60\nclient-output-buffer-limit pubsub 32mb 8mb 60\n\n# Client query buffers accumulate new commands. They are limited to a fixed\n# amount by default in order to avoid that a protocol desynchronization (for\n# instance due to a bug in the client) will lead to unbound memory usage in\n# the query buffer. However you can configure it here if you have very special\n# needs, such as a command with huge argument, or huge multi/exec requests or alike.\n#\n# client-query-buffer-limit 1gb\n\n# In some scenarios client connections can hog up memory leading to OOM\n# errors or data eviction. To avoid this we can cap the accumulated memory\n# used by all client connections (all pubsub and normal clients). Once we\n# reach that limit connections will be dropped by the server freeing up\n# memory. The server will attempt to drop the connections using the most\n# memory first. We call this mechanism \"client eviction\".\n#\n# Client eviction is configured using the maxmemory-clients setting as follows:\n# 0 - client eviction is disabled (default)\n#\n# A memory value can be used for the client eviction threshold,\n# for example:\n# maxmemory-clients 1g\n#\n# A percentage value (between 1% and 100%) means the client eviction threshold\n# is based on a percentage of the maxmemory setting. For example to set client\n# eviction at 5% of maxmemory:\n# maxmemory-clients 5%\n\n# In the server protocol, bulk requests, that are, elements representing single\n# strings, are normally limited to 512 mb. However you can change this limit\n# here, but must be 1mb or greater\n#\n# proto-max-bulk-len 512mb\n\n# The server calls an internal function to perform many background tasks, like\n# closing connections of clients in timeout, purging expired keys that are\n# never requested, and so forth.\n#\n# Not all tasks are performed with the same frequency, but the server checks for\n# tasks to perform according to the specified \"hz\" value.\n#\n# By default \"hz\" is set to 10. Raising the value will use more CPU when\n# the server is idle, but at the same time will make the server more responsive when\n# there are many keys expiring at the same time, and timeouts may be\n# handled with more precision.\n#\n# The range is between 1 and 500, however a value over 100 is usually not\n# a good idea. Most users should use the default of 10 and raise this up to\n# 100 only in environments where very low latency is required.\nhz 10\n\n# When a child rewrites the AOF file, if the following option is enabled\n# the file will be fsync-ed every 4 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\naof-rewrite-incremental-fsync yes\n\n# When the server saves RDB file, if the following option is enabled\n# the file will be fsync-ed every 4 MB of data generated. This is useful\n# in order to commit the file to the disk more incrementally and avoid\n# big latency spikes.\nrdb-save-incremental-fsync yes\n\n# The server's LFU eviction (see maxmemory setting) can be tuned. However it is a good\n# idea to start with the default settings and only change them after investigating\n# how to improve the performances and how the keys LFU change over time, which\n# is possible to inspect via the OBJECT FREQ command.\n#\n# There are two tunable parameters in the server LFU implementation: the\n# counter logarithm factor and the counter decay time. It is important to\n# understand what the two parameters mean before changing them.\n#\n# The LFU counter is just 8 bits per key, it's maximum value is 255, so the server\n# uses a probabilistic increment with logarithmic behavior. Given the value\n# of the old counter, when a key is accessed, the counter is incremented in\n# this way:\n#\n# 1. A random number R between 0 and 1 is extracted.\n# 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1).\n# 3. The counter is incremented only if R < P.\n#\n# The default lfu-log-factor is 10. This is a table of how the frequency\n# counter changes with a different number of accesses with different\n# logarithmic factors:\n#\n# +--------+------------+------------+------------+------------+------------+\n# | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits |\n# +--------+------------+------------+------------+------------+------------+\n# | 0 | 104 | 255 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 1 | 18 | 49 | 255 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 10 | 10 | 18 | 142 | 255 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n# | 100 | 8 | 11 | 49 | 143 | 255 |\n# +--------+------------+------------+------------+------------+------------+\n#\n# NOTE: The above table was obtained by running the following commands:\n#\n# valkey-benchmark -n 1000000 incr foo\n# valkey-cli object freq foo\n#\n# NOTE 2: The counter initial value is 5 in order to give new objects a chance\n# to accumulate hits.\n#\n# The counter decay time is the time, in minutes, that must elapse in order\n# for the key counter to be decremented.\n#\n# The default value for the lfu-decay-time is 1. A special value of 0 means we\n# will never decay the counter.\n#\n# lfu-log-factor 10\n# lfu-decay-time 1\n\n\n# The maximum number of new client connections accepted per event-loop cycle. This configuration\n# is set independently for TLS connections.\n#\n# By default, up to 10 new connection will be accepted per event-loop cycle for normal connections\n# and up to 1 new connection per event-loop cycle for TLS connections.\n#\n# Adjusting this to a larger number can slightly improve efficiency for new connections\n# at the risk of causing timeouts for regular commands on established connections. It is\n# not advised to change this without ensuring that all clients have limited connection\n# pools and exponential backoff in the case of command/connection timeouts.\n#\n# If your application is establishing a large number of new connections per second you should\n# also consider tuning the value of tcp-backlog, which allows the kernel to buffer more\n# pending connections before dropping or rejecting connections.\n#\n# max-new-connections-per-cycle 10\n# max-new-tls-connections-per-cycle 1\n\n# Memory prefetching is used when multiple commands are parsed and ready for\n# execution. We take advantage of knowing the next set of commands and prefetch\n# their required hash table entries in a batch. This reduces the time spent on\n# memory accesses.\n#\n# When I/O threads are used, the keys of multiple commands from multiple clients\n# are prefetched together. When I/O threads are not used, only the commands from\n# a single client's command pipeline is prefetched.\n#\n# The optimal batch size depends on the specific workflow of the user and on the\n# hardware used. The default batch size is 16, which can be modified using the\n# 'prefetch-batch-max-size' config.\n#\n# When the config is set to 0, prefetching is disabled.\n#\n# prefetch-batch-max-size 16\n\n\n########################### ACTIVE DEFRAGMENTATION #######################\n#\n# What is active defragmentation?\n# -------------------------------\n#\n# Active (online) defragmentation allows a server to compact the\n# spaces left between small allocations and deallocations of data in memory,\n# thus allowing to reclaim back memory.\n#\n# Fragmentation is a natural process that happens with every allocator (but\n# less so with Jemalloc, fortunately) and certain workloads. Normally a server\n# restart is needed in order to lower the fragmentation, or at least to flush\n# away all the data and create it again. However thanks to this feature, this\n# process can happen at runtime in a \"hot\" way, while the server is running.\n#\n# Basically when the fragmentation is over a certain level (see the\n# configuration options below) the server will start to create new copies of the\n# values in contiguous memory regions by exploiting certain specific Jemalloc\n# features (in order to understand if an allocation is causing fragmentation\n# and to allocate it in a better place), and at the same time, will release the\n# old copies of the data. This process, repeated incrementally for all the keys\n# will cause the fragmentation to drop back to normal values.\n#\n# Important things to understand:\n#\n# 1. This feature is disabled by default, and only works if you compiled the server\n# to use the copy of Jemalloc we ship with the source code of the server.\n# This is the default with Linux builds.\n#\n# 2. You never need to enable this feature if you don't have fragmentation\n# issues.\n#\n# 3. Once you experience fragmentation, you can enable this feature when\n# needed with the command \"CONFIG SET activedefrag yes\".\n#\n# The configuration parameters are able to fine tune the behavior of the\n# defragmentation process. If you are not sure about what they mean it is\n# a good idea to leave the defaults untouched.\n\n# Active defragmentation is disabled by default\n# activedefrag no\n\n# Minimum amount of fragmentation waste to start active defrag\n# active-defrag-ignore-bytes 100mb\n\n# Minimum percentage of fragmentation to start active defrag\n# active-defrag-threshold-lower 10\n\n# Maximum percentage of fragmentation at which we use maximum effort\n# active-defrag-threshold-upper 100\n\n# Minimal effort for defrag in CPU percentage, not cycle time as the name might\n# suggest, to be used when the lower threshold is reached.\n# active-defrag-cycle-min 1\n\n# Maximal effort for defrag in CPU percentage, not cycle time as the name might\n# suggest, to be used when the upper threshold is reached.\n# active-defrag-cycle-max 25\n\n# Maximum number of set/hash/zset/list fields that will be processed from\n# the main dictionary scan\n# active-defrag-max-scan-fields 1000\n\n# The time spent (in microseconds) of the periodic active defrag process. This\n# affects the latency impact of active defrag on client commands. Smaller numbers\n# will result in less latency impact at the cost of increased defrag overhead.\n# active-defrag-cycle-us 500\n\n# Jemalloc background thread for purging will be enabled by default\njemalloc-bg-thread yes\n\n# It is possible to pin different threads and processes of the server to specific\n# CPUs in your system, in order to maximize the performances of the server.\n# This is useful both in order to pin different server threads in different\n# CPUs, but also in order to make sure that multiple server instances running\n# in the same host will be pinned to different CPUs.\n#\n# Normally you can do this using the \"taskset\" command, however it is also\n# possible to do this via the server configuration directly, both in Linux and FreeBSD.\n#\n# You can pin the server/IO threads, bio threads, aof rewrite child process,\n# bgsave child process and the slot migration process.\n# The syntax to specify the cpu list is the same as the taskset command:\n#\n# Set server/io threads to cpu affinity 0,2,4,6:\n# server-cpulist 0-7:2\n#\n# Set bio threads to cpu affinity 1,3:\n# bio-cpulist 1,3\n#\n# Set aof rewrite child process to cpu affinity 8,9,10,11:\n# aof-rewrite-cpulist 8-11\n#\n# Set bgsave (or slot migration) child process to cpu affinity 1,10,11:\n# bgsave-cpulist 1,10-11\n\n# In some cases the server will emit warnings and even refuse to start if it detects\n# that the system is in bad state, it is possible to suppress these warnings\n# by setting the following config which takes a space delimited list of warnings\n# to suppress\n#\n# ignore-warnings ARM64-COW-BUG\n\n# Inform Valkey of the availability zone if running in a cloud environment. Currently\n# this is exposed in the INFO and HELLO commands for clients to use. Default is\n# the empty string.\n#\n# availability-zone \"zone-name\"\n" }, { "path": "aegir/conf/var/boa.bashrc.txt", "content": "#-------------------------------------------------------------\n# BOA default .bashrc\n#-------------------------------------------------------------\n\nulimit -S -c 0\n\nset -o notify\nset -o ignoreeof\n\nshopt -s cdspell\nshopt -s cdable_vars\nshopt -s checkhash\nshopt -s checkwinsize\nshopt -s sourcepath\nshopt -s no_empty_cmd_completion\nshopt -s cmdhist\nshopt -s histappend histreedit histverify\nshopt -u mailwarn\nunset MAILCHECK\n\nHISTCONTROL=ignoredups:ignorespace\n\nexport PATH=$PATH:/usr/local/bin:/opt/local/bin\n\ncase \"$TERM\" in\nxterm*|rxvt*|vt100)\n export PS1='\\h:\\w\\$ '\n ;;\n *)\n ;;\nesac\n\n# workaround for immediate refresh in screen session\nif [ -n \"$STY\" ]; then\n alias mc='TERM=dumb mc'\nelse\n alias mc='mc'\nfi\n\nif [ -x /usr/bin/dircolors ]; then\n test -r ~/.dircolors && eval \"$(dircolors -b ~/.dircolors)\" || eval \"$(dircolors -b)\"\n alias ll=\"ls -l --group-directories-first --color=auto\"\n alias ls='ls -hF --color=auto' # add colors for filetype recognition\n alias la='ls -Al --color=auto' # show hidden files\n alias lx='ls -lXB --color=auto' # sort by extension\n alias lk='ls -lSr --color=auto' # sort by size, biggest last\n alias lc='ls -ltcr --color=auto' # sort by and show change time, most recent last\n alias lu='ls -ltur --color=auto' # sort by and show access time, most recent last\n alias lt='ls -ltr --color=auto' # sort by date, most recent last\n alias lr='ls -lR --color=auto' # recursive ls\n alias dir='dir --color=auto' # add colors\n alias vdir='vdir --color=auto' # add colors\n alias grep='grep --color=auto' # add colors\n alias fgrep='fgrep --color=auto' # add colors\n alias egrep='egrep --color=auto' # add colors\nelse\n alias ll=\"ls -l --group-directories-first\"\n alias ls='ls -hF' # filetype recognition\n alias la='ls -Al' # show hidden files\n alias lx='ls -lXB' # sort by extension\n alias lk='ls -lSr' # sort by size, biggest last\n alias lc='ls -ltcr' # sort by and show change time, most recent last\n alias lu='ls -ltur' # sort by and show access time, most recent last\n alias lt='ls -ltr' # sort by date, most recent last\n alias lr='ls -lR' # recursive ls\nfi\n\nalias df='df -kTPh'\nalias wget='wget --no-check-certificate'\n\nfunction xtitle() {\n case \"$TERM\" in\n xterm*|rxvt*)\n echo -n -e \"\\033]0;$*\\007\" ;;\n *)\n ;;\n esac\n}\n\n_L_HOST=\"$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\nalias top='xtitle $_L_HOST System Monitor && top'\nalias htop='xtitle $_L_HOST System Monitor && htop'\nalias mytop='xtitle $_L_HOST SQL Monitor && mytop'\nalias make='xtitle Making $(basename $PWD) ; make SHELL=/bin/bash'\n\nfunction extract() {\n if [ -f $1 ]; then\n case $1 in\n *.tar.bz2) tar xjf $1 ;;\n *.tar.gz) tar xzf $1 ;;\n *.bz2) bunzip2 $1 ;;\n *.rar) unrar x $1 ;;\n *.gz) gunzip -q $1 ;;\n *.tar) tar xf $1 ;;\n *.tbz2) tar xjf $1 ;;\n *.tgz) tar xzf $1 ;;\n *.zip) unzip -qq $1 ;;\n *.Z) uncompress $1 ;;\n *.7z) 7z x $1 ;;\n *) echo \"'$1' cannot be extracted via >extract<\" ;;\n esac\n else\n echo \"'$1' is not a valid file\"\n fi\n}\n\nif [ -f ~/.bash_aliases ]; then\n . ~/.bash_aliases\nfi\n\numask 022\n" }, { "path": "aegir/conf/var/clean-boa-env", "content": "#!/bin/bash\n\n### BEGIN INIT INFO\n# Provides: clean-boa-env\n# Required-Start: $remote_fs $syslog\n# Required-Stop: $remote_fs $syslog\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: safeguard to remove auto-healing pid files after reboot etc.\n# Description: safeguard to remove auto-healing pid files after reboot etc.\n### END INIT INFO\n\nPATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nNAME=clean-boa-env\nDESC=clean-boa-env\nPIDFILE=/run/clean-boa-env.pid\n\ncase \"$1\" in\n start)\n echo -n \"Starting $DESC: \"\n if [ -L \"/bin/sh\" ]; then\n _WEB_SH=\"$(readlink -n /bin/sh)\"\n if [ -x \"/bin/dash\" ] || [ -x \"/usr/bin/dash\" ]; then\n if [ \"${_WEB_SH}\" != \"/bin/dash\" ]; then\n if [ -x \"/usr/bin/dash\" ] && [ ! -L \"/usr/bin/dash\" ]; then\n if [ -L \"/usr/bin/sh\" ]; then\n ln -sfn /usr/bin/dash /usr/bin/sh\n fi\n if [ -L \"/bin/sh\" ]; then\n ln -sfn /usr/bin/dash /bin/sh\n fi\n fi\n if [ -x \"/bin/dash\" ] && [ ! -L \"/bin/dash\" ]; then\n if [ -L \"/usr/bin/sh\" ]; then\n ln -sfn /bin/dash /usr/bin/sh\n fi\n if [ -L \"/bin/sh\" ]; then\n ln -sfn /bin/dash /bin/sh\n fi\n fi\n fi\n elif [ -x \"/bin/bash\" ] || [ -x \"/usr/bin/bash\" ]; then\n if [ \"${_WEB_SH}\" != \"/bin/bash\" ]; then\n if [ -x \"/usr/bin/bash\" ] && [ ! -L \"/usr/bin/bash\" ]; then\n if [ -L \"/usr/bin/sh\" ]; then\n ln -sfn /usr/bin/bash /usr/bin/sh\n fi\n if [ -L \"/bin/sh\" ]; then\n ln -sfn /usr/bin/bash /bin/sh\n fi\n fi\n if [ -x \"/bin/bash\" ] && [ ! -L \"/bin/bash\" ]; then\n if [ -L \"/usr/bin/sh\" ]; then\n ln -sfn /bin/bash /usr/bin/sh\n fi\n if [ -L \"/bin/sh\" ]; then\n ln -sfn /bin/bash /bin/sh\n fi\n fi\n fi\n fi\n fi\n _RAM_AUTO_FILE=\"/sys/devices/system/memory/auto_online_blocks\"\n if [ -f \"${_RAM_AUTO_FILE}\" ]; then\n if grep -qx offline \"${_RAM_AUTO_FILE}\"; then\n echo online > \"${_RAM_AUTO_FILE}\"\n fi\n fi\n for _CPU_DIR in /sys/devices/system/cpu/cpu[0-9]*\n do\n _CPU=${_CPU_DIR##*/}\n _CPU_STATE_FILE=\"${_CPU_DIR}/online\"\n if [ -f \"${_CPU_STATE_FILE}\" ]; then\n if grep -qx 0 \"${_CPU_STATE_FILE}\"; then\n echo 1 > \"${_CPU_STATE_FILE}\"\n fi\n fi\n done\n for _RAM_DIR in /sys/devices/system/memory/memory[0-9]*\n do\n _RAM=${_RAM_DIR##*/}\n _RAM_STATE_FILE=\"${_RAM_DIR}/state\"\n if [ -f \"${_RAM_STATE_FILE}\" ]; then\n if grep -qx offline \"${_RAM_STATE_FILE}\"; then\n echo online > \"${_RAM_STATE_FILE}\"\n fi\n fi\n done\n if [ -e \"/root/.run-to-excalibur.cnf\" ]; then\n if [ -x \"/opt/local/bin/autoexcalibur\" ]; then\n nohup /opt/local/bin/autoexcalibur > /dev/null 2>&1 &\n fi\n elif [ -e \"/root/.run-to-daedalus.cnf\" ]; then\n if [ -x \"/opt/local/bin/autodaedalus\" ]; then\n nohup /opt/local/bin/autodaedalus > /dev/null 2>&1 &\n fi\n elif [ -e \"/root/.run-to-chimaera.cnf\" ]; then\n if [ -x \"/opt/local/bin/autochimaera\" ]; then\n nohup /opt/local/bin/autochimaera > /dev/null 2>&1 &\n fi\n elif [ -e \"/root/.run-to-beowulf.cnf\" ]; then\n if [ -x \"/opt/local/bin/autobeowulf\" ]; then\n nohup /opt/local/bin/autobeowulf > /dev/null 2>&1 &\n fi\n fi\n touch $PIDFILE\n [ -e \"/run/boa_wait.pid\" ] && rm -f /run/boa_wait.pid\n [ -e \"/run/boa_run.pid\" ] && rm -f /run/boa_run.pid\n [ -e \"/run/manage_ltd_users.pid\" ] && rm -f /run/manage_ltd_users.pid\n [ -e \"/run/daily-fix.pid\" ] && rm -f /run/daily-fix.pid\n [ -e \"/run/boa_cron_wait.pid\" ] && rm -f /run/boa_cron_wait.pid\n ;;\n stop)\n echo -n \"Stopping $DESC: \"\n if [ -L \"/bin/sh\" ]; then\n _WEB_SH=\"$(readlink -n /bin/sh)\"\n if [ -x \"/bin/dash\" ]; then\n if [ \"${_WEB_SH}\" != \"/bin/dash\" ]; then\n ln -sfn /bin/dash /bin/sh\n if [ -e \"/usr/bin/sh\" ]; then\n ln -sfn /bin/dash /usr/bin/sh\n fi\n fi\n else\n if [ \"${_WEB_SH}\" != \"/bin/bash\" ]; then\n ln -sfn /bin/bash /bin/sh\n if [ -e \"/usr/bin/sh\" ]; then\n ln -sfn /bin/bash /usr/bin/sh\n fi\n fi\n fi\n fi\n _REBOOT_ONE_TEST=$(ls -la /root/.run-auto-major-os-reboot*-one.cnf 2>&1)\n _REBOOT_TWO_TEST=$(ls -la /root/.run-auto-major-os-reboot*-two.cnf 2>&1)\n if [[ \"${_REBOOT_ONE_TEST}\" =~ \"No such file\" ]] \\\n && [[ \"${_REBOOT_TWO_TEST}\" =~ \"No such file\" ]]; then\n service cron stop &> /dev/null\n killall cron &> /dev/null\n pkill -9 -f second.sh\n pkill -9 -f runner.sh\n pkill -9 -f minute.sh\n echo \"Cron has been stopped\"\n if [ ! -e \"/root/.allow.clamav.cnf\" ] || [ -e \"/root/.deny.clamav.cnf\" ]; then\n if [ -e \"/etc/init.d/clamav-daemon\" ]; then\n update-rc.d -f clamav-daemon remove &> /dev/null\n fi\n if [ -e \"/etc/init.d/clamav-freshclam\" ]; then\n update-rc.d -f clamav-freshclam remove &> /dev/null\n fi\n fi\n pkill -9 -f avahi-daemon\n pkill -9 -f clamd\n pkill -9 -f freshclam\n pkill -9 -f java\n rm -f /run/clamav/*\n echo \"Java/Solr/Clamav have been stopped\"\n service nginx stop &> /dev/null\n killall nginx &> /dev/null\n killall php &> /dev/null\n pkill -9 -f php-fpm\n echo \"Nginx, PHP-CLI and PHP-FPM have been stopped\"\n csf -df &> /dev/null\n csf -tf &> /dev/null\n echo \"Firewall has been purged\"\n if [ -e \"/root/.my.pass.txt\" ]; then\n _SQL_PSWD=$(cat /root/.my.pass.txt 2>/dev/null | tr -d '\\n')\n _IS_MYSQLD_RUNNING=$(pgrep -f /usr/sbin/mysqld)\n if [ ! -z \"${_IS_MYSQLD_RUNNING}\" ] && [ ! -z \"${_SQL_PSWD}\" ]; then\n echo \"Preparing MySQLD for quick shutdown...\"\n _DBS_TEST=\"$(which mysql)\"\n if [ ! -z \"${_DBS_TEST}\" ]; then\n _DB_SERVER_TEST=$(mysql -V 2>&1)\n fi\n if [[ \"${_DB_SERVER_TEST}\" =~ \"Ver 8.4.\" ]]; then\n _DB_V=8.4\n elif [[ \"${_DB_SERVER_TEST}\" =~ \"Ver 8.0.\" ]]; then\n _DB_V=8.0\n elif [[ \"${_DB_SERVER_TEST}\" =~ \"Distrib 5.7.\" ]]; then\n _DB_V=5.7\n fi\n mysql -u root -e \"SET GLOBAL innodb_max_dirty_pages_pct = 0;\" &> /dev/null\n mysql -u root -e \"SET GLOBAL innodb_change_buffering = 'none';\" &> /dev/null\n mysql -u root -e \"SET GLOBAL innodb_buffer_pool_dump_at_shutdown = 1;\" &> /dev/null\n mysql -u root -e \"SET GLOBAL innodb_io_capacity=3000;\" &> /dev/null\n mysql -u root -e \"SET GLOBAL innodb_io_capacity_max=6000;\" &> /dev/null\n if [ \"${_DB_V}\" = \"5.7\" ]; then\n mysql -u root -e \"SET GLOBAL innodb_buffer_pool_dump_pct = 100;\" &> /dev/null\n mysql -u root -e \"SET GLOBAL innodb_buffer_pool_dump_now = ON;\" &> /dev/null\n fi\n mysql -u root -e \"SET GLOBAL innodb_fast_shutdown = 1;\" &> /dev/null\n echo \"Stopping MySQLD now...\"\n service mysql stop &> /dev/null\n wait\n echo \"MySQLD stopped\"\n else\n echo \"MySQLD already stopped\"\n fi\n fi\n fi\n [ -e \"/run/boa_wait.pid\" ] && rm -f /run/boa_wait.pid\n [ -e \"/run/boa_run.pid\" ] && rm -f /run/boa_run.pid\n [ -e \"/run/manage_ltd_users.pid\" ] && rm -f /run/manage_ltd_users.pid\n [ -e \"/run/daily-fix.pid\" ] && rm -f /run/daily-fix.pid\n [ -e \"/run/boa_cron_wait.pid\" ] && rm -f /run/boa_cron_wait.pid\n rm -f $PIDFILE\n ;;\n\n restart|force-reload)\n ${0} stop\n ${0} start\n ;;\n\n *)\n echo \"Usage: service $NAME {start|stop|restart|force-reload}\" >&2\n exit 0\n ;;\nesac\n\nexit 0\n" }, { "path": "aegir/conf/var/crossdomain.xml", "content": "\n\n\n \n \n" }, { "path": "aegir/conf/var/csf.conf", "content": "###############################################################################\n# SECTION:Initial Settings\n###############################################################################\n# Testing flag - enables a CRON job that clears iptables incase of\n# configuration problems when you start csf. This should be enabled until you\n# are sure that the firewall works - i.e. incase you get locked out of your\n# server! Then do remember to set it to 0 and restart csf when you're sure\n# everything is OK. Stopping csf will remove the line from /etc/crontab\n#\n# lfd will not start while this is enabled\nTESTING = \"0\"\n\n# The interval for the crontab in minutes. Since this uses the system clock the\n# CRON job will run at the interval past the hour and not from when you issue\n# the start command. Therefore an interval of 5 minutes means the firewall\n# will be cleared in 0-5 minutes from the firewall start\nTESTING_INTERVAL = \"5\"\n\n# SECURITY WARNING\n# ================\n#\n# Unfortunately, syslog and rsyslog allow end-users to log messages to some\n# system logs via the same unix socket that other local services use. This\n# means that any log line shown in these system logs that syslog or rsyslog\n# maintain can be spoofed (they are exactly the same as real log lines).\n#\n# Since some of the features of lfd rely on such log lines, spoofed messages\n# can cause false-positive matches which can lead to confusion at best, or\n# blocking of any innocent IP address or making the server inaccessible at\n# worst.\n#\n# Any option that relies on the log entries in the files listed in\n# /etc/syslog.conf and /etc/rsyslog.conf should therefore be considered\n# vulnerable to exploitation by end-users and scripts run by end-users.\n#\n# NOTE: Not all log files are affected as they may not use syslog/rsyslog\n#\n# The option RESTRICT_SYSLOG disables all these features that rely on affected\n# logs. These options are:\n# LF_SSHD LF_FTPD LF_IMAPD LF_POP3D LF_BIND LF_SUHOSIN LF_SSH_EMAIL_ALERT\n# LF_SU_EMAIL_ALERT LF_CONSOLE_EMAIL_ALERT LF_DISTATTACK LF_DISTFTP\n# LT_POP3D LT_IMAPD PS_INTERVAL UID_INTERVAL WEBMIN_LOG LF_WEBMIN_EMAIL_ALERT\n# PORTKNOCKING_ALERT LF_SUDO_EMAIL_ALERT\n#\n# This list of options use the logs but are not disabled by RESTRICT_SYSLOG:\n# ST_ENABLE SYSLOG_CHECK LOGSCANNER CUSTOM*_LOG\n#\n# The following options are still enabled by default on new installations so\n# that, on balance, csf/lfd still provides expected levels of security:\n# LF_SSHD LF_FTPD LF_POP3D LF_IMAPD LF_SSH_EMAIL_ALERT LF_SU_EMAIL_ALERT\n#\n# If you set RESTRICT_SYSLOG to \"0\" or \"2\" and enable any of the options listed\n# above, it should be done with the knowledge that any of the those options\n# that are enabled could be triggered by spoofed log lines and lead to the\n# server being inaccessible in the worst case. If you do not want to take that\n# risk you should set RESTRICT_SYSLOG to \"1\" and those features will not work\n# but you will not be protected from the exploits that they normally help block\n#\n# The recommended setting for RESTRICT_SYSLOG is \"3\" to restrict who can access\n# the syslog/rsyslog unix socket.\n#\n# For further advice on how to help mitigate these issues, see\n# /etc/csf/readme.txt\n#\n# 0 = Allow those options listed above to be used and configured\n# 1 = Disable all the options listed above and prevent them from being used\n# 2 = Disable only alerts about this feature and do nothing else\n# 3 = Restrict syslog/rsyslog access to RESTRICT_SYSLOG_GROUP ** RECOMMENDED **\nRESTRICT_SYSLOG = \"3\"\n\n# The following setting is used if RESTRICT_SYSLOG is set to 3. It restricts\n# write access to the syslog/rsyslog unix socket(s). The group must not already\n# exists in /etc/group before setting RESTRICT_SYSLOG to 3, so set the option\n# to a unique name for the server\n#\n# You can add users to this group by changing /etc/csf/csf.syslogusers and then\n# restarting lfd afterwards. This will create the system group and add the\n# users from csf.syslogusers if they exist to that group and will change the\n# permissions on the syslog/rsyslog unix socket(s). The socket(s) will be\n# monitored and the permissions re-applied should syslog/rsyslog be restarted\n#\n# Using this option will prevent some legitimate logging, e.g. end-user cron\n# job logs\n#\n# If you want to revert RESTRICT_SYSLOG to another option and disable this\n# feature, change the setting of RESTRICT_SYSLOG and then restart lfd and then\n# syslog/rsyslog and the unix sockets will be reset\nRESTRICT_SYSLOG_GROUP = \"mysyslog\"\n\n# This options restricts the ability to modify settings within this file from\n# the csf UI. Should the parent control panel be compromised, these restricted\n# options could be used to further compromise the server. For this reason we\n# recommend leaving this option set to at least \"1\" and if any of the\n# restricted items need to be changed, they are done so from the root shell\n#\n# 0 = Unrestricted UI\n# 1 = Restricted UI\n# 2 = Disabled UI\nRESTRICT_UI = \"1\"\n\n# Enabling auto updates creates a cron job called /etc/cron.d/csf_update which\n# runs once per day to see if there is an update to csf+lfd and upgrades if\n# available and restarts csf and lfd\n#\n# You should check for new version announcements at http://blog.configserver.com\nAUTO_UPDATES = \"0\"\n\n###############################################################################\n# SECTION:IPv4 Port Settings\n###############################################################################\n# Lists of ports in the following comma separated lists can be added using a\n# colon (e.g. 30000:35000).\n\n# Some kernel/iptables setups do not perform stateful connection tracking\n# correctly (typically some virtual servers or custom compiled kernels), so a\n# SPI firewall will not function correctly. If this happens, LF_SPI can be set\n# to 0 to reconfigure csf as a static firewall.\n#\n# As connection tracking will not be configured, applications that rely on it\n# will not function unless all outgoing ports are opened. Therefore, all\n# outgoing connections will be allowed once all other tests have completed. So\n# TCP_OUT, UDP_OUT and ICMP_OUT will not have any affect.\n#\n# If you allow incoming DNS lookups you may need to use the following\n# directive in the options{} section of your named.conf:\n#\n# query-source port 53;\n#\n# This will force incoming DNS traffic only through port 53\n#\n# Disabling this option will break firewall functionality that relies on\n# stateful packet inspection (e.g. DNAT, PACKET_FILTER) and makes the firewall\n# less secure\n#\n# This option should be set to \"1\" in all other circumstances\nLF_SPI = \"1\"\n\n# Allow incoming TCP ports\nTCP_IN = \"20,21,22,24,53,80,110,143,443,465,587,993,995,2401,5280,9418,30000:50000\"\n\n# Allow outgoing TCP ports\nTCP_OUT = \"20,21,22,25,53,80,110,143,222,389,443,465,587,636,873,993,995,1129,1935,2195,2222,2401,2525,3268,3306,5280,5432,8081,8443,9418,9998,11371,27017,30000:50000,5201:5210\"\n\n# Allow incoming UDP ports\nUDP_IN = \"20,21,53,123,33434:33523,443\"\n\n# Allow outgoing UDP ports\n# To allow outgoing traceroute add 33434:33523 to this list\nUDP_OUT = \"20,21,53,123,33434:33523\"\n\n# Allow incoming PING. Disabling PING will likely break external uptime\n# monitoring\nICMP_IN = \"1\"\n\n# Set the per IP address incoming ICMP packet rate for PING requests. This\n# ratelimits PING requests which if exceeded results in silently rejected\n# packets. Disable or increase this value if you are seeing PING drops that you\n# do not want\n#\n# To disable rate limiting set to \"0\", otherwise set according to the iptables\n# documentation for the limit module. For example, \"1/s\" will limit to one\n# packet per second\nICMP_IN_RATE = \"1/s\"\n\n# Allow outgoing PING\n#\n# Unless there is a specific reason, this option should NOT be disabled as it\n# could break OS functionality\nICMP_OUT = \"1\"\n\n# Set the per IP address outgoing ICMP packet rate for PING requests. This\n# ratelimits PING requests which if exceeded results in silently rejected\n# packets. Disable or increase this value if you are seeing PING drops that you\n# do not want\n#\n# Unless there is a specific reason, this option should NOT be enabled as it\n# could break OS functionality\n#\n# To disable rate limiting set to \"0\", otherwise set according to the iptables\n# documentation for the limit module. For example, \"1/s\" will limit to one\n# packet per second\nICMP_OUT_RATE = \"1/s\"\n\n# For those with PCI Compliance tools that state that ICMP timestamps (type 13)\n# should be dropped, you can enable the following option. Otherwise, there\n# appears to be little evidence that it has anything to do with a security risk\n# and can impact network performance, so should be left disabled by everyone\n# else\nICMP_TIMESTAMPDROP = \"0\"\n\n###############################################################################\n# SECTION:IPv6 Port Settings\n###############################################################################\n# IPv6: (Requires ip6tables)\n#\n# Pre v2.6.20 kernels do not perform stateful connection tracking, so a static\n# firewall is configured as a fallback instead if IPV6_SPI is set to 0 below\n#\n# Supported:\n# Temporary ACCEPT/DENY, GLOBAL_DENY, GLOBAL_ALLOW, SMTP_BLOCK, LF_PERMBLOCK,\n# PACKET_FILTER, Advanced Allow/Deny Filters, RELAY_*, CLUSTER_*, CC6_LOOKUPS,\n# SYNFLOOD, LF_NETBLOCK\n#\n# Supported if CC6_LOOKUPS and CC_LOOKUPS are enabled\n# CC_DENY, CC_ALLOW, CC_ALLOW_FILTER, CC_IGNORE, CC_ALLOW_PORTS, CC_DENY_PORTS,\n# CC_ALLOW_SMTPAUTH\n#\n# Supported if ip6tables >= 1.4.3:\n# PORTFLOOD, CONNLIMIT\n#\n# Supported if ip6tables >= 1.4.17 and perl module IO::Socket::INET6 is\n# installed:\n# MESSENGER DOCKER SMTP_REDIRECT\n#\n# Not supported:\n# ICMP_IN, ICMP_OUT\n#\nIPV6 = \"1\"\n\n# IPv6 uses icmpv6 packets very heavily. By default, csf will allow all icmpv6\n# traffic in the INPUT and OUTPUT chains. However, this could increase the risk\n# of icmpv6 attacks. To restrict incoming icmpv6, set to \"1\" but may break some\n# connection types\nIPV6_ICMP_STRICT = \"1\"\n\n# Pre v2.6.20 kernel must set this option to \"0\" as no working state module is\n# present, so a static firewall is configured as a fallback\n#\n# A workaround has been added for CentOS/RedHat v5 and custom kernels that do\n# not support IPv6 connection tracking by opening ephemeral port range\n# 32768:61000. This is only applied if IPV6_SPI is not enabled. This is the\n# same workaround implemented by RedHat in the sample default IPv6 rules\n#\n# As connection tracking will not be configured, applications that rely on it\n# will not function unless all outgoing ports are opened. Therefore, all\n# outgoing connections will be allowed once all other tests have completed. So\n# TCP6_OUT, UDP6_OUT and ICMP6_OUT will not have any affect.\n#\n# If you allow incoming ipv6 DNS lookups you may need to use the following\n# directive in the options{} section of your named.conf:\n#\n# query-source-v6 port 53;\n#\n# This will force ipv6 incoming DNS traffic only through port 53\n#\n# These changes are not necessary if the SPI firewall is used\nIPV6_SPI = \"1\"\n\n# Allow incoming IPv6 TCP ports\nTCP6_IN = \"53\"\n\n# Allow outgoing IPv6 TCP ports\nTCP6_OUT = \"53\"\n\n# Allow incoming IPv6 UDP ports\nUDP6_IN = \"53\"\n\n# Allow outgoing IPv6 UDP ports\n# To allow outgoing traceroute add 33434:33523 to this list\nUDP6_OUT = \"53\"\n\n###############################################################################\n# SECTION:General Settings\n###############################################################################\n# By default, csf will auto-configure iptables to filter all traffic except on\n# the loopback device. If you only want iptables rules applied to a specific\n# NIC, then list it here (e.g. eth1, or eth+)\nETH_DEVICE = \"\"\n\n# By adding a device to this option, ip6tables can be configured only on the\n# specified device. Otherwise, ETH_DEVICE and then the default setting will be\n# used\nETH6_DEVICE = \"\"\n\n# If you don't want iptables rules applied to specific NICs, then list them in\n# a comma separated list (e.g \"eth1,eth2\")\nETH_DEVICE_SKIP = \"\"\n\n# This option should be enabled unless the kernel does not support the\n# \"conntrack\" module\n#\n# To use the deprecated iptables \"state\" module, change this to 0\nUSE_CONNTRACK = \"1\"\n\n# Enable ftp helper via the iptables CT target on supporting kernels (v2.6.34+)\n# instead of the current method via /proc/sys/net/netfilter/nf_conntrack_helper\n# This will also remove the RELATED target from the global state iptables rule\n#\n# This is not needed (and will be ignored) if LF_SPI/IPV6_SPI is disabled or\n# the raw tables do not exist. The USE_CONNTRACK option should be enabled\n#\n# To enable this option, set it to your FTP server listening port number\n# (normally 21), do NOT set it to \"1\"\nUSE_FTPHELPER = \"0\"\n\n# Check whether syslog is running. Many of the lfd checks require syslog to be\n# running correctly. This test will send a coded message to syslog every\n# SYSLOG_CHECK seconds. lfd will check SYSLOG_LOG log lines for the coded\n# message. If it fails to do so within SYSLOG_CHECK seconds an alert using\n# syslogalert.txt is sent\n#\n# A value of between 300 and 3600 seconds is suggested. Set to 0 to disable\nSYSLOG_CHECK = \"0\"\n\n# Enable this option if you want lfd to ignore (i.e. don't block) IP addresses\n# listed in csf.allow in addition to csf.ignore (the default). This option\n# should be used with caution as it would mean that IP's allowed through the\n# firewall from infected PC's could launch attacks on the server that lfd\n# would ignore\nIGNORE_ALLOW = \"0\"\n\n# Enable the following option if you want to apply strict iptables rules to DNS\n# traffic (i.e. relying on iptables connection tracking). Enabling this option\n# could cause DNS resolution issues both to and from the server but could help\n# prevent abuse of the local DNS server\nDNS_STRICT = \"0\"\n\n# Enable the following option if you want to apply strict iptables rules to DNS\n# traffic between the server and the nameservers listed in /etc/resolv.conf\n# Enabling this option could cause DNS resolution issues both to and from the\n# server but could help prevent abuse of the local DNS server\nDNS_STRICT_NS = \"0\"\n\n# Limit the number of IP's kept in the /etc/csf/csf.deny file\n#\n# Care should be taken when increasing this value on servers with low memory\n# resources or hard limits (such as Virtuozzo/OpenVZ) as too many rules (in the\n# thousands) can sometimes cause network slowdown\n#\n# The value set here is the maximum number of IPs/CIDRs allowed\n# if the limit is reached, the entries will be rotated so that the oldest\n# entries (i.e. the ones at the top) will be removed and the latest is added.\n# The limit is only checked when using csf -d (which is what lfd also uses)\n# Set to 0 to disable limiting\n#\n# For implementations wishing to set this value significantly higher, we\n# recommend using the IPSET option\nDENY_IP_LIMIT = \"9000\"\n\n# Limit the number of IP's kept in the temprary IP ban list. If the limit is\n# reached the oldest IP's in the ban list will be removed and allowed\n# regardless of the amount of time remaining for the block\n# Set to 0 to disable limiting\nDENY_TEMP_IP_LIMIT = \"300\"\n\n# Enable login failure detection daemon (lfd). If set to 0 none of the\n# following settings will have any effect as the daemon won't start.\nLF_DAEMON = \"1\"\n\n# Check whether csf appears to have been stopped and restart if necessary,\n# unless TESTING is enabled above. The check is done every 300 seconds\nLF_CSF = \"1\"\n\n# This option uses IPTABLES_SAVE, IPTABLES_RESTORE and IP6TABLES_SAVE,\n# IP6TABLES_RESTORE in two ways:\n#\n# 1. On a clean server reboot the entire csf iptables configuration is saved\n# and then restored where possible to provide a near instant firewall\n# startup[*]\n#\n# 2. On csf restart or lfd reloading tables, CC_* as well as SPAMHAUS, DSHIELD,\n# BOGON, TOR are loaded using this method in a fraction of the time than if\n# this setting is disabled\n#\n# [*]Not supported on all OS platforms\n#\n# Set to \"0\" to disable this functionality\nFASTSTART = \"0\"\n\n# This option allows you to use ipset v6+ for the following csf options:\n# CC_* and /etc/csf/csf.blocklist, /etc/csf/csf.allow, /etc/csf/csf.deny,\n# GLOBAL_DENY, GLOBAL_ALLOW, DYNDNS, GLOBAL_DYNDNS, MESSENGER\n#\n# ipset will only be used with the above options when listing IPs and CIDRs.\n# Advanced Allow Filters and temporary blocks use traditional iptables\n#\n# Using ipset moves the onus of ip matching against large lists away from\n# iptables rules and to a purpose built and optimised database matching\n# utility. It also simplifies the switching in of updated lists\n#\n# To use this option you must have a fully functioning installation of ipset\n# installed either via rpm or source from http://ipset.netfilter.org/\n#\n# Note: Using ipset has many advantages, some disadvantages are that you will\n# no longer see packet and byte counts against IPs and it makes identifying\n# blocked/allowed IPs that little bit harder\n#\n# Note: If you mainly use IP address only entries in csf.deny, you can increase\n# the value of DENY_IP_LIMIT significantly if you wish\n#\n# Note: It's highly unlikely that ipset will function on Virtuozzo/OpenVZ\n# containers even if it has been installed\n#\n# If you find any problems, please post on forums.configserver.com with full\n# details of the issue\nLF_IPSET = \"1\"\n\n# Versions of iptables greater or equal to v1.4.20 should support the --wait\n# option. This forces iptables commands that use the option to wait until a\n# lock by any other process using iptables completes, rather than simply\n# failing\n#\n# Enabling this feature will add the --wait option to iptables commands\n#\n# NOTE: The disadvantage of using this option is that any iptables command that\n# uses it will hang until the lock is released. This could cause a cascade of\n# hung processes trying to issue iptables commands. To try and avoid this issue\n# csf uses a last ditch timeout, WAITLOCK_TIMEOUT in seconds, that will trigger\n# a failure if reached\nWAITLOCK = \"1\"\nWAITLOCK_TIMEOUT = \"300\"\n\n# The following sets the hashsize for ipset sets, which must be a power of 2.\n#\n# Note: Increasing this value will consume more memory for all sets\n# Default: \"1024\"\nLF_IPSET_HASHSIZE = \"1024\"\n\n# The following sets the maxelem for ipset sets.\n#\n# Note: Increasing this value will consume more memory for all sets\n# Default: \"65536\"\nLF_IPSET_MAXELEM = \"65536\"\n\n# If you enable this option then whenever a CLI request to restart csf is used\n# lfd will restart csf instead within LF_PARSE seconds\n#\n# This feature can be helpful for restarting configurations that cannot use\n# FASTSTART\nLFDSTART = \"1\"\n\n# Enable verbose output of iptables commands\nVERBOSE = \"1\"\n\n# Drop out of order packets and packets in an INVALID state in iptables\n# connection tracking\nPACKET_FILTER = \"1\"\n\n# Perform reverse DNS lookups on IP addresses. (See also CC_LOOKUPS)\nLF_LOOKUPS = \"1\"\n\n# Custom styling is possible in the csf UI. See the readme.txt for more\n# information under \"UI skinning and Mobile View\"\n#\n# This option enables the use of custom styling. If the styling fails to work\n# correctly, e.g. custom styling does not take into account a change in the\n# standard csf UI, then disabling this option will return the standard UI\nSTYLE_CUSTOM = \"1\"\n\n# This option disables the presence of the Mobile View in the csf UI\nSTYLE_MOBILE = \"1\"\n\n###############################################################################\n# SECTION:SMTP Settings\n###############################################################################\n# Block outgoing SMTP except for root, exim and mailman (forces scripts/users\n# to use the exim/sendmail binary instead of sockets access). This replaces the\n# protection as WHM > Tweak Settings > SMTP Tweaks\n#\n# This option uses the iptables ipt_owner/xt_owner module and must be loaded\n# for it to work. It may not be available on some VPS platforms\n#\n# Note: Run /etc/csf/csftest.pl to check whether this option will function on\n# this server\nSMTP_BLOCK = \"1\"\n\n# If SMTP_BLOCK is enabled but you want to allow local connections to port 25\n# on the server (e.g. for webmail or web scripts) then enable this option to\n# allow outgoing SMTP connections to the loopback device\nSMTP_ALLOWLOCAL = \"0\"\n\n# This option redirects outgoing SMTP connections destined for remote servers\n# for non-bypass users to the local SMTP server to force local relaying of\n# email. Such email may require authentication (SMTP AUTH)\nSMTP_REDIRECT = \"0\"\n\n# This is a comma separated list of the ports to block. You should list all\n# ports that exim is configured to listen on\nSMTP_PORTS = \"25\"\n\n# Always allow the following comma separated users and groups to bypass\n# SMTP_BLOCK\n#\n# Note: root (UID:0) is always allowed\nSMTP_ALLOWUSER = \"postfix\"\nSMTP_ALLOWGROUP = \"\"\n\n# This option will only allow SMTP AUTH to be advertised to the IP addresses\n# listed in /etc/csf/csf.smtpauth on EXIM mail servers\n#\n# The additional option CC_ALLOW_SMTPAUTH can be used with this option to\n# additionally restrict access to specific countries\n#\n# This is to help limit attempts at distributed attacks against SMTP AUTH which\n# are difficult to achive since port 25 needs to be open to relay email\n#\n# The reason why this works is that if EXIM does not advertise SMTP AUTH on a\n# connection, then SMTP AUTH will not accept logins, defeating the attacks\n# without restricting mail relaying\n#\n# Note: csf and lfd must be restarted if /etc/csf/csf.smtpauth is modified so\n# that the lookup file in /etc/exim.smtpauth is regenerated from the\n# information from /etc/csf/csf.smtpauth plus any countries listed in\n# CC_ALLOW_SMTPAUTH\n#\n# NOTE: To make this option work you MUST make the modifications to exim.conf\n# as explained in \"Exim SMTP AUTH Restriction\" section in /etc/csf/readme.txt\n# after enabling the option here, otherwise this option will not work\n#\n# To enable this option, set to 1 and make the exim configuration changes\n# To disable this option, set to 0 and undo the exim configuration changes\nSMTPAUTH_RESTRICT = \"0\"\n\n###############################################################################\n# SECTION:Port Flood Settings\n###############################################################################\n# Enable SYN Flood Protection. This option configures iptables to offer some\n# protection from tcp SYN packet DOS attempts. You should set the RATE so that\n# false-positives are kept to a minimum otherwise visitors may see connection\n# issues (check /var/log/messages for *SYNFLOOD Blocked*). See the iptables\n# man page for the correct --limit rate syntax\n#\n# Note: This option should ONLY be enabled if you know you are under a SYN\n# flood attack as it will slow down all new connections from any IP address to\n# the server if triggered\nSYNFLOOD = \"0\"\nSYNFLOOD_RATE = \"100/s\"\nSYNFLOOD_BURST = \"150\"\n\n# Connection Limit Protection. This option configures iptables to offer more\n# protection from DOS attacks against specific ports. It can also be used as a\n# way to simply limit resource usage by IP address to specific server services.\n# This option limits the number of concurrent new connections per IP address\n# that can be made to specific ports\n#\n# This feature does not work on servers that do not have the iptables module\n# xt_connlimit loaded. Typically, this will be with MONOLITHIC kernels. VPS\n# server admins should check with their VPS host provider that the iptables\n# module is included\n#\n# For further information and syntax refer to the Connection Limit Protection\n# section of the csf readme.txt\n#\n# Note: Run /etc/csf/csftest.pl to check whether this option will function on\n# this server\nCONNLIMIT = \"24;99,22;99,80;9999,443;9999,53;99\"\n\n# Port Flood Protection. This option configures iptables to offer protection\n# from DOS attacks against specific ports. This option limits the number of\n# new connections per time interval that can be made to specific ports\n#\n# This feature does not work on servers that do not have the iptables module\n# ipt_recent loaded. Typically, this will be with MONOLITHIC kernels. VPS\n# server admins should check with their VPS host provider that the iptables\n# module is included\n#\n# For further information and syntax refer to the Port Flood Protection\n# section of the csf readme.txt\n#\n# Note: Run /etc/csf/csftest.pl to check whether this option will function on\n# this server\nPORTFLOOD = \"24;tcp;99;60,22;tcp;99;60,1433;tcp;1;900\"\n\n# Outgoing UDP Flood Protection. This option limits outbound UDP packet floods.\n# These typically originate from exploit scripts uploaded through vulnerable\n# web scripts. Care should be taken on servers that use services that utilise\n# high levels of UDP outbound traffic, such as SNMP, so you may need to alter\n# the UDPFLOOD_LIMIT and UDPFLOOD_BURST options to suit your environment\n#\n# We recommend enabling User ID Tracking (UID_INTERVAL) with this feature\nUDPFLOOD = \"0\"\nUDPFLOOD_LIMIT = \"100/s\"\nUDPFLOOD_BURST = \"500\"\n\n# This is a list of usernames that should not be rate limited, such as \"named\"\n# to prevent bind traffic from being limited.\n#\n# Note: root (UID:0) is always allowed\nUDPFLOOD_ALLOWUSER = \"named\"\n\n###############################################################################\n# SECTION:Logging Settings\n###############################################################################\n# Log lfd messages to SYSLOG in addition to /var/log/lfd.log. You must have the\n# perl module Sys::Syslog installed to use this feature\nSYSLOG = \"0\"\n\n# Drop target for incoming iptables rules. This can be set to either DROP or\n# REJECT. REJECT will send back an error packet, DROP will not respond at all.\n# REJECT is more polite, however it does provide extra information to a hacker\n# and lets them know that a firewall is blocking their attempts. DROP hangs\n# their connection, thereby frustrating attempts to port scan the server\nDROP = \"DROP\"\n\n# Drop target for outgoing iptables rules. This can be set to either DROP or\n# REJECT as with DROP, however as such connections are from this server it is\n# better to REJECT connections to closed ports rather than to DROP them. This\n# helps to immediately free up server resources rather than tying them up until\n# a connection times out. It also tells the process making the connection that\n# it has immediately failed\n#\n# It is possible that some monolithic kernels may not support the REJECT\n# target. If this is the case, csf checks before using REJECT and falls back to\n# using DROP, issuing a warning to set this to DROP instead\nDROP_OUT = \"REJECT\"\n\n# Enable logging of dropped connections to blocked ports to syslog, usually\n# /var/log/messages. This option needs to be enabled to use Port Scan Tracking\nDROP_LOGGING = \"1\"\n\n# Enable logging of dropped incoming connections from blocked IP addresses\n#\n# This option will be disabled if you enable Port Scan Tracking (PS_INTERVAL)\nDROP_IP_LOGGING = \"0\"\n\n# Enable logging of dropped outgoing connections\n#\n# Note: Only outgoing SYN packets for TCP connections are logged, other\n# protocols log all packets\n#\n# We recommend that you enable this option\nDROP_OUT_LOGGING = \"1\"\n\n# Together with DROP_OUT_LOGGING enabled, this option logs the UID connecting\n# out (where available) which can help track abuse\nDROP_UID_LOGGING = \"1\"\n\n# Only log incoming reserved port dropped connections (0:1023). This can reduce\n# the amount of log noise from dropped connections, but will affect options\n# such as Port Scan Tracking (PS_INTERVAL)\nDROP_ONLYRES = \"0\"\n\n# Commonly blocked ports that you do not want logging as they tend to just fill\n# up the log file. These ports are specifically blocked (applied to TCP and UDP\n# protocols) for incoming connections\nDROP_NOLOG = \"67,68,111,113,135:139,445,500,513,520\"\n\n# Log packets dropped by the packet filtering option PACKET_FILTER\nDROP_PF_LOGGING = \"0\"\n\n# Log packets dropped by the Connection Limit Protection option CONNLIMIT. If\n# this is enabled and Port Scan Tracking (PS_INTERVAL) is also enabled, IP\n# addresses breaking the Connection Limit Protection will be blocked\nCONNLIMIT_LOGGING = \"0\"\n\n# Enable logging of UDP floods. This should be enabled, especially with User ID\n# Tracking enabled\nUDPFLOOD_LOGGING = \"1\"\n\n# Send an alert if log file flooding is detected which causes lfd to skip log\n# lines to prevent lfd from looping. If this alert is sent you should check the\n# reported log file for the reason for the flooding\nLOGFLOOD_ALERT = \"1\"\n\n###############################################################################\n# SECTION:Reporting Settings\n###############################################################################\n# By default, lfd will send alert emails using the relevant alert template to\n# the To: address configured within that template. Setting the following\n# option will override the configured To: field in all lfd alert emails\n#\n# Leave this option empty to use the To: field setting in each alert template\nLF_ALERT_TO = \"notify@omega8.cc\"\n\n# By default, lfd will send alert emails using the relevant alert template from\n# the From: address configured within that template. Setting the following\n# option will override the configured From: field in all lfd alert emails\n#\n# Leave this option empty to use the From: field setting in each alert template\nLF_ALERT_FROM = \"\"\n\n# By default, lfd will send all alerts using the SENDMAIL binary. To send using\n# SMTP directly, you can set the following to a relaying SMTP server, e.g.\n# \"127.0.0.1\". Leave this setting blank to use SENDMAIL\nLF_ALERT_SMTP = \"\"\n\n# Block Reporting. lfd can run an external script when it performs and IP\n# address block following for example a login failure. The following setting\n# is to the full path of the external script which must be executable. See\n# readme.txt for format details\n#\n# Leave this setting blank to disable\nBLOCK_REPORT = \"\"\n\n# To also run an external script when a temporary block is unblocked. The\n# following setting can be the full path of the external script which must be\n# executable. See readme.txt for format details\n#\n# Leave this setting blank to disable\nUNBLOCK_REPORT = \"\"\n\n# In addition to the standard lfd email alerts, you can additionally enable the\n# sending of X-ARF reports (see http://www.xarf.org/specification.html). Only\n# block alert messages will be sent. The reports use our schema at:\n# https://download.configserver.com/abuse_login-attack_0.2.json\n#\n# These reports are in a format accepted by many Netblock owners and should\n# help them investigate abuse. This option is not designed to automatically\n# forward these reports to the Netblock owners and should be checked for\n# false-positive blocks before reporting\n#\n# If available, the report will also include the abuse contact for the IP from\n# the Abusix Contact DB: https://abusix.com/contactdb.html\n#\n# Note: The following block types are not reported through this feature:\n# LF_PERMBLOCK, LF_NETBLOCK, LF_DISTATTACK, LF_DISTFTP, RT_*_ALERT\nX_ARF = \"0\"\n\n# By default, lfd will send emails from the root forwarder. Setting the\n# following option will override this\nX_ARF_FROM = \"\"\n\n# By default, lfd will send emails to the root forwarder. Setting the following\n# option will override this\nX_ARF_TO = \"notify@omega8.cc\"\n\n# If you want to automatically send reports to the abuse contact where found,\n# you can enable the following option\n#\n# Note: You MUST set X_ARF_FROM to a valid email address for this option to\n# work. This is so that the abuse contact can reply to the report\n#\n# However, you should be aware that without manual checking you could be\n# reporting innocent IP addresses, including your own clients, yourself and\n# your own servers\n#\n# Additionally, just because a contact address is found, does not mean that\n# there is anyone on the end of it reading, processing or acting on such\n# reports and you could conceivably reported for sending spam\n#\n# We do not recommend enabling this option. Abuse reports should be checked and\n# verified before being forwarded to the abuse contact\nX_ARF_ABUSE = \"0\"\n\n###############################################################################\n# SECTION:Temp to Perm/Netblock Settings\n###############################################################################\n# Temporary to Permanent IP blocking. The following enables this feature to\n# permanently block IP addresses that have been temporarily blocked more than\n# LF_PERMBLOCK_COUNT times in the last LF_PERMBLOCK_INTERVAL seconds. Set\n# LF_PERMBLOCK to \"1\" to enable this feature\n#\n# Care needs to be taken when setting LF_PERMBLOCK_INTERVAL as it needs to be\n# at least LF_PERMBLOCK_COUNT multiplied by the longest temporary time setting\n# (TTL) for blocked IPs, to be effective\n#\n# Set LF_PERMBLOCK to \"0\" to disable this feature\nLF_PERMBLOCK = \"1\"\nLF_PERMBLOCK_INTERVAL = \"86400\"\nLF_PERMBLOCK_COUNT = \"4\"\nLF_PERMBLOCK_ALERT = \"0\"\n\n# Permanently block IPs by network class. The following enables this feature\n# to permanently block classes of IP address where individual IP addresses\n# within the same class LF_NETBLOCK_CLASS have already been blocked more than\n# LF_NETBLOCK_COUNT times in the last LF_NETBLOCK_INTERVAL seconds. Set\n# LF_NETBLOCK to \"1\" to enable this feature\n#\n# This can be an affective way of blocking DDOS attacks launched from within\n# the same network class\n#\n# Valid settings for LF_NETBLOCK_CLASS are \"A\", \"B\" and \"C\", care and\n# consideration is required when blocking network classes A or B\n#\n# Set LF_NETBLOCK to \"0\" to disable this feature\nLF_NETBLOCK = \"1\"\nLF_NETBLOCK_INTERVAL = \"86400\"\nLF_NETBLOCK_COUNT = \"4\"\nLF_NETBLOCK_CLASS = \"C\"\nLF_NETBLOCK_ALERT = \"0\"\n\n# Valid settings for LF_NETBLOCK_IPV6 are \"/64\", \"/56\", \"/48\", \"/32\" and \"/24\"\n# Great care should be taken with IPV6 netblock ranges due to the large number\n# of addresses involved\n#\n# To disable IPv6 netblocks set to \"\"\nLF_NETBLOCK_IPV6 = \"\"\n\n###############################################################################\n# SECTION:Global Lists/DYNDNS/Blocklists\n###############################################################################\n# Safe Chain Update. If enabled, all dynamic update chains (GALLOW*, GDENY*,\n# SPAMHAUS, DSHIELD, BOGON, CC_ALLOW, CC_DENY, ALLOWDYN*) will create a new\n# chain when updating, and insert it into the relevant LOCALINPUT/LOCALOUTPUT\n# chain, then flush and delete the old dynamic chain and rename the new chain.\n#\n# This prevents a small window of opportunity opening when an update occurs and\n# the dynamic chain is flushed for the new rules.\n#\n# This option should not be enabled on servers with long dynamic chains (e.g.\n# CC_DENY/CC_ALLOW lists) and low memory. It should also not be enabled on\n# Virtuozzo VPS servers with a restricted numiptent value. This is because each\n# chain will effectively be duplicated while the update occurs, doubling the\n# number of iptables rules\nSAFECHAINUPDATE = \"0\"\n\n# If you wish to allow access from dynamic DNS records (for example if your IP\n# address changes whenever you connect to the internet but you have a dedicated\n# dynamic DNS record from the likes of dyndns.org) then you can list the FQDN\n# records in csf.dyndns and then set the following to the number of seconds to\n# poll for a change in the IP address. If the IP address has changed iptables\n# will be updated.\n#\n# If the FQDN has multiple A records then all of the IP addresses will be\n# processed. If IPV6 is enabled, then all IPv6 AAAA IP address records will\n# also be allowed.\n#\n# A setting of 600 would check for IP updates every 10 minutes. Set the value\n# to 0 to disable the feature\nDYNDNS = \"0\"\n\n# To always ignore DYNDNS IP addresses in lfd blocking, set the following\n# option to 1\nDYNDNS_IGNORE = \"0\"\n\n# The follow Global options allow you to specify a URL where csf can grab a\n# centralised copy of an IP allow or deny block list of your own. You need to\n# specify the full URL in the following options, i.e.:\n# http://www.somelocation.com/allow.txt\n#\n# The actual retrieval of these IP's is controlled by lfd, so you need to set\n# LF_GLOBAL to the interval (in seconds) when you want lfd to retrieve. lfd\n# will perform the retrieval when it runs and then again at the specified\n# interval. A sensible interval would probably be every 3600 seconds (1 hour).\n# A minimum value of 300 is enforced for LF_GLOBAL if enabled\n#\n# You do not have to specify both an allow and a deny file\n#\n# You can also configure a global ignore file for IP's that lfd should ignore\nLF_GLOBAL = \"0\"\n\nGLOBAL_ALLOW = \"\"\nGLOBAL_DENY = \"\"\nGLOBAL_IGNORE = \"\"\n\n# Provides the same functionality as DYNDNS but with a GLOBAL URL file. Set\n# this to the URL of the file containing DYNDNS entries\nGLOBAL_DYNDNS = \"\"\n\n# Set the following to the number of seconds to poll for a change in the IP\n# address resoved from GLOBAL_DYNDNS\nGLOBAL_DYNDNS_INTERVAL = \"600\"\n\n# To always ignore GLOBAL_DYNDNS IP addresses in lfd blocking, set the following\n# option to 1\nGLOBAL_DYNDNS_IGNORE = \"0\"\n\n# Blocklists are controlled by modifying /etc/csf/csf.blocklists\n#\n# If you don't want BOGON rules applied to specific NICs, then list them in\n# a comma separated list (e.g \"eth1,eth2\")\nLF_BOGON_SKIP = \"\"\n\n# The following option can be used to select the method csf will use to\n# retrieve URL data and files\n#\n# This can be set to use:\n#\n# 1. Perl module HTTP::Tiny\n# 2. Perl module LWP::UserAgent\n# 3. CURL/WGET (set location at the bottom of csf.conf if installed)\n#\n# HTTP::Tiny is much faster than LWP::UserAgent and is included in the csf\n# distribution. LWP::UserAgent may have to be installed manually, but it can\n# better support https:// URL's which also needs the LWP::Protocol::https perl\n# module\n#\n# CURL/WGET uses the system binaries if installed but does not always provide\n# good feedback when it fails. The script will first look for CURL, if that\n# does not exist at the configured location it will then look for WGET\n#\n# Additionally, 1 or 2 are used and the retrieval fails, then if either CURL or\n# WGET are available, an additional attempt will be using CURL/WGET. This is\n# useful if the perl distribution has outdated modules that do not support\n# modern SSL/TLS implementations\n#\n# To install the LWP perl modules required:\n#\n# On rpm based systems:\n#\n# yum install perl-libwww-perl.noarch perl-LWP-Protocol-https.noarch\n#\n# On APT based systems:\n#\n# apt-get install libwww-perl liblwp-protocol-https-perl\n#\n# Via cpan:\n#\n# perl -MCPAN -eshell\n# cpan> install LWP LWP::Protocol::https\n#\n# We recommend setting this set to \"2\" or \"3\" as upgrades to csf will be\n# performed over SSL as well as other URLs used when retrieving external data\n#\n# \"1\" = HTTP::Tiny\n# \"2\" = LWP::UserAgent\n# \"3\" = CURL/WGET (set location at the bottom of csf.conf)\nURLGET = \"1\"\n\n# If you need csf/lfd to use a proxy, then you can set this option to the URL\n# of the proxy. The proxy provided will be used for both HTTP and HTTPS\n# connections\nURLPROXY = \"\"\n\n###############################################################################\n# SECTION:Country Code Lists and Settings\n###############################################################################\n# Country Code to CIDR allow/deny. In the following options you can allow or\n# deny whole country CIDR ranges. The CIDR blocks are obtained from a selected\n# source below. They also display Country Code Country and City for reported IP\n# addresses and lookups\n#\n# There are a number of sources for these databases, before utilising them you\n# need to visit each site and ensure you abide by their license provisions\n# where stated:\n\n# 1. MaxMind\n#\n# MaxMind GeoLite2 Country/City and ASN databases at:\n# https://dev.MaxMind.com/geoip/geoip2/geolite2/\n# This feature relies entirely on that service being available\n#\n# Advantages: This is a one stop shop for all of the databases required for\n# these features. They provide a consistent dataset for blocking and reporting\n# purposes\n#\n# Disadvantages: MaxMind require a license key to download their databases.\n# This is free of charge, but requires the user to create an account on their\n# website to generate the required key:\n#\n# WARNING: As of 2019-12-29, MaxMind REQUIRES you to create an account on their\n# site and to generate a license key to use their databases. See:\n# https://www.maxmind.com/en/geolite2/signup\n# https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/\n#\n# You MUST set the following to continue using the IP lookup features of csf,\n# otherwise an error will be generated and the features will not work.\n# Alternatively set CC_SRC below to a different provider\n#\n# MaxMind License Key:\nMM_LICENSE_KEY = \"\"\n\n# 2. DB-IP, ipdeny.com, iptoasn.com\n#\n# Advantages: The ipdeny.com databases form CC blocking are better optimised\n# and so are quicker to process and create fewer iptables entries. All of these\n# databases are free to download without requiring login or key\n#\n# Disadvantages: Multiple sources mean that any one of the three could\n# interrupt the provision of these features. It may also mean that there are\n# inconsistences between them\n#\n# https://db-ip.com/db/lite.php\n# http://ipdeny.com/\n# https://iptoasn.com/\n# http://download.geonames.org/export/dump/readme.txt\n\n# Set the following to your preferred source:\n#\n# \"1\" - MaxMind\n# \"2\" - db-ip, ipdeny, iptoasn\n#\n# The default is \"2\" on new installations of csf, or set to \"1\" to use the\n# MaxMind databases after obtaining a license key\nCC_SRC = \"2\"\n\n# In the following options, specify the the two-letter ISO Country Code(s).\n# The iptables rules are for incoming connections only\n#\n# Additionally, ASN numbers can also be added to the comma separated lists\n# below that also list Country Codes. The same WARNINGS for Country Codes apply\n# to the use of ASNs. More about Autonomous System Numbers (ASN):\n# http://www.iana.org/assignments/as-numbers/as-numbers.xhtml\n# ASNs must be listed as ASnnnn (where nnnn is the ASN number)\n#\n# You should consider using LF_IPSET when using any of the following options\n#\n# WARNING: These lists are never 100% accurate and some ISP's (e.g. AOL) use\n# non-geographic IP address designations for their clients\n#\n# WARNING: Some of the CIDR lists are huge and each one requires a rule within\n# the incoming iptables chain. This can result in significant performance\n# overheads and could render the server inaccessible in some circumstances. For\n# this reason (amongst others) we do not recommend using these options\n#\n# WARNING: Due to the resource constraints on VPS servers this feature should\n# not be used on such systems unless you choose very small CC zones\n#\n# WARNING: CC_ALLOW allows access through all ports in the firewall. For this\n# reason CC_ALLOW probably has very limited use and CC_ALLOW_FILTER is\n# preferred\n#\n# Each option is a comma separated list of CC's, e.g. \"US,GB,DE\"\nCC_DENY = \"\"\nCC_ALLOW = \"\"\n\n# An alternative to CC_ALLOW is to only allow access from the following\n# countries but still filter based on the port and packets rules. All other\n# connections are dropped\nCC_ALLOW_FILTER = \"\"\n\n# This option allows access from the following countries to specific ports\n# listed in CC_ALLOW_PORTS_TCP and CC_ALLOW_PORTS_UDP\n#\n# Note: The rules for this feature are inserted after the allow and deny\n# rules to still allow blocking of IP addresses\n#\n# Each option is a comma separated list of CC's, e.g. \"US,GB,DE\"\nCC_ALLOW_PORTS = \"\"\n\n# All listed ports should be removed from TCP_IN/UDP_IN to block access from\n# elsewhere. This option uses the same format as TCP_IN/UDP_IN\n#\n# An example would be to list port 21 here and remove it from TCP_IN/UDP_IN\n# then only countries listed in CC_ALLOW_PORTS can access FTP\nCC_ALLOW_PORTS_TCP = \"\"\nCC_ALLOW_PORTS_UDP = \"\"\n\n# This option denies access from the following countries to specific ports\n# listed in CC_DENY_PORTS_TCP and CC_DENY_PORTS_UDP\n#\n# Note: The rules for this feature are inserted after the allow and deny\n# rules to still allow allowing of IP addresses\n#\n# Each option is a comma separated list of CC's, e.g. \"US,GB,DE\"\nCC_DENY_PORTS = \"\"\n\n# This option uses the same format as TCP_IN/UDP_IN. The ports listed should\n# NOT be removed from TCP_IN/UDP_IN\n#\n# An example would be to list port 21 here then countries listed in\n# CC_DENY_PORTS cannot access FTP\nCC_DENY_PORTS_TCP = \"\"\nCC_DENY_PORTS_UDP = \"\"\n\n# This Country Code list will prevent lfd from blocking IP address hits for the\n# listed CC's\n#\n# CC_LOOKUPS must be enabled to use this option\nCC_IGNORE = \"\"\n\n# This Country Code list will only allow SMTP AUTH to be advertised to the\n# listed countries in EXIM. This is to help limit attempts at distributed\n# attacks against SMTP AUTH which are difficult to achive since port 25 needs\n# to be open to relay email\n#\n# The reason why this works is that if EXIM does not advertise SMTP AUTH on a\n# connection, then SMTP AUTH will not accept logins, defeating the attacks\n# without restricting mail relaying\n#\n# This option can generate a very large list of IP addresses that could easily\n# severely impact on SMTP (mail) performance, so care must be taken when\n# selecting countries and if performance issues ensue\n#\n# The option SMTPAUTH_RESTRICT must be enabled to use this option\nCC_ALLOW_SMTPAUTH = \"\"\n\n# These options can control which IP blocks are redirected to the MESSENGER\n# service, if it is enabled\n#\n# If Country Codes are listed in CC_MESSENGER_ALLOW, then only a blocked IP\n# that resolves to one of those Country Codes will be redirected to the\n# MESSENGER service\n#\n# If Country Codes are listed in CC_MESSENGER_DENY, then a blocked IP that\n# resolves to one of those Country Codes will NOT be redirected to the\n# MESSENGER service\n#\nCC_MESSENGER_ALLOW = \"\"\nCC_MESSENGER_DENY = \"\"\n\n# Set this option to a valid CIDR (i.e. 1 to 32) to ignore CIDR blocks smaller\n# than this value when implementing CC_DENY/CC_ALLOW/CC_ALLOW_FILTER. This can\n# help reduce the number of CC entries and may improve iptables throughput.\n# Obviously, this will deny/allow fewer IP addresses depending on how small you\n# configure the option\n#\n# For example, to ignore all CIDR (and single IP) entries small than a /16, set\n# this option to \"16\". Set to \"\" to block all CC IP addresses\nCC_DROP_CIDR = \"\"\n\n# Display Country Code and Country for reported IP addresses. This option can\n# be configured to use the databases enabled at the top of this section. An\n# additional option is also available if you cannot use those databases:\n#\n# \"0\" - disable\n# \"1\" - Reports: Country Code and Country\n# \"2\" - Reports: Country Code and Country and Region and City\n# \"3\" - Reports: Country Code and Country and Region and City and ASN\n# \"4\" - Reports: Country Code and Country and Region and City (db-ip.com)\n#\n# Note: \"4\" does not use the databases enabled at the top of this section\n# directly for lookups. Instead it uses a URL-based lookup from\n# https://db-ip.com and so avoids having to download and process the large\n# databases. Please visit the https://db-ip.com and read their limitations and\n# understand that this option will either cease to function or be removed by us\n# if that site is abused or overloaded. ONLY use this option if you have\n# difficulties using the databases enabled at the top of this section. This\n# option is ONLY for IP lookups, NOT when using the CC_* options above, which\n# will continue to use the databases enabled at the top of this section\n#\nCC_LOOKUPS = \"1\"\n\n# Display Country Code and Country for reported IPv6 addresses using the\n# databases enabled at the top of this section\n#\n# \"0\" - disable\n# \"1\" - enable and report the detail level as specified in CC_LOOKUPS\n#\n# This option must also be enabled to allow IPv6 support to CC_*, MESSENGER and\n# PORTFLOOD\nCC6_LOOKUPS = \"0\"\n\n# This option tells lfd how often to retrieve the databases for CC_ALLOW,\n# CC_ALLOW_FILTER, CC_DENY, CC_IGNORE and CC_LOOKUPS (in days)\nCC_INTERVAL = \"7\"\n\n###############################################################################\n# SECTION:Login Failure Blocking and Alerts\n###############################################################################\n# The following[*] triggers are application specific. If you set LF_TRIGGER to\n# \"0\" the value of each trigger is the number of failures against that\n# application that will trigger lfd to block the IP address\n#\n# If you set LF_TRIGGER to a value greater than \"0\" then the following[*]\n# application triggers are simply on or off (\"0\" or \"1\") and the value of\n# LF_TRIGGER is the total cumulative number of failures that will trigger lfd\n# to block the IP address\n#\n# Setting the application trigger to \"0\" disables it\nLF_TRIGGER = \"0\"\n\n# If LF_TRIGGER is > \"0\" then LF_TRIGGER_PERM can be set to \"1\" to permanently\n# block the IP address, or LF_TRIGGER_PERM can be set to a value greater than\n# \"1\" and the IP address will be blocked temporarily for that value in seconds.\n# For example:\n# LF_TRIGGER_PERM = \"1\" => the IP is blocked permanently\n# LF_TRIGGER_PERM = \"3600\" => the IP is blocked temporarily for 1 hour\n#\n# If LF_TRIGGER is \"0\", then the application LF_[application]_PERM value works\n# in the same way as above and LF_TRIGGER_PERM serves no function\nLF_TRIGGER_PERM = \"3600\"\n\n# To only block access to the failed application instead of a complete block\n# for an ip address, you can set the following to \"1\", but LF_TRIGGER must be\n# set to \"0\" with specific application[*] trigger levels also set appropriately\n#\n# The ports that are blocked can be configured by changing the PORTS_* options\nLF_SELECT = \"0\"\n\n# Send an email alert if an IP address is blocked by one of the [*] triggers\nLF_EMAIL_ALERT = \"0\"\n\n# Send an email alert if an IP address is only temporarily blocked by one of\n# the [*] triggers\n#\n# Note: LF_EMAIL_ALERT must still be enabled to get permanent block emails\nLF_TEMP_EMAIL_ALERT = \"1\"\n\n# [*]Enable login failure detection of sshd connections\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_SSHD = \"10\"\nLF_SSHD_PERM = \"3600\"\n\n# [*]Enable login failure detection of ftp connections\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_FTPD = \"10\"\nLF_FTPD_PERM = \"3600\"\n\n# [*]Enable login failure detection of SMTP AUTH connections\nLF_SMTPAUTH = \"10\"\nLF_SMTPAUTH_PERM = \"3600\"\n\n# [*]Enable syntax failure detection of Exim connections\nLF_EXIMSYNTAX = \"10\"\nLF_EXIMSYNTAX_PERM = \"1\"\n\n# [*]Enable login failure detection of pop3 connections\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_POP3D = \"10\"\nLF_POP3D_PERM = \"3600\"\n\n# [*]Enable login failure detection of imap connections\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_IMAPD = \"10\"\nLF_IMAPD_PERM = \"3600\"\n\n# [*]Enable login failure detection of Apache .htpasswd connections\n# Due to the often high logging rate in the Apache error log, you might want to\n# enable this option only if you know you are suffering from attacks against\n# password protected directories\nLF_HTACCESS = \"0\"\nLF_HTACCESS_PERM = \"3600\"\n\n# [*]Enable failure detection of repeated Apache mod_security rule triggers\nLF_MODSEC = \"10\"\nLF_MODSEC_PERM = \"3600\"\n\n# [*]Enable detection of repeated BIND denied requests\n# This option should be enabled with care as it will prevent blocked IPs from\n# resolving any domains on the server. You might want to set the trigger value\n# reasonably high to avoid this\n# Example: LF_BIND = \"100\"\nLF_BIND = \"0\"\nLF_BIND_PERM = \"1\"\n\n# [*]Enable detection of repeated suhosin ALERTs\n# Example: LF_SUHOSIN = \"5\"\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_SUHOSIN = \"0\"\nLF_SUHOSIN_PERM = \"1\"\n\n# [*]Enable detection of repeated cxs ModSecurity mod_security rule triggers\n# This option will block IP addresses if cxs detects a hits from the\n# ModSecurity rule associated with it\n#\n# Note: This option takes precedence over LF_MODSEC and removes any hits\n# counted towards LF_MODSEC for the cxs rule\n#\n# This setting should probably set very low, perhaps to 1, if you want to\n# effectively block IP addresses for this trigger option\nLF_CXS = \"0\"\nLF_CXS_PERM = \"1\"\n\n# [*]Enable detection of repeated Apache mod_qos rule triggers\nLF_QOS = \"0\"\nLF_QOS_PERM = \"1\"\n\n# [*]Enable detection of repeated Apache symlink race condition triggers from\n# the Apache patch provided by:\n# http://www.mail-archive.com/dev@httpd.apache.org/msg55666.html\n# This patch has also been included by cPanel via the easyapache option:\n# \"Symlink Race Condition Protection\"\nLF_SYMLINK = \"0\"\nLF_SYMLINK_PERM = \"1\"\n\n# [*]Enable login failure detection of webmin connections\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_WEBMIN = \"0\"\nLF_WEBMIN_PERM = \"1\"\n\n# Send an email alert if anyone logs in successfully using SSH\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_SSH_EMAIL_ALERT = \"0\"\n\n# Send an email alert if anyone uses su to access another account. This will\n# send an email alert whether the attempt to use su was successful or not\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_SU_EMAIL_ALERT = \"1\"\n\n# Send an email alert if anyone uses sudo to access another account. This will\n# send an email alert whether the attempt to use sudo was successful or not\n#\n# NOTE: This option could become onerous if sudo is used extensively for root\n# access by administrators or control panels. It is provided for those where\n# this is not the case\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_SUDO_EMAIL_ALERT = \"0\"\n\n# Send an email alert if anyone accesses webmin\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_WEBMIN_EMAIL_ALERT = \"0\"\n\n# Send an email alert if anyone logs in successfully to root on the console\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_CONSOLE_EMAIL_ALERT = \"1\"\n\n# This option will keep track of the number of \"File does not exist\" errors in\n# HTACCESS_LOG. If the number of hits is more than LF_APACHE_404 in LF_INTERVAL\n# seconds then the IP address will be blocked\n#\n# Care should be used with this option as it could generate many\n# false-positives, especially Search Bots (use csf.rignore to ignore such bots)\n# so only use this option if you know you are under this type of attack\n#\n# A sensible setting for this would be quite high, perhaps 200\n#\n# To disable set to \"0\"\nLF_APACHE_404 = \"0\"\n\n# If this option is set to 1 the blocks will be permanent\n# If this option is > 1, the blocks will be temporary for the specified number\n# of seconds\nLF_APACHE_404_PERM = \"3600\"\n\n# This option will keep track of the number of \"client denied by server\n# configuration\" errors in HTACCESS_LOG. If the number of hits is more than\n# LF_APACHE_403 in LF_INTERVAL seconds then the IP address will be blocked\n#\n# Care should be used with this option as it could generate many\n# false-positives, especially Search Bots (use csf.rignore to ignore such bots)\n# so only use this option if you know you are under this type of attack\n#\n# A sensible setting for this would be quite high, perhaps 200\n#\n# To disable set to \"0\"\nLF_APACHE_403 = \"0\"\n\n# If this option is set to 1 the blocks will be permanent\n# If this option is > 1, the blocks will be temporary for the specified number\n# of seconds\nLF_APACHE_403_PERM = \"3600\"\n\n# This option will keep track of the number of 401 failures in HTACCESS_LOG.\n# If the number of hits is more than LF_APACHE_401 in LF_INTERVAL seconds then\n# the IP address will be blocked\n#\n# To disable set to \"0\"\nLF_APACHE_401 = \"0\"\n\n# This option is used to determine if the Apache error_log format contains the\n# client port after the client IP. In Apache prior to v2.4, this was not the\n# case. In Apache v2.4+ the error_log format can be configured using\n# ErrorLogFormat, making the port directive optional\n#\n# Unfortunately v2.4 ErrorLogFormat places the port number after a colon next\n# to the client IP by default. This makes determining client IPv6 addresses\n# difficult unless we know whether the port is being appended or not\n#\n# lfd will attempt to autodetect the correct value if this option is set to \"0\"\n# from the httpd binary found in common locations. If it fails to find a binary\n# it will be set to \"2\", unless specified here\n#\n# The value can be set here explicitly if the autodetection does not work:\n# 0 - autodetect\n# 1 - no port directive after client IP\n# 2 - port directive after client IP\nLF_APACHE_ERRPORT = \"0\"\n\n# If this option is set to 1 the blocks will be permanent\n# If this option is > 1, the blocks will be temporary for the specified number\n# of seconds\nLF_APACHE_401_PERM = \"3600\"\n\n# This option will send an alert if the ModSecurity IP persistent storage grows\n# excessively large: https://goo.gl/rGh5sF\n#\n# More information on cPanel servers here: https://goo.gl/vo6xTE\n#\n# LF_MODSECIPDB_FILE must be set to the correct location of the database file\n#\n# The check is performed at lfd startup and then once per hour, the template\n# used is modsecipdbalert.txt\n#\n# Set to \"0\" to disable this option, otherwise it is the threshold size of the\n# file to report in gigabytes, e.g. set to 5 for 5GB\nLF_MODSECIPDB_ALERT = \"0\"\n\n# This is the location of the persistent IP storage file on the server, e.g.:\n# /run/modsecurity/data/ip.pag\n# /var/cpanel/secdatadir/ip.pag\n# /var/cache/modsecurity/ip.pag\n# /usr/local/apache/conf/modsec/data/msa/ip.pag\n# /var/tmp/ip.pag\n# /tmp/ip.pag\nLF_MODSECIPDB_FILE = \"/run/modsecurity/data/ip.pag\"\n\n# System Exploit Checking. This option is designed to perform a series of tests\n# to send an alert in case a possible server compromise is detected\n#\n# To enable this feature set the following to the checking interval in seconds\n# (a value of 300 would seem sensible).\n#\n# To disable set to \"0\"\nLF_EXPLOIT = \"300\"\n\n# This comma separated list allows you to ignore tests LF_EXPLOIT performs\n#\n# For the SUPERUSER check, you can list usernames in csf.suignore to have them\n# ignored for that test\n#\n# Valid tests are:\n# SUPERUSER\n#\n# If you want to ignore a test add it to this as a comma separated list, e.g.\n# \"SUPERUSER\"\nLF_EXPLOIT_IGNORE = \"\"\n\n# Set the time interval to track login and other LF_ failures within (seconds),\n# i.e. LF_TRIGGER failures within the last LF_INTERVAL seconds\nLF_INTERVAL = \"300\"\n\n# This is how long the lfd process sleeps (in seconds) before processing the\n# log file entries and checking whether other events need to be triggered\nLF_PARSE = \"5\"\n\n# This is the interval that is used to flush reports of usernames, files and\n# pids so that persistent problems continue to be reported, in seconds.\n# A value of 3600 seems sensible\nLF_FLUSH = \"3600\"\n\n# Under some circumstances iptables can fail to include a rule instruction,\n# especially if more than one request is made concurrently. In this event, a\n# permanent block entry may exist in csf.deny, but not in iptables.\n#\n# This option instructs csf to deny an already blocked IP address the number\n# of times set. The downside, is that there will be multiple entries for an IP\n# address in csf.deny and possibly multiple rules for the same IP address in\n# iptables. This needs to be taken into consideration when unblocking such IP\n# addresses.\n#\n# Set to \"0\" to disable this feature. Do not set this too high for the reasons\n# detailed above (e.g. \"5\" should be more than enough)\nLF_REPEATBLOCK = \"0\"\n\n# By default csf will create both an inbound and outbound blocks from/to an IP\n# unless otherwise specified in csf.deny and GLOBAL_DENY. This is the most\n# effective way to block IP traffic. This option instructs csf to only block\n# inbound traffic from those IP's and so reduces the number of iptables rules,\n# but at the expense of less effectiveness. For this reason we recommend\n# leaving this option disabled\n#\n# Set to \"0\" to disable this feature - the default\nLF_BLOCKINONLY = \"0\"\n\n###############################################################################\n# SECTION:CloudFlare\n###############################################################################\n# This features provides interaction with the CloudFlare Firewall\n#\n# As CloudFlare is a reverse proxy, any attacking IP addresses (so far as\n# iptables is concerned) come from the CloudFlare IP's. To counter this, an\n# Apache module (mod_cloudflare) is available that obtains the true attackers\n# IP from a custom HTTP header record (similar functionality is available\n# for other HTTP daemons\n#\n# However, despite now knowing the true attacking IP address, iptables cannot\n# be used to block that IP as the traffic is still coming from the CloudFlare\n# servers\n#\n# CloudFlare have provided a Firewall feature within the user account where\n# rules can be added to block, challenge or whitelist IP addresses\n#\n# Using the CloudFlare API, this feature adds and removes attacking IPs from\n# that firewall and provides CLI (and via the UI) additional commands\n#\n# See /etc/csf/readme.txt for more information about this feature and the\n# restrictions for its use BEFORE enabling this feature\nCF_ENABLE = \"0\"\n\n# This can be set to either \"block\" or \"challenge\" (see CloudFlare docs)\nCF_BLOCK = \"block\"\n\n# This setting determines how long the temporary block will apply within csf\n# and CloudFlare, keeping them in sync\n#\n# Block duration in seconds - overrides perm block or time of individual blocks\n# in lfd for block triggers\nCF_TEMP = \"3600\"\n\n###############################################################################\n# SECTION:Directory Watching & Integrity\n###############################################################################\n# Enable Directory Watching. This enables lfd to check /tmp and /dev/shm\n# directories for suspicious files, i.e. script exploits. If a suspicious\n# file is found an email alert is sent. One alert per file per LF_FLUSH\n# interval is sent\n#\n# To enable this feature set the following to the checking interval in seconds.\n# To disable set to \"0\"\nLF_DIRWATCH = \"300\"\n\n# To remove any suspicious files found during directory watching, enable the\n# following. These files will be appended to a tarball in\n# /var/lib/csf/suspicious.tar\nLF_DIRWATCH_DISABLE = \"0\"\n\n# This option allows you to have lfd watch a particular file or directory for\n# changes and should they change and email alert using watchalert.txt is sent\n#\n# To enable this feature set the following to the checking interval in seconds\n# (a value of 60 would seem sensible) and add your entries to csf.dirwatch\n#\n# Set to disable set to \"0\"\nLF_DIRWATCH_FILE = \"0\"\n\n# System Integrity Checking. This enables lfd to compare md5sums of the\n# servers OS binary application files from the time when lfd starts. If the\n# md5sum of a monitored file changes an alert is sent. This option is intended\n# as an IDS (Intrusion Detection System) and is the last line of detection for\n# a possible root compromise.\n#\n# There will be constant false-positives as the servers OS is updated or\n# monitored application binaries are updated. However, unexpected changes\n# should be carefully inspected.\n#\n# Modified files will only be reported via email once.\n#\n# To enable this feature set the following to the checking interval in seconds\n# (a value of 3600 would seem sensible). This option may increase server I/O\n# load onto the server as it checks system binaries.\n#\n# To disable set to \"0\"\nLF_INTEGRITY = \"3600\"\n\n###############################################################################\n# SECTION:Distributed Attacks\n###############################################################################\n# Distributed Account Attack. This option will keep track of login failures\n# from distributed IP addresses to a specific application account. If the\n# number of failures matches the trigger value above, ALL of the IP addresses\n# involved in the attack will be blocked according to the temp/perm rules above\n#\n# Tracking applies to LF_SSHD, LF_FTPD, LF_SMTPAUTH, LF_POP3D, LF_IMAPD,\n# LF_HTACCESS\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_DISTATTACK = \"1\"\n\n# Set the following to the minimum number of unique IP addresses that trigger\n# LF_DISTATTACK\nLF_DISTATTACK_UNIQ = \"3\"\n\n# Distributed FTP Logins. This option will keep track of successful FTP logins.\n# If the number of successful logins to an individual account is at least\n# LF_DISTFTP in LF_DIST_INTERVAL from at least LF_DISTFTP_UNIQ IP addresses,\n# then all of the IP addresses will be blocked\n#\n# This option can help mitigate the common FTP account compromise attacks that\n# use a distributed network of zombies to deface websites\n#\n# A sensible setting for this might be 5, depending on how many different\n# IP addresses you expect to an individual FTP account within LF_DIST_INTERVAL\n#\n# To disable set to \"0\"\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLF_DISTFTP = \"5\"\n\n# Set the following to the minimum number of unique IP addresses that trigger\n# LF_DISTFTP. LF_DISTFTP_UNIQ must be <= LF_DISTFTP for this to work\nLF_DISTFTP_UNIQ = \"5\"\n\n# If this option is set to 1 the blocks will be permanent\n# If this option is > 1, the blocks will be temporary for the specified number\n# of seconds\nLF_DISTFTP_PERM = \"900\"\n\n# Send an email alert if LF_DISTFTP is triggered\nLF_DISTFTP_ALERT = \"1\"\n\n# Distributed SMTP Logins. This option will keep track of successful SMTP\n# logins. If the number of successful logins to an individual account is at\n# least LF_DISTSMTP in LF_DIST_INTERVAL from at least LF_DISTSMTP_UNIQ IP\n# addresses, then all of the IP addresses will be blocked. These options only\n# apply to the exim MTA\n#\n# This option can help mitigate the common SMTP account compromise attacks that\n# use a distributed network of zombies to send spam\n#\n# A sensible setting for this might be 5, depending on how many different\n# IP addresses you expect to an individual SMTP account within LF_DIST_INTERVAL\n#\n# To disable set to \"0\"\nLF_DISTSMTP = \"0\"\n\n# Set the following to the minimum number of unique IP addresses that trigger\n# LF_DISTSMTP. LF_DISTSMTP_UNIQ must be <= LF_DISTSMTP for this to work\nLF_DISTSMTP_UNIQ = \"3\"\n\n# If this option is set to 1 the blocks will be permanent\n# If this option is > 1, the blocks will be temporary for the specified number\n# of seconds\nLF_DISTSMTP_PERM = \"1\"\n\n# Send an email alert if LF_DISTSMTP is triggered\nLF_DISTSMTP_ALERT = \"1\"\n\n# This is the interval during which a distributed FTP or SMTP attack is\n# measured\nLF_DIST_INTERVAL = \"300\"\n\n# If LF_DISTFTP or LF_DISTSMTP is triggered, then if the following contains the\n# path to a script, it will run the script and pass the following as arguments:\n#\n# LF_DISTFTP/LF_DISTSMTP\n# account name\n# log file text\n#\n# The action script must have the execute bit and interpreter (shebang) set\nLF_DIST_ACTION = \"\"\n\n###############################################################################\n# SECTION:Login Tracking\n###############################################################################\n# Block POP3 logins if greater than LT_POP3D times per hour per account per IP\n# address (0=disabled)\n#\n# This is a temporary block for the rest of the hour, afterwhich the IP is\n# unblocked\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLT_POP3D = \"0\"\n\n# Block IMAP logins if greater than LT_IMAPD times per hour per account per IP\n# address (0=disabled) - not recommended for IMAP logins due to the ethos\n# within which IMAP works. If you want to use this, setting it quite high is\n# probably a good idea\n#\n# This is a temporary block for the rest of the hour, afterwhich the IP is\n# unblocked\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nLT_IMAPD = \"0\"\n\n# Send an email alert if an account exceeds LT_POP3D/LT_IMAPD logins per hour\n# per IP\nLT_EMAIL_ALERT = \"0\"\n\n# If LF_PERMBLOCK is enabled but you do not want this to apply to\n# LT_POP3D/LT_IMAPD, then enable this option\nLT_SKIPPERMBLOCK = \"0\"\n\n###############################################################################\n# SECTION:Connection Tracking\n###############################################################################\n# Connection Tracking. This option enables tracking of all connections from IP\n# addresses to the server. If the total number of connections is greater than\n# this value then the offending IP address is blocked. This can be used to help\n# prevent some types of DOS attack.\n#\n# Care should be taken with this option. It's entirely possible that you will\n# see false-positives. Some protocols can be connection hungry, e.g. FTP, IMAPD\n# and HTTP so it could be quite easy to trigger, especially with a lot of\n# closed connections in TIME_WAIT. However, for a server that is prone to DOS\n# attacks this may be very useful. A reasonable setting for this option might\n# be around 300.\n#\n# To disable this feature, set this to 0\nCT_LIMIT = \"0\"\n\n# Connection Tracking interval. Set this to the the number of seconds between\n# connection tracking scans\nCT_INTERVAL = \"30\"\n\n# Send an email alert if an IP address is blocked due to connection tracking\nCT_EMAIL_ALERT = \"0\"\n\n# If you want to make IP blocks permanent then set this to 1, otherwise blocks\n# will be temporary and will be cleared after CT_BLOCK_TIME seconds\nCT_PERMANENT = \"0\"\n\n# If you opt for temporary IP blocks for CT, then the following is the interval\n# in seconds that the IP will remained blocked for (e.g. 1800 = 30 mins)\nCT_BLOCK_TIME = \"3600\"\n\n# If you don't want to count the TIME_WAIT state against the connection count\n# then set the following to \"1\"\nCT_SKIP_TIME_WAIT = \"0\"\n\n# If you only want to count specific states (e.g. SYN_RECV) then add the states\n# to the following as a comma separated list. E.g. \"SYN_RECV,TIME_WAIT\"\n#\n# Leave this option empty to count all states against CT_LIMIT\nCT_STATES = \"\"\n\n# If you only want to count specific ports (e.g. 80,443) then add the ports\n# to the following as a comma separated list. E.g. \"80,443\"\n#\n# Leave this option empty to count all ports against CT_LIMIT\nCT_PORTS = \"\"\n\n# If the total number of connections from a class C subnet is greater than this\n# value then the offending subnet is blocked according to the other CT_*\n# settings\n#\n# This option can be used to help prevent some types of DOS attack where a\n# range of IP's between x.y.z.1-255 has connected to the server\n#\n# If you use a reverse proxy service such as Cloudflare you should not enable\n# this option, or should exclude the ports that you have proxied in CT_PORTS\n#\n# To disable this feature, set this to 0\nCT_SUBNET_LIMIT = \"0\"\n\n###############################################################################\n# SECTION:Process Tracking\n###############################################################################\n# Process Tracking. This option enables tracking of user and nobody processes\n# and examines them for suspicious executables or open network ports. Its\n# purpose is to identify potential exploit processes that are running on the\n# server, even if they are obfuscated to appear as system services. If a\n# suspicious process is found an alert email is sent with relevant information.\n# It is then the responsibility of the recipient to investigate the process\n# further as the script takes no further action\n#\n# The following is the number of seconds a process has to be active before it\n# is inspected. If you set this time too low, then you will likely trigger\n# false-positives with CGI or PHP scripts.\n# Set the value to 0 to disable this feature\nPT_LIMIT = \"0\"\n\n# How frequently processes are checked in seconds\nPT_INTERVAL = \"60\"\n\n# If you want process tracking to highlight php or perl scripts that are run\n# through apache then disable the following,\n# i.e. set it to 0\n#\n# While enabling this setting will reduce false-positives, having it set to 0\n# does provide better checking for exploits running on the server\nPT_SKIP_HTTP = \"0\"\n\n# lfd will report processes, even if they're listed in csf.pignore, if they're\n# tagged as (deleted) by Linux. This information is provided in Linux under\n# /proc/PID/exe. A (deleted) process is one that is running a binary that has\n# the inode for the file removed from the file system directory. This usually\n# happens when the binary has been replaced due to an upgrade for it by the OS\n# vendor or another third party (e.g. cPanel). You need to investigate whether\n# this is indeed the case to be sure that the original binary has not been\n# replaced by a rootkit or is running an exploit.\n#\n# Note: If a deleted executable process is detected and reported then lfd will\n# not report children of the parent (or the parent itself if a child triggered\n# the report) if the parent is also a deleted executable process\n#\n# To stop lfd reporting such process you need to restart the daemon to which it\n# belongs and therefore run the process using the replacement binary (presuming\n# one exists). This will normally mean running the associated startup script in\n# /etc/init.d/\n#\n# If you do want lfd to report deleted binary processes, set to 1\nPT_DELETED = \"0\"\n\n# If a PT_DELETED event is triggered, then if the following contains the path to\n# a script, it will be run in a child process and passed the executable, pid,\n# account for the process, and parent pid\n#\n# The action script must have the execute bit and interpreter (shebang) set. An\n# example is provided in /usr/local/csf/bin/pt_deleted_action.pl\n#\n# WARNING: Make sure you read and understand the potential security\n# implications of such processes in PT_DELETED above before simply restarting\n# such processes with a script\nPT_DELETED_ACTION = \"\"\n\n# User Process Tracking. This option enables the tracking of the number of\n# process any given account is running at one time. If the number of processes\n# exceeds the value of the following setting an email alert is sent with\n# details of those processes. If you specify a user in csf.pignore it will be\n# ignored\n#\n# Set to 0 to disable this feature\nPT_USERPROC = \"0\"\n\n# This User Process Tracking option sends an alert if any user process exceeds\n# the virtual memory usage set (MB). To ignore specific processes or users use\n# csf.pignore\n#\n# Set to 0 to disable this feature\nPT_USERMEM = \"0\"\n\n# This User Process Tracking option sends an alert if any user process exceeds\n# the RSS memory usage set (MB) - RAM used, not virtual. To ignore specific\n# processes or users use csf.pignore\n#\n# Set to 0 to disable this feature\nPT_USERRSS = \"0\"\n\n# This User Process Tracking option sends an alert if any linux user process\n# exceeds the time usage set (seconds). To ignore specific processes or users\n# use csf.pignore\n#\n# Set to 0 to disable this feature\nPT_USERTIME = \"0\"\n\n# If this option is set then processes detected by PT_USERMEM, PT_USERTIME or\n# PT_USERPROC are killed\n#\n# Warning: We don't recommend enabling this option unless absolutely necessary\n# as it can cause unexpected problems when processes are suddenly terminated.\n# It can also lead to system processes being terminated which could cause\n# stability issues. It is much better to leave this option disabled and to\n# investigate each case as it is reported when the triggers above are breached\n#\n# Note: Processes that are running deleted excecutables (see PT_DELETED) will\n# not be killed by lfd\nPT_USERKILL = \"0\"\n\n# If you want to disable email alerts if PT_USERKILL is triggered, then set\n# this option to 0\nPT_USERKILL_ALERT = \"0\"\n\n# If a PT_* event is triggered, then if the following contains the path to\n# a script, it will be run in a child process and passed the PID(s) of the\n# process(es) in a comma separated list.\n#\n# The action script must have the execute bit and interpreter (shebang) set\nPT_USER_ACTION = \"\"\n\n# Check the PT_LOAD_AVG minute Load Average (can be set to 1 5 or 15 and\n# defaults to 5 if set otherwise) on the server every PT_LOAD seconds. If the\n# load average is greater than or equal to PT_LOAD_LEVEL then an email alert is\n# sent. lfd then does not report subsequent high load until PT_LOAD_SKIP\n# seconds has passed to prevent email floods.\n#\n# Set PT_LOAD to \"0\" to disable this feature\nPT_LOAD = \"0\"\nPT_LOAD_AVG = \"5\"\nPT_LOAD_LEVEL = \"10\"\nPT_LOAD_SKIP = \"3600\"\n\n# This is the Apache Server Status URL used in the email alert. Requires the\n# Apache mod_status module to be installed and configured correctly\nPT_APACHESTATUS = \"http://127.0.0.1/server-status\"\n\n# If a PT_LOAD event is triggered, then if the following contains the path to\n# a script, it will be run in a child process. For example, the script could\n# contain commands to terminate and restart httpd, php, exim, etc incase of\n# looping processes. The action script must have the execute bit an\n# interpreter (shebang) set\nPT_LOAD_ACTION = \"\"\n\n# Fork Bomb Protection. This option checks the number of processes with the\n# same session id and if greater than the value set, the whole session tree is\n# terminated and an alert sent\n#\n# You can see an example of common session id processes on most Linux systems\n# using: \"ps axf -O sid\"\n#\n# On cPanel servers, PT_ALL_USERS should be enabled to use this option\n# effectively\n#\n# This option will check root owned processes. Session id 0 and 1 will always\n# be ignored as they represent kernel and init processes. csf.pignore will be\n# honoured, but bear in mind that a session tree can contain a variety of users\n# and executables\n#\n# Care needs to be taken to ensure that this option only detects runaway fork\n# bombs, so should be set higher than any session tree is likely to get (e.g.\n# httpd could have 100s of legitimate children on very busy systems). A\n# sensible starting point on most servers might be 250\nPT_FORKBOMB = \"250\"\n\n# Terminate hung SSHD sessions. When under an SSHD login attack, SSHD processes\n# are often left hanging after their connecting IP addresses have been blocked\n#\n# This option will terminate the SSH processes created by the blocked IP. This\n# option is preferred over PT_SSHDHUNG\nPT_SSHDKILL = \"0\"\n\n# This option will terminate all processes with the cmdline of \"sshd: unknown\n# [net]\" or \"sshd: unknown [priv]\" if they have been running for more than 60\n# seconds\nPT_SSHDHUNG = \"0\"\n\n###############################################################################\n# SECTION:Port Scan Tracking\n###############################################################################\n# Port Scan Tracking. This feature tracks port blocks logged by iptables to\n# syslog. If an IP address generates a port block that is logged more than\n# PS_LIMIT within PS_INTERVAL seconds, the IP address will be blocked.\n#\n# This feature could, for example, be useful for blocking hackers attempting\n# to access the standard SSH port if you have moved it to a port other than 22\n# and have removed 22 from the TCP_IN list so that connection attempts to the\n# old port are being logged\n#\n# This feature blocks all iptables blocks from the iptables logs, including\n# repeated attempts to one port or SYN flood blocks, etc\n#\n# Note: This feature will only track iptables blocks from the log file set in\n# IPTABLES_LOG below and if you have DROP_LOGGING enabled. However, it will\n# cause redundant blocking with DROP_IP_LOGGING enabled\n#\n# Warning: It's possible that an elaborate DDOS (i.e. from multiple IP's)\n# could very quickly fill the iptables rule chains and cause a DOS in itself.\n# The DENY_IP_LIMIT should help to mitigate such problems with permanent blocks\n# and the DENY_TEMP_IP_LIMIT with temporary blocks\n#\n# Set PS_INTERVAL to \"0\" to disable this feature. A value of between 60 and 300\n# would be sensible to enable this feature\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nPS_INTERVAL = \"120\"\nPS_LIMIT = \"19\"\n\n# You can specify the ports and/or port ranges that should be tracked by the\n# Port Scan Tracking feature. The following setting is a comma separated list\n# of those ports and uses the same format as TCP_IN. The setting of\n# 0:65535,ICMP,INVALID,OPEN,BRD covers all ports\n#\n# Special values are:\n# ICMP - include ICMP blocks (see ICMP_*)\n# INVALID - include INVALID blocks (see PACKET_FILTER)\n# OPEN - include TCP_IN and UDP_IN open port blocks - *[proto]_IN Blocked*\n# BRD - include UDP Broadcast IPs, otherwise they are ignored\nPS_PORTS = \"0:65535,ICMP\"\n\n# To specify how many different ports qualifies as a Port Scan you can increase\n# the following from the default value of 1. The risk in doing so will mean\n# that persistent attempts to attack a specific closed port will not be\n# detected and blocked\nPS_DIVERSITY = \"1\"\n\n# You can select whether IP blocks for Port Scan Tracking should be temporary\n# or permanent. Set PS_PERMANENT to \"0\" for temporary and \"1\" for permanent\n# blocking. If set to \"0\" PS_BLOCK_TIME is the amount of time in seconds to\n# temporarily block the IP address for\nPS_PERMANENT = \"0\"\nPS_BLOCK_TIME = \"3600\"\n\n# Set the following to \"1\" to enable Port Scan Tracking email alerts, set to\n# \"0\" to disable them\nPS_EMAIL_ALERT = \"1\"\n\n###############################################################################\n# SECTION:User ID Tracking\n###############################################################################\n# User ID Tracking. This feature tracks UID blocks logged by iptables to\n# syslog. If a UID generates a port block that is logged more than UID_LIMIT\n# times within UID_INTERVAL seconds, an alert will be sent\n#\n# Note: This feature will only track iptables blocks from the log file set in\n# IPTABLES_LOG and if DROP_OUT_LOGGING and DROP_UID_LOGGING are enabled.\n#\n# To ignore specific UIDs list them in csf.uidignore and then restart lfd\n#\n# Set UID_INTERVAL to \"0\" to disable this feature. A value of between 60 and 300\n# would be sensible to enable this feature\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nUID_INTERVAL = \"0\"\nUID_LIMIT = \"10\"\n\n# You can specify the ports and/or port ranges that should be tracked by the\n# User ID Tracking feature. The following setting is a comma separated list\n# of those ports and uses the same format as TCP_OUT. The default setting of\n# 0:65535,ICMP covers all ports\nUID_PORTS = \"0:65535,ICMP\"\n\n###############################################################################\n# SECTION:Account Tracking\n###############################################################################\n# Account Tracking. The following options enable the tracking of modifications\n# to the accounts on a server. If any of the enabled options are triggered by\n# a modifications to an account, an alert email is sent. Only the modification\n# is reported. The cause of the modification will have to be investigated\n# manually\n#\n# You can set AT_ALERT to the following:\n# 0 = disable this feature\n# 1 = enable this feature for all accounts\n# 2 = enable this feature only for superuser accounts (UID = 0, e.g. root, etc)\n# 3 = enable this feature only for the root account\nAT_ALERT = \"2\"\n\n# This options is the interval between checks in seconds\nAT_INTERVAL = \"60\"\n\n# Send alert if a new account is created\nAT_NEW = \"1\"\n\n# Send alert if an existing account is deleted\nAT_OLD = \"1\"\n\n# Send alert if an account password has changed\nAT_PASSWD = \"1\"\n\n# Send alert if an account uid has changed\nAT_UID = \"1\"\n\n# Send alert if an account gid has changed\nAT_GID = \"1\"\n\n# Send alert if an account login directory has changed\nAT_DIR = \"1\"\n\n# Send alert if an account login shell has changed\nAT_SHELL = \"1\"\n\n###############################################################################\n# SECTION:Integrated User Interface\n###############################################################################\n# Integrated User Interface. This feature provides a HTML UI to csf and lfd,\n# without requiring a control panel or web server. The UI runs as a sub process\n# to the lfd daemon\n#\n# As it runs under the root account and successful login provides root access\n# to the server, great care should be taken when configuring and using this\n# feature. There are additional restrictions to enhance secure access to the UI\n#\n# See readme.txt for more information about using this feature BEFORE enabling\n# it for security and access reasons\n#\n# 1 to enable, 0 to disable\nUI = \"0\"\n\n# Set this to the port that want to bind this service to. You should configure\n# this port to be >1023 and different from any other port already being used\n#\n# Do NOT enable access to this port in TCP_IN, instead only allow trusted IP's\n# to the port using Advanced Allow Filters (see readme.txt)\nUI_PORT = \"9898\"\n\n# Optionally set the IP address to bind to. Normally this should be left blank\n# to bind to all IP addresses on the server.\n#\n# If the server is configured for IPv6 but the IP to bind to is IPv4, then the\n# IP address MUST use the IPv6 representation. For example 1.2.3.4 must use\n# ::ffff:1.2.3.4\n#\n# Leave blank to bind to all IP addresses on the server\nUI_IP = \"\"\n\n# This should be a secure, hard to guess username\n#\n# This must be changed from the default\nUI_USER = \"username\"\n\n# This should be a secure, hard to guess password. That is, at least 8\n# characters long with a mixture of upper and lowercase characters plus\n# numbers and non-alphanumeric characters\n#\n# This must be changed from the default\nUI_PASS = \"password\"\n\n# This is the login session timeout. If there is no activity for a logged in\n# session within this number of seconds, the session will timeout and a new\n# login will be required\n#\n# For security reasons, you should always keep this option low (i.e 60-300)\nUI_TIMEOUT = \"300\"\n\n# This is the maximum concurrent connections allowed to the server. The default\n# value should be sufficient\nUI_CHILDREN = \"5\"\n\n# The number of login retries allowed within a 24 hour period. A successful\n# login from the IP address will clear the failures\n#\n# For security reasons, you should always keep this option low (i.e 0-10)\nUI_RETRY = \"5\"\n\n# If enabled, this option will add the connecting IP address to the file\n# /etc/csf/ui/ui.ban after UI_RETRY login failures. The IP address will not be\n# able to login to the UI while it is listed in this file. The UI_BAN setting\n# does not refer to any of the csf/lfd allow or ignore files, e.g. csf.allow,\n# csf.ignore, etc.\n#\n# For security reasons, you should always enable this option\nUI_BAN = \"1\"\n\n# If enabled, only IPs (or CIDR's) listed in the file /etc/csf/ui/ui.allow will\n# be allowed to login to the UI. The UI_ALLOW setting does not refer to any of\n# the csf/lfd allow or ignore files, e.g. csf.allow, csf.ignore, etc.\n#\n# For security reasons, you should always enable this option and use ui.allow\nUI_ALLOW = \"1\"\n\n# If enabled, this option will trigger an iptables block through csf after\n# UI_RETRY login failures\n#\n# 0 = no block;1 = perm block;nn=temp block for nn secs\nUI_BLOCK = \"1\"\n\n# This controls what email alerts are sent with regards to logins to the UI. It\n# uses the uialert.txt template\n#\n# 4 = login success + login failure/ban/block + login attempts\n# 3 = login success + login failure/ban/block\n# 2 = login failure/ban/block\n# 1 = login ban/block\n# 0 = disabled\nUI_ALERT = \"4\"\n\n# This is the SSL cipher list that the Integrated UI will negotiate from\nUI_CIPHER = \"ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH\"\n\n# This is the SSL protocol version used. See IO::Socket::SSL if you wish to\n# change this and to understand the implications of changing it\nUI_SSL_VERSION = \"SSLv23:!SSLv2\"\n\n# If cxs is installed then enabling this option will provide a dropdown box to\n# switch between applications\nUI_CXS = \"0\"\n\n# There is a modified installation of ConfigServer Explorer (cse) provided with\n# the csf distribution. If this option is enabled it will provide a dropdown\n# box to switch between applications\nUI_CSE = \"0\"\n\n###############################################################################\n# SECTION:Messenger service\n###############################################################################\n# Messenger service. This feature allows the display of a message to a blocked\n# connecting IP address to inform the user that they are blocked in the\n# firewall. This can help when users get themselves blocked, e.g. due to\n# multiple login failures. The service is provided by two daemons running on\n# ports providing either an HTML or TEXT message\n#\n# This feature does not work on servers that do not have the iptables module\n# ipt_REDIRECT loaded. Typically, this will be with MONOLITHIC kernels. VPS\n# server admins should check with their VPS host provider that the iptables\n# module is included\n#\n# IPv6 will need the IO::Socket::INET6 perl module\n#\n# For further information on features and limitations refer to the csf\n# readme.txt\n#\n# Note: Run /etc/csf/csftest.pl to check whether this option will function on\n# this server\n#\n# 1 to enable, 0 to disable\nMESSENGER = \"0\"\n\n# Provide this service to temporary IP address blocks\nMESSENGER_TEMP = \"1\"\n\n# Provide this service to permanent IP address blocks\nMESSENGER_PERM = \"1\"\n\n# User account to run the service servers under. We recommend creating a\n# specific non-priv, non-shell account for this purpose\n#\n# Note: When using MESSENGERV2, this account must NOT be a valid control panel\n# account, it must be created manually as explained in the csf readme.txt\nMESSENGER_USER = \"csf\"\n\n# This option points to the file(s) containing the Apache VirtualHost SSL\n# definitions. This can be a file glob if there are multiple files to search.\n# Only Apache v2 SSL VirtualHost definitions are supported\n#\n# This is used by MESSENGERV1 and MESSENGERV2 only\nMESSENGER_HTTPS_CONF = \"/etc/httpd/conf.d/ssl.conf\"\n\n# The following options can be specified to provide a default fallback\n# certificate to be used if either SNI is not supported or a hosted domain does\n# not have an SSL certificate. If a fallback is not provided, one of the certs\n# obtained from MESSENGER_HTTPS_CONF will be used\n#\n# This is used by MESSENGERV1 and MESSENGERV2 only\nMESSENGER_HTTPS_KEY = \"/etc/pki/tls/private/localhost.key\"\nMESSENGER_HTTPS_CRT = \"/etc/pki/tls/certs/localhost.crt\"\n\n# Set this to the port that will receive the HTTPS HTML message. You should\n# configure this port to be >1023 and different from the TEXT and HTML port. Do\n# NOT enable access to this port in TCP_IN. This option requires the perl\n# module IO::Socket::SSL at a version level that supports SNI (1.83+).\n# Additionally the version of openssl on the server must also support SNI\n#\n# The option uses existing SSL certificates on the server for each domain to\n# maintain a secure connection without browser warnings. It uses SNI to choose\n# the correct certificate to use for each client connection\n#\n# Warning: On some servers the amount of memory used by the HTTPS MESSENGER\n# service can become significant depending on various factors associated with\n# the use of IO::Socket::SSL including the number of domains and certificates\n# served. This is normally only an issue if using MESSENGERV1\nMESSENGER_HTTPS = \"8887\"\n\n# This comma separated list are the HTTPS HTML ports that will be redirected\n# for the blocked IP address. If you are using per application blocking\n# (LF_TRIGGER) then only the relevant block port will be redirected to the\n# messenger port\n#\n# Recommended setting \"443\" plus any end-user control panel SSL ports. So, for\n# cPanel: \"443,2083,2096\"\nMESSENGER_HTTPS_IN = \"\"\n\n# Set this to the port that will receive the HTML message. You should configure\n# this port to be >1023 and different from the TEXT port. Do NOT enable access\n# to this port in TCP_IN\nMESSENGER_HTML = \"8888\"\n\n# This comma separated list are the HTML ports that will be redirected for the\n# blocked IP address. If you are using per application blocking (LF_TRIGGER)\n# then only the relevant block port will be redirected to the messenger port\nMESSENGER_HTML_IN = \"80,2082,2095\"\n\n# Set this to the port that will receive the TEXT message. You should configure\n# this port to be >1023 and different from the HTML port. Do NOT enable access\n# to this port in TCP_IN\nMESSENGER_TEXT = \"8889\"\n\n# This comma separated list are the TEXT ports that will be redirected for the\n# blocked IP address. If you are using per application blocking (LF_TRIGGER)\n# then only the relevant block port will be redirected to the messenger port\nMESSENGER_TEXT_IN = \"21\"\n\n# These settings limit the rate at which connections can be made to the\n# messenger service servers. Its intention is to provide protection from\n# attacks or excessive connections to the servers. If the rate is exceeded then\n# iptables will revert for the duration to the normal blocking activity\n#\n# See the iptables man page for the correct --limit rate syntax\nMESSENGER_RATE = \"100/s\"\nMESSENGER_BURST = \"150\"\n\n# MESSENGERV1 only:\n#------------------------------------------------------------------------------\n# This is the maximum concurrent connections allowed to each service server\n#\n# Note: This number should be increased to cater for the number of local images\n# served by this page, including one for favicon.ico. This is because each\n# image displayed counts as an additional connection\nMESSENGER_CHILDREN = \"10\"\n\n# This options ignores ServerAlias definitions that begin with \"mail.\". This\n# can help reduce memory usage on systems that do not require the use of\n# MESSENGER_HTTPS on those subdomains\n#\n# Set to 0 to include these ServerAlias definitions\nMESSENGER_HTTPS_SKIPMAIL = \"1\"\n\n# MESSENGERV2 only:\n#------------------------------------------------------------------------------\n# MESSENGERV2. This option is available on cPanel servers running Apache v2.4+\n# under EA4.\n#\n# This uses the Apache http daemon to provide the web server functionality for\n# the MESSENGER HTML and HTTPS services. It uses a fraction of the resources\n# that the lfd inbuilt service uses and overcomes the memory overhead of using\n# the MESSENGER HTTPS service\n#\n# For more information consult readme.txt before enabling this option\n#MESSENGERV2 = \"0\"\n\n# MESSENGERV3 only:\n#------------------------------------------------------------------------------\n# MESSENGERV3. This option is available on any server running Apache v2.4+,\n# Litespeed or Openlitespeed\n#\n# This uses the web server http daemon to provide the web server functionality\n# for the MESSENGER HTML and HTTPS services. It uses a fraction of the\n# resources that the lfd inbuilt service uses and overcomes the memory overhead\n# of using the MESSENGER HTTPS service\n#\n# For more information consult readme.txt before enabling this option\nMESSENGERV3 = \"0\"\n\n# This is the file or directory where the additional web server configuration\n# file should be included\nMESSENGERV3LOCATION = \"/etc/httpd/conf.d/\"\n\n# This is the command to restart the web server\nMESSENGERV3RESTART = \"service httpd restart\"\n\n# This is the command to test the validity of the web server configuration. If\n# using Litespeed, set to \"\"\nMESSENGERV3TEST = \"/usr/sbin/apachectl -t\"\n\n# This must be set to the main httpd.conf file for either Apache or Litespeed\nMESSENGERV3HTTPS_CONF = \"/etc/httpd/conf/httpd.conf\"\n\n# This can be set to either:\n# \"apache\" - for servers running Apache v2.4+ or Litespeed using Apache\n# configuration\n# \"litespeed\" - for Litespeed or Openlitespeed\nMESSENGERV3WEBSERVER = \"apache\"\n\n# On creation, set the MESSENGER_USER public_html directory permissions to\n# Note: If you precreate this directory the following setting will be ignored\nMESSENGERV3PERMS = \"711\"\n\n# On creation, set the MESSENGER_USER public_html directory group user to\n# Note: If you precreate this directory the following setting will be ignored\nMESSENGERV3GROUP = \"apache\"\n\n# This is the web server configuration to allow PHP scripts to run. If left\n# empty, the MESSENGER service will try to configure this. If this does not\n# work, this should be set as an \"Include /path/to/csf_php.conf\" or similar\n# file which must contain appropriate web server configuration to allow PHP\n# scripts to run. This line will be included within each MESSENGER VirtualHost\n# container. This will replace the [MESSENGERV3PHPHANDLER] line from the csf\n# webserver template files\nMESSENGERV3PHPHANDLER = \"\"\n\n# RECAPTCHA:\n#------------------------------------------------------------------------------\n# The RECAPTCHA options provide a way for end-users that have blocked\n# themselves in the firewall to unblock themselves.\n#\n# A valid Google ReCAPTCHA (v2) key set is required for this feature from:\n# https://www.google.com/recaptcha/intro/index.html\n#\n# When configuring a new reCAPTCHA API key set you must ensure that the option\n# for \"Domain Name Validation\" is unticked so that the same reCAPTCHA can be\n# used for all domains hosted on the server. lfd then checks that the hostname\n# of the request resolves to an IP on this server\n#\n# This feature requires the installation of the LWP::UserAgent perl module (see\n# option URLGET for more details)\n#\n# The template used for this feature is /etc/csf/messenger/index.recaptcha.html\n#\n# Note: An unblock will fail if the end-users IP is located in a netblock,\n# blocklist or CC_* deny entry\nRECAPTCHA_SITEKEY = \"\"\nRECAPTCHA_SECRET = \"\"\n\n# Send an email when an IP address successfully attempts to unblock themselves.\n# This does not necessarily mean the IP was unblocked, only that the\n# post-recaptcha unblock request was attempted\n#\n# Set to \"0\" to disable\nRECAPTCHA_ALERT = \"1\"\n\n# If the server uses NAT then resolving the hostname to hosted IPs will likely\n# not succeed. In that case, the external IP addresses must be listed as comma\n# separated list here\nRECAPTCHA_NAT = \"\"\n\n###############################################################################\n# SECTION:lfd Clustering\n###############################################################################\n# lfd Clustering. This allows the configuration of an lfd cluster environment\n# where a group of servers can share blocks and configuration option changes.\n# Included are CLI and UI options to send requests to the cluster.\n#\n# See the readme.txt file for more information and details on setup and\n# security risks.\n#\n# Set this to a comma separated list of cluster member IP addresses to send\n# requests to. Alternatively, it can be set to the full path of a file that\n# will read in one IP per line, e.g.:\n# \"/etc/csf/cluster_sendto.txt\"\nCLUSTER_SENDTO = \"\"\n\n# Set this to a comma separated list of cluster member IP addresses to receive\n# requests from. Alternatively, it can be set to the full path of a file that\n# will read in one IP per line, e.g.:\n# \"/etc/csf/cluster_recvfrom.txt\"\nCLUSTER_RECVFROM = \"\"\n\n# IP address of the master node in the cluster allowed to send CLUSTER_CONFIG\n# changes\nCLUSTER_MASTER = \"\"\n\n# If this is a NAT server, set this to the public IP address of this server\nCLUSTER_NAT = \"\"\n\n# If a cluster member should send requests on an IP other than the default IP,\n# set it here\nCLUSTER_LOCALADDR = \"\"\n\n# Cluster communication port (must be the same on all member servers). There\n# is no need to open this port in the firewall as csf will automatically add\n# in and out bound rules to allow communication between cluster members\nCLUSTER_PORT = \"7777\"\n\n# This is a secret key used to encrypt cluster communications using the\n# Blowfish algorithm. It should be between 8 and 56 characters long,\n# preferably > 20 random characters\n# 56 chars: 01234567890123456789012345678901234567890123456789012345\nCLUSTER_KEY = \"\"\n\n# Automatically send lfd blocks to all members of CLUSTER_SENDTO. Those\n# servers must have this servers IP address listed in their CLUSTER_RECVFROM\n#\n# Set to 0 to disable this feature\nCLUSTER_BLOCK = \"0\"\n\n# This option allows the enabling and disabling of the Cluster configuration\n# changing options --cconfig, --cconfigr, --cfile, --ccfile sent from the\n# CLUSTER_MASTER server\n#\n# Set this option to 1 to allow Cluster configurations to be received\nCLUSTER_CONFIG = \"0\"\n\n# Maximum number of child processes to listen on. High blocking rates or large\n# clusters may need to increase this\nCLUSTER_CHILDREN = \"10\"\n\n###############################################################################\n# SECTION:Port Knocking\n###############################################################################\n# Port Knocking. This feature allows port knocking to be enabled on multiple\n# ports with a variable number of knocked ports and a timeout. There must be a\n# minimum of 3 ports to knock for an entry to be valid\n#\n# See the following for information regarding Port Knocking:\n# http://www.portknocking.org/\n#\n# This feature does not work on servers that do not have the iptables module\n# ipt_recent loaded. Typically, this will be with MONOLITHIC kernels. VPS\n# server admins should check with their VPS host provider that the iptables\n# module is included\n#\n# For further information and syntax refer to the Port Knocking section of the\n# csf readme.txt\n#\n# Note: Run /etc/csf/csftest.pl to check whether this option will function on\n# this server\n#\n# openport;protocol;timeout;kport1;kport2;kport3[...;kportN],...\n# e.g.: 22;TCP;20;100;200;300;400\nPORTKNOCKING = \"\"\n\n# Enable PORTKNOCKING logging by iptables\nPORTKNOCKING_LOG = \"1\"\n\n# Send an email alert if the PORTKNOCKING port is opened. PORTKNOCKING_LOG must\n# also be enabled to use this option\n#\n# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read\n# this file about RESTRICT_SYSLOG before enabling this option:\nPORTKNOCKING_ALERT = \"1\"\n\n###############################################################################\n# SECTION:Log Scanner\n###############################################################################\n# Log Scanner. This feature will send out an email summary of the log lines of\n# each log listed in /etc/csf/csf.logfiles. All lines will be reported unless\n# they match a regular expression in /etc/csf/csf.logignore\n#\n# File globbing is supported for logs listed in /etc/csf/csf.logfiles. However,\n# be aware that the more files lfd has to track, the greater the performance\n# hit. Note: File globs are only evaluated when lfd is started\n#\n# Note: lfd builds the report continuously from lines logged after lfd has\n# started, so any lines logged when lfd is not running will not be reported\n# (e.g. during reboot). If lfd is restarted, then the report will include any\n# lines logged during the previous lfd logging period that weren't reported\n#\n# 1 to enable, 0 to disable\nLOGSCANNER = \"0\"\n\n# This is the interval each report will be sent based on the logalert.txt\n# template\n#\n# The interval can be set to:\n# \"hourly\" - sent on the hour\n# \"daily\" - sent at midnight (00:00)\n# \"manual\" - sent whenever \"csf --logrun\" is run. This allows for scheduling\n# via cron job\nLOGSCANNER_INTERVAL = \"hourly\"\n\n# Report Style\n# 1 = Separate chronological log lines per log file\n# 2 = Simply chronological log of all lines\nLOGSCANNER_STYLE = \"1\"\n\n# Send the report email even if no log lines reported\n# 1 to enable, 0 to disable\nLOGSCANNER_EMPTY = \"1\"\n\n# Maximum number of lines in the report before it is truncated. This is to\n# prevent log lines flooding resulting in an excessively large report. This\n# might need to be increased if you choose a daily report\nLOGSCANNER_LINES = \"5000\"\n\n###############################################################################\n# SECTION:Statistics Settings\n###############################################################################\n# Statistics\n#\n# Some of the Statistics output requires the gd graphics library and the\n# GD::Graph perl module with all dependent modules to be installed for the UI\n# for them to be displayed\n#\n# This option enabled statistical data gathering\nST_ENABLE = \"1\"\n\n# This option determines how many iptables log lines to store for reports\nST_IPTABLES = \"100\"\n\n# This option indicates whether rDNS and CC lookups are performed at the time\n# the log line is recorded (this is not performed when viewing the reports)\n#\n# Warning: If DROP_IP_LOGGING is enabled and there are frequent iptables hits,\n# then enabling this setting could cause serious performance problems\nST_LOOKUP = \"0\"\n\n# This option will gather basic system statstics. Through the UI it displays\n# various graphs for disk, cpu, memory, network, etc usage over 4 intervals:\n# . Hourly (per minute)\n# . 24 hours (per minute)\n# . 7 days (per minute averaged over an hour)\n# . 30 days (per minute averaged over an hour) - user definable\n# The data is stored in /var/lib/csf/stats/system and the option requires the\n# perl GD::Graph module\n#\n# Note: Disk graphs do not show on Virtuozzo/OpenVZ servers as the kernel on\n# those systems do not store the required information in /proc/diskstats\n# On new installations or when enabling this option it will take time for these\n# graphs to be populated\nST_SYSTEM = \"0\"\n\n# Set the maximum days to collect statistics for. The default is 30 days, the\n# more data that is collected the longer it will take for each of the graphs to\n# be generated\nST_SYSTEM_MAXDAYS = \"30\"\n\n# If ST_SYSTEM is enabled, then these options can collect MySQL statistical\n# data. To use this option the server must have the perl modules DBI and\n# DBD::mysql installed.\n#\n# Set this option to \"0\" to disable MySQL data collection\nST_MYSQL = \"0\"\n\n# The following options are for authentication for MySQL data collection. If\n# the password is left blank and the user set to \"root\" then the procedure will\n# look for authentication data in /root/.my.cnf. Otherwise, you will need to\n# provide a MySQL username and password to collect the data. Any MySQL user\n# account can be used\nST_MYSQL_USER = \"root\"\nST_MYSQL_PASS = \"\"\nST_MYSQL_HOST = \"localhost\"\n\n# If ST_SYSTEM is enabled, then this option can collect Apache statistical data\n# The value for PT_APACHESTATUS must be correctly set\nST_APACHE = \"0\"\n\n# The following options measure disk write performance using dd (location set\n# via the DD setting). It creates a 64MB file called /var/lib/dd_write_test and\n# the statistics will plot the MB/s response time of the disk. As this is an IO\n# intensive operation, it may not be prudent to run this test too often, so by\n# default it is only run every 5 minutes and the result duplicated for each\n# intervening minute for the statistics\n#\n# This is not necessrily a good measure of disk performance, primarily because\n# the measurements are for relatively small amounts of data over a small amount\n# of time. To properly test disk performance there are a variety of tools\n# available that should be run for extended periods of time to obtain an\n# accurate measurement. This metric is provided to give an idea of how the disk\n# is performing over time\n#\n# Note: There is a 15 second timeout performing the check\n#\n# Set to 0 to disable, 1 to enable\nST_DISKW = \"0\"\n\n# The number of minutes that elapse between tests. Default is 5, minimum is 1.\nST_DISKW_FREQ = \"5\"\n\n# This is the command line passed to dd. If you are familiar with dd, or wish\n# to move the output file (of) to a different disk, then you can alter this\n# command. Take great care when making any changes to this command as it is\n# very easy to overwrite a disk using dd if you make a mistake\nST_DISKW_DD = \"if=/dev/zero of=/etc/csf/dd_test bs=1MB count=64 conv=fdatasync\"\n\n###############################################################################\n# SECTION:Docker Settings\n###############################################################################\n# This section provides the configuration of iptables rules to allow Docker\n# containers to communicate through the host. If the generated rules do not\n# work with your setup you will have to use a /etc/csf/csfpost.sh file and add\n# your own iptables configuration instead\n#\n# 1 to enable, 0 to disable\nDOCKER = \"0\"\n\n# The network device on the host\nDOCKER_DEVICE = \"docker0\"\n\n# Docker container IPv4 range\nDOCKER_NETWORK4 = \"172.17.0.0/16\"\n\n# Docker container IPv6 range. IPV6 must be enabled and the IPv6 nat table\n# available (see IPv6 section). Leave blank to disable\nDOCKER_NETWORK6 = \"2001:db8:1::/64\"\n\n###############################################################################\n# SECTION:OS Specific Settings\n###############################################################################\n# Binary locations\nIPTABLES = \"/usr/sbin/iptables\"\nIPTABLES_SAVE = \"/usr/sbin/iptables-save\"\nIPTABLES_RESTORE = \"/usr/sbin/iptables-restore\"\nIP6TABLES = \"/usr/sbin/ip6tables\"\nIP6TABLES_SAVE = \"/usr/sbin/ip6tables-save\"\nIP6TABLES_RESTORE = \"/usr/sbin/ip6tables-restore\"\nMODPROBE = \"/sbin/modprobe\"\nIFCONFIG = \"/sbin/ifconfig\"\nSENDMAIL = \"/usr/sbin/sendmail\"\nPS = \"/bin/ps\"\nVMSTAT = \"/usr/bin/vmstat\"\nNETSTAT = \"/bin/netstat\"\nLS = \"/bin/ls\"\nMD5SUM = \"/usr/bin/md5sum\"\nTAR = \"/bin/tar\"\nCHATTR = \"/usr/bin/chattr\"\nUNZIP = \"/usr/bin/unzip\"\nGUNZIP = \"/bin/gunzip\"\nDD = \"/bin/dd\"\nTAIL = \"/usr/bin/tail\"\nGREP = \"/bin/grep\"\nZGREP = \"/bin/zgrep\"\nIPSET = \"/usr/sbin/ipset\"\nSYSTEMCTL = \"/usr/bin/systemctl\"\nHOST = \"/usr/bin/host\"\nIP = \"/bin/ip\"\nCURL = \"/usr/bin/curl\"\nWGET = \"/usr/bin/wget\"\n\n# Log file locations\n#\n# File globbing is allowed for the following logs. However, be aware that the\n# more files lfd has to track, the greater the performance hit\n#\n# Note: File globs are only evaluated when lfd is started\n#\nHTACCESS_LOG = \"/var/log/nginx/error.log\"\nMODSEC_LOG = \"/var/log/nginx/error.log\"\nSSHD_LOG = \"/var/log/auth.log\"\nSU_LOG = \"/var/log/auth.log\"\nSUDO_LOG = \"/var/log/auth.log\"\nFTPD_LOG = \"/var/log/messages\"\nSMTPAUTH_LOG = \"/var/log/mail.log\"\nPOP3D_LOG = \"/var/log/mail.log\"\nIMAPD_LOG = \"/var/log/mail.log\"\nIPTABLES_LOG = \"/var/log/iptables.log\"\nSUHOSIN_LOG = \"/var/log/messages\"\nBIND_LOG = \"/var/log/messages\"\nSYSLOG_LOG = \"/var/log/syslog\"\nWEBMIN_LOG = \"/var/log/auth.log\"\nCUSTOM1_LOG = \"/var/log/cron.log\"\n\n# The following are comma separated lists used if LF_SELECT is enabled,\n# otherwise they are not used. They are derived from the application returned\n# from a regex match in /usr/local/csf/bin/regex.pm\n#\n# All ports default to tcp blocks. To specify udp or tcp use the format:\n# port;protocol,port;protocol,... For example, \"53;udp,53;tcp\"\nPORTS_pop3d = \"110,995\"\nPORTS_imapd = \"143,993\"\nPORTS_htpasswd = \"80,443\"\nPORTS_mod_security = \"80,443\"\nPORTS_mod_qos = \"80,443\"\nPORTS_symlink = \"80,443\"\nPORTS_suhosin = \"80,443\"\nPORTS_cxs = \"80,443\"\nPORTS_bind = \"53\"\nPORTS_ftpd = \"20,21\"\nPORTS_webmin = \"10000\"\nPORTS_smtpauth = \"25,465,587\"\nPORTS_eximsyntax = \"25,465,587\"\n# This list is replaced, if present, by \"Port\" definitions in\n# /etc/ssh/sshd_config\nPORTS_sshd = \"22\"\n\n# This configuration is for use with generic Linux servers, do not change the\n# following setting:\nGENERIC = \"1\"\n\n# For internal use only. You should not enable this option as it could cause\n# instability in csf and lfd\nDEBUG = \"0\"\n###############################################################################\n" }, { "path": "aegir/conf/var/galera.cnf", "content": "[mysqld]\n\n###\n### Galera configuration template\n### /etc/mysql/conf.d/galera.cnf\n###\n\n### Mandatory for Galera\n#\nbinlog_format=ROW\n#default_storage_engine=InnoDB\ninnodb_autoinc_lock_mode=2\n\n### Recommended for Galera\n#\ninnodb_flush_log_at_trx_commit=0\nbinlog_row_image=minimal\nperformance_schema=OFF\n\n### Basic Galera Settings\n#\n# wsrep_provider=/usr/lib/galera/libgalera_smm.so\n# wsrep_cluster_name=\"galera_cluster\"\n# wsrep_cluster_address=\"gcomm://192.168.0.1,192.168.0.2,192.168.0.3,...?pc.wait_prim=no\"\n# wsrep_sst_auth=wsrep:sCWL4tgEpyS5cLZITshxSTWRjhsUOeR6\n# wsrep_provider_options='socket.checksum=1'\n\n### Optional Galera Settings\n#\n# wsrep_node_address=\"192.168.0.1\"\n# wsrep_node_name=\"galera_node1\"\n# wsrep_slave_threads=8\n\n### Optional Memory Settings for Galera\n#\n# gcs.recv_q_hard_limit=4G\n# gcs.recv_q_soft_limit=2G\n# gcs.max_throttle=0.25T\n\n### Optional MyISAM Support in Galera\n#\n# wsrep_replicate_myisam=1\n" }, { "path": "aegir/conf/var/get.htaccess.txt", "content": "#\n# Apache/PHP/Drupal settings:\n#\n\n# Protect files and directories from prying eyes.\n\n Order allow,deny\n\n\n# Don't show directory listings for URLs which map to a directory.\nOptions -Indexes\n\n# Follow symbolic links in this directory.\nOptions +FollowSymLinks\n\n# Make Drupal handle any 404 errors.\nErrorDocument 404 /index.php\n\n# Set the default handler.\nDirectoryIndex index.php index.html index.htm\n\n# Override PHP settings that cannot be changed at runtime. See\n# sites/default/default.settings.php and drupal_environment_initialize() in\n# includes/bootstrap.inc for settings that can be changed at runtime.\n\n# PHP 5, Apache 1 and 2.\n\n php_flag magic_quotes_gpc off\n php_flag magic_quotes_sybase off\n php_flag register_globals off\n php_flag session.auto_start off\n php_value mbstring.http_input pass\n php_value mbstring.http_output pass\n php_flag mbstring.encoding_translation off\n\n\n# Requires mod_expires to be enabled.\n\n # Enable expirations.\n ExpiresActive On\n\n # Cache all files for 2 weeks after access (A).\n ExpiresDefault A1209600\n\n \n # Do not allow PHP scripts to be cached unless they explicitly send cache\n # headers themselves. Otherwise all scripts would have to overwrite the\n # headers set by mod_expires if they want another caching behavior. This may\n # fail if an error occurs early in the bootstrap process, and it may cause\n # problems if a non-Drupal PHP file is installed in a subdirectory.\n ExpiresActive Off\n \n\n\n# Various rewrite rules.\n\n RewriteEngine on\n\n # Set \"protossl\" to \"s\" if we were accessed via https://. This is used later\n # if you enable \"www.\" stripping or enforcement, in order to ensure that\n # you don't bounce between http and https.\n RewriteRule ^ - [E=protossl]\n RewriteCond %{HTTPS} on\n RewriteRule ^ - [E=protossl:s]\n\n # Make sure Authorization HTTP header is available to PHP\n # even when running as CGI or FastCGI.\n RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]\n\n # Block access to \"hidden\" directories whose names begin with a period. This\n # includes directories used by version control systems such as Subversion or\n # Git to store control files. Files whose names begin with a period, as well\n # as the control files used by CVS, are protected by the FilesMatch directive\n # above.\n #\n # NOTE: This only works when mod_rewrite is loaded. Without mod_rewrite, it is\n # not possible to block access to entire directories from .htaccess, because\n # is not allowed here.\n #\n # If you do not have mod_rewrite installed, you should remove these\n # directories from your webroot or otherwise protect them from being\n # downloaded.\n RewriteRule \"(^|/)\\.\" - [F]\n\n # If your site can be accessed both with and without the 'www.' prefix, you\n # can use one of the following settings to redirect users to your preferred\n # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option:\n #\n # To redirect all users to access the site WITH the 'www.' prefix,\n # (http://example.com/... will be redirected to http://www.example.com/...)\n # uncomment the following:\n # RewriteCond %{HTTP_HOST} .\n # RewriteCond %{HTTP_HOST} !^www\\. [NC]\n # RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]\n #\n # To redirect all users to access the site WITHOUT the 'www.' prefix,\n # (http://www.example.com/... will be redirected to http://example.com/...)\n # uncomment the following:\n # RewriteCond %{HTTP_HOST} ^www\\.(.+)$ [NC]\n # RewriteRule ^ http%{ENV:protossl}://%1%{REQUEST_URI} [L,R=301]\n\n # Modify the RewriteBase if you are using Drupal in a subdirectory or in a\n # VirtualDocumentRoot and the rewrite rules are not working properly.\n # For example if your site is at http://example.com/drupal uncomment and\n # modify the following line:\n # RewriteBase /drupal\n #\n # If your site is running in a VirtualDocumentRoot at http://example.com/,\n # uncomment the following line:\n # RewriteBase /\n\n# AIS: Adaptive Image Style\n RewriteBase /\n RewriteCond %{REQUEST_URI} ^(.+)/files/styles/adaptive/(.+)$\n RewriteCond %{REQUEST_URI} !/modules/image/sample.png\n RewriteCond %{HTTP_COOKIE} ais=([a-z0-9_-]+)\n RewriteRule ^(.+)/files/styles/adaptive/(.+)$ $1/files/styles/%1/$2 [R=302,L]\n\n ### BOOST START ###\n AddDefaultCharset utf-8\n \n \n ExpiresDefault A1\n \n \n Header set Expires \"Tue, 24 Jan 1984 08:00:00 GMT\"\n Header set Cache-Control \"no-store, no-cache, must-revalidate, post-check=0, pre-check=0\"\n \n \n \n AddCharset utf-8 .html\n AddCharset utf-8 .xml\n AddCharset utf-8 .json\n AddCharset utf-8 .css\n AddCharset utf-8 .js\n AddEncoding gzip .gz\n \n \n ForceType text/html\n \n \n ForceType text/xml\n \n \n ForceType text/javascript\n \n \n ForceType text/css\n \n\n # Gzip Cookie Test\n RewriteRule boost-gzip-cookie-test\\.html cache/perm/boost-gzip-cookie-test\\.html\\.gz [L,T=text/html]\n\n # GZIP - Cached css & js files\n RewriteCond %{HTTP_COOKIE} !(boost-gzip)\n RewriteCond %{HTTP:Accept-encoding} !gzip\n RewriteRule .* - [S=2]\n RewriteCond %{DOCUMENT_ROOT}/cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\\.css\\.gz -s\n RewriteRule .* cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\\.css\\.gz [L,QSA,T=text/css]\n RewriteCond %{DOCUMENT_ROOT}/cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\\.js\\.gz -s\n RewriteRule .* cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\\.js\\.gz [L,QSA,T=text/javascript]\n\n # NORMAL - Cached css & js files\n RewriteCond %{DOCUMENT_ROOT}/cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\\.css -s\n RewriteRule .* cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\\.css [L,QSA,T=text/css]\n RewriteCond %{DOCUMENT_ROOT}/cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\\.js -s\n RewriteRule .* cache/perm/%{HTTP_HOST}%{REQUEST_URI}_\\.js [L,QSA,T=text/javascript]\n\n # Caching for anonymous users\n # Skip boost IF not get request OR uri has wrong dir OR cookie is set OR https request\n RewriteCond %{REQUEST_METHOD} !^(GET|HEAD)$ [OR]\n RewriteCond %{REQUEST_URI} (^/(admin|cache|misc|modules|sites|system|openid|themes|node/add))|(/(comment/reply|edit|user|user/(login|password|register))$) [OR]\n RewriteCond %{HTTP_COOKIE} DRUPAL_UID [OR]\n RewriteCond %{HTTPS} on\n RewriteRule .* - [S=7]\n\n # GZIP\n RewriteCond %{HTTP_COOKIE} !(boost-gzip)\n RewriteCond %{HTTP:Accept-encoding} !gzip\n RewriteRule .* - [S=3]\n RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.html\\.gz -s\n RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.html\\.gz [L,T=text/html]\n RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.xml\\.gz -s\n RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.xml\\.gz [L,T=text/xml]\n RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.json\\.gz -s\n RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.json\\.gz [L,T=text/javascript]\n\n # NORMAL\n RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.html -s\n RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.html [L,T=text/html]\n RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.xml -s\n RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.xml [L,T=text/xml]\n RewriteCond %{DOCUMENT_ROOT}/cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.json -s\n RewriteRule .* cache/normal/%{HTTP_HOST}%{REQUEST_URI}_%{QUERY_STRING}\\.json [L,T=text/javascript]\n\n ### BOOST END ###\n\n# $Id: boosted2.txt,v 1.1.2.24 2010/03/17 05:43:15 mikeytown2 Exp $\n\n # Pass all requests not referring directly to files in the filesystem to\n # index.php. Clean URLs are handled in drupal_environment_initialize().\n RewriteCond %{REQUEST_FILENAME} !-f\n RewriteCond %{REQUEST_FILENAME} !-d\n RewriteCond %{REQUEST_URI} !=/favicon.ico\n RewriteRule ^ index.php [L]\n\n # Rules to correctly serve gzip compressed CSS and JS files.\n # Requires both mod_rewrite and mod_headers to be enabled.\n \n # Serve gzip compressed CSS files if they exist and the client accepts gzip.\n RewriteCond %{HTTP:Accept-encoding} gzip\n RewriteCond %{REQUEST_FILENAME}\\.gz -s\n RewriteRule ^(.*)\\.css $1\\.css\\.gz [QSA]\n\n # Serve gzip compressed JS files if they exist and the client accepts gzip.\n RewriteCond %{HTTP:Accept-encoding} gzip\n RewriteCond %{REQUEST_FILENAME}\\.gz -s\n RewriteRule ^(.*)\\.js $1\\.js\\.gz [QSA]\n\n # Serve correct content types, and prevent mod_deflate double gzip.\n RewriteRule \\.css\\.gz$ - [T=text/css,E=no-gzip:1]\n RewriteRule \\.js\\.gz$ - [T=text/javascript,E=no-gzip:1]\n\n \n # Serve correct encoding type.\n Header set Content-Encoding gzip\n # Force proxies to cache gzipped & non-gzipped css/js files separately.\n Header append Vary Accept-Encoding\n \n \n\n" }, { "path": "aegir/conf/var/logrotate.d.rsyslog.conf", "content": "/var/log/syslog\n/var/log/mail.info\n/var/log/mail.warn\n/var/log/mail.err\n/var/log/mail.log\n/var/log/daemon.log\n/var/log/mysql-notices.log\n/var/log/kern.log\n/var/log/iptables.log\n/var/log/auth.log\n/var/log/user.log\n/var/log/lpr.log\n/var/log/cron.log\n/var/log/debug\n/var/log/messages\n{\n rotate 4\n weekly\n missingok\n notifempty\n compress\n delaycompress\n sharedscripts\n postrotate\n /usr/lib/rsyslog/rsyslog-rotate\n endscript\n}\n" }, { "path": "aegir/conf/var/my.cnf.txt", "content": "[client]\nport = 3306\nsocket = /run/mysqld/mysqld.sock\ndefault-character-set = utf8mb4\n\n[mysqld]\nuser = mysql\npid-file = /run/mysqld/mysqld.pid\nsocket = /run/mysqld/mysqld.sock\nport = 3306\nbasedir = /usr\ndatadir = /var/lib/mysql\ntmpdir = /tmp\n#default_storage_engine = InnoDB\n#mysql_native_password = ON\n#mysqlx = OFF\nlc_messages_dir = /usr/share/mysql\nlc_messages = en_US\ncharacter_set_server = utf8mb4\ncollation_server = utf8mb4_unicode_ci\ntransaction-isolation = READ-COMMITTED\ntransaction-read-only = OFF\nskip-external-locking\nskip-name-resolve\nsecure_file_priv = NULL\n#performance_schema = OFF\n#performance_schema_instrument = 'wait/%=ON'\n#performance_schema_consumer_events_waits_current=OFF\n#performance_schema_consumer_events_waits_history=OFF\n#performance_schema_consumer_events_waits_history_long=OFF\n#symbolic-links = 0\nconnect_timeout = 60\njoin_buffer_size = 1M\nkey_buffer_size = 1024M\nmax_allowed_packet = 256M\nmax_connect_errors = 191\nmax_connections = 292\nmax_user_connections = 191\nmyisam_sort_buffer_size = 256K\nread_buffer_size = 8M\nread_rnd_buffer_size = 4M\nsort_buffer_size = 256K\nbulk_insert_buffer_size = 256K\ntable_open_cache = 2048\ntable_definition_cache = 512\nthread_stack = 256K\nthread_cache_size = 128\nwait_timeout = 3600\ntmp_table_size = 64M\nmax_heap_table_size = 128M\nlow_priority_updates = 1\nconcurrent_insert = 2\n#max_tmp_tables = 16384\nserver-id = 8\n#myisam-recover-options = BACKUP\n#myisam_recover = BACKUP\nsync_binlog = 0\nopen_files_limit = 294912\ninnodb_autoinc_lock_mode= 2\ngroup_concat_max_len = 10000\nskip-log-bin\n#log_bin = ON\n#max_binlog_size = 256M\n#binlog_row_image = minimal\n#binlog_format = ROW\n#slow_query_log = 1\n#long_query_time = 10\n#slow_query_log_file = /var/log/mysql/sql-slow-query.log\n#log_queries_not_using_indexes\n\n# --- Logging in Percona 5.7 -----------------------------------------------\n# log_syslog = ON\n# log_syslog_facility = daemon\n# log_syslog_include_pid = ON\n\n# --- Logging in Percona 8.x -----------------------------------------------\n# log_error = /var/log/mysql/error.log\n# log_error_verbosity = 2\n# log_error_services = log_filter_internal; log_sink_internal; log_sink_syseventlog\n# syseventlog.facility = daemon\n# syseventlog.include_pid = ON\n\n# * InnoDB\n#\n# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.\n# Read the manual for more InnoDB related options. There are many!\nsql_mode = NO_ENGINE_SUBSTITUTION\n# you can't just change log file size, requires special procedure\n#innodb_log_file_size = 50M\n#innodb_redo_log_capacity = 50M\ninnodb_buffer_pool_instances = 8\ninnodb_page_cleaners = 8\ninnodb_lru_scan_depth = 1024\ninnodb_buffer_pool_size = 181M\ninnodb_log_buffer_size = 256M\ninnodb_file_per_table = 1\n#innodb_use_native_aio = 1\ninnodb_open_files = 196608\ninnodb_io_capacity = 1000\ninnodb_flush_method = O_DIRECT\ninnodb_flush_log_at_trx_commit = 2\ninnodb_thread_concurrency = 0\ninnodb_lock_wait_timeout = 300\ninnodb_buffer_pool_dump_at_shutdown = 1\ninnodb_buffer_pool_load_at_startup = 1\n#innodb_buffer_pool_dump_pct = 100\n#innodb_buffer_pool_dump_now = ON\ninnodb_stats_on_metadata = OFF\ninnodb_adaptive_hash_index = 0\ninnodb_default_row_format = dynamic\ninnodb_doublewrite = 1\n#innodb_checksum_algorithm=crc32\ninnodb_flush_log_at_timeout = 1\n#innodb_force_recovery = 3\n#innodb_temp_data_file_path = ibtmp1:12M:autoextend:max:900M\n\n[mysqld_safe]\nsocket = /run/mysqld/mysqld.sock\nnice = 0\nopen_files_limit = 294912\nsyslog\n\n[mysqldump]\nquick\nmax_allowed_packet = 256M\nquote-names\n\n[mysql]\ndefault-character-set = utf8mb4\nno-auto-rehash\n\n[myisamchk]\nkey_buffer = 1M\nsort_buffer_size = 256K\nread_buffer = 4M\nwrite_buffer = 4M\n\n[isamchk]\nkey_buffer = 1M\nsort_buffer_size = 256K\nread_buffer = 4M\nwrite_buffer = 4M\n\n[mysqlhotcopy]\ninteractive-timeout\n\n!includedir /etc/mysql/conf.d/\n" }, { "path": "aegir/conf/var/mysql", "content": "#!/bin/bash\n### BEGIN INIT INFO\n# Provides: mysql\n# Required-Start: $network $remote_fs $syslog\n# Required-Stop: $network $remote_fs $syslog\n# Default-Start: 2 3 4 5\n# Default-Stop: 0 1 6\n# Short-Description: Start and stop Percona MySQL server\n# Description: Manage the Percona MySQL server daemon\n### END INIT INFO\n\n# Path to Percona MySQL executable\nDAEMON=/usr/sbin/mysqld\nMYSQL_OPTS=\"\"\n\n# PID file location\nPIDFILE=/run/mysqld/mysqld.pid\n\n# Configuration file location\nMYCNF=/etc/mysql/my.cnf\n\n# Logging\nLOGFILE=/var/log/mysql/mysql.log\nERRORLOG=/var/log/mysql/error.log\n\n# Ensure the Percona MySQL directory exists\n[ -d /run/mysqld ] || mkdir -p /run/mysqld\nchown mysql:mysql /run/mysqld\n\n# Start Percona MySQL Server\nstart_mysql() {\n echo \"Starting MySQL\"\n if [ -f $PIDFILE ]; then\n echo \"Percona MySQL is already running.\"\n return 1\n fi\n\n # Start MySQL\n $DAEMON --defaults-file=$MYCNF $MYSQL_OPTS > /dev/null 2>&1 &\n sleep 5\n\n if [ -f $PIDFILE ]; then\n echo \"Percona MySQL started successfully.\"\n else\n echo \"Percona MySQL failed to start.\"\n return 1\n fi\n}\n\n# Stop Percona MySQL Server\nstop_mysql() {\n echo \"Stopping MySQL\"\n if [ ! -f $PIDFILE ]; then\n echo \"Percona MySQL is not running.\"\n return 1\n fi\n\n kill `cat $PIDFILE`\n sleep 5\n\n if [ -f $PIDFILE ]; then\n echo \"Percona MySQL failed to stop.\"\n return 1\n else\n echo \"Percona MySQL stopped successfully.\"\n fi\n}\n\n# Restart Percona MySQL Server\nrestart_mysql() {\n stop_mysql\n start_mysql\n}\n\n# Status of Percona MySQL Server\nstatus_mysql() {\n if [ -f $PIDFILE ]; then\n echo \"Percona MySQL is running (PID: `cat $PIDFILE`).\"\n else\n echo \"Percona MySQL is not running.\"\n return 1\n fi\n}\n\ncase \"$1\" in\n start)\n start_mysql\n ;;\n stop)\n stop_mysql\n ;;\n restart)\n restart_mysql\n ;;\n status)\n status_mysql\n ;;\n *)\n echo \"Usage: $0 {start|stop|restart|status}\"\n exit 1\nesac\n\nexit 0\n" }, { "path": "aegir/conf/var/mysql-notices.conf", "content": "# /etc/rsyslog.d/mysql-notices.conf\nif $programname == 'mysqld' and $msg contains 'InnoDB: Stopping purge' then /var/log/mysql-notices.log\nif $programname == 'mysqld' and $msg contains 'InnoDB: Resuming purge' then /var/log/mysql-notices.log\n\n# Don't log these specific notices in syslog or daemon.log\nif $programname == 'mysqld' and $msg contains 'InnoDB: Stopping purge' then stop\nif $programname == 'mysqld' and $msg contains 'InnoDB: Resuming purge' then stop\n" }, { "path": "aegir/conf/var/named.conf.options", "content": "options {\n\tdirectory \"/var/cache/bind\";\n\n\t// If there is a firewall between you and nameservers you want\n\t// to talk to, you may need to fix the firewall to allow multiple\n\t// ports to talk. See http://www.kb.cert.org/vuls/id/800113\n\n\t// If your ISP provided one or more IP addresses for stable \n\t// nameservers, you probably want to use them as forwarders. \n\t// Uncomment the following block, and insert the addresses replacing \n\t// the all-0's placeholder.\n\n\t// forwarders {\n\t// \t0.0.0.0;\n\t// };\n\n\tauth-nxdomain no; # conform to RFC1035\n\tlisten-on-v6 { any; };\n\tlisten-on {\n\t\t127.0.1.1;\n\t\t};\n};\n" }, { "path": "aegir/conf/var/rsyslog.conf", "content": "# /etc/rsyslog.conf configuration file for rsyslog\n#\n# For more information install rsyslog-doc and see\n# /usr/share/doc/rsyslog-doc/html/configuration/index.html\n\n\n#################\n#### MODULES ####\n#################\n\nmodule(load=\"imuxsock\") # provides support for local system logging\nmodule(load=\"imklog\") # provides kernel logging support\n#module(load=\"immark\") # provides --MARK-- message capability\n\n# provides UDP syslog reception\n#module(load=\"imudp\")\n#input(type=\"imudp\" port=\"514\")\n\n# provides TCP syslog reception\n#module(load=\"imtcp\")\n#input(type=\"imtcp\" port=\"514\")\n\n\n###########################\n#### GLOBAL DIRECTIVES ####\n###########################\n\n#\n# Use traditional timestamp format.\n# To enable high precision timestamps, comment out the following line.\n#\n$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat\n\n#\n# Set the default permissions for all log files.\n#\n$FileOwner root\n$FileGroup adm\n$FileCreateMode 0640\n$DirCreateMode 0755\n$Umask 0022\n\n#\n# Where to place spool and state files\n#\n$WorkDirectory /var/spool/rsyslog\n\n#\n# Include all config files in /etc/rsyslog.d/\n#\n$IncludeConfig /etc/rsyslog.d/*.conf\n\n\n###############\n#### RULES ####\n###############\n\n#\n# First some standard log files. Log by facility.\n#\n\n# Direct all cron messages to /var/log/cron.log\nif $programname == 'CRON' then /var/log/cron.log\n& stop\n\n# Log auth and authpriv messages to /var/log/auth.log\nauth,authpriv.* /var/log/auth.log\n\n*.*;kern.!info;\\\n cron.!info;\\\n mail.!info;\\\n auth,authpriv.none -/var/log/syslog\ndaemon.*\t\t\t-/var/log/daemon.log\nkern.*;kern.!info -/var/log/kern.log\nlpr.*\t\t\t\t-/var/log/lpr.log\nmail.*\t\t\t\t-/var/log/mail.log\nuser.*\t\t\t\t-/var/log/user.log\nkern.info -/var/log/iptables.log\ncron.info\t\t\t/var/log/cron.log\n\n#\n# Logging for the mail system. Split it up so that\n# it is easy to write scripts to parse these files.\n#\nmail.info\t\t\t-/var/log/mail.info\nmail.warn\t\t\t-/var/log/mail.warn\nmail.err\t\t\t/var/log/mail.err\n\n#\n# Some \"catch-all\" log files.\n#\n*.=debug;\\\n\tauth,authpriv.none;\\\n\tmail.none\t\t-/var/log/debug\n*.=info;*.=notice;*.=warn;\\\n kern.!info;\\\n\tauth,authpriv.none;\\\n\tcron,daemon.none;\\\n\tmail.none\t\t-/var/log/messages\n\n#\n# Emergencies are sent to everybody logged in.\n#\n*.emerg\t\t\t\t:omusrmsg:*\n\n" }, { "path": "aegir/conf/var/sftp_config", "content": "\n GlobalDownload 0\n GlobalUpload 0\n Download 0\n Upload 0\n StayAtHome true\n VirtualChroot true\n LimitConnection 0\n LimitConnectionByUser 5\n LimitConnectionByIP 5\n Home /home/$USER\n IdleTimeOut 15m\n ResolveIP false\n IgnoreHidden false\n HideNoAccess true\n DefaultRights 0664 0775\n MinimumRights 0664 0775\n\n\n\n Shell /usr/bin/lshell\n\n" }, { "path": "aegir/conf/var/ssh_config", "content": "\n# This is the ssh client system-wide configuration file. See\n# ssh_config(5) for more information. This file provides defaults for\n# users, and the values can be changed in per-user configuration files\n# or on the command line.\n\n# Configuration data is parsed as follows:\n# 1. command line options\n# 2. user-specific file\n# 3. system-wide file\n# Any configuration value is only changed the first time it is set.\n# Thus, host-specific definitions should be at the beginning of the\n# configuration file, and defaults at the end.\n\n# Site-wide defaults for some commonly used options. For a comprehensive\n# list of available options, their meanings and defaults, please see the\n# ssh_config(5) man page.\n\nInclude /etc/ssh/ssh_config.d/*.conf\n\nHost *\n# ForwardAgent no\n# ForwardX11 no\n# ForwardX11Trusted yes\n# PasswordAuthentication yes\n# HostbasedAuthentication no\n# GSSAPIAuthentication no\n# GSSAPIDelegateCredentials no\n# GSSAPIKeyExchange no\n# GSSAPITrustDNS no\n# BatchMode no\n# CheckHostIP yes\n# AddressFamily any\n# ConnectTimeout 0\n# StrictHostKeyChecking ask\n# IdentityFile ~/.ssh/id_rsa\n# IdentityFile ~/.ssh/id_dsa\n# IdentityFile ~/.ssh/id_ecdsa\n# IdentityFile ~/.ssh/id_ed25519\n# Port 22\n# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc\n# MACs hmac-md5,hmac-sha1,umac-64@openssh.com\n# EscapeChar ~\n# Tunnel no\n# TunnelDevice any:any\n# PermitLocalCommand no\n# VisualHostKey no\n# ProxyCommand ssh -q -W %h:%p gateway.example.com\n# RekeyLimit 1G 1h\n# UserKnownHostsFile ~/.ssh/known_hosts.d/%k\n SendEnv LANG LC_*\n HashKnownHosts yes\n WarnWeakCrypto no\n" }, { "path": "aegir/conf/var/sshd_config", "content": "# This is the sshd server system-wide configuration file. See\n# sshd_config(5) for more information.\n# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games\n# The strategy used for options in the default sshd_config shipped with\n# OpenSSH is to specify options with their default value where\n# possible, but leave them commented. Uncommented options override the\n# default value.\nInclude /etc/ssh/sshd_config.d/*.conf\nPort 22\n#AddressFamily any\n#ListenAddress 0.0.0.0\n#ListenAddress ::\n#HostKey /etc/ssh/ssh_host_rsa_key\n#HostKey /etc/ssh/ssh_host_ecdsa_key\n#HostKey /etc/ssh/ssh_host_ed25519_key\n# Ciphers and keying\n#RekeyLimit default none\n# Logging\n#SyslogFacility AUTH\n#LogLevel INFO\n# Authentication:\n#LoginGraceTime 2m\nPermitRootLogin prohibit-password\n#StrictModes yes\n#MaxAuthTries 6\n#MaxSessions 10\n#PubkeyAuthentication yes\n# Expect .ssh/authorized_keys2 to be disregarded by default in future.\n#AuthorizedKeysFile\t.ssh/authorized_keys .ssh/authorized_keys2\n#AuthorizedPrincipalsFile none\n#AuthorizedKeysCommand none\n#AuthorizedKeysCommandUser nobody\n# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts\n#HostbasedAuthentication no\n# Change to yes if you don't trust ~/.ssh/known_hosts for\n# HostbasedAuthentication\n#IgnoreUserKnownHosts no\n# Don't read the user's ~/.rhosts and ~/.shosts files\n#IgnoreRhosts yes\n# To disable tunneled clear text passwords, change to no here!\nPermitEmptyPasswords no\n# Change to yes to enable challenge-response passwords (beware issues with\n# some PAM modules and threads)\nKbdInteractiveAuthentication no\n# Kerberos options\n#KerberosAuthentication no\n#KerberosOrLocalPasswd yes\n#KerberosTicketCleanup yes\n#KerberosGetAFSToken no\n# GSSAPI options\n#GSSAPIAuthentication no\n#GSSAPICleanupCredentials yes\n#GSSAPIStrictAcceptorCheck yes\n#GSSAPIKeyExchange no\n# Set this to 'yes' to enable PAM authentication, account processing,\n# and session processing. If this is enabled, PAM authentication will\n# be allowed through the KbdInteractiveAuthentication and\n# PasswordAuthentication. Depending on your PAM configuration,\n# PAM authentication via KbdInteractiveAuthentication may bypass\n# the setting of \"PermitRootLogin prohibit-password\".\n# If you just want the PAM account and session checks to run without\n# PAM authentication, then enable this but set PasswordAuthentication\n# and KbdInteractiveAuthentication to 'no'.\n#AllowAgentForwarding yes\n#AllowTcpForwarding yes\n#GatewayPorts no\n#X11Forwarding yes\n#X11DisplayOffset 10\n#X11UseLocalhost yes\n#PermitTTY yes\n#PrintLastLog yes\n#PermitUserEnvironment no\n#Compression delayed\n#ClientAliveInterval 0\n#ClientAliveCountMax 3\n#PidFile /run/sshd.pid\n#MaxStartups 10:30:100\n#PermitTunnel no\n#ChrootDirectory none\n#VersionAddendum none\n# no default banner path\n#Banner none\n# Allow client to pass locale environment variables\nAcceptEnv LANG LC_*\n# override default of no subsystems\nSubsystem sftp /usr/lib/openssh/sftp-server -u 0002\n# Example of overriding settings on a per-user basis\n#Match User anoncvs\n#\tX11Forwarding no\n#\tAllowTcpForwarding no\n#\tPermitTTY no\n#\tForceCommand cvs server\nIgnoreUserKnownHosts no\nPasswordAuthentication yes\nUseDNS no\nUsePAM no\nPrintMotd yes\nClientAliveInterval 300\nClientAliveCountMax 10000\nTCPKeepAlive yes\nMaxAuthTries 3\nLoginGraceTime 30\nMaxStartups 5:50:10\nX11Forwarding no\nAllowTcpForwarding no\nAllowAgentForwarding no\n" }, { "path": "aegir/conf/var/sysctl.conf", "content": "# =============================================================================\n# sysctl.conf - Kernel parameter tuning for KVM/QEMU virtual machines\n# Target: Devuan Daedalus 5.x (Linux kernel 6.1 LTS / Debian Bookworm base)\n# Compatible with: Linux 4.9+ (all settings verified for kernel 6.1)\n#\n# Apply changes with: sysctl -p /etc/sysctl.conf\n# Verify a value with: sysctl \n#\n# Sections:\n# 1. IPv4 Security Hardening\n# 2. IPv6 Disablement\n# 3. TCP/IP Performance Tuning\n# 4. Network Buffer Sizes\n# 5. Virtual Memory\n# 6. Filesystem & Process Limits\n# 7. Kernel Security Hardening\n# =============================================================================\n\n\n# -----------------------------------------------------------------------------\n# 1. IPv4 Security Hardening\n# -----------------------------------------------------------------------------\n\n# Ignore ICMP echo requests sent to broadcast addresses (smurf attack defence)\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\n\n# Suppress bogus ICMP error responses that could be used for OS fingerprinting\nnet.ipv4.icmp_ignore_bogus_error_responses = 1\n\n# Enable SYN cookies to withstand SYN flood attacks without dropping connections\nnet.ipv4.tcp_syncookies = 1\n\n# Log martian packets (packets with impossible source addresses).\n# Useful for detecting spoofing attempts; generates some log noise on noisy\n# networks. Set to 0 if log verbosity is a concern.\nnet.ipv4.conf.all.log_martians = 1\nnet.ipv4.conf.default.log_martians = 1\n\n# Reject source-routed packets (attacker-controlled routing)\nnet.ipv4.conf.all.accept_source_route = 0\nnet.ipv4.conf.default.accept_source_route = 0\n\n# Strict Reverse Path Filtering: drop packets whose source address has no\n# return route through the interface they arrived on. Prevents IP spoofing.\n# Use rp_filter = 2 (loose mode) only if asymmetric routing is required.\nnet.ipv4.conf.all.rp_filter = 1\nnet.ipv4.conf.default.rp_filter = 1\n\n# Reject ICMP redirect messages (could be used to alter routing tables)\nnet.ipv4.conf.all.accept_redirects = 0\nnet.ipv4.conf.default.accept_redirects = 0\n\n# Reject \"secure\" redirects as well (redirects from listed gateways only)\nnet.ipv4.conf.all.secure_redirects = 0\nnet.ipv4.conf.default.secure_redirects = 0\n\n# Do not forward traffic between interfaces (this is not a router)\nnet.ipv4.ip_forward = 0\n\n# Do not send ICMP redirects (only relevant on routers)\nnet.ipv4.conf.all.send_redirects = 0\nnet.ipv4.conf.default.send_redirects = 0\n\n# Protect against TIME_WAIT assassination (RFC 1337).\n# Drops RST packets for sockets in TIME_WAIT state.\nnet.ipv4.tcp_rfc1337 = 1\n\n\n# -----------------------------------------------------------------------------\n# 2. IPv6 Disablement\n# -----------------------------------------------------------------------------\n# Remove this section entirely if IPv6 is needed. If keeping IPv6, replace\n# these with appropriate security settings instead of wholesale disablement.\n\n# Disable IPv6 on all interfaces including loopback\nnet.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1\nnet.ipv6.conf.lo.disable_ipv6 = 1\n\n# The following are redundant when disable_ipv6 = 1 but are kept as a\n# defence-in-depth measure in case IPv6 is re-enabled without removing this file\nnet.ipv6.conf.default.router_solicitations = 0\nnet.ipv6.conf.default.accept_ra_rtr_pref = 0\nnet.ipv6.conf.default.accept_ra_pinfo = 0\nnet.ipv6.conf.default.accept_ra_defrtr = 0\nnet.ipv6.conf.default.autoconf = 0\nnet.ipv6.conf.default.dad_transmits = 0\nnet.ipv6.conf.default.max_addresses = 1\n\n\n# -----------------------------------------------------------------------------\n# 3. TCP/IP Performance Tuning\n# -----------------------------------------------------------------------------\n\n# Use BBR (Bottleneck Bandwidth and RTT) congestion control.\n# BBR significantly improves throughput in virtualised environments compared\n# to the default CUBIC algorithm. Requires the 'fq' packet scheduler below.\n# Available since kernel 4.9; present in Daedalus kernel 6.1.\nnet.core.default_qdisc = fq\nnet.ipv4.tcp_congestion_control = bbr\n\n# How long to wait before closing a socket in FIN_WAIT_2 (seconds).\n# Reducing from the 60s default frees ports faster under heavy connection churn.\n# Do not go below 15 on systems with load balancers or long-RTT clients.\nnet.ipv4.tcp_fin_timeout = 20\n\n# TCP keepalive: how long an idle connection is kept before probing begins.\n# 300s is a reasonable balance between detecting dead peers and keeping\n# long-lived idle connections (e.g. SSH, database pools) alive.\nnet.ipv4.tcp_keepalive_time = 300\n# Number of unacknowledged probes before the connection is declared dead\nnet.ipv4.tcp_keepalive_probes = 5\n# Interval between consecutive keepalive probes (seconds)\nnet.ipv4.tcp_keepalive_intvl = 15\n\n# Disable slow-start restart after an idle period.\n# Prevents throughput degradation for long-lived but bursty connections\n# (e.g. HTTP/2 keep-alive, gRPC). Recommended for most server workloads.\nnet.ipv4.tcp_slow_start_after_idle = 0\n\n# Allow TIME_WAIT sockets to be reused for new outbound connections.\n# Safe when tcp_timestamps is enabled (which it is below).\nnet.ipv4.tcp_tw_reuse = 1\n\n# Ephemeral port range for outbound connections.\n# Starting at 1024 (below 1024 requires CAP_NET_BIND_SERVICE anyway) gives\n# more ports. The previous value of 2000 wasted the 1024-1999 range.\nnet.ipv4.ip_local_port_range = 1024 65535\n\n# Maximum queue length for SYN requests awaiting completion of the 3-way\n# handshake. Increase for servers handling high connection rates.\nnet.ipv4.tcp_max_syn_backlog = 4096\n\n# Number of times a SYN-ACK is retransmitted for an incoming connection.\n# Reducing from the 5 default shortens the time a half-open connection\n# occupies resources before being abandoned.\nnet.ipv4.tcp_synack_retries = 2\n\n# Enable TCP timestamps (RFC 1323). Required for tcp_tw_reuse to be safe,\n# and improves RTT estimation accuracy. Disable only if you have strong\n# reasons (e.g. privacy concerns about timestamp-based OS fingerprinting).\nnet.ipv4.tcp_timestamps = 1\n\n# Enable window scaling (RFC 1323) to support receive windows > 65535 bytes.\n# Essential for performance over high-bandwidth or high-latency paths.\nnet.ipv4.tcp_window_scaling = 1\n\n# Enable TCP Fast Open for both outbound (1) and inbound (2) connections.\n# Value 3 = both. Reduces latency for repeated TCP connections by allowing\n# data in the SYN packet. Requires application support.\nnet.ipv4.tcp_fastopen = 3\n\n# Raise the conntrack table size if this VM runs iptables/nftables and\n# sees high connection volume. The default (~65k) is often too low.\n# Note: this parameter only takes effect if the nf_conntrack module is loaded.\nnet.netfilter.nf_conntrack_max = 262144\n\n# TCP SACK (Selective Acknowledgments) - leave enabled (default = 1).\n# SACK improves recovery from packet loss. The security argument for disabling\n# it (a 2019 kernel bug) has been patched in all current kernels.\nnet.ipv4.tcp_sack = 1\n\n\n# -----------------------------------------------------------------------------\n# 4. Network Buffer Sizes\n# -----------------------------------------------------------------------------\n\n# Per-socket TCP receive buffer: min, default, max (bytes)\n# 8 MB max gives headroom for high-BDP (bandwidth-delay product) paths\n# without wasting memory on idle sockets.\nnet.ipv4.tcp_rmem = 4096 131072 8388608\n\n# Per-socket TCP send buffer: min, default, max (bytes)\nnet.ipv4.tcp_wmem = 4096 131072 8388608\n\n# Global maximum socket receive/send buffer (bytes).\n# Must be >= the max values in tcp_rmem/tcp_wmem above.\nnet.core.rmem_max = 8388608\nnet.core.wmem_max = 8388608\n\n# Default socket receive/send buffer for non-TCP protocols (UDP etc.)\nnet.core.rmem_default = 262144\nnet.core.wmem_default = 262144\n\n# Maximum number of packets queued on the input side of a network interface\n# before the kernel starts dropping them. Increase for high-throughput NICs.\nnet.core.netdev_max_backlog = 16384\n\n# Maximum number of connections that can be queued for acceptance per socket.\n# nginx/Apache worker queues and similar services benefit from values >= 1024.\nnet.core.somaxconn = 1024\n\n\n# -----------------------------------------------------------------------------\n# 5. Virtual Memory\n# -----------------------------------------------------------------------------\n\n# Swappiness: how aggressively the kernel swaps anonymous memory to disk.\n# 0 = swap only to avoid OOM\n# 1 = swap as little as possible (original value; risky with limited RAM)\n# 10 = sensible minimum for VMs; avoids OOM kills while still preferring RAM\n# 60 = kernel default\n# For VMs with ample RAM and no swap, 1 is acceptable. For typical VMs,\n# 10 reduces the risk of unexpected OOM kills under memory pressure.\nvm.swappiness = 10\n\n# vfs_cache_pressure controls how eagerly the kernel reclaims memory used for\n# dentries and inodes. Default is 100 (neutral). Values > 100 reclaim more\n# aggressively; values < 100 keep more cache. 50 favours retaining the VFS\n# cache, which benefits workloads touching many files (web servers, git, etc.)\n# The original value of 200 was excessively aggressive for most workloads.\nvm.vfs_cache_pressure = 50\n\n# Minimum virtual address for mmap. Prevents null-pointer dereference exploits.\n# 4096 = one page. Some hardened profiles set this to 65536.\nvm.mmap_min_addr = 65536\n\n# Memory overcommit policy:\n# 0 = heuristic (default): the kernel uses an estimate of available memory\n# 1 = always allow overcommit (suitable for scientific/HPC workloads)\n# 2 = strict: never commit more than (RAM * overcommit_ratio / 100) + swap\n# Mode 0 is appropriate for general-purpose VMs.\n# overcommit_ratio is only meaningful with mode 2; leaving it at the default\n# (50) avoids confusion. The original config set ratio=0 with mode=0 which\n# had no effect but implied strict behaviour.\nvm.overcommit_memory = 0\n# vm.overcommit_ratio = 50 # Only relevant when overcommit_memory = 2\n\n\n# -----------------------------------------------------------------------------\n# 6. Filesystem & Process Limits\n# -----------------------------------------------------------------------------\n\n# Maximum number of open file descriptors system-wide.\n# Raise if running databases, high-concurrency servers, or many containers.\nfs.file-max = 2097152\n\n# Maximum number of concurrent asynchronous I/O operations system-wide.\n# Relevant for databases (PostgreSQL, MySQL) that use AIO heavily.\nfs.aio-max-nr = 1048576\n\n# Maximum number of inotify watches per user.\n# 65536 covers most use cases. Raise to 524288 if running IDEs, webpack,\n# lsyncd, or other file-watching tools that exhaust the default.\nfs.inotify.max_user_watches = 65536\n\n# Maximum number of inotify event queue entries per inotify instance.\n# The default (16384) is usually fine; raise if you see ENOSPC from inotify.\nfs.inotify.max_queued_events = 32768\n\n# Protect against hardlink attacks (e.g. TOCTOU in /tmp).\n# Prevents users from creating hardlinks to files they do not own.\nfs.protected_hardlinks = 1\n\n# Protect against symlink attacks in world-writable sticky directories.\nfs.protected_symlinks = 1\n\n# Protect against opening FIFOs in world-writable sticky directories\n# by users other than the owner. Available since kernel 4.19.\nfs.protected_fifos = 1\n\n# Prevent opening regular files not owned by the user in world-writable\n# sticky directories. Available since kernel 4.19.\n# 2 = also block writes; 1 = block opens by non-owners\nfs.protected_regular = 2\n\n# Disable core dumps for setuid programs. Prevents sensitive memory from\n# being written to disk by privilege-dropped processes.\nfs.suid_dumpable = 0\n\n\n# -----------------------------------------------------------------------------\n# 7. Kernel Security Hardening\n# -----------------------------------------------------------------------------\n\n# Full ASLR: randomise the base addresses of the stack, VDSO, and mmap regions.\n# 0 = off, 1 = partial, 2 = full. Always use 2 on production systems.\nkernel.randomize_va_space = 2\n\n# Restrict access to the kernel message ring buffer (dmesg) to root only.\n# Prevents unprivileged users from gleaning kernel addresses or error details.\nkernel.dmesg_restrict = 1\n\n# Hide kernel symbol addresses from unprivileged users.\n# 1 = hide from non-root, 2 = hide from all including root (CAP_SYSLOG bypasses).\n# kptr_restrict = 2 is the stricter option; use 1 if you need oops reports.\nkernel.kptr_restrict = 2\n\n# Restrict ptrace to parent processes (or root). Prevents one unprivileged\n# process from attaching to and inspecting another.\n# 1 = restricted (recommended), 0 = permissive (default), 3 = disabled entirely\n# Note: this is a Debian/Ubuntu-specific sysctl; it may be a no-op on some kernels.\nkernel.yama.ptrace_scope = 1\n\n# Suppress most kernel messages on the console. The four values are:\n# console_loglevel, default_message_loglevel, min_console_level, default_console_level\n# \"4 1 1 7\" shows KERN_WARNING and above on the console, which is appropriate\n# for production VMs to avoid log spam without silencing warnings.\nkernel.printk = 4 1 1 7\n\n# Redirect core dumps to /dev/null rather than writing them to disk.\n# Prevents potentially sensitive process memory from being captured.\n# To re-enable temporarily: sysctl -w kernel.core_pattern=core\nkernel.core_pattern = |/bin/false\n\n# Maximum PID value. The default (32768) can be exhausted by systems running\n# many threads or containers. 4194304 is the maximum on 64-bit kernels.\nkernel.pid_max = 4194304\n\n# Kernel module loading:\n# Uncomment the line below only on fully provisioned systems where you are\n# certain no additional modules will ever need to be loaded. It is\n# irreversible without a reboot.\n# kernel.modules_disabled = 1\n\n# =============================================================================\n# End of sysctl.conf\n# =============================================================================\n" }, { "path": "aegir/conf/version/barracuda-release.txt", "content": "BOA-5.9.1-dev\n" }, { "path": "aegir/conf/version/barracuda-version.txt", "content": "BOA-5.9.1-dev\n" }, { "path": "aegir/conf/version/octopus-release.txt", "content": "BOA-5.9.1-dev\n" }, { "path": "aegir/conf/version/octopus-version.txt", "content": "BOA-5.9.1-dev\n" }, { "path": "aegir/conf/version/release.txt", "content": "BOA-5.9.1-dev\n" }, { "path": "aegir/conf/version/version.txt", "content": "BOA-5.9.1-dev\n" }, { "path": "aegir/helpers/Gemfile.txt", "content": "source 'https://rubygems.org'\n\ngroup :development do\n\n # Sass, Compass and extensions.\n gem 'sass' # Sass.\n gem 'sass-globbing' # Import Sass files based on globbing pattern.\n gem 'compass' # Framework built on Sass.\n gem 'compass-validator' # So you can `compass validate`.\n gem 'compass-normalize' # Compass version of normalize.css.\n gem 'compass-rgbapng' # Turns rgba() into .png's for backwards compatibility.\n gem 'susy' # Susy grid framework.\n gem 'singularitygs' # Alternative to the Susy grid framework.\n gem 'toolkit' # Compass utility from the fabulous Snugug.\n gem 'breakpoint' # Manages CSS media queries.\n gem 'oily_png' # Faster Compass sprite generation.\n gem 'css_parser' # Helps `compass stats` output statistics.\n\n # Guard\n gem 'guard' # Guard event handler.\n gem 'guard-compass' # Compile on sass/scss change.\n gem 'guard-shell' # Run shell commands.\n gem 'guard-livereload' # Browser reload.\n gem 'yajl-ruby' # Faster JSON with LiveReload in the browser.\n\n # Dependency to prevent polling. Setup for multiple OS environments.\n # Optionally remove the lines not specific to your OS.\n # https://github.com/guard/guard#efficient-filesystem-handling\n gem 'rb-inotify', '~> 0.9', :require => false # Linux\n gem 'rb-fsevent', :require => false # Mac OSX\n gem 'rb-fchange', :require => false # Windows\n\nend\n" }, { "path": "aegir/helpers/apt-list-debian.txt", "content": "ftp.at.debian.org\nftp.au.debian.org\nftp.ba.debian.org\nftp.be.debian.org\nftp.bg.debian.org\nftp.br.debian.org\nftp.ca.debian.org\nftp.ch.debian.org\nftp.cz.debian.org\nftp.de.debian.org\nftp.debian.org\nftp.dk.debian.org\nftp.ee.debian.org\nftp.es.debian.org\nftp.fi.debian.org\nftp.fr.debian.org\nftp.gr.debian.org\nftp.hk.debian.org\nftp.hu.debian.org\nftp.ie.debian.org\nftp.it.debian.org\nftp.jp.debian.org\nftp.lt.debian.org\nftp.nl.debian.org\nftp.nz.debian.org\nftp.pl.debian.org\nftp.pt.debian.org\nftp.ro.debian.org\nftp.ru.debian.org\nftp.se.debian.org\nftp.sk.debian.org\nftp.th.debian.org\nftp.tr.debian.org\nftp.tw.debian.org\nftp.ua.debian.org\nftp.uk.debian.org\nftp.us.debian.org" }, { "path": "aegir/helpers/apt.conf.noi.dist", "content": "APT::Get::Assume-Yes \"true\";\nAPT::Get::Show-Upgraded \"true\";\nAPT::Get::Install-Recommends \"false\";\nAPT::Get::Install-Suggests \"false\";\nAPT::Quiet \"true\";\nDPkg::Options {\"--force-confnew\";\"--force-confmiss\";};\nDPkg::Pre-Install-Pkgs {\"/usr/sbin/dpkg-preconfigure --apt\";};\nDir::Etc::SourceList \"/etc/apt/sources.list\";\n" }, { "path": "aegir/helpers/apt.conf.noi.nrml", "content": "APT::Get::Assume-Yes \"true\";\nAPT::Get::Show-Upgraded \"true\";\nAPT::Get::Install-Recommends \"false\";\nAPT::Get::Install-Suggests \"false\";\nAPT::Quiet \"true\";\nDPkg::Options {\"--force-confdef\";\"--force-confmiss\";\"--force-confold\"};\nDPkg::Pre-Install-Pkgs {\"/usr/sbin/dpkg-preconfigure --apt\";};\nDir::Etc::SourceList \"/etc/apt/sources.list\";\n" }, { "path": "aegir/helpers/apt.conf.noninteractive", "content": "APT::Get::Assume-Yes \"true\";\nAPT::Get::Show-Upgraded \"true\";\nAPT::Get::Install-Recommends \"false\";\nAPT::Get::Install-Suggests \"false\";\nAPT::Quiet \"true\";\nDPkg::Options {\"--force-confdef\";\"--force-confmiss\";\"--force-confold\"};\nDPkg::Pre-Install-Pkgs {\"/usr/sbin/dpkg-preconfigure --apt\";};\nDir::Etc::SourceList \"/etc/apt/sources.list\";\n" }, { "path": "aegir/helpers/cf-simple-hook.sh", "content": "#!/usr/bin/env bash\n\n# Enable strict error handling for debugging only\n# set -euo pipefail\n\nfunction vault_upload {\n local DOMAIN=\"${1}\"\n local KEYFILE=\"${2}\"\n local CERTFILE=\"${3}\"\n local FULLCHAINFILE=\"${4}\"\n local CHAINFILE=\"${5}\"\n\n local MAIN=$(<<<\"${DOMAIN}\" grep -oP '[^\\.]+\\.[^\\.]+$')\n local HOST=\"${DOMAIN/.${MAIN}/}\"\n\n if [[ \"${HOST}\" == \"\" ]]; then\n local STORE=secret/dehydrated/${MAIN}/${HOST}\n else\n local STORE=secret/dehydrated/${MAIN}/wildcard\n fi\n\n local TOKEN=$(\n curl -s -X POST \\\n -d \"{\\\"role_id\\\":\\\"SNIP\\\",\\\"secret_id\\\":\\\"SNIP\\\"}\" \\\n https://vault.example.com/v1/auth/approle/login | jq -r .auth.client_token\n )\n\n curl -s -X POST \\\n -H \"X-Vault-Token: ${TOKEN}\" \\\n -d @<(\n jq -n \\\n --arg cert \"$(< ${CERTFILE} )\" \\\n --arg key \"$(< ${KEYFILE} )\" \\\n --arg chain \"$(< ${CHAINFILE} )\" \\\n --arg fullchain \"$(< ${FULLCHAINFILE} )\" \\\n --arg timestamp \"${TIMESTAMP}\" \\\n '{cert:$cert,key:$key,chain:$chain,fullchain:$fullchain}'\n ) \\\n https://vault.example.com/v1/${STORE}\n}\n\nfunction deploy_challenge {\n local DOMAIN=\"${1}\"\n local TOKEN_FILENAME=\"${2}\"\n local TOKEN_VALUE=\"${3}\"\n\n lexicon cloudflare create ${DOMAIN} TXT \\\n --name=\"_acme-challenge.${DOMAIN}.\" \\\n --content=\"${TOKEN_VALUE}\" \\\n --auth-username=\"devops@example.com\" \\\n --auth-token=\"SNIP\"\n\n sleep 10\n\n :\n}\n\nfunction clean_challenge {\n local DOMAIN=\"${1}\"\n local TOKEN_FILENAME=\"${2}\"\n local TOKEN_VALUE=\"${3}\"\n\n lexicon cloudflare delete ${DOMAIN} TXT \\\n --name=\"_acme-challenge.${DOMAIN}.\" \\\n --content=\"${TOKEN_VALUE}\" \\\n --auth-username=\"devops@example.com\" \\\n --auth-token=\"SNIP\"\n\n :\n}\n\nfunction deploy_cert {\n local DOMAIN=\"${1}\"\n local KEYFILE=\"${2}\"\n local CERTFILE=\"${3}\"\n local FULLCHAINFILE=\"${4}\"\n local CHAINFILE=\"${5}\"\n\n vault_upload \"${@}\"\n\n :\n}\n\nfunction unchanged_cert {\n local DOMAIN=\"${1}\"\n local KEYFILE=\"${2}\"\n local CERTFILE=\"${3}\"\n local FULLCHAINFILE=\"${4}\"\n local CHAINFILE=\"${5}\"\n\n vault_upload \"${@}\"\n\n :\n}\n\nfunction invalid_challenge() {\n local DOMAIN=\"${1}\"\n local RESPONSE=\"${2}\"\n\n :\n}\n\nexit_hook() {\n :\n}\n\nstartup_hook() {\n :\n}\n\nHANDLER=\"${1}\"\nshift\n\nif [ -n \"$(type -t ${HANDLER})\" ] && [ \"$(type -t ${HANDLER})\" = function ]; then\n $HANDLER \"${@}\"\nfi\n" }, { "path": "aegir/helpers/challenge-dns-email-hook.sh", "content": "#!/usr/bin/env bash\n\nfunction has_propagated {\n while [ \"$#\" -ge 2 ]; do\n local RECORD_NAME=\"${1}\"; shift\n local TOKEN_VALUE=\"${1}\"; shift\n if [ ${#AUTH_NS[@]} -eq 0 ]; then\n local RECORD_DOMAIN=$RECORD_NAME\n declare -a iAUTH_NS\n while [ -z \"$iAUTH_NS\" ]; do\n RECORD_DOMAIN=$(echo \"${RECORD_DOMAIN}\" | cut -d'.' -f 2-)\n iAUTH_NS=($(dig +short \"${RECORD_DOMAIN}\" IN CNAME))\n if [ -n \"$iAUTH_NS\" ]; then\n unset iAUTH_NS && declare -a iAUTH_NS\n continue\n fi\n iAUTH_NS=($(dig +short \"${RECORD_DOMAIN}\" IN NS))\n done\n else\n local iAUTH_NS=(\"${AUTH_NS[@]}\")\n fi\n for NS in \"${iAUTH_NS[@]}\"; do\n dig +short @\"${NS}\" \"${RECORD_NAME}\" IN TXT | grep -q \"\\\"${TOKEN_VALUE}\\\"\" || return 1\n done\n unset iAUTH_NS\n done\n return 0\n}\n\nfunction ocsp_update {\n local DOMAIN=\"${1}\" KEYFILE=\"${2}\" CERTFILE=\"${3}\" FULLCHAINFILE=\"${4}\" CHAINFILE=\"${5}\" TIMESTAMP=\"${6}\"\n\n # Get oscp response and shove it into a file, used for OCSP stapling.\n #\n # You only need this for old versions of of nginx that can't do this itself,\n # or if your server is behind a proxy (eg nginx can't do OCSP via HTTP proxy).\n #\n # Parameters:\n # - DOMAIN\n # The primary domain name, i.e. the certificate common\n # name (CN).\n # - KEYFILE\n # The path of the file containing the private key.\n # - CERTFILE\n # The path of the file containing the signed certificate.\n # - FULLCHAINFILE\n # The path of the file containing the full certificate chain.\n # - CHAINFILE\n # The path of the file containing the intermediate certificate(s).\n # - TIMESTAMP\n # Timestamp when the specified certificate was created.\n\n if [ -n \"${OCSP_RESPONSE_FILE}\" ]; then\n\n if [ -z \"${OCSP_HOST}\" ]; then\n OCSP_HOST=\"${http_proxy}\" # eg http://foo.bar:3128/\n\t # strip protocol and path:\n\t OCSP_HOST=\"$(echo \"$OCSP_HOST\" | sed -E 's/(\\w+:\\/\\/)((\\w|\\.)+:[0-9]+?)\\/?.*/\\2/')\" # eg foo.bar:3128\n fi\n\n if [ -n \"$VERBOSE\" ]; then\n echo \"OCSP_HOST: $OCSP_HOST\"\n echo \"http_proxy: $http_proxy\"\n echo \"OCSP_RESPONSE_FILE: $OCSP_RESPONSE_FILE\"\n echo \"CHAINFILE: $CHAINFILE\"\n echo \"CERTFILE: $CERTFILE\"\n echo \"command: openssl ocsp -noverify -no_nonce -respout \\\"${OCSP_RESPONSE_FILE}\\\" -issuer \\\"${CHAINFILE}\\\" -cert \\\"${CERTFILE}\\\" -host \\\"${OCSP_HOST}\\\" -path \\\"\\$(openssl x509 -noout -ocsp_uri -in \\\"${CERTFILE}\\\")\\\" -CApath \\\"/etc/ssl/certs\\\"\"\n fi\n\n if [ -n \"${OCSP_HOST}\" ]; then\n openssl ocsp -noverify -no_nonce -respout \"${OCSP_RESPONSE_FILE}\" -issuer \"${CHAINFILE}\" -cert \"${CERTFILE}\" -host \"${OCSP_HOST}\" -path \"$(openssl x509 -noout -ocsp_uri -in \"${CERTFILE}\")\" -CApath \"/etc/ssl/certs\"\n else\n openssl ocsp -noverify -no_nonce -respout \"${OCSP_RESPONSE_FILE}\" -issuer \"${CHAINFILE}\" -cert \"${CERTFILE}\" -path \"$(openssl x509 -noout -ocsp_uri -in \"${CERTFILE}\")\" -CApath \"/etc/ssl/certs\"\n fi\n fi\n}\n\nfunction oscp_update {\n #oops :)\n ocsp_update \"$@\"\n}\n\nfunction deploy_challenge {\n local RECORDS=()\n RECIPIENT=${RECIPIENT:-$(id -u -n)}\n local FIRSTDOMAIN=\"${1}\"\n local SUBJECT=\"Let's Encrypt certificate renewal\"\n while (( \"$#\" >= 3 )); do\n local DOMAIN=\"${1}\"; shift\n local TOKEN_FILENAME=\"${1}\"; shift\n local TOKEN_VALUE=\"${1}\"; shift\n\n # This hook is called once for every domain that needs to be\n # validated, including any alternative names you may have listed.\n #\n # Parameters:\n # - DOMAIN\n # The domain name (CN or subject alternative name) being\n # validated.\n # - TOKEN_FILENAME\n # The name of the file containing the token to be served for HTTP\n # validation. Should be served by your web server as\n # /.well-known/acme-challenge/${TOKEN_FILENAME}.\n # - TOKEN_VALUE\n # The token value that needs to be served for validation. For DNS\n # validation, this is what you want to put in the _acme-challenge\n # TXT record. For HTTP validation it is the value that is expected\n # be found in the $TOKEN_FILENAME file.\n\n RECORD_NAME=\"_acme-challenge.${DOMAIN}\"\n RECORDS+=( ${RECORD_NAME} )\n RECORDS+=( ${TOKEN_VALUE} )\n done\n\n read -d '' MESSAGE <= 3 )); do\n local DOMAIN=\"${1}\"; shift\n local TOKEN_FILENAME=\"${1}\"; shift\n local TOKEN_VALUE=\"${1}\"; shift\n\n # This hook is called after attempting to validate each domain,\n # whether or not validation was successful. Here you can delete\n # files or DNS records that are no longer needed.\n #\n # The parameters are the same as for deploy_challenge.\n\n RECORD_NAME=\"_acme-challenge.${DOMAIN}\"\n RECORDS+=( ${RECORD_NAME} )\n RECORDS+=( ${TOKEN_VALUE} )\n done\n\n read -d '' MESSAGE <= 2 )); do\n MESSAGE=\"$(printf '%s\\n %s. IN TXT %s\\n' \"$MESSAGE\" \"${RECORDS[0]}\" \"${RECORDS[1]}\")\"\n RECORDS=( \"${RECORDS[@]:2}\" )\n done\n\n echo \"$MESSAGE\" | s-nail -s \"$SUBJECT\" \"$RECIPIENT\"\n\n}\n\nfunction deploy_cert {\n local DOMAIN=\"${1}\" KEYFILE=\"${2}\" CERTFILE=\"${3}\" FULLCHAINFILE=\"${4}\" CHAINFILE=\"${5}\" TIMESTAMP=\"${6}\"\n\n # This hook is called once for each certificate that has been\n # produced. Here you might, for instance, copy your new certificates\n # to service-specific locations and reload the service.\n #\n # Parameters:\n # - DOMAIN\n # The primary domain name, i.e. the certificate common\n # name (CN).\n # - KEYFILE\n # The path of the file containing the private key.\n # - CERTFILE\n # The path of the file containing the signed certificate.\n # - FULLCHAINFILE\n # The path of the file containing the full certificate chain.\n # - CHAINFILE\n # The path of the file containing the intermediate certificate(s).\n # - TIMESTAMP\n # Timestamp when the specified certificate was created.\n\n oscp_update \"$@\"\n}\n\nfunction unchanged_cert {\n local DOMAIN=\"${1}\" KEYFILE=\"${2}\" CERTFILE=\"${3}\" FULLCHAINFILE=\"${4}\" CHAINFILE=\"${5}\"\n\n # This hook is called once for each certificate that is still\n # valid and therefore wasn't reissued.\n #\n # Parameters:\n # - DOMAIN\n # The primary domain name, i.e. the certificate common\n # name (CN).\n # - KEYFILE\n # The path of the file containing the private key.\n # - CERTFILE\n # The path of the file containing the signed certificate.\n # - FULLCHAINFILE\n # The path of the file containing the full certificate chain.\n # - CHAINFILE\n # The path of the file containing the intermediate certificate(s).\n\n oscp_update \"$@\"\n}\n\nHANDLER=$1; shift\nif [[ \"${HANDLER}\" =~ ^(deploy_challenge|clean_challenge|deploy_cert|unchanged_cert)$ ]]; then\n \"$HANDLER\" \"$@\"\nfi\n" }, { "path": "aegir/helpers/dehydrated", "content": "#!/usr/bin/env bash\n\n# dehydrated by lukas2511\n# Source: https://dehydrated.io\n#\n# This script is licensed under The MIT License (see LICENSE for more information).\n\nset -e\nset -u\nset -o pipefail\n[[ -n \"${ZSH_VERSION:-}\" ]] && set -o SH_WORD_SPLIT && set +o FUNCTION_ARGZERO && set -o NULL_GLOB && set -o noglob\n[[ -z \"${ZSH_VERSION:-}\" ]] && shopt -s nullglob && set -f\n\numask 077 # paranoid umask, we're creating private keys\n\n# Close weird external file descriptors\nexec 3>&-\nexec 4>&-\n\nVERSION=\"0.7.3\"\n\n# Find directory in which this script is stored by traversing all symbolic links\nSOURCE=\"${0}\"\nwhile [ -h \"$SOURCE\" ]; do # resolve $SOURCE until the file is no longer a symlink\n DIR=\"$( cd -P \"$( dirname \"$SOURCE\" )\" && pwd )\"\n SOURCE=\"$(readlink \"$SOURCE\")\"\n [[ $SOURCE != /* ]] && SOURCE=\"$DIR/$SOURCE\" # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located\ndone\nSCRIPTDIR=\"$( cd -P \"$( dirname \"$SOURCE\" )\" && pwd )\"\n\nBASEDIR=\"${SCRIPTDIR}\"\nORIGARGS=(\"${@}\")\n\nnoglob_set() {\n if [[ -n \"${ZSH_VERSION:-}\" ]]; then\n set +o noglob\n else\n set +f\n fi\n}\n\nnoglob_clear() {\n if [[ -n \"${ZSH_VERSION:-}\" ]]; then\n set -o noglob\n else\n set -f\n fi\n}\n\n# Generate json.sh path matching string\njson_path() {\n if [ ! \"${1}\" = \"-p\" ]; then\n printf '\"%s\"' \"${1}\"\n else\n printf '%s' \"${2}\"\n fi\n}\n\n# Get string value from json dictionary\nget_json_string_value() {\n local filter\n filter=\"$(printf 's/.*\\[%s\\][[:space:]]*\"\\([^\"]*\\)\"/\\\\1/p' \"$(json_path \"${1:-}\" \"${2:-}\")\")\"\n sed -n \"${filter}\"\n}\n\n# Get array values from json dictionary\nget_json_array_values() {\n grep -E '^\\['\"$(json_path \"${1:-}\" \"${2:-}\")\"',[0-9]*\\]' | sed -e 's/\\[[^\\]*\\][[:space:]]*//g' -e 's/^\"//' -e 's/\"$//'\n}\n\n# Get sub-dictionary from json\nget_json_dict_value() {\n local filter\n filter=\"$(printf 's/.*\\[%s\\][[:space:]]*\\(.*\\)/\\\\1/p' \"$(json_path \"${1:-}\" \"${2:-}\")\")\"\n sed -n \"${filter}\" | jsonsh\n}\n\n# Get integer value from json\nget_json_int_value() {\n local filter\n filter=\"$(printf 's/.*\\[%s\\][[:space:]]*\\([^\"]*\\)/\\\\1/p' \"$(json_path \"${1:-}\" \"${2:-}\")\")\"\n sed -n \"${filter}\"\n}\n\n# Get boolean value from json\nget_json_bool_value() {\n local filter\n filter=\"$(printf 's/.*\\[%s\\][[:space:]]*\\([^\"]*\\)/\\\\1/p' \"$(json_path \"${1:-}\" \"${2:-}\")\")\"\n sed -n \"${filter}\"\n}\n\n# JSON.sh JSON-parser\n# Modified from https://github.com/dominictarr/JSON.sh\n# Original Copyright (c) 2011 Dominic Tarr\n# Licensed under The MIT License\njsonsh() {\n\n throw() {\n echo \"$*\" >&2\n exit 1\n }\n\n awk_egrep () {\n local pattern_string=$1\n\n awk '{\n while ($0) {\n start=match($0, pattern);\n token=substr($0, start, RLENGTH);\n print token;\n $0=substr($0, start+RLENGTH);\n }\n }' pattern=\"$pattern_string\"\n }\n\n tokenize () {\n local GREP\n local ESCAPE\n local CHAR\n\n if echo \"test string\" | grep -Eao --color=never \"test\" >/dev/null 2>&1\n then\n GREP='grep -Eao --color=never'\n else\n GREP='grep -Eao'\n fi\n\n # shellcheck disable=SC2196\n if echo \"test string\" | grep -Eao \"test\" >/dev/null 2>&1\n then\n ESCAPE='(\\\\[^u[:cntrl:]]|\\\\u[0-9a-fA-F]{4})'\n CHAR='[^[:cntrl:]\"\\\\]'\n else\n GREP=awk_egrep\n ESCAPE='(\\\\\\\\[^u[:cntrl:]]|\\\\u[0-9a-fA-F]{4})'\n CHAR='[^[:cntrl:]\"\\\\\\\\]'\n fi\n\n local STRING=\"\\\"$CHAR*($ESCAPE$CHAR*)*\\\"\"\n local NUMBER='-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?'\n local KEYWORD='null|false|true'\n local SPACE='[[:space:]]+'\n\n # Force zsh to expand $A into multiple words\n local is_wordsplit_disabled\n is_wordsplit_disabled=\"$(unsetopt 2>/dev/null | grep -c '^shwordsplit$' || true)\"\n if [ \"${is_wordsplit_disabled}\" != \"0\" ]; then setopt shwordsplit; fi\n $GREP \"$STRING|$NUMBER|$KEYWORD|$SPACE|.\" | grep -Ev \"^$SPACE$\"\n if [ \"${is_wordsplit_disabled}\" != \"0\" ]; then unsetopt shwordsplit; fi\n }\n\n parse_array () {\n local index=0\n local ary=''\n read -r token\n case \"$token\" in\n ']') ;;\n *)\n while :\n do\n parse_value \"$1\" \"$index\"\n index=$((index+1))\n ary=\"$ary\"\"$value\"\n read -r token\n case \"$token\" in\n ']') break ;;\n ',') ary=\"$ary,\" ;;\n *) throw \"EXPECTED , or ] GOT ${token:-EOF}\" ;;\n esac\n read -r token\n done\n ;;\n esac\n value=$(printf '[%s]' \"$ary\") || value=\n :\n }\n\n parse_object () {\n local key\n local obj=''\n read -r token\n case \"$token\" in\n '}') ;;\n *)\n while :\n do\n case \"$token\" in\n '\"'*'\"') key=$token ;;\n *) throw \"EXPECTED string GOT ${token:-EOF}\" ;;\n esac\n read -r token\n case \"$token\" in\n ':') ;;\n *) throw \"EXPECTED : GOT ${token:-EOF}\" ;;\n esac\n read -r token\n parse_value \"$1\" \"$key\"\n obj=\"$obj$key:$value\"\n read -r token\n case \"$token\" in\n '}') break ;;\n ',') obj=\"$obj,\" ;;\n *) throw \"EXPECTED , or } GOT ${token:-EOF}\" ;;\n esac\n read -r token\n done\n ;;\n esac\n value=$(printf '{%s}' \"$obj\") || value=\n :\n }\n\n parse_value () {\n local jpath=\"${1:+$1,}${2:-}\"\n case \"$token\" in\n '{') parse_object \"$jpath\" ;;\n '[') parse_array \"$jpath\" ;;\n # At this point, the only valid single-character tokens are digits.\n ''|[!0-9]) throw \"EXPECTED value GOT ${token:-EOF}\" ;;\n *) value=\"${token//\\\\\\///}\"\n # replace solidus (\"\\/\") in json strings with normalized value: \"/\"\n ;;\n esac\n [ \"$value\" = '' ] && return\n [ -z \"$jpath\" ] && return # do not print head\n\n printf \"[%s]\\t%s\\n\" \"$jpath\" \"$value\"\n :\n }\n\n parse () {\n read -r token\n parse_value\n read -r token || true\n case \"$token\" in\n '') ;;\n *) throw \"EXPECTED EOF GOT $token\" ;;\n esac\n }\n\n tokenize | parse\n}\n\n# Convert IP addresses to their reverse dns variants.\n# Used for ALPN certs as validation for IPs uses this in SNI since IPs aren't allowed there.\nip_to_ptr() {\n ip=\"$(cat)\"\n if [[ \"${ip}\" =~ : ]]; then\n printf \"%sip6.arpa\" \"$(printf \"%s\" \"${ip}\" | awk -F: 'BEGIN {OFS=\"\"; }{addCount = 9 - NF; for(i=1; i<=NF;i++){if(length($i) == 0){ for(j=1;j<=addCount;j++){$i = ($i \"0000\");} } else { $i = substr((\"0000\" $i), length($i)+5-4);}}; print}' | rev | sed -e \"s/./&./g\")\"\n else\n printf \"%s.in-addr.arpa\" \"$(printf \"%s\" \"${ip}\" | awk -F. '{print $4\".\"$3\".\" $2\".\"$1}')\"\n fi\n}\n\n# IPv6 conversion helpers\nipv6_expand() {\n # expand double colons until 8 segments exist\n # replace remaining double colon with single colon\n # pad all segments to 4 characters with leading zeros\n _sed \\\n -e ':addsegs; /^([^:]*:){0,7}[^:]*$/{ s/::/:0000::/g; t addsegs; }' \\\n -e 's/::/:/' \\\n -e ':padsegs; s/(:|^)([^:]{0,3})(:|$)/\\10\\2\\3/g; t padsegs;'\n}\n\nipv6_shorten() {\n # remove leading zeros from all segments\n # find the longest matching run of zeros and replace with double colons (this could be prettier..)\n _sed \\\n -e ':unpadsegs;/(^|:)0/{s/(^|:)0([^:])/\\1\\2/g;t unpadsegs;}' \\\n -e '/(^|:)(0(:|$)){8}/{ s/(^|:)(0(:|$)){8}/::/; t end; }' \\\n -e '/(^|:)(0(:|$)){7}/{ s/(^|:)(0(:|$)){7}/::/; t end; }' \\\n -e '/(^|:)(0(:|$)){6}/{ s/(^|:)(0(:|$)){6}/::/; t end; }' \\\n -e '/(^|:)(0(:|$)){5}/{ s/(^|:)(0(:|$)){5}/::/; t end; }' \\\n -e '/(^|:)(0(:|$)){4}/{ s/(^|:)(0(:|$)){4}/::/; t end; }' \\\n -e '/(^|:)(0(:|$)){3}/{ s/(^|:)(0(:|$)){3}/::/; t end; }' \\\n -e '/(^|:)(0(:|$)){2}/{ s/(^|:)(0(:|$)){2}/::/; t end; }' \\\n -e ':end'\n}\n\nipv6_normalize() {\n for domain in $(cat); do\n if [[ \"${domain}\" =~ : ]]; then\n printf \"%s\" \"${domain}\" | ipv6_expand | ipv6_shorten\n else\n printf \"%s\" \"${domain}\"\n fi\n printf \" \"\n done | sed -e 's/ $//'\n}\n\n# Create (identifiable) temporary files\n_mktemp() {\n mktemp \"${TMPDIR:-/tmp}/dehydrated-XXXXXX\"\n}\n\n# Check for script dependencies\ncheck_dependencies() {\n # look for required binaries\n for binary in grep mktemp diff sed awk curl cut head tail hexdump; do\n bin_path=\"$(command -v \"${binary}\" 2>/dev/null)\" || _exiterr \"This script requires ${binary}.\"\n [[ -x \"${bin_path}\" ]] || _exiterr \"${binary} found in PATH but it's not executable\"\n done\n\n # just execute some dummy and/or version commands to see if required tools are actually usable\n \"${OPENSSL}\" version > /dev/null 2>&1 || _exiterr \"This script requires an openssl binary.\"\n _sed \"\" < /dev/null > /dev/null 2>&1 || _exiterr \"This script requires sed with support for extended (modern) regular expressions.\"\n\n # curl returns with an error code in some ancient versions so we have to catch that\n set +e\n CURL_VERSION=\"$(curl -V 2>&1 | head -n1 | awk '{print $2}')\"\n set -e\n}\n\nstore_configvars() {\n __KEY_ALGO=\"${KEY_ALGO}\"\n __OCSP_MUST_STAPLE=\"${OCSP_MUST_STAPLE}\"\n __OCSP_FETCH=\"${OCSP_FETCH}\"\n __OCSP_DAYS=\"${OCSP_DAYS}\"\n __PRIVATE_KEY_RENEW=\"${PRIVATE_KEY_RENEW}\"\n __PRIVATE_KEY_ROLLOVER=\"${PRIVATE_KEY_ROLLOVER}\"\n __KEYSIZE=\"${KEYSIZE}\"\n __CHALLENGETYPE=\"${CHALLENGETYPE}\"\n __HOOK=\"${HOOK}\"\n __PREFERRED_CHAIN=\"${PREFERRED_CHAIN}\"\n __WELLKNOWN=\"${WELLKNOWN}\"\n __HOOK_CHAIN=\"${HOOK_CHAIN}\"\n __OPENSSL_CNF=\"${OPENSSL_CNF}\"\n __RENEW_DAYS=\"${RENEW_DAYS}\"\n __IP_VERSION=\"${IP_VERSION}\"\n __ACME_PROFILE=\"${ACME_PROFILE}\"\n __ORDER_TIMEOUT=${ORDER_TIMEOUT}\n __VALIDATION_TIMEOUT=${VALIDATION_TIMEOUT}\n __KEEP_GOING=${KEEP_GOING}\n}\n\nreset_configvars() {\n KEY_ALGO=\"${__KEY_ALGO}\"\n OCSP_MUST_STAPLE=\"${__OCSP_MUST_STAPLE}\"\n OCSP_FETCH=\"${__OCSP_FETCH}\"\n OCSP_DAYS=\"${__OCSP_DAYS}\"\n PRIVATE_KEY_RENEW=\"${__PRIVATE_KEY_RENEW}\"\n PRIVATE_KEY_ROLLOVER=\"${__PRIVATE_KEY_ROLLOVER}\"\n KEYSIZE=\"${__KEYSIZE}\"\n CHALLENGETYPE=\"${__CHALLENGETYPE}\"\n HOOK=\"${__HOOK}\"\n PREFERRED_CHAIN=\"${__PREFERRED_CHAIN}\"\n WELLKNOWN=\"${__WELLKNOWN}\"\n HOOK_CHAIN=\"${__HOOK_CHAIN}\"\n OPENSSL_CNF=\"${__OPENSSL_CNF}\"\n RENEW_DAYS=\"${__RENEW_DAYS}\"\n IP_VERSION=\"${__IP_VERSION}\"\n ACME_PROFILE=\"${__ACME_PROFILE}\"\n ORDER_TIMEOUT=${__ORDER_TIMEOUT}\n VALIDATION_TIMEOUT=${__VALIDATION_TIMEOUT}\n KEEP_GOING=\"${__KEEP_GOING}\"\n}\n\nhookscript_bricker_hook() {\n # Hook scripts should ignore any hooks they don't know.\n # Calling a random hook to make this clear to the hook script authors...\n if [[ -n \"${HOOK}\" ]]; then\n \"${HOOK}\" \"this_hookscript_is_broken__dehydrated_is_working_fine__please_ignore_unknown_hooks_in_your_script\" || _exiterr \"Please check your hook script, it should exit cleanly without doing anything on unknown/new hooks.\"\n fi\n}\n\n# verify configuration values\nverify_config() {\n [[ \"${CHALLENGETYPE}\" == \"http-01\" || \"${CHALLENGETYPE}\" == \"dns-01\" || \"${CHALLENGETYPE}\" == \"dns-persist-01\" || \"${CHALLENGETYPE}\" == \"tls-alpn-01\" ]] || _exiterr \"Unknown challenge type ${CHALLENGETYPE}... cannot continue.\"\n if [[ \"${COMMAND:-}\" =~ sign_domains|sign_csr ]]; then\n if [[ \"${CHALLENGETYPE}\" = \"dns-01\" ]] && [[ -z \"${HOOK}\" ]]; then\n _exiterr \"Challenge type dns-01 needs a hook script for deployment... cannot continue.\"\n fi\n if [[ \"${CHALLENGETYPE}\" = \"http-01\" ]] && [[ ! -d \"${WELLKNOWN}\" ]]; then\n _exiterr \"WELLKNOWN directory doesn't exist, please create ${WELLKNOWN} and set appropriate permissions.\"\n fi\n fi\n [[ \"${KEY_ALGO}\" == \"rsa\" || \"${KEY_ALGO}\" == \"prime256v1\" || \"${KEY_ALGO}\" == \"secp384r1\" || \"${KEY_ALGO}\" == \"secp521r1\" ]] || _exiterr \"Unknown public key algorithm ${KEY_ALGO}... cannot continue.\"\n if [[ -n \"${IP_VERSION}\" ]]; then\n [[ \"${IP_VERSION}\" = \"4\" || \"${IP_VERSION}\" = \"6\" ]] || _exiterr \"Unknown IP version ${IP_VERSION}... cannot continue.\"\n fi\n [[ \"${API}\" == \"auto\" || \"${API}\" == \"1\" || \"${API}\" == \"2\" ]] || _exiterr \"Unsupported API version defined in config: ${API}\"\n [[ \"${OCSP_DAYS}\" =~ ^[0-9]+$ ]] || _exiterr \"OCSP_DAYS must be a number\"\n [[ \"${ORDER_TIMEOUT}\" =~ ^[0-9]+$ ]] || _exiterr \"ORDER_TIMEOUT must be a number\"\n [[ \"${VALIDATION_TIMEOUT}\" =~ ^[0-9]+$ ]] || _exiterr \"VALIDATION_TIMEOUT must be a number\"\n}\n\n# Setup default config values, search for and load configuration files\nload_config() {\n # Check for config in various locations\n if [[ -z \"${CONFIG:-}\" ]]; then\n for check_config in \"/etc/dehydrated\" \"/usr/local/etc/dehydrated\" \"${PWD}\" \"${SCRIPTDIR}\"; do\n if [[ -f \"${check_config}/config\" ]]; then\n BASEDIR=\"${check_config}\"\n CONFIG=\"${check_config}/config\"\n break\n fi\n done\n fi\n\n # Preset\n CA_ZEROSSL=\"https://acme.zerossl.com/v2/DV90\"\n CA_LETSENCRYPT=\"https://acme-v02.api.letsencrypt.org/directory\"\n CA_LETSENCRYPT_TEST=\"https://acme-staging-v02.api.letsencrypt.org/directory\"\n CA_BUYPASS=\"https://api.buypass.com/acme/directory\"\n CA_BUYPASS_TEST=\"https://api.test4.buypass.no/acme/directory\"\n CA_GOOGLE=\"https://dv.acme-v02.api.pki.goog/directory\"\n CA_GOOGLE_TEST=\"https://dv.acme-v02.test-api.pki.goog/directory\"\n\n # Default values\n CA=\"letsencrypt\"\n OLDCA=\n CERTDIR=\n ALPNCERTDIR=\n ACCOUNTDIR=\n ACCOUNT_KEYSIZE=\"4096\"\n ACCOUNT_KEY_ALGO=rsa\n CHALLENGETYPE=\"http-01\"\n CONFIG_D=\n CURL_OPTS=\n DOMAINS_D=\n DOMAINS_TXT=\n HOOK=\n PREFERRED_CHAIN=\n HOOK_CHAIN=\"no\"\n RENEW_DAYS=\"69\"\n KEYSIZE=\"4096\"\n WELLKNOWN=\n PRIVATE_KEY_RENEW=\"yes\"\n PRIVATE_KEY_ROLLOVER=\"no\"\n KEY_ALGO=secp384r1\n OPENSSL=openssl\n OPENSSL_CNF=\n CONTACT_EMAIL=\n LOCKFILE=\n OCSP_MUST_STAPLE=\"no\"\n OCSP_FETCH=\"no\"\n OCSP_DAYS=5\n IP_VERSION=\n CHAINCACHE=\n AUTO_CLEANUP=\"no\"\n AUTO_CLEANUP_DELETE=\"no\"\n DEHYDRATED_USER=\n DEHYDRATED_GROUP=\n API=2\n ACME_PROFILE=\"\"\n ORDER_TIMEOUT=0\n VALIDATION_TIMEOUT=0\n KEEP_GOING=\"no\"\n\n if [[ -z \"${CONFIG:-}\" ]]; then\n echo \"#\" >&2\n echo \"# BOA auto-config mode\" >&2\n echo \"#\" >&2\n elif [[ -f \"${CONFIG}\" ]]; then\n echo \"# INFO: Using main config file ${CONFIG}\"\n BASEDIR=\"$(dirname \"${CONFIG}\")\"\n # shellcheck disable=SC1090\n . \"${CONFIG}\"\n else\n _exiterr \"Specified config file doesn't exist.\"\n fi\n\n if [[ -n \"${CONFIG_D}\" ]]; then\n if [[ ! -d \"${CONFIG_D}\" ]]; then\n _exiterr \"The path ${CONFIG_D} specified for CONFIG_D does not point to a directory.\"\n fi\n\n # Allow globbing\n noglob_set\n\n for check_config_d in \"${CONFIG_D}\"/*.sh; do\n if [[ -f \"${check_config_d}\" ]] && [[ -r \"${check_config_d}\" ]]; then\n echo \"# INFO: Using additional config file ${check_config_d}\"\n # shellcheck disable=SC1090\n . \"${check_config_d}\"\n else\n _exiterr \"Specified additional config ${check_config_d} is not readable or not a file at all.\"\n fi\n done\n\n # Disable globbing\n noglob_clear\n fi\n\n # Check for missing dependencies\n check_dependencies\n\n has_sudo() {\n command -v sudo > /dev/null 2>&1 || _exiterr \"DEHYDRATED_USER set but sudo not available. Please install sudo.\"\n }\n\n # Check if we are running & are allowed to run as root\n if [[ -n \"$DEHYDRATED_USER\" ]]; then\n command -v getent > /dev/null 2>&1 || _exiterr \"DEHYDRATED_USER set but getent not available. Please install getent.\"\n\n TARGET_UID=\"$(getent passwd \"${DEHYDRATED_USER}\" | cut -d':' -f3)\" || _exiterr \"DEHYDRATED_USER ${DEHYDRATED_USER} is invalid\"\n if [[ -z \"${DEHYDRATED_GROUP}\" ]]; then\n if [[ \"${EUID}\" != \"${TARGET_UID}\" ]]; then\n echo \"# INFO: Running $0 as ${DEHYDRATED_USER}\"\n has_sudo && exec sudo -u \"${DEHYDRATED_USER}\" \"${0}\" \"${ORIGARGS[@]}\"\n fi\n else\n TARGET_GID=\"$(getent group \"${DEHYDRATED_GROUP}\" | cut -d':' -f3)\" || _exiterr \"DEHYDRATED_GROUP ${DEHYDRATED_GROUP} is invalid\"\n if [[ -z \"${EGID:-}\" ]]; then\n command -v id > /dev/null 2>&1 || _exiterr \"DEHYDRATED_GROUP set, don't know current gid and 'id' not available... Please provide 'id' binary.\"\n EGID=\"$(id -g)\"\n fi\n if [[ \"${EUID}\" != \"${TARGET_UID}\" ]] || [[ \"${EGID}\" != \"${TARGET_GID}\" ]]; then\n echo \"# INFO: Running $0 as ${DEHYDRATED_USER}/${DEHYDRATED_GROUP}\"\n has_sudo && exec sudo -u \"${DEHYDRATED_USER}\" -g \"${DEHYDRATED_GROUP}\" \"${0}\" \"${ORIGARGS[@]}\"\n fi\n fi\n elif [[ -n \"${DEHYDRATED_GROUP}\" ]]; then\n _exiterr \"DEHYDRATED_GROUP can only be used in combination with DEHYDRATED_USER.\"\n fi\n\n # Remove slash from end of BASEDIR. Mostly for cleaner outputs, doesn't change functionality.\n [[ \"$BASEDIR\" != \"/\" ]] && BASEDIR=\"${BASEDIR%%/}\"\n\n # Check BASEDIR and set default variables\n [[ -d \"${BASEDIR}\" ]] || _exiterr \"BASEDIR does not exist: ${BASEDIR}\"\n\n # Check for ca cli parameter\n if [ -n \"${PARAM_CA:-}\" ]; then\n CA=\"${PARAM_CA}\"\n fi\n\n # Preset CAs\n if [ \"${CA}\" = \"letsencrypt\" ]; then\n CA=\"${CA_LETSENCRYPT}\"\n elif [ \"${CA}\" = \"letsencrypt-test\" ]; then\n CA=\"${CA_LETSENCRYPT_TEST}\"\n elif [ \"${CA}\" = \"zerossl\" ]; then\n CA=\"${CA_ZEROSSL}\"\n elif [ \"${CA}\" = \"buypass\" ]; then\n CA=\"${CA_BUYPASS}\"\n elif [ \"${CA}\" = \"buypass-test\" ]; then\n CA=\"${CA_BUYPASS_TEST}\"\n elif [ \"${CA}\" = \"google\" ]; then\n CA=\"${CA_GOOGLE}\"\n elif [ \"${CA}\" = \"google-test\" ]; then\n CA=\"${CA_GOOGLE_TEST}\"\n fi\n\n if [[ -z \"${OLDCA}\" ]] && [[ \"${CA}\" = \"https://acme-v02.api.letsencrypt.org/directory\" ]]; then\n OLDCA=\"https://acme-v01.api.letsencrypt.org/directory\"\n fi\n\n # Create new account directory or symlink to account directory from old CA\n # dev note: keep in mind that because of the use of 'echo' instead of 'printf' or\n # similar there is a newline encoded in the directory name. not going to fix this\n # since it's a non-issue and trying to fix existing installations would be too much\n # trouble\n CAHASH=\"$(echo \"${CA}\" | urlbase64)\"\n [[ -z \"${ACCOUNTDIR}\" ]] && ACCOUNTDIR=\"${BASEDIR}/accounts\"\n if [[ ! -e \"${ACCOUNTDIR}/${CAHASH}\" ]]; then\n OLDCAHASH=\"$(echo \"${OLDCA}\" | urlbase64)\"\n mkdir -p \"${ACCOUNTDIR}\"\n if [[ -n \"${OLDCA}\" ]] && [[ -e \"${ACCOUNTDIR}/${OLDCAHASH}\" ]]; then\n echo \"! Reusing account from ${OLDCA}\"\n ln -s \"${OLDCAHASH}\" \"${ACCOUNTDIR}/${CAHASH}\"\n else\n mkdir \"${ACCOUNTDIR}/${CAHASH}\"\n fi\n fi\n\n # shellcheck disable=SC1090\n [[ -f \"${ACCOUNTDIR}/${CAHASH}/config\" ]] && . \"${ACCOUNTDIR}/${CAHASH}/config\"\n ACCOUNT_KEY=\"${ACCOUNTDIR}/${CAHASH}/account_key.pem\"\n ACCOUNT_KEY_JSON=\"${ACCOUNTDIR}/${CAHASH}/registration_info.json\"\n ACCOUNT_ID_JSON=\"${ACCOUNTDIR}/${CAHASH}/account_id.json\"\n ACCOUNT_DEACTIVATED=\"${ACCOUNTDIR}/${CAHASH}/deactivated\"\n\n if [[ -f \"${ACCOUNT_DEACTIVATED}\" ]]; then\n _exiterr \"Account has been deactivated. Remove account and create a new one using --register.\"\n fi\n\n if [[ -f \"${BASEDIR}/private_key.pem\" ]] && [[ ! -f \"${ACCOUNT_KEY}\" ]]; then\n echo \"! Moving private_key.pem to ${ACCOUNT_KEY}\"\n mv \"${BASEDIR}/private_key.pem\" \"${ACCOUNT_KEY}\"\n fi\n if [[ -f \"${BASEDIR}/private_key.json\" ]] && [[ ! -f \"${ACCOUNT_KEY_JSON}\" ]]; then\n echo \"! Moving private_key.json to ${ACCOUNT_KEY_JSON}\"\n mv \"${BASEDIR}/private_key.json\" \"${ACCOUNT_KEY_JSON}\"\n fi\n\n [[ -z \"${CERTDIR}\" ]] && CERTDIR=\"${BASEDIR}/certs\"\n [[ -z \"${ALPNCERTDIR}\" ]] && ALPNCERTDIR=\"${BASEDIR}/alpn-certs\"\n [[ -z \"${CHAINCACHE}\" ]] && CHAINCACHE=\"${BASEDIR}/chains\"\n [[ -z \"${DOMAINS_TXT}\" ]] && DOMAINS_TXT=\"${BASEDIR}/domains.txt\"\n [[ -z \"${WELLKNOWN}\" ]] && WELLKNOWN=\"${BASEDIR}/.acme-challenges\"\n [[ -z \"${LOCKFILE}\" ]] && LOCKFILE=\"${BASEDIR}/lock\"\n [[ -z \"${OPENSSL_CNF}\" ]] && OPENSSL_CNF=\"$(\"${OPENSSL}\" version -d | cut -d\\\" -f2)/openssl.cnf\"\n [[ -n \"${PARAM_LOCKFILE_SUFFIX:-}\" ]] && LOCKFILE=\"${LOCKFILE}-${PARAM_LOCKFILE_SUFFIX}\"\n [[ -n \"${PARAM_NO_LOCK:-}\" ]] && LOCKFILE=\"\"\n\n [[ -n \"${PARAM_HOOK:-}\" ]] && HOOK=\"${PARAM_HOOK}\"\n [[ -n \"${PARAM_DOMAINS_TXT:-}\" ]] && DOMAINS_TXT=\"${PARAM_DOMAINS_TXT}\"\n [[ -n \"${PARAM_PREFERRED_CHAIN:-}\" ]] && PREFERRED_CHAIN=\"${PARAM_PREFERRED_CHAIN}\"\n [[ -n \"${PARAM_CERTDIR:-}\" ]] && CERTDIR=\"${PARAM_CERTDIR}\"\n [[ -n \"${PARAM_ALPNCERTDIR:-}\" ]] && ALPNCERTDIR=\"${PARAM_ALPNCERTDIR}\"\n [[ -n \"${PARAM_CHALLENGETYPE:-}\" ]] && CHALLENGETYPE=\"${PARAM_CHALLENGETYPE}\"\n [[ -n \"${PARAM_KEY_ALGO:-}\" ]] && KEY_ALGO=\"${PARAM_KEY_ALGO}\"\n [[ -n \"${PARAM_OCSP_MUST_STAPLE:-}\" ]] && OCSP_MUST_STAPLE=\"${PARAM_OCSP_MUST_STAPLE}\"\n [[ -n \"${PARAM_IP_VERSION:-}\" ]] && IP_VERSION=\"${PARAM_IP_VERSION}\"\n [[ -n \"${PARAM_ACME_PROFILE:-}\" ]] && ACME_PROFILE=\"${PARAM_ACME_PROFILE}\"\n [[ -n \"${PARAM_ORDER_TIMEOUT:-}\" ]] && ORDER_TIMEOUT=\"${PARAM_ORDER_TIMEOUT}\"\n [[ -n \"${PARAM_VALIDATION_TIMEOUT:-}\" ]] && VALIDATION_TIMEOUT=\"${PARAM_VALIDATION_TIMEOUT}\"\n [[ -n \"${PARAM_KEEP_GOING:-}\" ]] && KEEP_GOING=\"${PARAM_KEEP_GOING}\"\n\n if [ \"${PARAM_FORCE_VALIDATION:-no}\" = \"yes\" ] && [ \"${PARAM_FORCE:-no}\" = \"no\" ]; then\n _exiterr \"Argument --force-validation can only be used in combination with --force (-x)\"\n fi\n\n if [ ! \"${1:-}\" = \"noverify\" ]; then\n verify_config\n fi\n store_configvars\n}\n\n# Initialize system\ninit_system() {\n load_config\n\n # Lockfile handling (prevents concurrent access)\n if [[ -n \"${LOCKFILE}\" ]]; then\n LOCKDIR=\"$(dirname \"${LOCKFILE}\")\"\n [[ -w \"${LOCKDIR}\" ]] || _exiterr \"Directory ${LOCKDIR} for LOCKFILE ${LOCKFILE} is not writable, aborting.\"\n ( set -C; date > \"${LOCKFILE}\" ) 2>/dev/null || _exiterr \"Lock file '${LOCKFILE}' present, aborting.\"\n remove_lock() { rm -f \"${LOCKFILE}\"; }\n trap 'remove_lock' EXIT\n fi\n\n # Get CA URLs\n CA_DIRECTORY=\"$(http_request get \"${CA}\" | jsonsh)\"\n\n # Automatic discovery of API version\n if [[ \"${API}\" = \"auto\" ]]; then\n grep -q newOrder <<< \"${CA_DIRECTORY}\" && API=2 || API=1\n fi\n\n # shellcheck disable=SC2015\n if [[ \"${API}\" = \"1\" ]]; then\n CA_NEW_CERT=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_string_value new-cert)\" &&\n CA_NEW_AUTHZ=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_string_value new-authz)\" &&\n CA_NEW_REG=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_string_value new-reg)\" &&\n CA_TERMS=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_string_value terms-of-service)\" &&\n CA_REQUIRES_EAB=\"false\" &&\n CA_REVOKE_CERT=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_string_value revoke-cert)\" ||\n _exiterr \"Problem retrieving ACME/CA-URLs, check if your configured CA points to the directory entrypoint.\"\n # Since reg URI is missing from directory we will assume it is the same as CA_NEW_REG without the new part\n CA_REG=${CA_NEW_REG/new-reg/reg}\n\n if [[ -n \"${ACME_PROFILE}\" ]]; then\n _exiterr \"ACME profiles are not supported in ACME v1.\"\n fi\n else\n CA_NEW_ORDER=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_string_value newOrder)\" &&\n CA_NEW_NONCE=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_string_value newNonce)\" &&\n CA_NEW_ACCOUNT=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_string_value newAccount)\" &&\n CA_TERMS=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_string_value -p '\"meta\",\"termsOfService\"')\" &&\n CA_REQUIRES_EAB=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_bool_value -p '\"meta\",\"externalAccountRequired\"' || echo false)\" &&\n CA_REVOKE_CERT=\"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_string_value revokeCert)\" ||\n _exiterr \"Problem retrieving ACME/CA-URLs, check if your configured CA points to the directory entrypoint.\"\n\n # Checking ACME profile\n if [[ -n \"${ACME_PROFILE}\" ]]; then\n # Extract available profiles from CA directory\n declare -A available_profiles=()\n while IFS=$'\\t' read -r path value; do\n if [[ \"${value}\" =~ ^\\\"([^\\\"]+)\\\"$ ]]; then\n value=${BASH_REMATCH[1]}\n fi\n if [[ \"${path}\" =~ ^\\[\\\"([^\\\"]+)\\\"\\]$ ]]; then\n available_profiles[${BASH_REMATCH[1]}]=$value\n fi\n done <<< \"$(printf \"%s\" \"${CA_DIRECTORY}\" | get_json_dict_value -p '\"meta\",\"profiles\"' 2>/dev/null)\"\n if [[ ${#available_profiles[@]} -eq 0 ]]; then\n _exiterr \"ACME profile not supported by this CA\"\n fi\n\n # Check if the requested profile is available\n found_profile=\"no\"\n for profile in \"${!available_profiles[@]}\"; do\n if [[ \"${profile}\" == \"${ACME_PROFILE}\" ]]; then\n found_profile=\"yes\"\n break\n fi\n done\n if [[ \"${found_profile}\" == \"no\" ]]; then\n _exiterr \"ACME profile '${ACME_PROFILE}' not found, available profiles:$(for key in \"${!available_profiles[@]}\"; do printf \"\\n %s: %s\" \"${key}\" \"${available_profiles[$key]}\"; done)\"\n fi\n fi\n fi\n\n # Export some environment variables to be used in hook script\n export WELLKNOWN BASEDIR CERTDIR ALPNCERTDIR CONFIG COMMAND\n\n # Checking for private key ...\n register_new_key=\"no\"\n generated=\"false\"\n if [[ -n \"${PARAM_ACCOUNT_KEY:-}\" ]]; then\n # a private key was specified from the command line so use it for this run\n echo \"Using private key ${PARAM_ACCOUNT_KEY} instead of account key\"\n ACCOUNT_KEY=\"${PARAM_ACCOUNT_KEY}\"\n ACCOUNT_KEY_JSON=\"${PARAM_ACCOUNT_KEY}.json\"\n ACCOUNT_ID_JSON=\"${PARAM_ACCOUNT_KEY}_id.json\"\n [ \"${COMMAND:-}\" = \"register\" ] && register_new_key=\"yes\"\n else\n # Check if private account key exists, if it doesn't exist yet generate a new one (rsa key)\n if [[ ! -e \"${ACCOUNT_KEY}\" ]]; then\n if [[ ! \"${PARAM_ACCEPT_TERMS:-}\" = \"yes\" ]]; then\n printf '\\n' >&2\n printf 'To use dehydrated with this certificate authority you have to agree to their terms of service which you can find here: %s\\n\\n' \"${CA_TERMS}\" >&2\n printf 'To accept these terms of service run \"%s --register --accept-terms\".\\n' \"${0}\" >&2\n exit 1\n fi\n\n echo \"+ Generating account key...\"\n generated=\"true\"\n local tmp_account_key\n tmp_account_key=\"$(_mktemp)\"\n if [[ ${API} -eq 1 && ! \"${ACCOUNT_KEY_ALGO}\" = \"rsa\" ]]; then\n _exiterr \"ACME API version 1 does not support EC account keys\"\n fi\n case \"${ACCOUNT_KEY_ALGO}\" in\n rsa) _openssl genrsa -out \"${tmp_account_key}\" \"${ACCOUNT_KEYSIZE}\";;\n prime256v1|secp384r1|secp521r1) _openssl ecparam -genkey -name \"${ACCOUNT_KEY_ALGO}\" -out \"${tmp_account_key}\" -noout;;\n esac\n cat \"${tmp_account_key}\" > \"${ACCOUNT_KEY}\"\n rm \"${tmp_account_key}\"\n register_new_key=\"yes\"\n fi\n fi\n\n if (\"${OPENSSL}\" rsa -in \"${ACCOUNT_KEY}\" -check 2>/dev/null > /dev/null); then\n # Get public components from private key and calculate thumbprint\n pubExponent64=\"$(printf '%x' \"$(\"${OPENSSL}\" rsa -in \"${ACCOUNT_KEY}\" -noout -text | awk '/publicExponent/ {print $2}')\" | hex2bin | urlbase64)\"\n pubMod64=\"$(\"${OPENSSL}\" rsa -in \"${ACCOUNT_KEY}\" -noout -modulus | cut -d'=' -f2 | hex2bin | urlbase64)\"\n\n account_key_info=\"$(printf '{\"e\":\"%s\",\"kty\":\"RSA\",\"n\":\"%s\"}' \"${pubExponent64}\" \"${pubMod64}\")\"\n account_key_sigalgo=RS256\n elif (\"${OPENSSL}\" ec -in \"${ACCOUNT_KEY}\" -check 2>/dev/null > /dev/null); then\n curve=\"$(\"${OPENSSL}\" ec -in \"${ACCOUNT_KEY}\" -noout -text 2>/dev/null | grep 'NIST CURVE' | cut -d':' -f2 | tr -d ' ')\"\n pubkey=\"$(\"${OPENSSL}\" ec -in \"${ACCOUNT_KEY}\" -noout -text 2>/dev/null | tr -d '\\n ' | grep -Eo 'pub:.*ASN1' | _sed -e 's/^pub://' -e 's/ASN1$//' | tr -d ':')\"\n\n if [ \"${curve}\" = \"P-256\" ]; then\n account_key_sigalgo=\"ES256\"\n elif [ \"${curve}\" = \"P-384\" ]; then\n account_key_sigalgo=\"ES384\"\n elif [ \"${curve}\" = \"P-521\" ]; then\n account_key_sigalgo=\"ES512\"\n else\n _exiterr \"Unknown account key curve: ${curve}\"\n fi\n\n ec_x_offset=2\n ec_x_len=$((${#pubkey}/2 - 1))\n ec_x=\"${pubkey:$ec_x_offset:$ec_x_len}\"\n ec_x64=\"$(printf \"%s\" \"${ec_x}\" | hex2bin | urlbase64)\"\n\n ec_y_offset=$((ec_x_offset+ec_x_len))\n ec_y_len=$((${#pubkey}-ec_y_offset))\n ec_y=\"${pubkey:$ec_y_offset:$ec_y_len}\"\n ec_y64=\"$(printf \"%s\" \"${ec_y}\" | hex2bin | urlbase64)\"\n\n account_key_info=\"$(printf '{\"crv\":\"%s\",\"kty\":\"EC\",\"x\":\"%s\",\"y\":\"%s\"}' \"${curve}\" \"${ec_x64}\" \"${ec_y64}\")\"\n else\n _exiterr \"Account key is not valid, cannot continue.\"\n fi\n thumbprint=\"$(printf '%s' \"${account_key_info}\" | \"${OPENSSL}\" dgst -sha256 -binary | urlbase64)\"\n\n # If we generated a new private key in the step above we have to register it with the acme-server\n if [[ \"${register_new_key}\" = \"yes\" ]]; then\n echo \"+ Registering account key with ACME server...\"\n FAILED=false\n\n if [[ ${API} -eq 1 && -z \"${CA_NEW_REG}\" ]] || [[ ${API} -eq 2 && -z \"${CA_NEW_ACCOUNT}\" ]]; then\n echo \"Certificate authority doesn't allow registrations.\"\n FAILED=true\n fi\n\n # ZeroSSL special sauce\n if [[ \"${CA}\" = \"${CA_ZEROSSL}\" ]]; then\n if [[ -z \"${EAB_KID:-}\" ]] || [[ -z \"${EAB_HMAC_KEY:-}\" ]]; then\n if [[ -z \"${CONTACT_EMAIL}\" ]]; then\n echo \"ZeroSSL requires contact email to be set or EAB_KID/EAB_HMAC_KEY to be manually configured\"\n FAILED=true\n else\n zeroapi=\"$(curl ${ip_version:-} -A \"dehydrated/${VERSION} curl/${CURL_VERSION}\" ${CURL_OPTS} -s \"https://api.zerossl.com/acme/eab-credentials-email\" -d \"email=${CONTACT_EMAIL}\" | jsonsh)\"\n EAB_KID=\"$(printf \"%s\" \"${zeroapi}\" | get_json_string_value eab_kid)\"\n EAB_HMAC_KEY=\"$(printf \"%s\" \"${zeroapi}\" | get_json_string_value eab_hmac_key)\"\n if [[ -z \"${EAB_KID:-}\" ]] || [[ -z \"${EAB_HMAC_KEY:-}\" ]]; then\n echo \"Unknown error retrieving ZeroSSL API credentials\"\n echo \"${zeroapi}\"\n FAILED=true\n fi\n fi\n fi\n fi\n\n # Google special sauce\n if [[ \"${CA}\" = \"${CA_GOOGLE}\" ]]; then\n if [[ -z \"${CONTACT_EMAIL}\" ]] || [[ -z \"${EAB_KID:-}\" ]] || [[ -z \"${EAB_HMAC_KEY:-}\" ]]; then\n echo \"Google requires contact email, EAB_KID and EAB_HMAC_KEY to be manually configured (see https://cloud.google.com/certificate-manager/docs/public-ca-tutorial)\"\n FAILED=true\n fi\n fi\n\n # Check if external account is required\n if [[ \"${FAILED}\" = \"false\" ]]; then\n if [[ \"${CA_REQUIRES_EAB}\" = \"true\" ]]; then\n if [[ -z \"${EAB_KID:-}\" ]] || [[ -z \"${EAB_HMAC_KEY:-}\" ]]; then\n FAILED=true\n echo \"This CA requires an external account but no EAB_KID/EAB_HMAC_KEY has been configured\"\n fi\n fi\n fi\n\n # If an email for the contact has been provided then adding it to the registration request\n if [[ \"${FAILED}\" = \"false\" ]]; then\n if [[ ${API} -eq 1 ]]; then\n if [[ -n \"${CONTACT_EMAIL}\" ]]; then\n (signed_request \"${CA_NEW_REG}\" '{\"resource\": \"new-reg\", \"contact\":[\"mailto:'\"${CONTACT_EMAIL}\"'\"], \"agreement\": \"'\"${CA_TERMS}\"'\"}' > \"${ACCOUNT_KEY_JSON}\") || FAILED=true\n else\n (signed_request \"${CA_NEW_REG}\" '{\"resource\": \"new-reg\", \"agreement\": \"'\"${CA_TERMS}\"'\"}' > \"${ACCOUNT_KEY_JSON}\") || FAILED=true\n fi\n else\n if [[ -n \"${EAB_KID:-}\" ]] && [[ -n \"${EAB_HMAC_KEY:-}\" ]]; then\n eab_url=\"${CA_NEW_ACCOUNT}\"\n eab_protected64=\"$(printf '{\"alg\":\"HS256\",\"kid\":\"%s\",\"url\":\"%s\"}' \"${EAB_KID}\" \"${eab_url}\" | urlbase64)\"\n eab_payload64=\"$(printf \"%s\" \"${account_key_info}\" | urlbase64)\"\n eab_key=\"$(printf \"%s\" \"${EAB_HMAC_KEY}\" | deurlbase64 | bin2hex)\"\n eab_signed64=\"$(printf '%s' \"${eab_protected64}.${eab_payload64}\" | \"${OPENSSL}\" dgst -binary -sha256 -mac HMAC -macopt \"hexkey:${eab_key}\" | urlbase64)\"\n\n if [[ -n \"${CONTACT_EMAIL}\" ]]; then\n regjson='{\"contact\":[\"mailto:'\"${CONTACT_EMAIL}\"'\"], \"termsOfServiceAgreed\": true, \"externalAccountBinding\": {\"protected\": \"'\"${eab_protected64}\"'\", \"payload\": \"'\"${eab_payload64}\"'\", \"signature\": \"'\"${eab_signed64}\"'\"}}'\n else\n regjson='{\"termsOfServiceAgreed\": true, \"externalAccountBinding\": {\"protected\": \"'\"${eab_protected64}\"'\", \"payload\": \"'\"${eab_payload64}\"'\", \"signature\": \"'\"${eab_signed64}\"'\"}}'\n fi\n else\n if [[ -n \"${CONTACT_EMAIL}\" ]]; then\n regjson='{\"contact\":[\"mailto:'\"${CONTACT_EMAIL}\"'\"], \"termsOfServiceAgreed\": true}'\n else\n regjson='{\"termsOfServiceAgreed\": true}'\n fi\n fi\n (signed_request \"${CA_NEW_ACCOUNT}\" \"${regjson}\" > \"${ACCOUNT_KEY_JSON}\") || FAILED=true\n fi\n fi\n\n if [[ \"${FAILED}\" = \"true\" ]]; then\n echo >&2\n echo >&2\n echo \"Error registering account key. See message above for more information.\" >&2\n if [[ \"${generated}\" = \"true\" ]]; then\n rm \"${ACCOUNT_KEY}\"\n fi\n rm -f \"${ACCOUNT_KEY_JSON}\"\n exit 1\n fi\n elif [[ \"${COMMAND:-}\" = \"register\" ]]; then\n echo \"+ Account already registered!\"\n exit 0\n fi\n\n # Read account information or request from CA if missing\n if [[ -e \"${ACCOUNT_KEY_JSON}\" ]]; then\n if [[ ${API} -eq 1 ]]; then\n ACCOUNT_ID=\"$(jsonsh < \"${ACCOUNT_KEY_JSON}\" | get_json_int_value id)\"\n ACCOUNT_URL=\"${CA_REG}/${ACCOUNT_ID}\"\n else\n if [[ -e \"${ACCOUNT_ID_JSON}\" ]]; then\n ACCOUNT_URL=\"$(jsonsh < \"${ACCOUNT_ID_JSON}\" | get_json_string_value url)\"\n fi\n # if account URL is not storred, fetch it from the CA\n if [[ -z \"${ACCOUNT_URL:-}\" ]]; then\n echo \"+ Fetching account URL...\"\n ACCOUNT_URL=\"$(signed_request \"${CA_NEW_ACCOUNT}\" '{\"onlyReturnExisting\": true}' 4>&1 | grep -i ^Location: | cut -d':' -f2- | tr -d ' \\t\\r\\n')\"\n if [[ -z \"${ACCOUNT_URL}\" ]]; then\n _exiterr \"Unknown error on fetching account information\"\n fi\n echo '{\"url\":\"'\"${ACCOUNT_URL}\"'\"}' > \"${ACCOUNT_ID_JSON}\" # store the URL for next time\n fi\n fi\n else\n echo \"Fetching missing account information from CA...\"\n if [[ ${API} -eq 1 ]]; then\n _exiterr \"This is not implemented for ACMEv1! Consider switching to ACMEv2 :)\"\n else\n ACCOUNT_URL=\"$(signed_request \"${CA_NEW_ACCOUNT}\" '{\"onlyReturnExisting\": true}' 4>&1 | grep -i ^Location: | cut -d':' -f2- | tr -d ' \\t\\r\\n')\"\n ACCOUNT_INFO=\"$(signed_request \"${ACCOUNT_URL}\" '{}')\"\n fi\n echo \"${ACCOUNT_INFO}\" > \"${ACCOUNT_KEY_JSON}\"\n fi\n}\n\n# Different sed version for different os types...\n_sed() {\n if [[ \"${OSTYPE}\" = \"Linux\" || \"${OSTYPE:0:5}\" = \"MINGW\" ]]; then\n sed -r \"${@}\"\n else\n sed -E \"${@}\"\n fi\n}\n\n# Print error message and exit with error\n_exiterr() {\n if [ -n \"${1:-}\" ]; then\n echo \"ERROR: ${1}\" >&2\n fi\n [[ \"${skip_exit_hook:-no}\" = \"no\" ]] && [[ -n \"${HOOK:-}\" ]] && (\"${HOOK}\" \"exit_hook\" \"${1:-}\" || echo 'exit_hook returned with non-zero exit code!' >&2)\n exit 1\n}\n\n# Remove newlines and whitespace from json\nclean_json() {\n tr -d '\\r\\n' | _sed -e 's/ +/ /g' -e 's/\\{ /{/g' -e 's/ \\}/}/g' -e 's/\\[ /[/g' -e 's/ \\]/]/g'\n}\n\n# Encode data as url-safe formatted base64\nurlbase64() {\n # urlbase64: base64 encoded string with '+' replaced with '-' and '/' replaced with '_'\n \"${OPENSSL}\" base64 -e | tr -d '\\n\\r' | _sed -e 's:=*$::g' -e 'y:+/:-_:'\n}\n\n# Decode data from url-safe formatted base64\ndeurlbase64() {\n data=\"$(cat | tr -d ' \\n\\r')\"\n modlen=$((${#data} % 4))\n padding=\"\"\n if [[ \"${modlen}\" = \"2\" ]]; then padding=\"==\";\n elif [[ \"${modlen}\" = \"3\" ]]; then padding=\"=\"; fi\n printf \"%s%s\" \"${data}\" \"${padding}\" | tr -d '\\n\\r' | _sed -e 'y:-_:+/:' | \"${OPENSSL}\" base64 -d -A\n}\n\n# Convert hex string to binary data\nhex2bin() {\n # Remove spaces, add leading zero, escape as hex string and parse with printf\n # shellcheck disable=SC2059\n printf \"%b\" \"$(cat | _sed -e 's/[[:space:]]//g' -e 's/^(.(.{2})*)$/0\\1/' -e 's/(.{2})/\\\\x\\1/g')\"\n}\n\n# Convert binary data to hex string\nbin2hex() {\n hexdump -v -e '/1 \"%02x\"'\n}\n\n# OpenSSL writes to stderr/stdout even when there are no errors. So just\n# display the output if the exit code was != 0 to simplify debugging.\n_openssl() {\n set +e\n out=\"$(\"${OPENSSL}\" \"${@}\" 2>&1)\"\n res=$?\n set -e\n if [[ ${res} -ne 0 ]]; then\n echo \" + ERROR: failed to run $* (Exitcode: ${res})\" >&2\n echo >&2\n echo \"Details:\" >&2\n echo \"${out}\" >&2\n echo >&2\n exit \"${res}\"\n fi\n}\n\n# Send http(s) request with specified method\nhttp_request() {\n tempcont=\"$(_mktemp)\"\n tempheaders=\"$(_mktemp)\"\n\n if [[ -n \"${IP_VERSION:-}\" ]]; then\n ip_version=\"-${IP_VERSION}\"\n fi\n\n set +e\n # shellcheck disable=SC2086\n if [[ \"${1}\" = \"head\" ]]; then\n statuscode=\"$(curl ${ip_version:-} -A \"dehydrated/${VERSION} curl/${CURL_VERSION}\" ${CURL_OPTS} -s -w \"%{http_code}\" -o \"${tempcont}\" -H 'Cache-Control: no-cache' \"${2}\" -I)\"\n curlret=\"${?}\"\n touch \"${tempheaders}\"\n elif [[ \"${1}\" = \"get\" ]]; then\n statuscode=\"$(curl ${ip_version:-} -A \"dehydrated/${VERSION} curl/${CURL_VERSION}\" ${CURL_OPTS} -L -s -w \"%{http_code}\" -o \"${tempcont}\" -D \"${tempheaders}\" -H 'Cache-Control: no-cache' \"${2}\")\"\n curlret=\"${?}\"\n elif [[ \"${1}\" = \"post\" ]]; then\n statuscode=\"$(curl ${ip_version:-} -A \"dehydrated/${VERSION} curl/${CURL_VERSION}\" ${CURL_OPTS} -s -w \"%{http_code}\" -o \"${tempcont}\" \"${2}\" -D \"${tempheaders}\" -H 'Cache-Control: no-cache' -H 'Content-Type: application/jose+json' -d \"${3}\")\"\n curlret=\"${?}\"\n else\n set -e\n _exiterr \"Unknown request method: ${1}\"\n fi\n set -e\n\n if [[ ! \"${curlret}\" = \"0\" ]]; then\n _exiterr \"Problem connecting to server (${1} for ${2}; curl returned with ${curlret})\"\n fi\n\n if [[ ! \"${statuscode:0:1}\" = \"2\" ]]; then\n # check for existing registration warning\n if [[ \"${API}\" = \"1\" ]] && [[ -n \"${CA_NEW_REG:-}\" ]] && [[ \"${2}\" = \"${CA_NEW_REG:-}\" ]] && [[ \"${statuscode}\" = \"409\" ]] && grep -q \"Registration key is already in use\" \"${tempcont}\"; then\n # do nothing\n :\n # check for already-revoked warning\n elif [[ -n \"${CA_REVOKE_CERT:-}\" ]] && [[ \"${2}\" = \"${CA_REVOKE_CERT:-}\" ]] && [[ \"${statuscode}\" = \"409\" ]]; then\n grep -q \"Certificate already revoked\" \"${tempcont}\" && return\n else\n if grep -q \"urn:ietf:params:acme:error:badNonce\" \"${tempcont}\"; then\n printf \"badnonce %s\" \"$(grep -Eoi \"^replay-nonce:.*$\" \"${tempheaders}\" | sed 's/ //' | cut -d: -f2)\"\n return 0\n fi\n echo \" + ERROR: An error occurred while sending ${1}-request to ${2} (Status ${statuscode})\" >&2\n echo >&2\n echo \"Details:\" >&2\n cat \"${tempheaders}\" >&2\n cat \"${tempcont}\" >&2\n echo >&2\n echo >&2\n\n # An exclusive hook for the {1}-request error might be useful (e.g., for sending an e-mail to admins)\n if [[ -n \"${HOOK}\" ]]; then\n errtxt=\"$(cat \"${tempcont}\")\"\n errheaders=\"$(cat \"${tempheaders}\")\"\n \"${HOOK}\" \"request_failure\" \"${statuscode}\" \"${errtxt}\" \"${1}\" \"${errheaders}\" || _exiterr 'request_failure hook returned with non-zero exit code'\n fi\n\n rm -f \"${tempcont}\"\n rm -f \"${tempheaders}\"\n\n # remove temporary domains.txt file if used\n [[ \"${COMMAND:-}\" = \"sign_domains\" && -n \"${PARAM_DOMAIN:-}\" && -n \"${DOMAINS_TXT:-}\" ]] && rm \"${DOMAINS_TXT}\"\n _exiterr\n fi\n fi\n\n if { true >&4; } 2>/dev/null; then\n cat \"${tempheaders}\" >&4\n fi\n cat \"${tempcont}\"\n rm -f \"${tempcont}\"\n rm -f \"${tempheaders}\"\n}\n\n# Send signed request\nsigned_request() {\n # Encode payload as urlbase64\n payload64=\"$(printf '%s' \"${2}\" | urlbase64)\"\n\n if [ -n \"${3:-}\" ]; then\n nonce=\"$(printf \"%s\" \"${3}\" | tr -d ' \\t\\n\\r')\"\n else\n # Retrieve nonce from acme-server\n if [[ ${API} -eq 1 ]]; then\n nonce=\"$(http_request head \"${CA}\" | grep -i ^Replay-Nonce: | cut -d':' -f2- | tr -d ' \\t\\n\\r')\"\n else\n nonce=\"$(http_request head \"${CA_NEW_NONCE}\" | grep -i ^Replay-Nonce: | cut -d':' -f2- | tr -d ' \\t\\n\\r')\"\n fi\n fi\n\n if [[ ${API} -eq 1 ]]; then\n # Build another header which also contains the previously received nonce and encode it as urlbase64\n protected='{\"alg\": \"RS256\", \"jwk\": {\"e\": \"'\"${pubExponent64}\"'\", \"kty\": \"RSA\", \"n\": \"'\"${pubMod64}\"'\"}, \"nonce\": \"'\"${nonce}\"'\"}'\n protected64=\"$(printf '%s' \"${protected}\" | urlbase64)\"\n else\n # Build another header which also contains the previously received nonce and url and encode it as urlbase64\n if [[ -n \"${ACCOUNT_URL:-}\" ]]; then\n protected='{\"alg\": \"'\"${account_key_sigalgo}\"'\", \"kid\": \"'\"${ACCOUNT_URL}\"'\", \"url\": \"'\"${1}\"'\", \"nonce\": \"'\"${nonce}\"'\"}'\n else\n protected='{\"alg\": \"'\"${account_key_sigalgo}\"'\", \"jwk\": '\"${account_key_info}\"', \"url\": \"'\"${1}\"'\", \"nonce\": \"'\"${nonce}\"'\"}'\n fi\n protected64=\"$(printf '%s' \"${protected}\" | urlbase64)\"\n fi\n\n # Sign header with nonce and our payload with our private key and encode signature as urlbase64\n if [[ \"${account_key_sigalgo}\" = \"RS256\" ]]; then\n signed64=\"$(printf '%s' \"${protected64}.${payload64}\" | \"${OPENSSL}\" dgst -sha256 -sign \"${ACCOUNT_KEY}\" | urlbase64)\"\n else\n dgstparams=\"$(printf '%s' \"${protected64}.${payload64}\" | \"${OPENSSL}\" dgst -sha${account_key_sigalgo:2} -sign \"${ACCOUNT_KEY}\" | \"${OPENSSL}\" asn1parse -inform DER)\"\n dgst_parm_1=\"$(echo \"$dgstparams\" | head -n 2 | tail -n 1 | cut -d':' -f4)\"\n dgst_parm_2=\"$(echo \"$dgstparams\" | head -n 3 | tail -n 1 | cut -d':' -f4)\"\n\n # zero-padding (doesn't seem to be necessary, but other clients are doing this as well...\n case \"${account_key_sigalgo}\" in\n \"ES256\") siglen=64;;\n \"ES384\") siglen=96;;\n \"ES512\") siglen=132;;\n esac\n while [[ ${#dgst_parm_1} -lt $siglen ]]; do dgst_parm_1=\"0${dgst_parm_1}\"; done\n while [[ ${#dgst_parm_2} -lt $siglen ]]; do dgst_parm_2=\"0${dgst_parm_2}\"; done\n\n signed64=\"$(printf \"%s%s\" \"${dgst_parm_1}\" \"${dgst_parm_2}\" | hex2bin | urlbase64)\"\n fi\n\n if [[ ${API} -eq 1 ]]; then\n # Build header with just our public key and algorithm information\n header='{\"alg\": \"RS256\", \"jwk\": {\"e\": \"'\"${pubExponent64}\"'\", \"kty\": \"RSA\", \"n\": \"'\"${pubMod64}\"'\"}}'\n\n # Send header + extended header + payload + signature to the acme-server\n data='{\"header\": '\"${header}\"', \"protected\": \"'\"${protected64}\"'\", \"payload\": \"'\"${payload64}\"'\", \"signature\": \"'\"${signed64}\"'\"}'\n else\n # Send extended header + payload + signature to the acme-server\n data='{\"protected\": \"'\"${protected64}\"'\", \"payload\": \"'\"${payload64}\"'\", \"signature\": \"'\"${signed64}\"'\"}'\n fi\n\n output=\"$(http_request post \"${1}\" \"${data}\")\"\n\n if grep -qE \"^badnonce \" <<< \"${output}\"; then\n echo \" ! Request failed (badNonce), retrying request...\" >&2\n signed_request \"${1:-}\" \"${2:-}\" \"$(printf \"%s\" \"${output}\" | cut -d' ' -f2)\"\n else\n printf \"%s\" \"${output}\"\n fi\n}\n\n# Extracts all subject names from a CSR\n# Outputs either the CN, or the SANs, one per line\nextract_altnames() {\n csrfile=\"${1}\" # path to CSR file\n\n if ! \"${OPENSSL}\" req -in \"${csrfile}\" -verify -noout >/dev/null; then\n _exiterr \"Certificate signing request isn't valid\"\n fi\n\n reqtext=\"$(\"${OPENSSL}\" req -in \"${csrfile}\" -noout -text)\"\n if <<<\"${reqtext}\" grep -q '^[[:space:]]*X509v3 Subject Alternative Name:[[:space:]]*$'; then\n # SANs used, extract these\n altnames=\"$( <<<\"${reqtext}\" awk '/X509v3 Subject Alternative Name:/{print;getline;print;}' | tail -n1 )\"\n # split to one per line:\n # shellcheck disable=SC1003\n altnames=\"$( <<<\"${altnames}\" _sed -e 's/^[[:space:]]*//; s/, /\\'$'\\n''/g' )\"\n # we can only get DNS/IP: ones signed\n if grep -qEv '^(DNS|IP( Address)*|othername):' <<<\"${altnames}\"; then\n _exiterr \"Certificate signing request contains non-DNS/IP Subject Alternative Names\"\n fi\n # strip away the DNS/IP: prefix\n altnames=\"$( <<<\"${altnames}\" _sed -e 's/^(DNS:|IP( Address)*:|othername:)//' )\"\n printf \"%s\" \"${altnames}\" | tr '\\n' ' '\n else\n # No SANs, extract CN\n altnames=\"$( <<<\"${reqtext}\" grep '^[[:space:]]*Subject:' | _sed -e 's/.*[ /]CN ?= ?([^ /,]*).*/\\1/' )\"\n printf \"%s\" \"${altnames}\"\n fi\n}\n\n# Get last issuer CN in certificate chain\nget_last_cn() {\n <<<\"${1}\" _sed 'H;/-----BEGIN CERTIFICATE-----/h;$!d;x' | \"${OPENSSL}\" x509 -noout -issuer | head -n1 | _sed -e 's/.*[ /]CN ?= ?([^/,]*).*/\\1/'\n}\n\n# Create certificate for domain(s) and outputs it FD 3\nsign_csr() {\n csrfile=\"${1}\" # path to CSR file\n\n if { true >&3; } 2>/dev/null; then\n : # fd 3 looks OK\n else\n _exiterr \"sign_csr: FD 3 not open\"\n fi\n\n shift 1 || true\n export altnames=\"${*}\"\n\n if [[ ${API} -eq 1 ]]; then\n if [[ -z \"${CA_NEW_AUTHZ}\" ]] || [[ -z \"${CA_NEW_CERT}\" ]]; then\n _exiterr \"Certificate authority doesn't allow certificate signing\"\n fi\n elif [[ ${API} -eq 2 ]] && [[ -z \"${CA_NEW_ORDER}\" ]]; then\n _exiterr \"Certificate authority doesn't allow certificate signing\"\n fi\n\n if [[ -n \"${ZSH_VERSION:-}\" ]]; then\n local -A challenge_names challenge_uris challenge_tokens authorizations keyauths deploy_args\n else\n local -a challenge_names challenge_uris challenge_tokens authorizations keyauths deploy_args\n fi\n\n # Initial step: Find which authorizations we're dealing with\n if [[ ${API} -eq 2 ]]; then\n # Request new order and store authorization URIs\n local challenge_identifiers=\"\"\n for altname in ${altnames}; do\n if [[ \"${altname}\" =~ ^ip: ]]; then\n ip=\"${altname:3}\"\n if [[ \"${ip}\" =~ : ]]; then\n ip=\"$(ipv6_normalize <<< \"${ip}\")\"\n fi\n challenge_identifiers+=\"$(printf '{\"type\": \"ip\", \"value\": \"%s\"}, ' \"${ip}\")\"\n else\n challenge_identifiers+=\"$(printf '{\"type\": \"dns\", \"value\": \"%s\"}, ' \"${altname}\")\"\n fi\n done\n challenge_identifiers=\"[${challenge_identifiers%, }]\"\n\n echo \" + Requesting new certificate order from CA...\"\n local order_payload='{\"identifiers\": '\"${challenge_identifiers}\"\n if [[ -n \"${ACME_PROFILE}\" ]]; then\n order_payload=\"${order_payload}\"',\"profile\":\"'\"${ACME_PROFILE}\"'\"'\n fi\n order_payload=\"${order_payload}\"'}'\n order_location=\"$(signed_request \"${CA_NEW_ORDER}\" \"${order_payload}\" 4>&1 | grep -i ^Location: | cut -d':' -f2- | tr -d ' \\t\\r\\n')\"\n result=\"$(signed_request \"${order_location}\" \"\" | jsonsh)\"\n\n order_authorizations=\"$(echo \"${result}\" | get_json_array_values authorizations)\"\n finalize=\"$(echo \"${result}\" | get_json_string_value finalize)\"\n\n local idx=0\n for uri in ${order_authorizations}; do\n authorizations[${idx}]=\"${uri}\"\n idx=$((idx+1))\n done\n echo \" + Received ${idx} authorizations URLs from the CA\"\n else\n # Copy $altnames to $authorizations (just doing this to reduce duplicate code later on)\n local idx=0\n for altname in ${altnames}; do\n authorizations[${idx}]=\"${altname}\"\n idx=$((idx+1))\n done\n fi\n\n # Check if authorizations are valid and gather challenge information for pending authorizations\n local idx=0\n for authorization in ${authorizations[*]}; do\n if [[ \"${API}\" -eq 2 ]]; then\n # Receive authorization ($authorization is authz uri)\n response=\"$(signed_request \"$(echo \"${authorization}\" | _sed -e 's/\\\"(.*)\".*/\\1/')\" \"\" | jsonsh)\"\n identifier=\"$(echo \"${response}\" | get_json_string_value -p '\"identifier\",\"value\"')\"\n identifier_type=\"$(echo \"${response}\" | get_json_string_value -p '\"identifier\",\"type\"')\"\n echo \" + Handling authorization for ${identifier}\"\n else\n # Request new authorization ($authorization is altname)\n identifier=\"${authorization}\"\n echo \" + Requesting authorization for ${identifier}...\"\n response=\"$(signed_request \"${CA_NEW_AUTHZ}\" '{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"'\"${identifier}\"'\"}}' | jsonsh)\"\n fi\n\n # Check if authorization has already been validated\n if [ \"$(echo \"${response}\" | get_json_string_value status)\" = \"valid\" ]; then\n if [ \"${PARAM_FORCE_VALIDATION:-no}\" = \"yes\" ]; then\n echo \" + A valid authorization has been found but will be ignored\"\n else\n echo \" + Found valid authorization for ${identifier}\"\n continue\n fi\n fi\n\n # Find challenge in authorization\n challengeindex=\"$(echo \"${response}\" | grep -E '^\\[\"challenges\",[0-9]+,\"type\"\\][[:space:]]+\"'\"${CHALLENGETYPE}\"'\"' | cut -d',' -f2 || true)\"\n\n if [ -z \"${challengeindex}\" ]; then\n allowed_validations=\"$(echo \"${response}\" | grep -E '^\\[\"challenges\",[0-9]+,\"type\"\\]' | sed -e 's/\\[[^\\]*\\][[:space:]]*//g' -e 's/^\"//' -e 's/\"$//' | tr '\\n' ' ')\"\n _exiterr \"Validating this certificate is not possible using ${CHALLENGETYPE}. Possible validation methods are: ${allowed_validations}. Please check with your CA for more information about supported validation methods.\"\n fi\n challenge=\"$(echo \"${response}\" | get_json_dict_value -p '\"challenges\",'\"${challengeindex}\")\"\n\n # Gather challenge information\n if [ \"${identifier_type:-}\" = \"ip\" ] && [ \"${CHALLENGETYPE}\" = \"tls-alpn-01\" ]; then\n challenge_names[${idx}]=\"$(echo \"${identifier}\" | ip_to_ptr)\"\n else\n challenge_names[${idx}]=\"${identifier}\"\n fi\n challenge_tokens[${idx}]=\"$(echo \"${challenge}\" | get_json_string_value token)\"\n\n if [[ ${API} -eq 2 ]]; then\n challenge_uris[${idx}]=\"$(echo \"${challenge}\" | get_json_string_value url)\"\n else\n if [[ \"$(echo \"${challenge}\" | get_json_string_value type)\" = \"urn:acme:error:unauthorized\" ]]; then\n _exiterr \"Challenge unauthorized: $(echo \"${challenge}\" | get_json_string_value detail)\"\n fi\n challenge_uris[${idx}]=\"$(echo \"${challenge}\" | get_json_dict_value validationRecord | get_json_string_value uri)\"\n fi\n\n # Prepare challenge tokens and deployment parameters\n keyauth=\"${challenge_tokens[${idx}]}.${thumbprint}\"\n\n case \"${CHALLENGETYPE}\" in\n \"http-01\")\n # Store challenge response in well-known location and make world-readable (so that a webserver can access it)\n printf '%s' \"${keyauth}\" > \"${WELLKNOWN}/${challenge_tokens[${idx}]}\"\n chmod a+r \"${WELLKNOWN}/${challenge_tokens[${idx}]}\"\n keyauth_hook=\"${keyauth}\"\n ;;\n \"dns-01\")\n # Generate DNS entry content for dns-01 validation\n keyauth_hook=\"$(printf '%s' \"${keyauth}\" | \"${OPENSSL}\" dgst -sha256 -binary | urlbase64)\"\n ;;\n \"dns-persist-01\")\n # Pre-existing persistent DNS record is expected; no deploy/cleanup by dehydrated.\n keyauth_hook=\"\"\n ;;\n \"tls-alpn-01\")\n keyauth_hook=\"$(printf '%s' \"${keyauth}\" | \"${OPENSSL}\" dgst -sha256 -c -hex | awk '{print $NF}')\"\n generate_alpn_certificate \"${identifier}\" \"${identifier_type}\" \"${keyauth_hook}\"\n ;;\n esac\n\n keyauths[${idx}]=\"${keyauth}\"\n if [ \"${identifier_type:-}\" = \"ip\" ] && [ \"${CHALLENGETYPE}\" = \"tls-alpn-01\" ]; then\n deploy_args[${idx}]=\"$(echo \"${identifier}\" | ip_to_ptr) ${challenge_tokens[${idx}]} ${keyauth_hook}\"\n else\n deploy_args[${idx}]=\"${identifier} ${challenge_tokens[${idx}]} ${keyauth_hook}\"\n fi\n\n idx=$((idx+1))\n done\n local num_pending_challenges=${idx}\n echo \" + ${num_pending_challenges} pending challenge(s)\"\n\n # Deploy challenge tokens\n if [[ ${num_pending_challenges} -ne 0 ]]; then\n if [[ \"${CHALLENGETYPE}\" != \"dns-persist-01\" ]]; then\n echo \" + Deploying challenge tokens...\"\n if [[ -n \"${HOOK}\" ]] && [[ \"${HOOK_CHAIN}\" = \"yes\" ]]; then\n # shellcheck disable=SC2068\n \"${HOOK}\" \"deploy_challenge\" ${deploy_args[@]} || _exiterr 'deploy_challenge hook returned with non-zero exit code'\n elif [[ -n \"${HOOK}\" ]]; then\n # Run hook script to deploy the challenge token\n local idx=0\n while [ ${idx} -lt ${num_pending_challenges} ]; do\n # shellcheck disable=SC2086\n \"${HOOK}\" \"deploy_challenge\" ${deploy_args[${idx}]} || _exiterr 'deploy_challenge hook returned with non-zero exit code'\n idx=$((idx+1))\n done\n fi\n fi\n fi\n\n # Validate pending challenges\n local idx=0\n while [ ${idx} -lt ${num_pending_challenges} ]; do\n echo \" + Responding to challenge for ${challenge_names[${idx}]} authorization...\"\n\n # Ask the acme-server to verify our challenge and wait until it is no longer pending\n if [[ ${API} -eq 1 ]]; then\n result=\"$(signed_request \"${challenge_uris[${idx}]}\" '{\"resource\": \"challenge\", \"keyAuthorization\": \"'\"${keyauths[${idx}]}\"'\"}' | jsonsh)\"\n else\n result=\"$(signed_request \"${challenge_uris[${idx}]}\" '{}' | jsonsh)\"\n fi\n\n reqstatus=\"$(echo \"${result}\" | get_json_string_value status)\"\n\n local waited=0\n while [[ \"${reqstatus}\" = \"pending\" ]] || [[ \"${reqstatus}\" = \"processing\" ]]; do\n if [ ${VALIDATION_TIMEOUT} -gt 0 ] && [ ${waited} -gt ${VALIDATION_TIMEOUT} ]; then\n _exiterr \"Timed out waiting for processing of domain validation (still ${reqstatus})\"\n fi\n echo \" + Validation is ${reqstatus}...\"\n sleep 1\n waited=$((waited+1))\n if [[ \"${API}\" -eq 2 ]]; then\n result=\"$(signed_request \"${challenge_uris[${idx}]}\" \"\" | jsonsh)\"\n else\n result=\"$(http_request get \"${challenge_uris[${idx}]}\" | jsonsh)\"\n fi\n reqstatus=\"$(echo \"${result}\" | get_json_string_value status)\"\n done\n\n [[ \"${CHALLENGETYPE}\" = \"http-01\" ]] && rm -f \"${WELLKNOWN}/${challenge_tokens[${idx}]}\"\n [[ \"${CHALLENGETYPE}\" = \"tls-alpn-01\" ]] && rm -f \"${ALPNCERTDIR}/${challenge_names[${idx}]}.crt.pem\" \"${ALPNCERTDIR}/${challenge_names[${idx}]}.key.pem\"\n\n if [[ \"${reqstatus}\" = \"valid\" ]]; then\n echo \" + Challenge is valid!\"\n else\n [[ -n \"${HOOK}\" ]] && (\"${HOOK}\" \"invalid_challenge\" \"${altname}\" \"${result}\" || _exiterr 'invalid_challenge hook returned with non-zero exit code')\n break\n fi\n idx=$((idx+1))\n done\n\n if [[ ${num_pending_challenges} -ne 0 ]]; then\n if [[ \"${CHALLENGETYPE}\" != \"dns-persist-01\" ]]; then\n echo \" + Cleaning challenge tokens...\"\n\n # Clean challenge tokens using chained hook\n # shellcheck disable=SC2068\n [[ -n \"${HOOK}\" ]] && [[ \"${HOOK_CHAIN}\" = \"yes\" ]] && (\"${HOOK}\" \"clean_challenge\" ${deploy_args[@]} || _exiterr 'clean_challenge hook returned with non-zero exit code')\n\n # Clean remaining challenge tokens if validation has failed\n local idx=0\n while [ ${idx} -lt ${num_pending_challenges} ]; do\n # Delete challenge file\n [[ \"${CHALLENGETYPE}\" = \"http-01\" ]] && rm -f \"${WELLKNOWN}/${challenge_tokens[${idx}]}\"\n # Delete alpn verification certificates\n [[ \"${CHALLENGETYPE}\" = \"tls-alpn-01\" ]] && rm -f \"${ALPNCERTDIR}/${challenge_names[${idx}]}.crt.pem\" \"${ALPNCERTDIR}/${challenge_names[${idx}]}.key.pem\"\n # Clean challenge token using non-chained hook\n # shellcheck disable=SC2086\n [[ -n \"${HOOK}\" ]] && [[ \"${HOOK_CHAIN}\" != \"yes\" ]] && (\"${HOOK}\" \"clean_challenge\" ${deploy_args[${idx}]} || _exiterr 'clean_challenge hook returned with non-zero exit code')\n idx=$((idx+1))\n done\n fi\n\n if [[ \"${reqstatus}\" != \"valid\" ]]; then\n echo \" + Challenge validation has failed :(\"\n _exiterr \"Challenge is invalid! (returned: ${reqstatus}) (result: ${result})\"\n fi\n fi\n\n # Finally request certificate from the acme-server and store it in cert-${timestamp}.pem and link from cert.pem\n echo \" + Requesting certificate...\"\n csr64=\"$(\"${OPENSSL}\" req -in \"${csrfile}\" -config \"${OPENSSL_CNF}\" -outform DER | urlbase64)\"\n if [[ ${API} -eq 1 ]]; then\n crt64=\"$(signed_request \"${CA_NEW_CERT}\" '{\"resource\": \"new-cert\", \"csr\": \"'\"${csr64}\"'\"}' | \"${OPENSSL}\" base64 -e)\"\n crt=\"$( printf -- '-----BEGIN CERTIFICATE-----\\n%s\\n-----END CERTIFICATE-----\\n' \"${crt64}\" )\"\n else\n result=\"$(signed_request \"${finalize}\" '{\"csr\": \"'\"${csr64}\"'\"}' | jsonsh)\"\n waited=0\n while :; do\n orderstatus=\"$(echo \"${result}\" | get_json_string_value status)\"\n case \"${orderstatus}\"\n in\n \"processing\" | \"pending\")\n if [ ${ORDER_TIMEOUT} -gt 0 ] && [ ${waited} -gt ${ORDER_TIMEOUT} ]; then\n _exiterr \"Timed out waiting for processing of order (still ${orderstatus})\"\n fi\n echo \" + Order is ${orderstatus}...\"\n sleep 2;\n waited=$((waited+2))\n ;;\n \"valid\")\n break;\n ;;\n *)\n _exiterr \"Order has invalid/unknown status: ${orderstatus}\"\n ;;\n esac\n result=\"$(signed_request \"${order_location}\" \"\" | jsonsh)\"\n done\n\n resheaders=\"$(_mktemp)\"\n certificate=\"$(echo \"${result}\" | get_json_string_value certificate)\"\n crt=\"$(signed_request \"${certificate}\" \"\" 4>\"${resheaders}\")\"\n\n if [ -n \"${PREFERRED_CHAIN:-}\" ]; then\n foundaltchain=0\n altcn=\"$(get_last_cn \"${crt}\")\"\n altoptions=\"${altcn}\"\n if [ \"${altcn}\" = \"${PREFERRED_CHAIN}\" ]; then\n foundaltchain=1\n fi\n if [ \"${foundaltchain}\" = \"0\" ] && (grep -Ei '^link:' \"${resheaders}\" | grep -q -Ei 'rel=\"alternate\"'); then\n while read -r altcrturl; do\n if [ \"${foundaltchain}\" = \"0\" ]; then\n altcrt=\"$(signed_request \"${altcrturl}\" \"\")\"\n altcn=\"$(get_last_cn \"${altcrt}\")\"\n altoptions=\"${altoptions}, ${altcn}\"\n if [ \"${altcn}\" = \"${PREFERRED_CHAIN}\" ]; then\n foundaltchain=1\n crt=\"${altcrt}\"\n fi\n fi\n done <<< \"$(grep -Ei '^link:' \"${resheaders}\" | grep -Ei 'rel=\"alternate\"' | cut -d'<' -f2 | cut -d'>' -f1)\"\n fi\n if [ \"${foundaltchain}\" = \"0\" ]; then\n _exiterr \"Alternative chain with CN = ${PREFERRED_CHAIN} not found, available options: ${altoptions}\"\n fi\n echo \" + Using preferred chain with CN = ${altcn}\"\n fi\n rm -f \"${resheaders}\"\n fi\n\n # Try to load the certificate to detect corruption\n echo \" + Checking certificate...\"\n _openssl x509 -text <<<\"${crt}\"\n\n echo \"${crt}\" >&3\n\n unset challenge_token\n echo \" + Done!\"\n}\n\n# grep issuer cert uri from certificate\nget_issuer_cert_uri() {\n certificate=\"${1}\"\n \"${OPENSSL}\" x509 -in \"${certificate}\" -noout -text | (grep 'CA Issuers - URI:' | cut -d':' -f2-) || true\n}\n\nget_issuer_hash() {\n certificate=\"${1}\"\n \"${OPENSSL}\" x509 -in \"${certificate}\" -noout -issuer_hash\n}\n\nget_ocsp_url() {\n certificate=\"${1}\"\n \"${OPENSSL}\" x509 -in \"${certificate}\" -noout -ocsp_uri\n}\n\n# walk certificate chain, retrieving all intermediate certificates\nwalk_chain() {\n local certificate\n certificate=\"${1}\"\n\n local issuer_cert_uri\n issuer_cert_uri=\"${2:-}\"\n if [[ -z \"${issuer_cert_uri}\" ]]; then issuer_cert_uri=\"$(get_issuer_cert_uri \"${certificate}\")\"; fi\n if [[ -n \"${issuer_cert_uri}\" ]]; then\n # create temporary files\n local tmpcert\n local tmpcert_raw\n tmpcert_raw=\"$(_mktemp)\"\n tmpcert=\"$(_mktemp)\"\n\n # download certificate\n http_request get \"${issuer_cert_uri}\" > \"${tmpcert_raw}\"\n\n # PEM\n if grep -q \"BEGIN CERTIFICATE\" \"${tmpcert_raw}\"; then mv \"${tmpcert_raw}\" \"${tmpcert}\"\n # DER\n elif \"${OPENSSL}\" x509 -in \"${tmpcert_raw}\" -inform DER -out \"${tmpcert}\" -outform PEM 2> /dev/null > /dev/null; then :\n # PKCS7\n elif \"${OPENSSL}\" pkcs7 -in \"${tmpcert_raw}\" -inform DER -out \"${tmpcert}\" -outform PEM -print_certs 2> /dev/null > /dev/null; then :\n # Unknown certificate type\n else _exiterr \"Unknown certificate type in chain\"\n fi\n\n local next_issuer_cert_uri\n next_issuer_cert_uri=\"$(get_issuer_cert_uri \"${tmpcert}\")\"\n if [[ -n \"${next_issuer_cert_uri}\" ]]; then\n printf \"\\n%s\\n\" \"${issuer_cert_uri}\"\n cat \"${tmpcert}\"\n walk_chain \"${tmpcert}\" \"${next_issuer_cert_uri}\"\n fi\n rm -f \"${tmpcert}\" \"${tmpcert_raw}\"\n fi\n}\n\n# Generate ALPN verification certificate\ngenerate_alpn_certificate() {\n local altname=\"${1}\"\n local identifier_type=\"${2}\"\n local acmevalidation=\"${3}\"\n\n local alpncertdir=\"${ALPNCERTDIR}\"\n if [[ ! -e \"${alpncertdir}\" ]]; then\n echo \" + Creating new directory ${alpncertdir} ...\"\n mkdir -p \"${alpncertdir}\" || _exiterr \"Unable to create directory ${alpncertdir}\"\n fi\n\n echo \" + Generating ALPN certificate and key for ${1}...\"\n tmp_openssl_cnf=\"$(_mktemp)\"\n cat \"${OPENSSL_CNF}\" > \"${tmp_openssl_cnf}\"\n if [[ \"${identifier_type}\" = \"ip\" ]]; then\n printf \"\\n[SAN]\\nsubjectAltName=IP:%s\\n\" \"${altname}\" >> \"${tmp_openssl_cnf}\"\n else\n printf \"\\n[SAN]\\nsubjectAltName=DNS:%s\\n\" \"${altname}\" >> \"${tmp_openssl_cnf}\"\n fi\n printf \"1.3.6.1.5.5.7.1.31=critical,DER:04:20:%s\\n\" \"${acmevalidation}\" >> \"${tmp_openssl_cnf}\"\n SUBJ=\"/CN=${altname}/\"\n [[ \"${OSTYPE:0:5}\" = \"MINGW\" ]] && SUBJ=\"/${SUBJ}\"\n if [[ \"${identifier_type}\" = \"ip\" ]]; then\n altname=\"$(echo \"${altname}\" | ip_to_ptr)\"\n fi\n _openssl req -x509 -new -sha256 -nodes -newkey rsa:2048 -keyout \"${alpncertdir}/${altname}.key.pem\" -out \"${alpncertdir}/${altname}.crt.pem\" -subj \"${SUBJ}\" -extensions SAN -config \"${tmp_openssl_cnf}\"\n chmod g+r \"${alpncertdir}/${altname}.key.pem\" \"${alpncertdir}/${altname}.crt.pem\"\n rm -f \"${tmp_openssl_cnf}\"\n}\n\n# Create certificate for domain(s)\nsign_domain() {\n local certdir=\"${1}\"\n shift\n timestamp=\"${1}\"\n shift\n domain=\"${1}\"\n altnames=\"${*}\"\n\n export altnames\n\n echo \" + Signing domains...\"\n if [[ ${API} -eq 1 ]]; then\n if [[ -z \"${CA_NEW_AUTHZ}\" ]] || [[ -z \"${CA_NEW_CERT}\" ]]; then\n _exiterr \"Certificate authority doesn't allow certificate signing\"\n fi\n elif [[ ${API} -eq 2 ]] && [[ -z \"${CA_NEW_ORDER}\" ]]; then\n _exiterr \"Certificate authority doesn't allow certificate signing\"\n fi\n\n local privkey=\"privkey.pem\"\n if [[ ! -e \"${certdir}/cert-${timestamp}.csr\" ]]; then\n # generate a new private key if we need or want one\n if [[ ! -r \"${certdir}/privkey.pem\" ]] || [[ \"${PRIVATE_KEY_RENEW}\" = \"yes\" ]]; then\n echo \" + Generating private key...\"\n privkey=\"privkey-${timestamp}.pem\"\n local tmp_privkey\n tmp_privkey=\"$(_mktemp)\"\n case \"${KEY_ALGO}\" in\n rsa) _openssl genrsa -out \"${tmp_privkey}\" \"${KEYSIZE}\";;\n prime256v1|secp384r1) _openssl ecparam -genkey -name \"${KEY_ALGO}\" -out \"${tmp_privkey}\" -noout;;\n esac\n cat \"${tmp_privkey}\" > \"${certdir}/privkey-${timestamp}.pem\"\n rm \"${tmp_privkey}\"\n fi\n # move rolloverkey into position (if any)\n if [[ -r \"${certdir}/privkey.pem\" && -r \"${certdir}/privkey.roll.pem\" && \"${PRIVATE_KEY_RENEW}\" = \"yes\" && \"${PRIVATE_KEY_ROLLOVER}\" = \"yes\" ]]; then\n echo \" + Moving Rolloverkey into position.... \"\n mv \"${certdir}/privkey.roll.pem\" \"${certdir}/privkey-tmp.pem\"\n mv \"${certdir}/privkey-${timestamp}.pem\" \"${certdir}/privkey.roll.pem\"\n mv \"${certdir}/privkey-tmp.pem\" \"${certdir}/privkey-${timestamp}.pem\"\n fi\n # generate a new private rollover key if we need or want one\n if [[ ! -r \"${certdir}/privkey.roll.pem\" && \"${PRIVATE_KEY_ROLLOVER}\" = \"yes\" && \"${PRIVATE_KEY_RENEW}\" = \"yes\" ]]; then\n echo \" + Generating private rollover key...\"\n case \"${KEY_ALGO}\" in\n rsa) _openssl genrsa -out \"${certdir}/privkey.roll.pem\" \"${KEYSIZE}\";;\n prime256v1|secp384r1) _openssl ecparam -genkey -name \"${KEY_ALGO}\" -out \"${certdir}/privkey.roll.pem\" -noout;;\n esac\n fi\n # delete rolloverkeys if disabled\n if [[ -r \"${certdir}/privkey.roll.pem\" && ! \"${PRIVATE_KEY_ROLLOVER}\" = \"yes\" ]]; then\n echo \" + Removing Rolloverkey (feature disabled)...\"\n rm -f \"${certdir}/privkey.roll.pem\"\n fi\n\n # Generate signing request config and the actual signing request\n echo \" + Generating signing request...\"\n SAN=\"\"\n for altname in ${altnames}; do\n if [[ \"${altname}\" =~ ^ip: ]]; then\n SAN=\"${SAN}IP:${altname:3}, \"\n else\n SAN=\"${SAN}DNS:${altname}, \"\n fi\n done\n if [[ \"${domain}\" =~ ^ip: ]]; then\n SUBJ=\"/\"\n else\n SUBJ=\"/CN=${domain}/\"\n fi\n SAN=\"${SAN%%, }\"\n local tmp_openssl_cnf\n tmp_openssl_cnf=\"$(_mktemp)\"\n cat \"${OPENSSL_CNF}\" > \"${tmp_openssl_cnf}\"\n printf \"\\n[SAN]\\nsubjectAltName=%s\" \"${SAN}\" >> \"${tmp_openssl_cnf}\"\n if [ \"${OCSP_MUST_STAPLE}\" = \"yes\" ]; then\n printf \"\\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05\" >> \"${tmp_openssl_cnf}\"\n fi\n if [[ \"${OSTYPE:0:5}\" = \"MINGW\" ]]; then\n # The subject starts with a /, so MSYS will assume it's a path and convert\n # it unless we escape it with another one:\n SUBJ=\"/${SUBJ}\"\n fi\n \"${OPENSSL}\" req -new -sha256 -key \"${certdir}/${privkey}\" -out \"${certdir}/cert-${timestamp}.csr\" -subj \"${SUBJ}\" -reqexts SAN -config \"${tmp_openssl_cnf}\"\n rm -f \"${tmp_openssl_cnf}\"\n fi\n\n crt_path=\"${certdir}/cert-${timestamp}.pem\"\n # shellcheck disable=SC2086\n sign_csr \"${certdir}/cert-${timestamp}.csr\" ${altnames} 3>\"${crt_path}\"\n\n # Create fullchain.pem\n echo \" + Creating fullchain.pem...\"\n if [[ ${API} -eq 1 ]]; then\n cat \"${crt_path}\" > \"${certdir}/fullchain-${timestamp}.pem\"\n local issuer_hash\n issuer_hash=\"$(get_issuer_hash \"${crt_path}\")\"\n if [ -e \"${CHAINCACHE}/${issuer_hash}.chain\" ]; then\n echo \" + Using cached chain!\"\n cat \"${CHAINCACHE}/${issuer_hash}.chain\" > \"${certdir}/chain-${timestamp}.pem\"\n else\n echo \" + Walking chain...\"\n local issuer_cert_uri\n issuer_cert_uri=\"$(get_issuer_cert_uri \"${crt_path}\" || echo \"unknown\")\"\n (walk_chain \"${crt_path}\" > \"${certdir}/chain-${timestamp}.pem\") || _exiterr \"Walking chain has failed, your certificate has been created and can be found at ${crt_path}, the corresponding private key at ${privkey}. If you want you can manually continue on creating and linking all necessary files. If this error occurs again you should manually generate the certificate chain and place it under ${CHAINCACHE}/${issuer_hash}.chain (see ${issuer_cert_uri})\"\n cat \"${certdir}/chain-${timestamp}.pem\" > \"${CHAINCACHE}/${issuer_hash}.chain\"\n fi\n cat \"${certdir}/chain-${timestamp}.pem\" >> \"${certdir}/fullchain-${timestamp}.pem\"\n else\n tmpcert=\"$(_mktemp)\"\n tmpchain=\"$(_mktemp)\"\n awk '{print >out}; /----END CERTIFICATE-----/{out=tmpchain}' out=\"${tmpcert}\" tmpchain=\"${tmpchain}\" \"${certdir}/cert-${timestamp}.pem\"\n mv \"${certdir}/cert-${timestamp}.pem\" \"${certdir}/fullchain-${timestamp}.pem\"\n cat \"${tmpcert}\" > \"${certdir}/cert-${timestamp}.pem\"\n cat \"${tmpchain}\" > \"${certdir}/chain-${timestamp}.pem\"\n rm \"${tmpcert}\" \"${tmpchain}\"\n fi\n\n # Wait for hook script to sync the files before creating the symlinks\n [[ -n \"${HOOK}\" ]] && (\"${HOOK}\" \"sync_cert\" \"${certdir}/privkey-${timestamp}.pem\" \"${certdir}/cert-${timestamp}.pem\" \"${certdir}/fullchain-${timestamp}.pem\" \"${certdir}/chain-${timestamp}.pem\" \"${certdir}/cert-${timestamp}.csr\" || _exiterr 'sync_cert hook returned with non-zero exit code')\n\n # Update symlinks\n [[ \"${privkey}\" = \"privkey.pem\" ]] || ln -sf \"privkey-${timestamp}.pem\" \"${certdir}/privkey.pem\"\n\n ln -sf \"chain-${timestamp}.pem\" \"${certdir}/chain.pem\"\n ln -sf \"fullchain-${timestamp}.pem\" \"${certdir}/fullchain.pem\"\n ln -sf \"cert-${timestamp}.csr\" \"${certdir}/cert.csr\"\n ln -sf \"cert-${timestamp}.pem\" \"${certdir}/cert.pem\"\n\n # Wait for hook script to clean the challenge and to deploy cert if used\n [[ -n \"${HOOK}\" ]] && (\"${HOOK}\" \"deploy_cert\" \"${domain}\" \"${certdir}/privkey.pem\" \"${certdir}/cert.pem\" \"${certdir}/fullchain.pem\" \"${certdir}/chain.pem\" \"${timestamp}\" || _exiterr 'deploy_cert hook returned with non-zero exit code')\n\n unset challenge_token\n echo \" + Done!\"\n}\n\n# Update OCSP stapling file\nupdate_ocsp_stapling() {\n local certdir=\"${1}\"\n local update_ocsp=\"${2}\"\n local cert=\"${3}\"\n local chain=\"${4}\"\n\n local ocsp_url=\"$(get_ocsp_url \"${cert}\")\"\n\n if [[ -z \"${ocsp_url}\" ]]; then\n echo \" ! ERROR: OCSP stapling requested but no OCSP url found in certificate.\" >&2\n echo \" ! Keep in mind that some CAs ended support for OCSP: https://letsencrypt.org/2024/12/05/ending-ocsp/\" >&2\n return 1\n fi\n\n if [[ ! -e \"${certdir}/ocsp.der\" ]]; then\n update_ocsp=\"yes\"\n elif ! (\"${OPENSSL}\" ocsp -no_nonce -issuer \"${chain}\" -verify_other \"${chain}\" -cert \"${cert}\" -respin \"${certdir}/ocsp.der\" -status_age $((OCSP_DAYS*24*3600)) 2>&1 | grep -q \"${cert}: good\"); then\n update_ocsp=\"yes\"\n fi\n\n if [[ \"${update_ocsp}\" = \"yes\" ]]; then\n echo \" + Updating OCSP stapling file\"\n ocsp_timestamp=\"$(date +%s)\"\n if grep -qE \"^(openssl (0|(1\\.0))\\.)|(libressl (1|2|3)\\.)\" <<< \"$(${OPENSSL} version | awk '{print tolower($0)}')\"; then\n ocsp_log=\"$(\"${OPENSSL}\" ocsp -no_nonce -issuer \"${chain}\" -verify_other \"${chain}\" -cert \"${cert}\" -respout \"${certdir}/ocsp-${ocsp_timestamp}.der\" -url \"${ocsp_url}\" -header \"HOST\" \"$(echo \"${ocsp_url}\" | _sed -e 's/^http(s?):\\/\\///' -e 's/\\/.*$//g')\" 2>&1)\" || _exiterr \"Fetching of OCSP information failed. Please note that some CAs (e.g. LetsEncrypt) do no longer support OCSP. Error message: ${ocsp_log}\"\n else\n ocsp_log=\"$(\"${OPENSSL}\" ocsp -no_nonce -issuer \"${chain}\" -verify_other \"${chain}\" -cert \"${cert}\" -respout \"${certdir}/ocsp-${ocsp_timestamp}.der\" -url \"${ocsp_url}\" 2>&1)\" || _exiterr \"Fetching of OCSP information failed. Please note that some CAs (e.g. LetsEncrypt) do no longer support OCSP. Error message: ${ocsp_log}\"\n fi\n ln -sf \"ocsp-${ocsp_timestamp}.der\" \"${certdir}/ocsp.der\"\n [[ -n \"${HOOK}\" ]] && (altnames=\"${domain} ${morenames}\" \"${HOOK}\" \"deploy_ocsp\" \"${domain}\" \"${certdir}/ocsp.der\" \"${ocsp_timestamp}\" || _exiterr 'deploy_ocsp hook returned with non-zero exit code')\n else\n echo \" + OCSP stapling file is still valid (skipping update)\"\n fi\n}\n\n# Usage: --version (-v)\n# Description: Print version information\ncommand_version() {\n load_config noverify\n\n echo \"Dehydrated by Lukas Schauer\"\n echo \"https://dehydrated.io\"\n echo \"\"\n echo \"Dehydrated version: ${VERSION}\"\n revision=\"$(cd \"${SCRIPTDIR}\"; git rev-parse HEAD 2>/dev/null || echo \"unknown\")\"\n echo \"GIT-Revision: ${revision}\"\n echo \"\"\n # shellcheck disable=SC1091\n if [[ \"${OSTYPE}\" =~ (BSD|Darwin) ]]; then\n echo \"OS: $(uname -sr)\"\n elif [[ -e /etc/os-release ]]; then\n ( . /etc/os-release && echo \"OS: $PRETTY_NAME\" )\n elif [[ -e /usr/lib/os-release ]]; then\n ( . /usr/lib/os-release && echo \"OS: $PRETTY_NAME\" )\n else\n echo \"OS: $(grep -v '^$' /etc/issue | head -n1 | _sed 's/\\\\(r|n|l) .*//g')\"\n fi\n echo \"Used software:\"\n [[ -n \"${BASH_VERSION:-}\" ]] && echo \" bash: ${BASH_VERSION}\"\n [[ -n \"${ZSH_VERSION:-}\" ]] && echo \" zsh: ${ZSH_VERSION}\"\n echo \" curl: ${CURL_VERSION}\"\n if [[ \"${OSTYPE}\" =~ (BSD|Darwin) ]]; then\n echo \" awk, sed, mktemp, grep, diff: BSD base system versions\"\n else\n echo \" awk: $(awk -W version 2>&1 | head -n1)\"\n echo \" sed: $(sed --version 2>&1 | head -n1)\"\n echo \" mktemp: $(mktemp --version 2>&1 | head -n1)\"\n echo \" grep: $(grep --version 2>&1 | head -n1)\"\n echo \" diff: $(diff --version 2>&1 | head -n1)\"\n fi\n echo \" openssl: $(\"${OPENSSL}\" version 2>&1)\"\n\n exit 0\n}\n\n# Usage: --display-terms\n# Description: Display current terms of service\ncommand_terms() {\n init_system\n echo \"The current terms of service: $CA_TERMS\"\n echo \"+ Done!\"\n exit 0\n}\n\n# Usage: --register\n# Description: Register account key\ncommand_register() {\n init_system\n echo \"+ Done!\"\n exit 0\n}\n\n# Usage: --account\n# Description: Update account contact information\ncommand_account() {\n init_system\n FAILED=false\n\n NEW_ACCOUNT_KEY_JSON=\"$(_mktemp)\"\n\n # Check if we have the registration url\n if [[ -z \"${ACCOUNT_URL}\" ]]; then\n _exiterr \"Error retrieving registration url.\"\n fi\n\n echo \"+ Updating registration url: ${ACCOUNT_URL} contact information...\"\n if [[ ${API} -eq 1 ]]; then\n # If an email for the contact has been provided then adding it to the registered account\n if [[ -n \"${CONTACT_EMAIL}\" ]]; then\n (signed_request \"${ACCOUNT_URL}\" '{\"resource\": \"reg\", \"contact\":[\"mailto:'\"${CONTACT_EMAIL}\"'\"]}' > \"${NEW_ACCOUNT_KEY_JSON}\") || FAILED=true\n else\n (signed_request \"${ACCOUNT_URL}\" '{\"resource\": \"reg\", \"contact\":[]}' > \"${NEW_ACCOUNT_KEY_JSON}\") || FAILED=true\n fi\n else\n # If an email for the contact has been provided then adding it to the registered account\n if [[ -n \"${CONTACT_EMAIL}\" ]]; then\n (signed_request \"${ACCOUNT_URL}\" '{\"contact\":[\"mailto:'\"${CONTACT_EMAIL}\"'\"]}' > \"${NEW_ACCOUNT_KEY_JSON}\") || FAILED=true\n else\n (signed_request \"${ACCOUNT_URL}\" '{\"contact\":[]}' > \"${NEW_ACCOUNT_KEY_JSON}\") || FAILED=true\n fi\n fi\n\n if [[ \"${FAILED}\" = \"true\" ]]; then\n rm \"${NEW_ACCOUNT_KEY_JSON}\"\n _exiterr \"Error updating account information. See message above for more information.\"\n fi\n if diff -q \"${NEW_ACCOUNT_KEY_JSON}\" \"${ACCOUNT_KEY_JSON}\" > /dev/null; then\n echo \"+ Account information was the same after the update\"\n rm \"${NEW_ACCOUNT_KEY_JSON}\"\n else\n ACCOUNT_KEY_JSON_BACKUP=\"${ACCOUNT_KEY_JSON%.*}-$(date +%s).json\"\n echo \"+ Backup ${ACCOUNT_KEY_JSON} as ${ACCOUNT_KEY_JSON_BACKUP}\"\n cp -p \"${ACCOUNT_KEY_JSON}\" \"${ACCOUNT_KEY_JSON_BACKUP}\"\n echo \"+ Populate ${ACCOUNT_KEY_JSON}\"\n mv \"${NEW_ACCOUNT_KEY_JSON}\" \"${ACCOUNT_KEY_JSON}\"\n fi\n echo \"+ Done!\"\n exit 0\n}\n\n# Parse contents of domains.txt and domains.txt.d\nparse_domains_txt() {\n # Allow globbing temporarily\n noglob_set\n local inputs=(\"${DOMAINS_TXT}\" \"${DOMAINS_TXT}.d\"/*.txt)\n noglob_clear\n\n cat \"${inputs[@]}\" |\n tr -d '\\r' |\n awk '{print tolower($0)}' |\n _sed -e 's/^[[:space:]]*//g' -e 's/[[:space:]]*$//g' -e 's/[[:space:]]+/ /g' -e 's/([^ ])>/\\1 >/g' -e 's/> />/g' |\n (grep -vE '^(#|$)' || true)\n}\n\n# normalize SAN lists\n# normalize IPv6 adresses, and sort alphabetically\nnormalize_san_list() {\n cat | awk '{print tolower($0)}' | _sed 's/ $//' | _sed 's/^ //' | ipv6_normalize | tr ' ' '\\n' | sort -u | tr '\\n' ' ' | _sed 's/ $//'\n}\n\n# Usage: --cron (-c)\n# Description: Sign/renew non-existent/changed/expiring certificates.\ncommand_sign_domains() {\n init_system\n hookscript_bricker_hook\n\n # Call startup hook\n [[ -n \"${HOOK}\" ]] && (\"${HOOK}\" \"startup_hook\" || _exiterr 'startup_hook hook returned with non-zero exit code')\n\n if [ ! -d \"${CHAINCACHE}\" ]; then\n echo \" + Creating chain cache directory ${CHAINCACHE}\"\n mkdir \"${CHAINCACHE}\"\n fi\n\n if [[ -n \"${PARAM_DOMAIN:-}\" ]]; then\n DOMAINS_TXT=\"$(_mktemp)\"\n if [[ -n \"${PARAM_ALIAS:-}\" ]]; then\n printf \"%s > %s\" \"${PARAM_DOMAIN}\" \"${PARAM_ALIAS}\" > \"${DOMAINS_TXT}\"\n else\n printf \"%s\" \"${PARAM_DOMAIN}\" > \"${DOMAINS_TXT}\"\n fi\n elif [[ -e \"${DOMAINS_TXT}\" ]]; then\n if [[ ! -r \"${DOMAINS_TXT}\" ]]; then\n _exiterr \"domains.txt found but not readable\"\n fi\n else\n _exiterr \"domains.txt not found and --domain not given\"\n fi\n\n # Generate certificates for all domains found in domains.txt. Check if existing certificate are about to expire\n ORIGIFS=\"${IFS}\"\n IFS=$'\\n'\n for line in $(parse_domains_txt); do\n reset_configvars\n IFS=\"${ORIGIFS}\"\n alias=\"$(grep -Eo '>[^ ]+' <<< \"${line}\" || true)\"\n line=\"$(_sed -e 's/>[^ ]+[ ]*//g' <<< \"${line}\")\"\n aliascount=\"$(grep -Eo '>' <<< \"${alias}\" | awk 'END {print NR}' || true )\"\n [ \"${aliascount}\" -gt 1 ] && _exiterr \"Only one alias per line is allowed in domains.txt!\"\n\n domain=\"$(printf '%s\\n' \"${line}\" | cut -d' ' -f1)\"\n morenames=\"$(printf '%s\\n' \"${line}\" | cut -s -d' ' -f2-)\"\n [ \"${aliascount}\" -lt 1 ] && alias=\"${domain}\" || alias=\"${alias#>}\"\n export alias\n\n if [[ -z \"${morenames}\" ]];then\n echo \"Processing ${domain}\"\n else\n echo \"Processing ${domain} with alternative names: ${morenames}\"\n fi\n\n if [ \"${alias:0:2}\" = \"*.\" ]; then\n _exiterr \"Please define a valid alias for your ${domain} wildcard-certificate. See domains.txt-documentation for more details.\"\n fi\n\n local certdir=\"${CERTDIR}/${alias}\"\n cert=\"${certdir}/cert.pem\"\n chain=\"${certdir}/chain.pem\"\n\n force_renew=\"${PARAM_FORCE:-no}\"\n\n timestamp=\"$(date +%s)\"\n\n # If there is no existing certificate directory => make it\n if [[ ! -e \"${certdir}\" ]]; then\n echo \" + Creating new directory ${certdir} ...\"\n mkdir -p \"${certdir}\" || _exiterr \"Unable to create directory ${certdir}\"\n fi\n\n # read cert config\n # for now this loads the certificate specific config in a subshell and parses a diff of set variables.\n # we could just source the config file but i decided to go this way to protect people from accidentally overriding\n # variables used internally by this script itself.\n if [[ -n \"${DOMAINS_D}\" ]]; then\n certconfig=\"${DOMAINS_D}/${alias}\"\n else\n certconfig=\"${certdir}/config\"\n fi\n\n if [ -f \"${certconfig}\" ]; then\n echo \" + Using certificate specific config file!\"\n ORIGIFS=\"${IFS}\"\n IFS=$'\\n'\n for cfgline in $(\n beforevars=\"$(_mktemp)\"\n aftervars=\"$(_mktemp)\"\n set > \"${beforevars}\"\n # shellcheck disable=SC1090\n . \"${certconfig}\"\n set > \"${aftervars}\"\n diff -u \"${beforevars}\" \"${aftervars}\" | grep -E '^\\+[^+]'\n rm \"${beforevars}\"\n rm \"${aftervars}\"\n ); do\n config_var=\"$(echo \"${cfgline:1}\" | cut -d'=' -f1)\"\n config_value=\"$(echo \"${cfgline:1}\" | cut -d'=' -f2- | tr -d \"'\")\"\n # All settings that are allowed here should also be stored and\n # restored in store_configvars() and reset_configvars()\n case \"${config_var}\" in\n KEY_ALGO|OCSP_MUST_STAPLE|OCSP_FETCH|OCSP_DAYS|PRIVATE_KEY_RENEW|PRIVATE_KEY_ROLLOVER|KEYSIZE|CHALLENGETYPE|HOOK|PREFERRED_CHAIN|WELLKNOWN|HOOK_CHAIN|OPENSSL_CNF|RENEW_DAYS|ACME_PROFILE|ORDER_TIMEOUT|VALIDATION_TIMEOUT|KEEP_GOING)\n echo \" + ${config_var} = ${config_value}\"\n declare -- \"${config_var}=${config_value}\"\n ;;\n _) ;;\n *) echo \" ! Setting ${config_var} on a per-certificate base is not (yet) supported\" >&2\n esac\n done\n IFS=\"${ORIGIFS}\"\n fi\n verify_config\n hookscript_bricker_hook\n export WELLKNOWN CHALLENGETYPE KEY_ALGO PRIVATE_KEY_ROLLOVER\n\n skip=\"no\"\n\n # Allow for external CSR generation\n local csrfile=\"\"\n if [[ -n \"${HOOK}\" ]]; then\n csr=\"$(\"${HOOK}\" \"generate_csr\" \"${domain}\" \"${certdir}\" \"${domain} ${morenames}\")\" || _exiterr 'generate_csr hook returned with non-zero exit code'\n if grep -qE \"\\-----BEGIN (NEW )?CERTIFICATE REQUEST-----\" <<< \"${csr}\"; then\n csrfile=\"$(_mktemp)\"\n cat > \"${csrfile}\" <<< \"${csr}\"\n altnames=\"$(extract_altnames \"${csrfile}\")\"\n domain=\"$(cut -d' ' -f1 <<< \"${altnames}\")\"\n morenames=\"$(cut -s -d' ' -f2- <<< \"${altnames}\")\"\n echo \" + Using CSR from hook script (real names: ${altnames})\"\n else\n csrfile=\"\"\n fi\n fi\n\n # Check domain names of existing certificate\n if [[ -e \"${cert}\" && \"${force_renew}\" = \"no\" ]]; then\n printf \" + Checking domain name(s) of existing cert...\"\n\n certnames=\"$(\"${OPENSSL}\" x509 -in \"${cert}\" -text -noout | grep -E '(DNS|IP( Address)*):' | _sed 's/(DNS|IP( Address)*)://g' | tr -d ' ' | tr ',' ' ' | normalize_san_list )\"\n givennames=\"$(echo \"${domain}\" \"${morenames}\" | _sed 's/ip://g' | normalize_san_list )\"\n\n if [[ \"${certnames}\" = \"${givennames}\" ]]; then\n echo \" unchanged.\"\n else\n echo \" changed!\"\n echo \" + Domain name(s) are not matching!\"\n echo \" + Names in old certificate: ${certnames}\"\n echo \" + Configured names: ${givennames}\"\n echo \" + Forcing renew.\"\n force_renew=\"yes\"\n fi\n fi\n\n # Check expire date of existing certificate\n if [[ -e \"${cert}\" ]]; then\n echo \" + Checking expire date of existing cert...\"\n valid=\"$(\"${OPENSSL}\" x509 -enddate -noout -in \"${cert}\" | cut -d= -f2- )\"\n\n printf \" + Valid till %s \" \"${valid}\"\n if (\"${OPENSSL}\" x509 -checkend $((RENEW_DAYS * 86400)) -in \"${cert}\" 2>&1 | grep -q \"will not expire\"); then\n printf \"(Longer than %d days). \" \"${RENEW_DAYS}\"\n if [[ \"${force_renew}\" = \"yes\" ]]; then\n echo \"Ignoring because renew was forced!\"\n else\n # Certificate-Names unchanged and cert is still valid\n echo \"Skipping renew!\"\n [[ -n \"${HOOK}\" ]] && (\"${HOOK}\" \"unchanged_cert\" \"${domain}\" \"${certdir}/privkey.pem\" \"${certdir}/cert.pem\" \"${certdir}/fullchain.pem\" \"${certdir}/chain.pem\" || _exiterr 'unchanged_cert hook returned with non-zero exit code')\n skip=\"yes\"\n fi\n else\n echo \"(Less than ${RENEW_DAYS} days). Renewing!\"\n fi\n fi\n\n local update_ocsp\n update_ocsp=\"no\"\n\n # Sign certificate for this domain\n if [[ ! \"${skip}\" = \"yes\" ]]; then\n update_ocsp=\"yes\"\n if [[ -n \"${csrfile}\" ]]; then\n cat \"${csrfile}\" > \"${certdir}/cert-${timestamp}.csr\"\n rm \"${csrfile}\"\n fi\n # shellcheck disable=SC2086\n if [[ \"${KEEP_GOING:-}\" = \"yes\" ]]; then\n skip_exit_hook=yes\n sign_domain \"${certdir}\" \"${timestamp}\" \"${domain}\" ${morenames} &\n wait $! || exit_with_errorcode=1\n skip_exit_hook=no\n else\n sign_domain \"${certdir}\" \"${timestamp}\" \"${domain}\" ${morenames}\n fi\n fi\n\n if [[ \"${OCSP_FETCH}\" = \"yes\" ]]; then\n if [[ \"${KEEP_GOING:-}\" = \"yes\" ]]; then\n skip_exit_hook=yes\n update_ocsp_stapling \"${certdir}\" \"${update_ocsp}\" \"${cert}\" \"${chain}\" &\n wait $! || exit_with_errorcode=1\n skip_exit_hook=no\n else\n update_ocsp_stapling \"${certdir}\" \"${update_ocsp}\" \"${cert}\" \"${chain}\"\n fi\n fi\n done\n reset_configvars\n\n # remove temporary domains.txt file if used\n [[ -n \"${PARAM_DOMAIN:-}\" ]] && rm -f \"${DOMAINS_TXT}\"\n\n [[ -n \"${HOOK}\" ]] && (\"${HOOK}\" \"exit_hook\" || echo 'exit_hook returned with non-zero exit code!' >&2)\n if [[ \"${AUTO_CLEANUP}\" == \"yes\" ]]; then\n echo \" + Running automatic cleanup\"\n PARAM_CLEANUPDELETE=\"${AUTO_CLEANUP_DELETE:-no}\" command_cleanup noinit | _sed 's/^/ + /g'\n fi\n\n exit \"${exit_with_errorcode}\"\n}\n\n# Usage: --signcsr (-s) path/to/csr.pem\n# Description: Sign a given CSR, output CRT on stdout (advanced usage)\ncommand_sign_csr() {\n init_system\n\n # redirect stdout to stderr\n # leave stdout over at fd 3 to output the cert\n exec 3>&1 1>&2\n\n # load csr\n local csrfile=\"${1}\"\n if [ ! -r \"${csrfile}\" ]; then\n _exiterr \"Could not read certificate signing request ${csrfile}\"\n fi\n\n # extract names\n altnames=\"$(extract_altnames \"${csrfile}\")\"\n\n # gen cert\n certfile=\"$(_mktemp)\"\n # shellcheck disable=SC2086\n sign_csr \"${csrfile}\" ${altnames} 3> \"${certfile}\"\n\n # print cert\n echo \"# CERT #\" >&3\n cat \"${certfile}\" >&3\n echo >&3\n\n # print chain\n if [ -n \"${PARAM_FULL_CHAIN:-}\" ]; then\n # get and convert ca cert\n chainfile=\"$(_mktemp)\"\n tmpchain=\"$(_mktemp)\"\n http_request get \"$(\"${OPENSSL}\" x509 -in \"${certfile}\" -noout -text | grep 'CA Issuers - URI:' | cut -d':' -f2-)\" > \"${tmpchain}\"\n if grep -q \"BEGIN CERTIFICATE\" \"${tmpchain}\"; then\n mv \"${tmpchain}\" \"${chainfile}\"\n else\n \"${OPENSSL}\" x509 -in \"${tmpchain}\" -inform DER -out \"${chainfile}\" -outform PEM\n rm \"${tmpchain}\"\n fi\n\n echo \"# CHAIN #\" >&3\n cat \"${chainfile}\" >&3\n\n rm \"${chainfile}\"\n fi\n\n # cleanup\n rm \"${certfile}\"\n\n exit 0\n}\n\n# Usage: --revoke (-r) path/to/cert.pem\n# Description: Revoke specified certificate\ncommand_revoke() {\n init_system\n\n [[ -n \"${CA_REVOKE_CERT}\" ]] || _exiterr \"Certificate authority doesn't allow certificate revocation.\"\n\n cert=\"${1}\"\n if [[ -L \"${cert}\" ]]; then\n # follow symlink and use real certificate name (so we move the real file and not the symlink at the end)\n local link_target\n link_target=\"$(readlink -n \"${cert}\")\"\n if [[ \"${link_target}\" =~ ^/ ]]; then\n cert=\"${link_target}\"\n else\n cert=\"$(dirname \"${cert}\")/${link_target}\"\n fi\n fi\n [[ -f \"${cert}\" ]] || _exiterr \"Could not find certificate ${cert}\"\n\n echo \"Revoking ${cert}\"\n\n cert64=\"$(\"${OPENSSL}\" x509 -in \"${cert}\" -inform PEM -outform DER | urlbase64)\"\n if [[ ${API} -eq 1 ]]; then\n response=\"$(signed_request \"${CA_REVOKE_CERT}\" '{\"resource\": \"revoke-cert\", \"certificate\": \"'\"${cert64}\"'\"}' | clean_json)\"\n else\n response=\"$(signed_request \"${CA_REVOKE_CERT}\" '{\"certificate\": \"'\"${cert64}\"'\"}' | clean_json)\"\n fi\n # if there is a problem with our revoke request _request (via signed_request) will report this and \"exit 1\" out\n # so if we are here, it is safe to assume the request was successful\n echo \" + Done.\"\n echo \" + Renaming certificate to ${cert}-revoked\"\n mv -f \"${cert}\" \"${cert}-revoked\"\n}\n\n# Usage: --deactivate\n# Description: Deactivate account\ncommand_deactivate() {\n init_system\n\n echo \"Deactivating account ${ACCOUNT_URL}\"\n\n if [[ ${API} -eq 1 ]]; then\n echo \"Deactivation for ACMEv1 is not implemented\"\n else\n response=\"$(signed_request \"${ACCOUNT_URL}\" '{\"status\": \"deactivated\"}' | clean_json)\"\n deactstatus=$(echo \"$response\" | jsonsh | get_json_string_value \"status\")\n if [[ \"${deactstatus}\" = \"deactivated\" ]]; then\n touch \"${ACCOUNT_DEACTIVATED}\"\n else\n _exiterr \"Account deactivation failed!\"\n fi\n fi\n\n echo \" + Done.\"\n}\n\n# Usage: --cleanup (-gc)\n# Description: Move unused certificate files to archive directory\ncommand_cleanup() {\n if [ ! \"${1:-}\" = \"noinit\" ]; then\n load_config\n fi\n\n if [[ ! \"${PARAM_CLEANUPDELETE:-}\" = \"yes\" ]]; then\n # Create global archive directory if not existent\n if [[ ! -e \"${BASEDIR}/archive\" ]]; then\n mkdir \"${BASEDIR}/archive\"\n fi\n fi\n\n # Allow globbing\n noglob_set\n\n # Loop over all certificate directories\n for certdir in \"${CERTDIR}/\"*; do\n # Skip if entry is not a folder\n [[ -d \"${certdir}\" ]] || continue\n\n # Get certificate name\n certname=\"$(basename \"${certdir}\")\"\n\n # Create certificates archive directory if not existent\n if [[ ! \"${PARAM_CLEANUPDELETE:-}\" = \"yes\" ]]; then\n archivedir=\"${BASEDIR}/archive/${certname}\"\n if [[ ! -e \"${archivedir}\" ]]; then\n mkdir \"${archivedir}\"\n fi\n fi\n\n # Loop over file-types (certificates, keys, signing-requests, ...)\n for filetype in cert.csr cert.pem chain.pem fullchain.pem privkey.pem ocsp.der; do\n # Delete all if symlink is broken\n if [[ -r \"${certdir}/${filetype}\" ]]; then\n # Look up current file in use\n current=\"$(basename \"$(readlink \"${certdir}/${filetype}\")\")\"\n else\n if [[ -h \"${certdir}/${filetype}\" ]]; then\n echo \"Removing broken symlink: ${certdir}/${filetype}\"\n rm -f \"${certdir}/${filetype}\"\n fi\n current=\"\"\n fi\n\n # Split filetype into name and extension\n filebase=\"$(echo \"${filetype}\" | cut -d. -f1)\"\n fileext=\"$(echo \"${filetype}\" | cut -d. -f2)\"\n\n # Loop over all files of this type\n for file in \"${certdir}/${filebase}-\"*\".${fileext}\" \"${certdir}/${filebase}-\"*\".${fileext}-revoked\"; do\n # Check if current file is in use, if unused move to archive directory\n filename=\"$(basename \"${file}\")\"\n if [[ ! \"${filename}\" = \"${current}\" ]] && [[ -f \"${certdir}/${filename}\" ]]; then\n if [[ \"${PARAM_CLEANUPDELETE:-}\" = \"yes\" ]]; then\n echo \"Deleting unused file: ${certname}/${filename}\"\n rm \"${certdir}/${filename}\"\n else\n echo \"Moving unused file to archive directory: ${certname}/${filename}\"\n mv \"${certdir}/${filename}\" \"${archivedir}/${filename}\"\n fi\n fi\n done\n done\n done\n\n exit \"${exit_with_errorcode}\"\n}\n\n# Usage: --cleanup-delete (-gcd)\n# Description: Deletes (!) unused certificate files\ncommand_cleanupdelete() {\n command_cleanup\n}\n\n\n# Usage: --help (-h)\n# Description: Show help text\ncommand_help() {\n printf \"Usage: %s [-h] [command [argument]] [parameter [argument]] [parameter [argument]] ...\\n\\n\" \"${0}\"\n printf \"Default command: help\\n\\n\"\n echo \"Commands:\"\n grep -e '^[[:space:]]*# Usage:' -e '^[[:space:]]*# Description:' -e '^command_.*()[[:space:]]*{' \"${0}\" | while read -r usage; read -r description; read -r command; do\n if [[ ! \"${usage}\" =~ Usage ]] || [[ ! \"${description}\" =~ Description ]] || [[ ! \"${command}\" =~ ^command_ ]]; then\n _exiterr \"Error generating help text.\"\n fi\n printf \" %-32s %s\\n\" \"${usage##\"# Usage: \"}\" \"${description##\"# Description: \"}\"\n done\n printf -- \"\\nParameters:\\n\"\n grep -E -e '^[[:space:]]*# PARAM_Usage:' -e '^[[:space:]]*# PARAM_Description:' \"${0}\" | while read -r usage; read -r description; do\n if [[ ! \"${usage}\" =~ Usage ]] || [[ ! \"${description}\" =~ Description ]]; then\n _exiterr \"Error generating help text.\"\n fi\n printf \" %-32s %s\\n\" \"${usage##\"# PARAM_Usage: \"}\" \"${description##\"# PARAM_Description: \"}\"\n done\n}\n\n# Usage: --env (-e)\n# Description: Output configuration variables for use in other scripts\ncommand_env() {\n echo \"# dehydrated configuration\"\n load_config\n typeset -p CA CERTDIR ALPNCERTDIR CHALLENGETYPE DOMAINS_D DOMAINS_TXT HOOK HOOK_CHAIN RENEW_DAYS ACCOUNT_KEY ACCOUNT_KEY_JSON ACCOUNT_ID_JSON KEYSIZE WELLKNOWN PRIVATE_KEY_RENEW OPENSSL_CNF CONTACT_EMAIL LOCKFILE\n}\n\n# Main method (parses script arguments and calls command_* methods)\nmain() {\n exit_with_errorcode=0\n skip_exit_hook=no\n COMMAND=\"\"\n set_command() {\n [[ -z \"${COMMAND}\" ]] || _exiterr \"Only one command can be executed at a time. See help (-h) for more information.\"\n COMMAND=\"${1}\"\n }\n\n check_parameters() {\n if [[ -z \"${1:-}\" ]]; then\n echo \"The specified command requires additional parameters. See help:\" >&2\n echo >&2\n command_help >&2\n exit 1\n elif [[ \"${1:0:1}\" = \"-\" ]]; then\n _exiterr \"Invalid argument: ${1}\"\n fi\n }\n\n [[ -z \"${*}\" ]] && eval set -- \"--help\"\n\n while (( ${#} )); do\n case \"${1}\" in\n --help|-h)\n command_help\n exit 0\n ;;\n\n --env|-e)\n set_command env\n ;;\n\n --cron|-c)\n set_command sign_domains\n ;;\n\n --register)\n set_command register\n ;;\n\n --account)\n set_command account\n ;;\n\n # PARAM_Usage: --accept-terms\n # PARAM_Description: Accept CAs terms of service\n --accept-terms)\n PARAM_ACCEPT_TERMS=\"yes\"\n ;;\n\n --display-terms)\n set_command terms\n ;;\n\n --signcsr|-s)\n shift 1\n set_command sign_csr\n check_parameters \"${1:-}\"\n PARAM_CSR=\"${1}\"\n ;;\n\n --revoke|-r)\n shift 1\n set_command revoke\n check_parameters \"${1:-}\"\n PARAM_REVOKECERT=\"${1}\"\n ;;\n\n --deactivate)\n set_command deactivate\n ;;\n\n --version|-v)\n set_command version\n ;;\n\n --cleanup|-gc)\n set_command cleanup\n ;;\n\n --cleanup-delete|-gcd)\n set_command cleanupdelete\n PARAM_CLEANUPDELETE=\"yes\"\n ;;\n\n # PARAM_Usage: --full-chain (-fc)\n # PARAM_Description: Print full chain when using --signcsr\n --full-chain|-fc)\n PARAM_FULL_CHAIN=\"1\"\n ;;\n\n # PARAM_Usage: --ipv4 (-4)\n # PARAM_Description: Resolve names to IPv4 addresses only\n --ipv4|-4)\n PARAM_IP_VERSION=\"4\"\n ;;\n\n # PARAM_Usage: --ipv6 (-6)\n # PARAM_Description: Resolve names to IPv6 addresses only\n --ipv6|-6)\n PARAM_IP_VERSION=\"6\"\n ;;\n\n # PARAM_Usage: --domain (-d) domain.tld\n # PARAM_Description: Use specified domain name(s) instead of domains.txt entry (one certificate!)\n --domain|-d)\n shift 1\n check_parameters \"${1:-}\"\n if [[ -z \"${PARAM_DOMAIN:-}\" ]]; then\n PARAM_DOMAIN=\"${1}\"\n else\n PARAM_DOMAIN=\"${PARAM_DOMAIN} ${1}\"\n fi\n ;;\n\n # PARAM_Usage: --ca url/preset\n # PARAM_Description: Use specified CA URL or preset\n --ca)\n shift 1\n check_parameters \"${1:-}\"\n [[ -n \"${PARAM_CA:-}\" ]] && _exiterr \"CA can only be specified once!\"\n PARAM_CA=\"${1}\"\n ;;\n\n # PARAM_Usage: --alias certalias\n # PARAM_Description: Use specified name for certificate directory (and per-certificate config) instead of the primary domain (only used if --domain is specified)\n --alias)\n shift 1\n check_parameters \"${1:-}\"\n [[ -n \"${PARAM_ALIAS:-}\" ]] && _exiterr \"Alias can only be specified once!\"\n PARAM_ALIAS=\"${1}\"\n ;;\n\n # PARAM_Usage: --keep-going (-g)\n # PARAM_Description: Keep going after encountering an error while creating/renewing multiple certificates in cron mode\n --keep-going|-g)\n PARAM_KEEP_GOING=\"yes\"\n ;;\n\n # PARAM_Usage: --force (-x)\n # PARAM_Description: Force certificate renewal even if it is not due to expire within RENEW_DAYS\n --force|-x)\n PARAM_FORCE=\"yes\"\n ;;\n\n # PARAM_Usage: --force-validation\n # PARAM_Description: Force revalidation of domain names (used in combination with --force)\n --force-validation)\n PARAM_FORCE_VALIDATION=\"yes\"\n ;;\n\n # PARAM_Usage: --no-lock (-n)\n # PARAM_Description: Don't use lockfile (potentially dangerous!)\n --no-lock|-n)\n PARAM_NO_LOCK=\"yes\"\n ;;\n\n # PARAM_Usage: --lock-suffix example.com\n # PARAM_Description: Suffix lockfile name with a string (useful for with -d)\n --lock-suffix)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_LOCKFILE_SUFFIX=\"${1}\"\n ;;\n\n # PARAM_Usage: --ocsp\n # PARAM_Description: Sets option in CSR indicating OCSP stapling to be mandatory\n --ocsp)\n PARAM_OCSP_MUST_STAPLE=\"yes\"\n ;;\n\n # PARAM_Usage: --privkey (-p) path/to/key.pem\n # PARAM_Description: Use specified private key instead of account key (useful for revocation)\n --privkey|-p)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_ACCOUNT_KEY=\"${1}\"\n ;;\n\n # PARAM_Usage: --domains-txt path/to/domains.txt\n # PARAM_Description: Use specified domains.txt instead of default/configured one\n --domains-txt)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_DOMAINS_TXT=\"${1}\"\n ;;\n\n # PARAM_Usage: --config (-f) path/to/config\n # PARAM_Description: Use specified config file\n --config|-f)\n shift 1\n check_parameters \"${1:-}\"\n CONFIG=\"${1}\"\n ;;\n\n # PARAM_Usage: --hook (-k) path/to/hook.sh\n # PARAM_Description: Use specified script for hooks\n --hook|-k)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_HOOK=\"${1}\"\n ;;\n\n # PARAM_Usage: --preferred-chain issuer-cn\n # PARAM_Description: Use alternative certificate chain identified by issuer CN\n --preferred-chain)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_PREFERRED_CHAIN=\"${1}\"\n ;;\n\n # PARAM_Usage: --out (-o) certs/directory\n # PARAM_Description: Output certificates into the specified directory\n --out|-o)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_CERTDIR=\"${1}\"\n ;;\n\n # PARAM_Usage: --alpn alpn-certs/directory\n # PARAM_Description: Output alpn verification certificates into the specified directory\n --alpn)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_ALPNCERTDIR=\"${1}\"\n ;;\n\n # PARAM_Usage: --challenge (-t) http-01|dns-01|dns-persist-01|tls-alpn-01\n # PARAM_Description: Which challenge should be used? Currently http-01, dns-01, dns-persist-01 and tls-alpn-01 are supported\n --challenge|-t)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_CHALLENGETYPE=\"${1}\"\n ;;\n\n # PARAM_Usage: --algo (-a) rsa|prime256v1|secp384r1\n # PARAM_Description: Which public key algorithm should be used? Supported: rsa, prime256v1 and secp384r1\n --algo|-a)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_KEY_ALGO=\"${1}\"\n ;;\n\n # PARAM_Usage: --acme-profile profile_name\n # PARAM_Description: Use specified ACME profile\n --acme-profile)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_ACME_PROFILE=\"${1}\"\n ;;\n\n # PARAM_Usage: --order-timeout seconds\n # PARAM_Description: Amount of seconds to wait for processing of order until erroring out\n --order-timeout)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_ORDER_TIMEOUT=${1}\n ;;\n\n # PARAM_Usage: --validation-timeout seconds\n # PARAM_Description: Amount of seconds to wait for processing of domain validations until erroring out\n --validation-timeout)\n shift 1\n check_parameters \"${1:-}\"\n PARAM_VALIDATION_TIMEOUT=${1}\n ;;\n\n *)\n echo \"Unknown parameter detected: ${1}\" >&2\n echo >&2\n command_help >&2\n exit 1\n ;;\n esac\n\n shift 1\n done\n\n case \"${COMMAND}\" in\n env) command_env;;\n sign_domains) command_sign_domains;;\n register) command_register;;\n account) command_account;;\n sign_csr) command_sign_csr \"${PARAM_CSR}\";;\n revoke) command_revoke \"${PARAM_REVOKECERT}\";;\n deactivate) command_deactivate;;\n cleanup) command_cleanup;;\n terms) command_terms;;\n cleanupdelete) command_cleanupdelete;;\n version) command_version;;\n *) command_help; exit 1;;\n esac\n\n exit \"${exit_with_errorcode}\"\n}\n\n# Determine OS type\nOSTYPE=\"$(uname)\"\n\nif [[ ! \"${DEHYDRATED_NOOP:-}\" = \"NOOP\" ]]; then\n # Run script\n main \"${@:-}\"\nfi\n\n# vi: expandtab sw=2 ts=2\n" }, { "path": "aegir/helpers/dump_cdorked_config.c", "content": "// This program dumps the content of a shared memory block\n// used by Linux/Cdorked.A into a file named httpd_cdorked_config.bin\n// when the machine is infected.\n//\n// Some of the data is encrypted. If your server is infected and you\n// would like to help, please send the httpd_cdorked_config.bin\n// and your httpd executable to our lab for analysis. Thanks!\n//\n// Build with gcc -o dump_cdorked_config dump_cdorked_config.c\n//\n// Marc-Etienne M.Léveillé \n//\n\n#include \n#include \n\n#define CDORKED_SHM_SIZE (6118512)\n#define CDORKED_OUTFILE \"httpd_cdorked_config.bin\"\n\nint main (int argc, char *argv[]) {\n int maxkey, id, shmid, infected = 0;\n struct shm_info shm_info;\n struct shmid_ds shmds;\n void * cdorked_data;\n FILE * outfile;\n \n maxkey = shmctl(0, SHM_INFO, (void *) &shm_info);\n for(id = 0; id <= maxkey; id++) {\n shmid = shmctl(id, SHM_STAT, &shmds);\n if (shmid < 0)\n continue;\n \n if(shmds.shm_segsz == CDORKED_SHM_SIZE) {\n // We have a matching Cdorked memory segment\n infected++;\n printf(\"A shared memory matching Cdorked signature was found.\\n\");\n printf(\"You should check your HTTP server's executable file integrity.\\n\");\n \n cdorked_data = shmat(shmid, NULL, 0666);\n if(cdorked_data != NULL) {\n outfile = fopen(CDORKED_OUTFILE, \"wb\");\n if(outfile == NULL) {\n printf(\"Could not open file %s for writing.\", CDORKED_OUTFILE);\n }\n else {\n fwrite(cdorked_data, CDORKED_SHM_SIZE, 1, outfile);\n fclose(outfile);\n \n printf(\"The Cdorked configuration was dumped in the %s file.\\n\\n\", CDORKED_OUTFILE);\n }\n }\n }\n }\n if(infected == 0) {\n printf(\"No shared memory matching Cdorked signature was found.\\n\");\n printf(\"To further verify your server, run \\\"ipcs -m -p\\\" and look\");\n printf(\" for a memory segments created by your http server.\\n\");\n }\n else {\n printf(\"If you would like to help us in our research on Cdorked, \");\n printf(\"please send the httpd_cdorked_config.bin and your httpd executable file \");\n printf(\"to our lab for analysis at leveille@eset.com. Thanks!\\n\");\n }\n return infected;\n}\n" }, { "path": "aegir/helpers/fix-fstab-to-uuid.sh", "content": "#!/bin/bash\n\n# Enable strict error handling for debugging only\n# set -euo pipefail\n\necho \"Backing up /etc/fstab to /etc/fstab.bak\"\ncp -p /etc/fstab /etc/fstab.bak\n\necho \"Processing Linode volume mounts...\"\n\n# Loop through current fstab entries related to Linode Volumes\ngrep '/dev/disk/by-id/scsi-0Linode_Volume_' /etc/fstab.bak | while read -r line; do\n # Extract device and mount point\n device=$(echo \"$line\" | awk '{print $1}')\n mountpoint=$(echo \"$line\" | awk '{print $2}')\n\n # Resolve the real device path (like /dev/sdb, /dev/sdc)\n realdev=$(readlink -f \"$device\")\n\n # Get the UUID of the real device\n uuid=$(blkid -s UUID -o value \"$realdev\")\n\n if [ -n \"$uuid\" ]; then\n echo \"Updating $mountpoint to UUID=$uuid\"\n # Escape slashes for sed replacement\n escaped_device=$(echo \"$device\" | sed 's|/|\\\\/|g')\n sed -i \"s|$escaped_device|UUID=$uuid|\" /etc/fstab\n else\n echo \"Warning: UUID not found for $device ($realdev)\"\n fi\ndone\n\necho \"Checking with diff..\"\ndiff -urp /etc/fstab.bak /etc/fstab\n\necho \"Done. New /etc/fstab is ready.\"\necho \"Please verify with: cat /etc/fstab\"\necho \"If everything looks good, you can safely reboot.\"\n" }, { "path": "aegir/helpers/hosting_cron.sql", "content": "CREATE TABLE IF NOT EXISTS `hosting_cron` (\n `nid` int(10) unsigned NOT NULL DEFAULT '0',\n `cron_interval` int(10) unsigned NOT NULL DEFAULT '0',\n PRIMARY KEY (`nid`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;\n" }, { "path": "aegir/helpers/le-hook.sh", "content": "#!/usr/bin/env bash\n# https://github.com/lukas2511/dehydrated/blob/master/docs/examples/hook.sh\n\n# Enable strict error handling for debugging only\n# set -euo pipefail\n\ndeploy_challenge() {\n\t\tlocal DOMAIN=\"${1}\" TOKEN_FILENAME=\"${2}\" TOKEN_VALUE=\"${3}\"\n\t\techo \"\"\n\t\techo \"Add the following to the zone definition of ${1}:\"\n\t\techo \"_acme-challenge.${1}. IN TXT \\\"${3}\\\"\"\n\t\techo \"\"\n\t\techo -n \"Press enter to continue...\"\n\t\tread tmp\n\t\techo \"\"\n}\n\nclean_challenge() {\n\t\tlocal DOMAIN=\"${1}\" TOKEN_FILENAME=\"${2}\" TOKEN_VALUE=\"${3}\"\n\t\techo \"\"\n\t\techo \"Now you can remove the following from the zone definition of ${1}:\"\n\t\techo \"_acme-challenge.${1}. IN TXT \\\"${3}\\\"\"\n\t\techo \"\"\n\t\techo -n \"Press enter to continue...\"\n\t\tread tmp\n\t\techo \"\"\n}\n\ndeploy_cert() {\n\t\tlocal DOMAIN=\"${1}\" KEYFILE=\"${2}\" CERTFILE=\"${3}\" FULLCHAINFILE=\"${4}\" CHAINFILE=\"${5}\" TIMESTAMP=\"${6}\"\n\t\techo \"\"\n\t\techo \"deploy_cert()\"\n\t\techo \"\"\n}\n\nunchanged_cert() {\n local DOMAIN=\"${1}\" KEYFILE=\"${2}\" CERTFILE=\"${3}\" FULLCHAINFILE=\"${4}\" CHAINFILE=\"${5}\"\n\t\techo \"\"\n\t\techo \"unchanged_cert()\"\n\t\techo \"\"\n}\n\ninvalid_challenge() {\n local DOMAIN=\"${1}\" RESPONSE=\"${2}\"\n\t\techo \"\"\n\t\techo \"invalid_challenge()\"\n\t\techo \"${1}\"\n\t\techo \"${2}\"\n\t\techo \"\"\n}\n\nrequest_failure() {\n local STATUSCODE=\"${1}\" REASON=\"${2}\" REQTYPE=\"${3}\"\n\t\techo \"\"\n\t\techo \"request_failure()\"\n\t\techo \"${1}\"\n\t\techo \"${2}\"\n\t\techo \"${3}\"\n\t\techo \"\"\n}\n\nexit_hook() {\n\t\techo \"\"\n\t\techo \"done\"\n\t\techo \"\"\n}\n\nHANDLER=\"$1\"; shift\nif [[ \"${HANDLER}\" =~ ^(deploy_challenge|clean_challenge|deploy_cert|unchanged_cert|invalid_challenge|request_failure|exit_hook)$ ]]; then\n \"$HANDLER\" \"$@\"\nfi\n" }, { "path": "aegir/helpers/make_client.php.txt", "content": "uid = 1;\n $node->type = 'client';\n $node->email = $_SERVER['argv'][3];\n $node->title = 'Octopus' . $number;\n $node->language = LANGUAGE_NONE;\n $node->status = 1;\n node_object_prepare($node);\n $node = node_submit($node);\n node_save($node);\n $this_client_id = $node->nid;\n variable_set('hosting_default_client', $node->nid);\n\n?>\n" }, { "path": "aegir/helpers/make_client_3.php.txt", "content": "uid = 1;\n $node->type = 'client';\n $node->email = $_SERVER['argv'][4];\n $node->title = 'Octopus' . $number;\n $node->status = 1;\n node_save($node);\n $this_client_id = $node->nid;\n variable_set('hosting_default_client', $node->nid);\n\n?>\n" }, { "path": "aegir/helpers/make_home.php.txt", "content": "type = 'book';\n variable_set('comment_book', '0');\n $node->title = 'Welcome to the World of Ægir';\n $node->language = LANGUAGE_NONE;\n $path = 'welcome';\n $node->path = array('alias' => $path);\n node_object_prepare($node);\n $node->uid = 1;\n $body_text = '

Do you manage more than a few Drupal sites, and feel a great sense of panic every time a security release is announced? Or maybe you only have a few sites, and would like to spend less time on the tedious (and likely manual) tasks associated with running these Drupal sites over their entire lifetime?

Solve your problems with multiple Drupal sites by running in Ægir! It\\'s even easier than tweeting! Simply enter your domain or subdomain, pointed to your Ægir instance, choose an installation profile and platform, click Save, then - wait a few minutes and you\\'re ready to go!

Now, from one web site, you can manage every other web site you\\'ve created - clone it, batch-migrate to newer platforms, reset your main password - anything you want, and it\\'s still the same 2-click easy task - as simple as posting a new tweet!



Already 900+ other hosts powering thousands of Drupal sites are running on our high-performance, Free/Libre Open Source Ægir BOA Software. BOA is an acronym of high performance Barracuda, Octopus and Ægir LEMP server stack. Barracuda installs and monitors all essential system services, while Octopus is an Ægir installer, with many popular Drupal Distributions ready to use, including: Drupal CMS, Commerce, DXPR Marketing, EzContent, farmOS, LocalGov, OpenCulturas, OpenFed, OpenLucius, Opigno LMS, Sector, Social, Thunder, Ubercart, and Varbase.



Ægir is built by a community of system administrators and developers who share Drupal deployment tools, strategies and best practices. Ægir makes it easy to install, upgrade, and backup an entire network of Drupal sites. Ægir is fully extensible, since it\\'s built on Drupal and Drush.

';\n $node->status = 1;\n $node->body[$node->language][0]['value'] = $body_text;\n $node->body[$node->language][0]['summary'] = text_summary('Welcome to the World of Ægir','filtered_html');\n $node->body[$node->language][0]['format'] = 'full_html';\n $node = node_submit($node);\n node_save($node);\n variable_set('site_frontpage', 'node/' . $node->nid);\n\n?>\n" }, { "path": "aegir/helpers/make_platform.php.txt", "content": "type = 'platform';\n $node->title = $_SERVER['argv'][3];\n $node->language = LANGUAGE_NONE;\n node_object_prepare($node);\n $node->uid = 1;\n $node->publish_path = $_SERVER['argv'][5];\n $node->web_server = variable_get('hosting_default_web_server', 2);\n $node->status = 1;\n $node = node_submit($node);\n node_save($node);\n $platform_id = $node->nid;\n variable_set('hosting_own_platform', $node->nid);\n\n // Create the platform profile node\n $node = new stdClass();\n $node->type = 'package';\n $node->title = $_SERVER['argv'][3];\n $node->language = LANGUAGE_NONE;\n node_object_prepare($node);\n $node->uid = 1;\n $node->package_type = 'profile';\n $node->short_name = $_SERVER['argv'][4];\n $node->status = 1;\n $node = node_submit($node);\n node_save($node);\n\n?>\n" }, { "path": "aegir/helpers/make_platform_3.php.txt", "content": "uid = 1;\n $node->type = 'platform';\n $node->title = $_SERVER['argv'][4];\n $node->publish_path = $_SERVER['argv'][6];\n $node->web_server = variable_get('hosting_default_web_server', 2);\n $node->status = 1;\n node_save($node);\n $platform_id = $node->nid;\n variable_set('hosting_own_platform', $node->nid);\n\n // Create the platform profile node\n $node = new stdClass();\n $node->uid = 1;\n $node->title = $_SERVER['argv'][4];\n $node->type = 'package';\n $node->package_type = 'profile';\n $node->short_name = $_SERVER['argv'][5];\n $node->status = 1;\n node_save($node);\n\n?>\n" }, { "path": "aegir/helpers/mysql_root_pass_reset.sh", "content": "service cron stop\n\n### Check /root/.my.cnf\nserver:~# cat /root/.my.cnf\n[client]\nuser=root\npassword=FOOO\nserver:~#\n\n### If /root/.my.pass.txt does not exist or does not match /root/.my.cnf\nserver:~# echo FOOO > /root/.my.pass.txt\n\n### If /etc/mysql_pre exists and /etc/mysql does not\nserver:~# mv -f /etc/mysql_pre /etc/mysql\n\n### Wait 60 sec.\n\n### Run:\nservice mysql stop\nps axf | grep mysql\n\n### For Percona 8.0 and 8.4\n/usr/sbin/mysqld \\\n --defaults-file=/etc/mysql/my.cnf \\\n --user=mysql \\\n --skip-grant-tables \\\n --skip-networking \\\n --log-error-verbosity=3 \\\n --daemonize=OFF\n\n### For Percona 5.7\n/usr/sbin/mysqld \\\n --defaults-file=/etc/mysql/my.cnf \\\n --user=mysql \\\n --skip-grant-tables \\\n --skip-networking \\\n --log-warnings=2\n\nserver:~# mysql\nFLUSH PRIVILEGES;\nALTER USER 'root'@'127.0.0.1' IDENTIFIED WITH mysql_native_password BY 'FOOO';\nALTER USER 'root'@'::1' IDENTIFIED WITH mysql_native_password BY 'FOOO';\nALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'FOOO';\nFLUSH PRIVILEGES;\nmysql> exit\n\nserver:~# service mysql restart\n\nserver:~# mysql\nmysql> exit\n\nserver:~# service cron start\n\n\n" }, { "path": "aegir/helpers/mysqltuner5", "content": "#!/usr/bin/env perl\n# mysqltuner.pl - Version 2.5.2\n# High Performance MySQL Tuning Script\n# Copyright (C) 2015-2023 Jean-Marie Renouard - jmrenouard@gmail.com\n# Copyright (C) 2006-2023 Major Hayden - major@mhtx.net\n\n# For the latest updates, please visit http://mysqltuner.pl/\n# Git repository available at https://github.com/major/MySQLTuner-perl\n#\n# This program is free software: you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation, either version 3 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program. If not, see .\n#\n# This project would not be possible without help from:\n# Matthew Montgomery Paul Kehrer Dave Burgess\n# Jonathan Hinds Mike Jackson Nils Breunese\n# Shawn Ashlee Luuk Vosslamber Ville Skytta\n# Trent Hornibrook Jason Gill Mark Imbriaco\n# Greg Eden Aubin Galinotti Giovanni Bechis\n# Bill Bradford Ryan Novosielski Michael Scheidell\n# Blair Christensen Hans du Plooy Victor Trac\n# Everett Barnes Tom Krouper Gary Barrueto\n# Simon Greenaway Adam Stein Isart Montane\n# Baptiste M. Cole Turner Major Hayden\n# Joe Ashcraft Jean-Marie Renouard Christian Loos\n# Julien Francoz Daniel Black Long Radix\n#\n# Inspired by Matthew Montgomery's tuning-primer.sh script:\n# http://www.day32.com/MySQL/\n#\npackage main;\n\nuse 5.005;\nuse strict;\nuse warnings;\n\nuse diagnostics;\nuse File::Spec;\nuse Getopt::Long;\nuse Pod::Usage;\nuse File::Basename;\nuse Cwd 'abs_path';\n\n#use Data::Dumper;\n#$Data::Dumper::Pair = \" : \";\n\n# for which()\n#use Env;\n\n# Set up a few variables for use in the script\nmy $tunerversion = \"2.5.2\";\nmy ( @adjvars, @generalrec );\n\n# Set defaults\nmy %opt = (\n \"silent\" => 0,\n \"nobad\" => 0,\n \"nogood\" => 0,\n \"noinfo\" => 0,\n \"debug\" => 0,\n \"nocolor\" => ( !-t STDOUT ),\n \"color\" => ( -t STDOUT ),\n \"forcemem\" => 0,\n \"forceswap\" => 0,\n \"host\" => 0,\n \"socket\" => 0,\n \"port\" => 0,\n \"user\" => 0,\n \"pass\" => 0,\n \"password\" => 0,\n \"ssl-ca\" => 0,\n \"skipsize\" => 0,\n \"checkversion\" => 0,\n \"updateversion\" => 0,\n \"buffers\" => 0,\n \"passwordfile\" => 0,\n \"bannedports\" => '',\n \"maxportallowed\" => 0,\n \"outputfile\" => 0,\n \"noprocess\" => 0,\n \"dbstat\" => 0,\n \"nodbstat\" => 0,\n \"server-log\" => '',\n \"tbstat\" => 0,\n \"notbstat\" => 0,\n \"colstat\" => 0,\n \"nocolstat\" => 0,\n \"idxstat\" => 0,\n \"noidxstat\" => 0,\n \"nomyisamstat\" => 0,\n \"nostructstat\" => 0,\n \"sysstat\" => 0,\n \"nosysstat\" => 0,\n \"pfstat\" => 0,\n \"nopfstat\" => 0,\n \"skippassword\" => 0,\n \"noask\" => 0,\n \"template\" => 0,\n \"json\" => 0,\n \"prettyjson\" => 0,\n \"reportfile\" => 0,\n \"verbose\" => 0,\n \"defaults-file\" => '',\n \"defaults-extra-file\" => '',\n \"protocol\" => '',\n \"dumpdir\" => '',\n \"feature\" => '',\n \"dbgpattern\" => '',\n \"defaultarch\" => 64\n);\n\n# Gather the options from the command line\nGetOptions(\n \\%opt, 'nobad',\n 'nogood', 'noinfo',\n 'debug', 'nocolor',\n 'forcemem=i', 'forceswap=i',\n 'host=s', 'socket=s',\n 'port=i', 'user=s',\n 'pass=s', 'skipsize',\n 'checkversion', 'mysqladmin=s',\n 'mysqlcmd=s', 'help',\n 'buffers', 'skippassword',\n 'passwordfile=s', 'outputfile=s',\n 'silent', 'noask',\n 'json', 'prettyjson',\n 'template=s', 'reportfile=s',\n 'cvefile=s', 'bannedports=s',\n 'updateversion', 'maxportallowed=s',\n 'verbose', 'password=s',\n 'passenv=s', 'userenv=s',\n 'defaults-file=s', 'ssl-ca=s',\n 'color', 'noprocess',\n 'dbstat', 'nodbstat',\n 'tbstat', 'notbstat',\n 'colstat', 'nocolstat',\n 'sysstat', 'nosysstat',\n 'pfstat', 'nopfstat',\n 'idxstat', 'noidxstat',\n 'structstat', 'nostructstat',\n 'myisamstat', 'nomyisamstat',\n 'server-log=s', 'protocol=s',\n 'defaults-extra-file=s', 'dumpdir=s',\n 'feature=s', 'dbgpattern=s',\n 'defaultarch=i'\n )\n or pod2usage(\n -exitval => 1,\n -verbose => 99,\n -sections => [\n \"NAME\",\n \"IMPORTANT USAGE GUIDELINES\",\n \"CONNECTION AND AUTHENTICATION\",\n \"PERFORMANCE AND REPORTING OPTIONS\",\n \"OUTPUT OPTIONS\"\n ]\n );\n\nif ( defined $opt{'help'} && $opt{'help'} == 1 ) {\n pod2usage(\n -exitval => 0,\n -verbose => 99,\n -sections => [\n \"NAME\",\n \"IMPORTANT USAGE GUIDELINES\",\n \"CONNECTION AND AUTHENTICATION\",\n \"PERFORMANCE AND REPORTING OPTIONS\",\n \"OUTPUT OPTIONS\"\n ]\n );\n}\n\nmy $devnull = File::Spec->devnull();\nmy $basic_password_files =\n ( $opt{passwordfile} eq \"0\" )\n ? abs_path( dirname(__FILE__) ) . \"/basic_passwords.txt\"\n : abs_path( $opt{passwordfile} );\n\n# Username from envvar\nif ( exists $opt{userenv} && exists $ENV{ $opt{userenv} } ) {\n $opt{user} = $ENV{ $opt{userenv} };\n}\n\n# Related to password option\nif ( exists $opt{passenv} && exists $ENV{ $opt{passenv} } ) {\n $opt{pass} = $ENV{ $opt{passenv} };\n}\n$opt{pass} = $opt{password} if ( $opt{pass} eq 0 and $opt{password} ne 0 );\n\nif ( $opt{dumpdir} ne '' ) {\n $opt{dumpdir} = abs_path( $opt{dumpdir} );\n if ( !-d $opt{dumpdir} ) {\n mkdir $opt{dumpdir} or die \"Cannot create directory $opt{dumpdir}: $!\";\n }\n}\n\n# for RPM distributions\n$basic_password_files = \"/usr/share/mysqltuner/basic_passwords.txt\"\n unless -f \"$basic_password_files\";\n\n$opt{dbgpattern} = '.*' if ( $opt{dbgpattern} eq '' );\n\n# check if we need to enable verbose mode\nif ( $opt{feature} ne '' ) { $opt{verbose} = 1; }\nif ( $opt{verbose} ) {\n $opt{checkversion} = 1; # Check for updates to MySQLTuner\n $opt{dbstat} = 1; # Print database information\n $opt{tbstat} = 1; # Print database information\n $opt{idxstat} = 1; # Print index information\n $opt{sysstat} = 1; # Print index information\n $opt{buffers} = 1; # Print global and per-thread buffer values\n $opt{pfstat} = 1; # Print performance schema info.\n $opt{structstat} = 1; # Print table structure information\n $opt{myisamstat} = 1; # Print MyISAM table information\n\n $opt{cvefile} = 'vulnerabilities.csv'; #CVE File for vulnerability checks\n}\n$opt{nocolor} = 1 if defined( $opt{outputfile} );\n$opt{tbstat} = 0 if ( $opt{notbstat} == 1 ); # Don't print table information\n$opt{colstat} = 0 if ( $opt{nocolstat} == 1 ); # Don't print column information\n$opt{dbstat} = 0 if ( $opt{nodbstat} == 1 ); # Don't print database information\n$opt{noprocess} = 0\n if ( $opt{noprocess} == 1 ); # Don't print process information\n$opt{sysstat} = 0 if ( $opt{nosysstat} == 1 ); # Don't print sysstat information\n$opt{pfstat} = 0\n if ( $opt{nopfstat} == 1 ); # Don't print performance schema information\n$opt{idxstat} = 0 if ( $opt{noidxstat} == 1 ); # Don't print index information\n$opt{structstat} = 0\n if ( not defined( $opt{structstat} ) or $opt{nostructstat} == 1 )\n ; # Don't print table struct information\n$opt{myisamstat} = 1\n if ( not defined( $opt{myisamstat} ) );\n$opt{myisamstat} = 0\n if ( $opt{nomyisamstat} == 1 ); # Don't print MyISAM table information\n\n# for RPM distributions\n$opt{cvefile} = \"/usr/share/mysqltuner/vulnerabilities.csv\"\n unless ( defined $opt{cvefile} and -f \"$opt{cvefile}\" );\n$opt{cvefile} = '' unless -f \"$opt{cvefile}\";\n$opt{cvefile} = './vulnerabilities.csv' if -f './vulnerabilities.csv';\n\n$opt{'bannedports'} = '' unless defined( $opt{'bannedports'} );\nmy @banned_ports = split ',', $opt{'bannedports'};\n\n#\nmy $outputfile = undef;\n$outputfile = abs_path( $opt{outputfile} ) unless $opt{outputfile} eq \"0\";\n\nmy $fh = undef;\nopen( $fh, '>', $outputfile )\n or die(\"Fail opening $outputfile\")\n if defined($outputfile);\n$opt{nocolor} = 1 if defined($outputfile);\n$opt{nocolor} = 1 unless ( -t STDOUT );\n\n$opt{nocolor} = 0 if ( $opt{color} == 1 );\n\n# Setting up the colors for the print styles\nmy $me = `whoami`;\n$me =~ s/\\n//g;\nmy $good = ( $opt{nocolor} == 0 ) ? \"[\\e[0;32mOK\\e[0m]\" : \"[OK]\";\nmy $bad = ( $opt{nocolor} == 0 ) ? \"[\\e[0;31m!!\\e[0m]\" : \"[!!]\";\nmy $info = ( $opt{nocolor} == 0 ) ? \"[\\e[0;34m--\\e[0m]\" : \"[--]\";\nmy $deb = ( $opt{nocolor} == 0 ) ? \"[\\e[0;31mDG\\e[0m]\" : \"[DG]\";\nmy $cmd = ( $opt{nocolor} == 0 ) ? \"\\e[1;32m[CMD]($me)\" : \"[CMD]($me)\";\nmy $end = ( $opt{nocolor} == 0 ) ? \"\\e[0m\" : \"\";\n\n# Maximum lines of log output to read from end\nmy $maxlines = 30000;\n\n# Checks for supported or EOL'ed MySQL versions\nmy ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro );\n\n# Database\nmy @dblist;\n\n# Super structure containing all information\nmy %result;\n$result{'MySQLTuner'}{'version'} = $tunerversion;\n$result{'MySQLTuner'}{'datetime'} = `date '+%d-%m-%Y %H:%M:%S'`;\n$result{'MySQLTuner'}{'options'} = \\%opt;\n\n# Functions that handle the print styles\nsub prettyprint {\n print $_[0] . \"\\n\" unless ( $opt{'silent'} or $opt{'json'} );\n print $fh $_[0] . \"\\n\" if defined($fh);\n}\n\nsub goodprint {\n prettyprint $good. \" \" . $_[0] unless ( $opt{nogood} == 1 );\n}\n\nsub infoprint {\n prettyprint $info. \" \" . $_[0] unless ( $opt{noinfo} == 1 );\n}\n\nsub badprint {\n prettyprint $bad. \" \" . $_[0] unless ( $opt{nobad} == 1 );\n}\n\nsub debugprint {\n prettyprint $deb. \" \" . $_[0] unless ( $opt{debug} == 0 );\n}\n\nsub redwrap {\n return ( $opt{nocolor} == 0 ) ? \"\\e[0;31m\" . $_[0] . \"\\e[0m\" : $_[0];\n}\n\nsub greenwrap {\n return ( $opt{nocolor} == 0 ) ? \"\\e[0;32m\" . $_[0] . \"\\e[0m\" : $_[0];\n}\n\nsub cmdprint {\n prettyprint $cmd. \" \" . $_[0] . $end;\n}\n\nsub infoprintml {\n for my $ln (@_) { $ln =~ s/\\n//g; infoprint \"\\t$ln\"; }\n}\n\nsub infoprintcmd {\n cmdprint \"@_\";\n infoprintml grep { $_ ne '' and $_ !~ /^\\s*$/ } `@_ 2>&1`;\n}\n\nsub subheaderprint {\n my $tln = 100;\n my $sln = 8;\n my $ln = length(\"@_\") + 2;\n\n prettyprint \" \";\n prettyprint \"-\" x $sln . \" @_ \" . \"-\" x ( $tln - $ln - $sln );\n}\n\nsub infoprinthcmd {\n subheaderprint \"$_[0]\";\n infoprintcmd \"$_[1]\";\n}\n\nsub is_remote() {\n my $host = $opt{'host'};\n return 0 if ( $host eq '' );\n return 0 if ( $host eq 'localhost' );\n return 0 if ( $host eq '127.0.0.1' );\n return 1;\n}\n\nsub is_int {\n return 0 unless defined $_[0];\n my $str = $_[0];\n\n #trim whitespace both sides\n $str =~ s/^\\s+|\\s+$//g;\n\n #Alternatively, to match any float-like numeric, use:\n # m/^([+-]?)(?=\\d|\\.\\d)\\d*(\\.\\d*)?([Ee]([+-]?\\d+))?$/\n\n #flatten to string and match dash or plus and one or more digits\n if ( $str =~ /^(\\-|\\+)?\\d+?$/ ) {\n return 1;\n }\n return 0;\n}\n\n# Calculates the number of physical cores considering HyperThreading\nsub cpu_cores {\n if ( $^O eq 'linux' ) {\n my $cntCPU =\n`awk -F: '/^core id/ && !P[\\$2] { CORES++; P[\\$2]=1 }; /^physical id/ && !N[\\$2] { CPUs++; N[\\$2]=1 }; END { print CPUs*CORES }' /proc/cpuinfo`;\n chomp $cntCPU;\n return ( $cntCPU == 0 ? `nproc` : $cntCPU );\n }\n\n if ( $^O eq 'freebsd' ) {\n my $cntCPU = `sysctl -n kern.smp.cores`;\n chomp $cntCPU;\n return $cntCPU + 0;\n }\n return 0;\n}\n\n# Calculates the parameter passed in bytes, then rounds it to one decimal place\nsub hr_bytes {\n my $num = shift;\n return \"0B\" unless defined($num);\n return \"0B\" if $num eq \"NULL\";\n return \"0B\" if $num eq \"\";\n\n if ( $num >= ( 1024**3 ) ) { # GB\n return sprintf( \"%.1f\", ( $num / ( 1024**3 ) ) ) . \"G\";\n }\n elsif ( $num >= ( 1024**2 ) ) { # MB\n return sprintf( \"%.1f\", ( $num / ( 1024**2 ) ) ) . \"M\";\n }\n elsif ( $num >= 1024 ) { # KB\n return sprintf( \"%.1f\", ( $num / 1024 ) ) . \"K\";\n }\n else {\n return $num . \"B\";\n }\n}\n\nsub hr_raw {\n my $num = shift;\n return \"0\" unless defined($num);\n return \"0\" if $num eq \"NULL\";\n if ( $num =~ /^(\\d+)G$/ ) {\n return $1 * 1024 * 1024 * 1024;\n }\n if ( $num =~ /^(\\d+)M$/ ) {\n return $1 * 1024 * 1024;\n }\n if ( $num =~ /^(\\d+)K$/ ) {\n return $1 * 1024;\n }\n if ( $num =~ /^(\\d+)$/ ) {\n return $1;\n }\n return $num;\n}\n\n# Calculates the parameter passed in bytes, then rounds it to the nearest integer\nsub hr_bytes_rnd {\n my $num = shift;\n return \"0B\" unless defined($num);\n return \"0B\" if $num eq \"NULL\";\n\n if ( $num >= ( 1024**3 ) ) { # GB\n return int( ( $num / ( 1024**3 ) ) ) . \"G\";\n }\n elsif ( $num >= ( 1024**2 ) ) { # MB\n return int( ( $num / ( 1024**2 ) ) ) . \"M\";\n }\n elsif ( $num >= 1024 ) { # KB\n return int( ( $num / 1024 ) ) . \"K\";\n }\n else {\n return $num . \"B\";\n }\n}\n\n# Calculates the parameter passed to the nearest power of 1000, then rounds it to the nearest integer\nsub hr_num {\n my $num = shift;\n if ( $num >= ( 1000**3 ) ) { # Billions\n return int( ( $num / ( 1000**3 ) ) ) . \"B\";\n }\n elsif ( $num >= ( 1000**2 ) ) { # Millions\n return int( ( $num / ( 1000**2 ) ) ) . \"M\";\n }\n elsif ( $num >= 1000 ) { # Thousands\n return int( ( $num / 1000 ) ) . \"K\";\n }\n else {\n return $num;\n }\n}\n\n# Calculate Percentage\nsub percentage {\n my $value = shift;\n my $total = shift;\n $total = 0 unless defined $total;\n $total = 0 if $total eq \"NULL\";\n return 100, 00 if $total == 0;\n return sprintf( \"%.2f\", ( $value * 100 / $total ) );\n}\n\n# Calculates uptime to display in a human-readable form\nsub pretty_uptime {\n my $uptime = shift;\n my $seconds = $uptime % 60;\n my $minutes = int( ( $uptime % 3600 ) / 60 );\n my $hours = int( ( $uptime % 86400 ) / (3600) );\n my $days = int( $uptime / (86400) );\n my $uptimestring;\n if ( $days > 0 ) {\n $uptimestring = \"${days}d ${hours}h ${minutes}m ${seconds}s\";\n }\n elsif ( $hours > 0 ) {\n $uptimestring = \"${hours}h ${minutes}m ${seconds}s\";\n }\n elsif ( $minutes > 0 ) {\n $uptimestring = \"${minutes}m ${seconds}s\";\n }\n else {\n $uptimestring = \"${seconds}s\";\n }\n return $uptimestring;\n}\n\n# Retrieves the memory installed on this machine\nmy ( $physical_memory, $swap_memory, $duflags, $xargsflags );\n\nsub memerror {\n badprint\n\"Unable to determine total memory/swap; use '--forcemem' and '--forceswap'\";\n exit 1;\n}\n\nsub os_setup {\n my $os = `uname`;\n $duflags = ( $os =~ /Linux/ ) ? '-b' : '';\n $xargsflags = ( $os =~ /Darwin|SunOS/ ) ? '' : '-r';\n if ( $opt{'forcemem'} > 0 ) {\n $physical_memory = $opt{'forcemem'} * 1048576;\n infoprint \"Assuming $opt{'forcemem'} MB of physical memory\";\n if ( $opt{'forceswap'} > 0 ) {\n $swap_memory = $opt{'forceswap'} * 1048576;\n infoprint \"Assuming $opt{'forceswap'} MB of swap space\";\n }\n else {\n $swap_memory = 0;\n badprint \"Assuming 0 MB of swap space (use --forceswap to specify)\";\n }\n }\n else {\n if ( $os =~ /Linux|CYGWIN/ ) {\n $physical_memory =\n `grep -i memtotal: /proc/meminfo | awk '{print \\$2}'`\n or memerror;\n $physical_memory *= 1024;\n\n $swap_memory =\n `grep -i swaptotal: /proc/meminfo | awk '{print \\$2}'`\n or memerror;\n $swap_memory *= 1024;\n }\n elsif ( $os =~ /Darwin/ ) {\n $physical_memory = `sysctl -n hw.memsize` or memerror;\n $swap_memory =\n `sysctl -n vm.swapusage | awk '{print \\$3}' | sed 's/\\..*\\$//'`\n or memerror;\n }\n elsif ( $os =~ /NetBSD|OpenBSD|FreeBSD/ ) {\n $physical_memory = `sysctl -n hw.physmem` or memerror;\n if ( $physical_memory < 0 ) {\n $physical_memory = `sysctl -n hw.physmem64` or memerror;\n }\n $swap_memory =\n `swapctl -l | grep '^/' | awk '{ s+= \\$2 } END { print s }'`\n or memerror;\n }\n elsif ( $os =~ /BSD/ ) {\n $physical_memory = `sysctl -n hw.realmem` or memerror;\n $swap_memory =\n `swapinfo | grep '^/' | awk '{ s+= \\$2 } END { print s }'`;\n }\n elsif ( $os =~ /SunOS/ ) {\n $physical_memory =\n `/usr/sbin/prtconf | grep Memory | cut -f 3 -d ' '`\n or memerror;\n chomp($physical_memory);\n $physical_memory = $physical_memory * 1024 * 1024;\n }\n elsif ( $os =~ /AIX/ ) {\n $physical_memory =\n `lsattr -El sys0 | grep realmem | awk '{print \\$2}'`\n or memerror;\n chomp($physical_memory);\n $physical_memory = $physical_memory * 1024;\n $swap_memory = `lsps -as | awk -F\"(MB| +)\" '/MB /{print \\$2}'`\n or memerror;\n chomp($swap_memory);\n $swap_memory = $swap_memory * 1024 * 1024;\n }\n elsif ( $os =~ /windows/i ) {\n $physical_memory =\n`wmic ComputerSystem get TotalPhysicalMemory | perl -ne \"chomp; print if /[0-9]+/;\"`\n or memerror;\n $swap_memory =\n`wmic OS get FreeVirtualMemory | perl -ne \"chomp; print if /[0-9]+/;\"`\n or memerror;\n }\n }\n debugprint \"Physical Memory: $physical_memory\";\n debugprint \"Swap Memory: $swap_memory\";\n chomp($physical_memory);\n chomp($swap_memory);\n chomp($os);\n $result{'OS'}{'OS Type'} = $os;\n $result{'OS'}{'Physical Memory'}{'bytes'} = $physical_memory;\n $result{'OS'}{'Physical Memory'}{'pretty'} = hr_bytes($physical_memory);\n $result{'OS'}{'Swap Memory'}{'bytes'} = $swap_memory;\n $result{'OS'}{'Swap Memory'}{'pretty'} = hr_bytes($swap_memory);\n $result{'OS'}{'Other Processes'}{'bytes'} = get_other_process_memory();\n $result{'OS'}{'Other Processes'}{'pretty'} =\n hr_bytes( get_other_process_memory() );\n}\n\nsub get_http_cli {\n my $httpcli = which( \"curl\", $ENV{'PATH'} );\n chomp($httpcli);\n if ($httpcli) {\n return $httpcli;\n }\n\n $httpcli = which( \"wget\", $ENV{'PATH'} );\n chomp($httpcli);\n if ($httpcli) {\n return $httpcli;\n }\n return \"\";\n}\n\n# Checks for updates to MySQLTuner\nsub validate_tuner_version {\n if ( $opt{'checkversion'} eq 0 ) {\n print \"\\n\" unless ( $opt{'silent'} or $opt{'json'} );\n infoprint \"Skipped version check for MySQLTuner script\";\n return;\n }\n\n my $update;\n my $url =\n\"https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl\";\n my $httpcli = get_http_cli();\n if ( $httpcli =~ /curl$/ ) {\n debugprint \"$httpcli is available.\";\n\n debugprint\n\"$httpcli -m 3 -silent '$url' 2>/dev/null | grep 'my \\$tunerversion'| cut -d\\\\\\\" -f2\";\n $update =\n`$httpcli -m 3 -silent '$url' 2>/dev/null | grep 'my \\$tunerversion'| cut -d\\\\\\\" -f2`;\n chomp($update);\n debugprint \"VERSION: $update\";\n\n compare_tuner_version($update);\n return;\n }\n\n if ( $httpcli =~ /wget$/ ) {\n debugprint \"$httpcli is available.\";\n\n debugprint\n\"$httpcli -e timestamping=off -t 1 -T 3 -O - '$url' 2>$devnull| grep 'my \\$tunerversion'| cut -d\\\\\\\" -f2\";\n $update =\n`$httpcli -e timestamping=off -t 1 -T 3 -O - '$url' 2>$devnull| grep 'my \\$tunerversion'| cut -d\\\\\\\" -f2`;\n chomp($update);\n compare_tuner_version($update);\n return;\n }\n debugprint \"curl and wget are not available.\";\n infoprint \"Unable to check for the latest MySQLTuner version\";\n infoprint\n\"Using --pass and --password option is insecure during MySQLTuner execution (password disclosure)\"\n if ( defined( $opt{'pass'} ) );\n}\n\n# Checks for updates to MySQLTuner\nsub update_tuner_version {\n if ( $opt{'updateversion'} eq 0 ) {\n badprint \"Skipped version update for MySQLTuner script\";\n print \"\\n\" unless ( $opt{'silent'} or $opt{'json'} );\n return;\n }\n\n my $update;\n my $fullpath = \"\";\n my $url = \"https://raw.githubusercontent.com/major/MySQLTuner-perl/master/\";\n my @scripts =\n ( \"mysqltuner.pl\", \"basic_passwords.txt\", \"vulnerabilities.csv\" );\n my $totalScripts = scalar(@scripts);\n my $receivedScripts = 0;\n my $httpcli = get_http_cli();\n\n foreach my $script (@scripts) {\n\n if ( $httpcli =~ /curl$/ ) {\n debugprint \"$httpcli is available.\";\n\n $fullpath = dirname(__FILE__) . \"/\" . $script;\n debugprint \"FullPath: $fullpath\";\n debugprint\n\"$httpcli --connect-timeout 3 '$url$script' 2>$devnull > $fullpath\";\n $update =\n`$httpcli --connect-timeout 3 '$url$script' 2>$devnull > $fullpath`;\n chomp($update);\n debugprint \"$script updated: $update\";\n\n if ( -s $script eq 0 ) {\n badprint \"Couldn't update $script\";\n }\n else {\n ++$receivedScripts;\n debugprint \"$script updated: $update\";\n }\n }\n elsif ( $httpcli =~ /wget$/ ) {\n\n debugprint \"$httpcli is available.\";\n\n debugprint\n\"$httpcli -qe timestamping=off -t 1 -T 3 -O $script '$url$script'\";\n $update =\n`$httpcli -qe timestamping=off -t 1 -T 3 -O $script '$url$script'`;\n chomp($update);\n\n if ( -s $script eq 0 ) {\n badprint \"Couldn't update $script\";\n }\n else {\n ++$receivedScripts;\n debugprint \"$script updated: $update\";\n }\n }\n else {\n debugprint \"curl and wget are not available.\";\n infoprint \"Unable to check for the latest MySQLTuner version\";\n }\n\n }\n\n if ( $receivedScripts eq $totalScripts ) {\n goodprint \"Successfully updated MySQLTuner script\";\n }\n else {\n badprint \"Couldn't update MySQLTuner script\";\n }\n infoprint \"Stopping program: MySQLTuner script must be updated first.\";\n exit 0;\n}\n\nsub compare_tuner_version {\n my $remoteversion = shift;\n debugprint \"Remote data: $remoteversion\";\n\n #exit 0;\n if ( $remoteversion ne $tunerversion ) {\n badprint\n \"There is a new version of MySQLTuner available ($remoteversion)\";\n update_tuner_version();\n return;\n }\n goodprint \"You have the latest version of MySQLTuner ($tunerversion)\";\n return;\n}\n\n# Checks to see if a MySQL login is possible\nmy ( $mysqllogin, $doremote, $remotestring, $mysqlcmd, $mysqladmincmd );\n\nmy $osname = $^O;\nif ( $osname eq 'MSWin32' ) {\n eval { require Win32; } or last;\n $osname = Win32::GetOSName();\n infoprint \"* Windows OS ($osname) is not fully supported.\\n\";\n\n #exit 1;\n}\n\nsub mysql_setup {\n $doremote = 0;\n $remotestring = '';\n if ( $opt{mysqladmin} ) {\n $mysqladmincmd = $opt{mysqladmin};\n }\n else {\n $mysqladmincmd = which( \"mysqladmin\", $ENV{'PATH'} );\n if ( !-e $mysqladmincmd ) {\n $mysqladmincmd = which( \"mariadb-admin\", $ENV{'PATH'} );\n }\n }\n chomp($mysqladmincmd);\n if ( !-e $mysqladmincmd && $opt{mysqladmin} ) {\n badprint \"Unable to find the mysqladmin command you specified: \"\n . $mysqladmincmd . \"\";\n exit 1;\n }\n elsif ( !-e $mysqladmincmd ) {\n badprint\n\"Couldn't find mysqladmin/mariadb-admin in your \\$PATH. Is MySQL installed?\";\n\n #exit 1;\n }\n if ( $opt{mysqlcmd} ) {\n $mysqlcmd = $opt{mysqlcmd};\n }\n else {\n $mysqlcmd = which( \"mysql\", $ENV{'PATH'} );\n if ( !-e $mysqlcmd ) {\n $mysqlcmd = which( \"mariadb\", $ENV{'PATH'} );\n }\n }\n chomp($mysqlcmd);\n if ( !-e $mysqlcmd && $opt{mysqlcmd} ) {\n badprint \"Unable to find the mysql command you specified: \"\n . $mysqlcmd . \"\";\n exit 1;\n }\n elsif ( !-e $mysqlcmd ) {\n badprint\n \"Couldn't find mysql/mariadb in your \\$PATH. Is MySQL installed?\";\n exit 1;\n }\n $mysqlcmd =~ s/\\n$//g;\n my $mysqlclidefaults = `$mysqlcmd --print-defaults`;\n debugprint \"MySQL Client: $mysqlclidefaults\";\n if ( $mysqlclidefaults =~ /auto-vertical-output/ ) {\n badprint\n \"Avoid auto-vertical-output in configuration file(s) for MySQL like\";\n exit 1;\n }\n\n debugprint \"MySQL Client: $mysqlcmd\";\n\n # Are we being asked to connect via a socket?\n if ( $opt{socket} ne 0 ) {\n if ( $opt{port} ne 0 ) {\n $remotestring = \" -S $opt{socket} -P $opt{port}\";\n }\n else {\n $remotestring = \" -S $opt{socket}\";\n }\n }\n\n if ( $opt{protocol} ne '' ) {\n $remotestring = \" --protocol=$opt{protocol}\";\n }\n\n # Are we being asked to connect to a remote server?\n if ( $opt{host} ne 0 ) {\n chomp( $opt{host} );\n $opt{port} = ( $opt{port} eq 0 ) ? 3306 : $opt{port};\n\n# If we're doing a remote connection, but forcemem wasn't specified, we need to exit\n if ( $opt{'forcemem'} eq 0 && is_remote eq 1 ) {\n badprint \"The --forcemem option is required for remote connections\";\n badprint\n \"Assuming RAM memory is 1Gb for simplify remote connection usage\";\n $opt{'forcemem'} = 1024;\n\n #exit 1;\n }\n if ( $opt{'forceswap'} eq 0 && is_remote eq 1 ) {\n badprint\n \"The --forceswap option is required for remote connections\";\n badprint\n \"Assuming Swap size is 1Gb for simplify remote connection usage\";\n $opt{'forceswap'} = 1024;\n\n #exit 1;\n }\n infoprint \"Performing tests on $opt{host}:$opt{port}\";\n $remotestring = \" -h $opt{host} -P $opt{port}\";\n $doremote = is_remote();\n\n }\n else {\n $opt{host} = '127.0.0.1';\n }\n\n if ( $opt{'ssl-ca'} ne 0 ) {\n if ( -e -r -f $opt{'ssl-ca'} ) {\n $remotestring .= \" --ssl-ca=$opt{'ssl-ca'}\";\n infoprint\n \"Will connect using ssl public key passed on the command line\";\n return 1;\n }\n else {\n badprint\n\"Attempted to use passed ssl public key, but it was not found or could not be read\";\n exit 1;\n }\n }\n\n # Did we already get a username with or without password on the command line?\n if ( $opt{user} ne 0 ) {\n $mysqllogin =\n \"-u $opt{user} \"\n . ( ( $opt{pass} ne 0 ) ? \"-p'$opt{pass}' \" : \" \" )\n . $remotestring;\n my $loginstatus =\n `$mysqlcmd -Nrs -e 'select \"mysqld is alive\";' $mysqllogin 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n goodprint \"Logged in using credentials passed on the command line\";\n return 1;\n }\n else {\n badprint\n \"Attempted to use login credentials, but they were invalid\";\n exit 1;\n }\n }\n\n my $svcprop = which( \"svcprop\", $ENV{'PATH'} );\n if ( substr( $svcprop, 0, 1 ) =~ \"/\" ) {\n\n # We are on solaris\n ( my $mysql_login =\n`svcprop -p quickbackup/username svc:/network/mysql-quickbackup:default`\n ) =~ s/\\s+$//;\n ( my $mysql_pass =\n`svcprop -p quickbackup/password svc:/network/mysql-quickbackup:default`\n ) =~ s/\\s+$//;\n if ( substr( $mysql_login, 0, 7 ) ne \"svcprop\" ) {\n\n # mysql-quickbackup is installed\n $mysqllogin = \"-u $mysql_login -p$mysql_pass\";\n my $loginstatus = `mysqladmin $mysqllogin ping 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n goodprint \"Logged in using credentials from mysql-quickbackup.\";\n return 1;\n }\n else {\n badprint\n\"Attempted to use login credentials from mysql-quickbackup, but they failed.\";\n exit 1;\n }\n }\n }\n elsif ( -r \"/etc/psa/.psa.shadow\" and $doremote == 0 ) {\n\n # It's a Plesk box, use the available credentials\n $mysqllogin = \"-u admin -p`cat /etc/psa/.psa.shadow`\";\n my $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`;\n unless ( $loginstatus =~ /mysqld is alive/ ) {\n\n # Plesk 10+\n $mysqllogin =\n \"-u admin -p`/usr/local/psa/bin/admin --show-password`\";\n $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`;\n unless ( $loginstatus =~ /mysqld is alive/ ) {\n badprint\n\"Attempted to use login credentials from Plesk and Plesk 10+, but they failed.\";\n exit 1;\n }\n }\n }\n elsif ( -r \"/usr/local/directadmin/conf/mysql.conf\" and $doremote == 0 ) {\n\n # It's a DirectAdmin box, use the available credentials\n my $mysqluser =\n `cat /usr/local/directadmin/conf/mysql.conf | egrep '^user=.*'`;\n my $mysqlpass =\n `cat /usr/local/directadmin/conf/mysql.conf | egrep '^passwd=.*'`;\n\n $mysqluser =~ s/user=//;\n $mysqluser =~ s/[\\r\\n]//;\n $mysqlpass =~ s/passwd=//;\n $mysqlpass =~ s/[\\r\\n]//;\n\n $mysqllogin = \"-u $mysqluser -p$mysqlpass\";\n\n my $loginstatus = `mysqladmin ping $mysqllogin 2>&1`;\n unless ( $loginstatus =~ /mysqld is alive/ ) {\n badprint\n\"Attempted to use login credentials from DirectAdmin, but they failed.\";\n exit 1;\n }\n }\n elsif ( -r \"/etc/mysql/debian.cnf\"\n and $doremote == 0\n and $opt{'defaults-file'} eq '' )\n {\n\n # We have a Debian maintenance account, use it\n $mysqllogin = \"--defaults-file=/etc/mysql/debian.cnf\";\n my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n goodprint\n \"Logged in using credentials from Debian maintenance account.\";\n return 1;\n }\n else {\n badprint\n\"Attempted to use login credentials from Debian maintenance account, but they failed.\";\n exit 1;\n }\n }\n elsif ( $opt{'defaults-file'} ne '' and -r \"$opt{'defaults-file'}\" ) {\n\n # defaults-file\n debugprint \"defaults file detected: $opt{'defaults-file'}\";\n my $mysqlclidefaults = `$mysqlcmd --print-defaults`;\n debugprint \"MySQL Client Default File: $opt{'defaults-file'}\";\n\n $mysqllogin = \"--defaults-file=\" . $opt{'defaults-file'};\n my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n goodprint \"Logged in using credentials from defaults file account.\";\n return 1;\n }\n }\n elsif ( $opt{'defaults-extra-file'} ne ''\n and -r \"$opt{'defaults-extra-file'}\" )\n {\n\n # defaults-extra-file\n debugprint \"defaults extra file detected: $opt{'defaults-extra-file'}\";\n my $mysqlclidefaults = `$mysqlcmd --print-defaults`;\n debugprint\n \"MySQL Client Extra Default File: $opt{'defaults-extra-file'}\";\n\n $mysqllogin = \"--defaults-extra-file=\" . $opt{'defaults-extra-file'};\n my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n goodprint\n \"Logged in using credentials from extra defaults file account.\";\n return 1;\n }\n }\n else {\n # It's not Plesk or Debian, we should try a login\n debugprint \"$mysqladmincmd $remotestring ping 2>&1\";\n\n #my $loginstatus = \"\";\n debugprint \"Using mysqlcmd: $mysqlcmd\";\n\n #if (defined($mysqladmincmd)) {\n # infoprint \"Using mysqladmin to check login\";\n # $loginstatus=`$mysqladmincmd $remotestring ping 2>&1`;\n #} else {\n infoprint \"Using mysql to check login\";\n my $loginstatus =\n`$mysqlcmd $remotestring -Nrs -e 'select \"mysqld is alive\"' --connect-timeout=3 2>&1`;\n\n #}\n\n if ( $loginstatus =~ /mysqld is alive/ ) {\n\n # Login went just fine\n $mysqllogin = \" $remotestring \";\n\n # Did this go well because of a .my.cnf file or is there no password set?\n my $userpath = `printenv HOME`;\n if ( length($userpath) > 0 ) {\n chomp($userpath);\n }\n unless ( -e \"${userpath}/.my.cnf\" or -e \"${userpath}/.mylogin.cnf\" )\n {\n badprint\n \"SECURITY RISK: Successfully authenticated without password\";\n }\n return 1;\n }\n else {\n if ( $opt{'noask'} == 1 ) {\n badprint\n \"Attempted to use login credentials, but they were invalid\";\n exit 1;\n }\n my ( $name, $password );\n\n # If --user is defined no need to ask for username\n if ( $opt{user} ne 0 ) {\n $name = $opt{user};\n }\n else {\n print STDERR \"Please enter your MySQL administrative login: \";\n $name = ;\n }\n\n # If --pass is defined no need to ask for password\n if ( $opt{pass} ne 0 ) {\n $password = $opt{pass};\n }\n else {\n print STDERR\n \"Please enter your MySQL administrative password: \";\n system(\"stty -echo >$devnull 2>&1\");\n $password = ;\n system(\"stty echo >$devnull 2>&1\");\n }\n chomp($password);\n chomp($name);\n $mysqllogin = \"-u $name\";\n\n if ( length($password) > 0 ) {\n $mysqllogin .= \" -p'$password'\";\n }\n $mysqllogin .= $remotestring;\n my $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n\n #print STDERR \"\";\n if ( !length($password) ) {\n\n # Did this go well because of a .my.cnf file or is there no password set?\n my $userpath = `printenv HOME`;\n chomp($userpath);\n unless ( -e \"$userpath/.my.cnf\" ) {\n print STDERR \"\";\n badprint\n\"SECURITY RISK: Successfully authenticated without password\";\n }\n }\n return 1;\n }\n else {\n #print STDERR \"\";\n badprint\n \"Attempted to use login credentials, but they were invalid.\";\n exit 1;\n }\n exit 1;\n }\n }\n}\n\n# MySQL Request Array\nsub select_array {\n my $req = shift;\n debugprint \"PERFORM: $req \";\n my @result = `$mysqlcmd $mysqllogin -Bse \"\\\\w$req\" 2>>/dev/null`;\n if ( $? != 0 ) {\n badprint \"Failed to execute: $req\";\n badprint \"FAIL Execute SQL / return code: $?\";\n debugprint \"CMD : $mysqlcmd\";\n debugprint \"OPTIONS: $mysqllogin\";\n debugprint `$mysqlcmd $mysqllogin -Bse \"$req\" 2>&1`;\n\n #exit $?;\n }\n debugprint \"select_array: return code : $?\";\n chomp(@result);\n return @result;\n}\n\n# MySQL Request Array\nsub select_array_with_headers {\n my $req = shift;\n debugprint \"PERFORM: $req \";\n my @result = `$mysqlcmd $mysqllogin -Bre \"\\\\w$req\" 2>>/dev/null`;\n if ( $? != 0 ) {\n badprint \"Failed to execute: $req\";\n badprint \"FAIL Execute SQL / return code: $?\";\n debugprint \"CMD : $mysqlcmd\";\n debugprint \"OPTIONS: $mysqllogin\";\n debugprint `$mysqlcmd $mysqllogin -Bse \"$req\" 2>&1`;\n\n #exit $?;\n }\n debugprint \"select_array_with_headers: return code : $?\";\n chomp(@result);\n return @result;\n}\n\n# MySQL Request Array\nsub select_csv_file {\n my $tfile = shift;\n my $req = shift;\n debugprint \"PERFORM: $req CSV into $tfile\";\n\n #return;\n my @result = select_array_with_headers($req);\n open( my $fh, '>', $tfile ) or die \"Could not open file '$tfile' $!\";\n for my $l (@result) {\n $l =~ s/\\t/\",\"/g;\n $l =~ s/^/\"/;\n $l =~ s/$/\"\\n/;\n print $fh $l;\n print $l if $opt{debug};\n }\n close $fh;\n infoprint \"CSV file $tfile created\";\n}\n\nsub human_size {\n my ( $size, $n ) = ( shift, 0 );\n ++$n and $size /= 1024 until $size < 1024;\n return sprintf \"%.2f %s\", $size, (qw[ bytes KB MB GB TB ])[$n];\n}\n\n# MySQL Request one\nsub select_one {\n my $req = shift;\n debugprint \"PERFORM: $req \";\n my $result = `$mysqlcmd $mysqllogin -Bse \"\\\\w$req\" 2>>/dev/null`;\n if ( $? != 0 ) {\n badprint \"Failed to execute: $req\";\n badprint \"FAIL Execute SQL / return code: $?\";\n debugprint \"CMD : $mysqlcmd\";\n debugprint \"OPTIONS: $mysqllogin\";\n debugprint `$mysqlcmd $mysqllogin -Bse \"$req\" 2>&1`;\n\n #exit $?;\n }\n debugprint \"select_array: return code : $?\";\n chomp($result);\n return $result;\n}\n\n# MySQL Request one\nsub select_one_g {\n my $pattern = shift;\n\n my $req = shift;\n debugprint \"PERFORM: $req \";\n my @result = `$mysqlcmd $mysqllogin -re \"\\\\w$req\\\\G\" 2>>/dev/null`;\n if ( $? != 0 ) {\n badprint \"Failed to execute: $req\";\n badprint \"FAIL Execute SQL / return code: $?\";\n debugprint \"CMD : $mysqlcmd\";\n debugprint \"OPTIONS: $mysqllogin\";\n debugprint `$mysqlcmd $mysqllogin -Bse \"$req\" 2>&1`;\n\n #exit $?;\n }\n debugprint \"select_array: return code : $?\";\n chomp(@result);\n return ( grep { /$pattern/ } @result )[0];\n}\n\nsub select_str_g {\n my $pattern = shift;\n\n my $req = shift;\n my $str = select_one_g $pattern, $req;\n return () unless defined $str;\n my @val = split /:/, $str;\n shift @val;\n return trim(@val);\n}\n\nsub select_user_dbs {\n return select_array(\n\"SELECT DISTINCT TABLE_SCHEMA FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema', 'percona', 'sys')\"\n );\n}\n\nsub select_tables_db {\n my $schema = shift;\n return select_array(\n\"SELECT DISTINCT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='$schema'\"\n );\n}\n\nsub select_indexes_db {\n my $schema = shift;\n return select_array(\n\"SELECT DISTINCT INDEX_NAME FROM information_schema.STATISTICS WHERE TABLE_SCHEMA='$schema'\"\n );\n}\n\nsub select_views_db {\n my $schema = shift;\n return select_array(\n\"SELECT DISTINCT TABLE_NAME FROM information_schema.VIEWS WHERE TABLE_SCHEMA='$schema'\"\n );\n}\n\nsub select_triggers_db {\n my $schema = shift;\n return select_array(\n\"SELECT DISTINCT TRIGGER_NAME FROM information_schema.TRIGGERS WHERE TRIGGER_SCHEMA='$schema'\"\n );\n}\n\nsub select_routines_db {\n my $schema = shift;\n return select_array(\n\"SELECT DISTINCT ROUTINE_NAME FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA='$schema'\"\n );\n}\n\nsub select_table_indexes_db {\n my $schema = shift;\n my $tbname = shift;\n return select_array(\n\"SELECT INDEX_NAME FROM information_schema.STATISTICS WHERE TABLE_SCHEMA='$schema' AND TABLE_NAME='$tbname'\"\n );\n}\n\nsub select_table_columns_db {\n my $schema = shift;\n my $table = shift;\n return select_array(\n\"SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$schema' AND TABLE_NAME='$table'\"\n );\n}\n\nsub get_tuning_info {\n my @infoconn = select_array \"\\\\s\";\n my ( $tkey, $tval );\n @infoconn =\n grep { !/Threads:/ and !/Connection id:/ and !/pager:/ and !/Using/ }\n @infoconn;\n foreach my $line (@infoconn) {\n if ( $line =~ /\\s*(.*):\\s*(.*)/ ) {\n debugprint \"$1 => $2\";\n $tkey = $1;\n $tval = $2;\n chomp($tkey);\n chomp($tval);\n $result{'MySQL Client'}{$tkey} = $tval;\n }\n }\n $result{'MySQL Client'}{'Client Path'} = $mysqlcmd;\n $result{'MySQL Client'}{'Admin Path'} = $mysqladmincmd;\n $result{'MySQL Client'}{'Authentication Info'} = $mysqllogin;\n\n}\n\n# Populates all of the variable and status hashes\nmy ( %mystat, %myvar, $dummyselect, %myrepl, %myslaves );\n\nsub arr2hash {\n my $href = shift;\n my $harr = shift;\n my $sep = shift;\n my $key = '';\n my $val = '';\n\n $sep = '\\s' unless defined($sep);\n foreach my $line (@$harr) {\n next if ( $line =~ m/^\\*\\*\\*\\*\\*\\*\\*/ );\n $line =~ /([a-zA-Z_]*)\\s*$sep\\s*(.*)/;\n $key = $1;\n $val = $2;\n $$href{$key} = $val;\n\n debugprint \" * $key = $val\" if $key =~ /$opt{dbgpattern}/i;\n }\n}\n\nsub get_all_vars {\n\n # We need to initiate at least one query so that our data is useable\n $dummyselect = select_one \"SELECT VERSION()\";\n if ( not defined($dummyselect) or $dummyselect eq \"\" ) {\n badprint\n \"You probably do not have enough privileges to run MySQLTuner ...\";\n exit(256);\n }\n $dummyselect =~ s/(.*?)\\-.*/$1/;\n debugprint \"VERSION: \" . $dummyselect . \"\";\n $result{'MySQL Client'}{'Version'} = $dummyselect;\n\n my @mysqlvarlist = select_array(\"SHOW VARIABLES\");\n push( @mysqlvarlist, select_array(\"SHOW GLOBAL VARIABLES\") );\n arr2hash( \\%myvar, \\@mysqlvarlist );\n $result{'Variables'} = \\%myvar;\n\n my @mysqlstatlist = select_array(\"SHOW STATUS\");\n push( @mysqlstatlist, select_array(\"SHOW GLOBAL STATUS\") );\n arr2hash( \\%mystat, \\@mysqlstatlist );\n $result{'Status'} = \\%mystat;\n unless ( defined( $myvar{'innodb_support_xa'} ) ) {\n $myvar{'innodb_support_xa'} = 'ON';\n }\n $mystat{'Uptime'} = 1\n unless defined( $mystat{'Uptime'} )\n and $mystat{'Uptime'} > 0;\n $myvar{'have_galera'} = \"NO\";\n if ( defined( $myvar{'wsrep_provider_options'} )\n && $myvar{'wsrep_provider_options'} ne \"\"\n && $myvar{'wsrep_on'} ne \"OFF\" )\n {\n $myvar{'have_galera'} = \"YES\";\n debugprint \"Galera options: \" . $myvar{'wsrep_provider_options'};\n }\n\n # Workaround for MySQL bug #59393 wrt. ignore-builtin-innodb\n if ( ( $myvar{'ignore_builtin_innodb'} || \"\" ) eq \"ON\" ) {\n $myvar{'have_innodb'} = \"NO\";\n }\n\n # Support GTID MODE FOR MARIADB\n # Issue MariaDB GTID mode #513\n $myvar{'gtid_mode'} = 'ON'\n if ( defined( $myvar{'gtid_current_pos'} )\n and $myvar{'gtid_current_pos'} ne '' );\n\n # Whether the server uses a thread pool to handle client connections\n # MariaDB: thread_handling = pool-of-threads\n # MySQL: thread_handling = loaded-dynamically\n $myvar{'have_threadpool'} = \"NO\";\n if (\n defined( $myvar{'thread_handling'} )\n and ( $myvar{'thread_handling'} eq 'pool-of-threads'\n || $myvar{'thread_handling'} eq 'loaded-dynamically' )\n )\n {\n $myvar{'have_threadpool'} = \"YES\";\n }\n\n # have_* for engines is deprecated and will be removed in MySQL 5.6;\n # check SHOW ENGINES and set corresponding old style variables.\n # Also works around MySQL bug #59393 wrt. skip-innodb\n my @mysqlenginelist = select_array \"SHOW ENGINES\";\n foreach my $line (@mysqlenginelist) {\n if ( $line =~ /^([a-zA-Z_]+)\\s+(\\S+)/ ) {\n my $engine = lc($1);\n\n if ( $engine eq \"federated\" || $engine eq \"blackhole\" ) {\n $engine .= \"_engine\";\n }\n elsif ( $engine eq \"berkeleydb\" ) {\n $engine = \"bdb\";\n }\n my $val = ( $2 eq \"DEFAULT\" ) ? \"YES\" : $2;\n $myvar{\"have_$engine\"} = $val;\n $result{'Storage Engines'}{$engine} = $2;\n }\n }\n\n #debugprint Dumper(@mysqlenginelist);\n\n my @mysqlslave;\n if ( mysql_version_eq(8) or mysql_version_ge( 10, 5 ) ) {\n @mysqlslave = select_array(\"SHOW REPLICA STATUS\\\\G\");\n }\n else {\n @mysqlslave = select_array(\"SHOW SLAVE STATUS\\\\G\");\n }\n arr2hash( \\%myrepl, \\@mysqlslave, ':' );\n $result{'Replication'}{'Status'} = \\%myrepl;\n\n my @mysqlslaves;\n if ( mysql_version_eq(8) or mysql_version_ge( 10, 5 ) ) {\n @mysqlslaves = select_array \"SHOW SLAVE STATUS\";\n }\n else {\n @mysqlslaves = select_array(\"SHOW SLAVE HOSTS\\\\G\");\n }\n\n my @lineitems = ();\n foreach my $line (@mysqlslaves) {\n debugprint \"L: $line \";\n @lineitems = split /\\s+/, $line;\n $myslaves{ $lineitems[0] } = $line;\n $result{'Replication'}{'Slaves'}{ $lineitems[0] } = $lineitems[4];\n }\n}\n\nsub remove_cr {\n return map {\n my $line = $_;\n $line =~ s/\\n$//g;\n $line =~ s/^\\s+$//g;\n $line;\n } @_;\n}\n\nsub remove_empty {\n grep { $_ ne '' } @_;\n}\n\nsub grep_file_contents {\n my $file = shift;\n my $patt;\n}\n\nsub get_file_contents {\n my $file = shift;\n open( my $fh, \"<\", $file ) or die \"Can't open $file for read: $!\";\n my @lines = <$fh>;\n close $fh or die \"Cannot close $file: $!\";\n @lines = remove_cr @lines;\n return @lines;\n}\n\nsub get_basic_passwords {\n return get_file_contents(shift);\n}\n\nsub get_log_file_real_path {\n my $file = shift;\n my $hostname = shift;\n my $datadir = shift;\n if ( -f \"$file\" ) {\n return $file;\n }\n elsif ( -f \"$hostname.log\" ) {\n return \"$hostname.log\";\n }\n elsif ( -f \"$hostname.err\" ) {\n return \"$hostname.err\";\n }\n elsif ( -f \"$datadir$hostname.err\" ) {\n return \"$datadir$hostname.err\";\n }\n elsif ( -f \"$datadir$hostname.log\" ) {\n return \"$datadir$hostname.log\";\n }\n elsif ( -f \"$datadir\" . \"mysql_error.log\" ) {\n return \"$datadir\" . \"mysql_error.log\";\n }\n elsif ( -f \"/var/log/mysql.log\" ) {\n return \"/var/log/mysql.log\";\n }\n elsif ( -f \"/var/log/mysqld.log\" ) {\n return \"/var/log/mysqld.log\";\n }\n elsif ( -f \"/var/log/mysql/$hostname.err\" ) {\n return \"/var/log/mysql/$hostname.err\";\n }\n elsif ( -f \"/var/log/mysql/$hostname.log\" ) {\n return \"/var/log/mysql/$hostname.log\";\n }\n elsif ( -f \"/var/log/mysql/\" . \"mysql_error.log\" ) {\n return \"/var/log/mysql/\" . \"mysql_error.log\";\n }\n else {\n return $file;\n }\n}\n\nsub log_file_recommendations {\n if ( is_remote eq 1 ) {\n infoprint \"Skipping error log files checks on remote host\";\n return;\n }\n my $fh;\n $myvar{'log_error'} = $opt{'server-log'}\n || get_log_file_real_path( $myvar{'log_error'}, $myvar{'hostname'},\n $myvar{'datadir'} );\n\n subheaderprint \"Log file Recommendations\";\n if ( \"$myvar{'log_error'}\" eq \"stderr\" ) {\n badprint\n\"log_error is set to $myvar{'log_error'}, but this script can't read stderr\";\n return;\n }\n elsif ( $myvar{'log_error'} =~ /^(docker|podman|kubectl):(.*)/ ) {\n open( $fh, '-|', \"$1 logs --tail=$maxlines '$2'\" )\n // die \"Can't start $1 $!\";\n goodprint \"Log from cloud` $myvar{'log_error'} exists\";\n }\n elsif ( $myvar{'log_error'} =~ /^systemd:(.*)/ ) {\n open( $fh, '-|', \"journalctl -n $maxlines -b -u '$1'\" )\n // die \"Can't start journalctl $!\";\n goodprint \"Log journal` $myvar{'log_error'} exists\";\n }\n elsif ( -f \"$myvar{'log_error'}\" ) {\n goodprint \"Log file $myvar{'log_error'} exists\";\n my $size = ( stat $myvar{'log_error'} )[7];\n infoprint \"Log file: \"\n . $myvar{'log_error'} . \" (\"\n . hr_bytes_rnd($size) . \")\";\n\n if ( $size > 0 ) {\n goodprint \"Log file $myvar{'log_error'} is not empty\";\n if ( $size < 32 * 1024 * 1024 ) {\n goodprint \"Log file $myvar{'log_error'} is smaller than 32 MB\";\n }\n else {\n badprint \"Log file $myvar{'log_error'} is bigger than 32 MB\";\n push @generalrec,\n $myvar{'log_error'}\n . \" is > 32MB, you should analyze why or implement a rotation log strategy such as logrotate!\";\n }\n }\n else {\n infoprint\n\"Log file $myvar{'log_error'} is empty. Assuming log-rotation. Use --server-log={file} for explicit file\";\n return;\n }\n if ( !open( $fh, '<', $myvar{'log_error'} ) ) {\n badprint \"Log file $myvar{'log_error'} isn't readable.\";\n return;\n }\n goodprint \"Log file $myvar{'log_error'} is readable.\";\n\n if ( $maxlines * 80 < $size ) {\n seek( $fh, -$maxlines * 80, 2 );\n <$fh>; # discard line fragment\n }\n }\n else {\n badprint \"Log file $myvar{'log_error'} doesn't exist\";\n return;\n }\n\n my $numLi = 0;\n my $nbWarnLog = 0;\n my $nbErrLog = 0;\n my @lastShutdowns;\n my @lastStarts;\n\n while ( my $logLi = <$fh> ) {\n chomp $logLi;\n $numLi++;\n debugprint \"$numLi: $logLi\"\n if $logLi =~ /warning|error/i and $logLi !~ /Logging to/;\n $nbErrLog++\n if $logLi =~ /error/i\n and $logLi !~ /(Logging to|\\[Warning\\].*ERROR_FOR_DIVISION_BY_ZERO)/;\n $nbWarnLog++ if $logLi =~ /warning/i;\n push @lastShutdowns, $logLi\n if $logLi =~ /Shutdown complete/ and $logLi !~ /Innodb/i;\n push @lastStarts, $logLi if $logLi =~ /ready for connections/;\n }\n close $fh;\n\n if ( $nbWarnLog > 0 ) {\n badprint \"$myvar{'log_error'} contains $nbWarnLog warning(s).\";\n push @generalrec, \"Check warning line(s) in $myvar{'log_error'} file\";\n }\n else {\n goodprint \"$myvar{'log_error'} doesn't contain any warning.\";\n }\n if ( $nbErrLog > 0 ) {\n badprint \"$myvar{'log_error'} contains $nbErrLog error(s).\";\n push @generalrec, \"Check error line(s) in $myvar{'log_error'} file\";\n }\n else {\n goodprint \"$myvar{'log_error'} doesn't contain any error.\";\n }\n\n infoprint scalar @lastStarts . \" start(s) detected in $myvar{'log_error'}\";\n my $nStart = 0;\n my $nEnd = 10;\n if ( scalar @lastStarts < $nEnd ) {\n $nEnd = scalar @lastStarts;\n }\n for my $startd ( reverse @lastStarts[ -$nEnd .. -1 ] ) {\n $nStart++;\n infoprint \"$nStart) $startd\";\n }\n infoprint scalar @lastShutdowns\n . \" shutdown(s) detected in $myvar{'log_error'}\";\n $nStart = 0;\n $nEnd = 10;\n if ( scalar @lastShutdowns < $nEnd ) {\n $nEnd = scalar @lastShutdowns;\n }\n for my $shutd ( reverse @lastShutdowns[ -$nEnd .. -1 ] ) {\n $nStart++;\n infoprint \"$nStart) $shutd\";\n }\n\n #exit 0;\n}\n\nsub cve_recommendations {\n subheaderprint \"CVE Security Recommendations\";\n unless ( defined( $opt{cvefile} ) && -f \"$opt{cvefile}\" ) {\n infoprint \"Skipped due to --cvefile option undefined\";\n return;\n }\n\n#$mysqlvermajor=10;\n#$mysqlverminor=1;\n#$mysqlvermicro=17;\n#prettyprint \"Look for related CVE for $myvar{'version'} or lower in $opt{cvefile}\";\n my $cvefound = 0;\n open( my $fh, \"<\", $opt{cvefile} )\n or die \"Can't open $opt{cvefile} for read: $!\";\n while ( my $cveline = <$fh> ) {\n my @cve = split( ';', $cveline );\n debugprint\n\"Comparing $mysqlvermajor\\.$mysqlverminor\\.$mysqlvermicro with $cve[1]\\.$cve[2]\\.$cve[3] : \"\n . ( mysql_version_le( $cve[1], $cve[2], $cve[3] ) ? '<=' : '>' );\n\n # Avoid not major/minor version corresponding CVEs\n next\n unless ( int( $cve[1] ) == $mysqlvermajor\n && int( $cve[2] ) == $mysqlverminor );\n if ( int( $cve[3] ) >= $mysqlvermicro ) {\n badprint \"$cve[4](<= $cve[1]\\.$cve[2]\\.$cve[3]) : $cve[6]\";\n $result{'CVE'}{'List'}{$cvefound} =\n \"$cve[4](<= $cve[1]\\.$cve[2]\\.$cve[3]) : $cve[6]\";\n $cvefound++;\n }\n }\n close $fh or die \"Cannot close $opt{cvefile}: $!\";\n $result{'CVE'}{'nb'} = $cvefound;\n\n my $cve_warning_notes = \"\";\n if ( $cvefound == 0 ) {\n goodprint \"NO SECURITY CVE FOUND FOR YOUR VERSION\";\n return;\n }\n if ( $mysqlvermajor eq 5 and $mysqlverminor eq 5 ) {\n infoprint\n \"False positive CVE(s) for MySQL and MariaDB 5.5.x can be found.\";\n infoprint \"Check carefully each CVE for those particular versions\";\n }\n badprint $cvefound . \" CVE(s) found for your MySQL release.\";\n push( @generalrec,\n $cvefound\n . \" CVE(s) found for your MySQL release. Consider upgrading your version !\"\n );\n}\n\nsub get_opened_ports {\n my @opened_ports = `netstat -ltn`;\n @opened_ports = map {\n my $v = $_;\n $v =~ s/.*:(\\d+)\\s.*$/$1/;\n $v =~ s/\\D//g;\n $v;\n } @opened_ports;\n @opened_ports = sort { $a <=> $b } grep { !/^$/ } @opened_ports;\n\n #debugprint Dumper \\@opened_ports;\n $result{'Network'}{'TCP Opened'} = \\@opened_ports;\n return @opened_ports;\n}\n\nsub is_open_port {\n my $port = shift;\n if ( grep { /^$port$/ } get_opened_ports ) {\n return 1;\n }\n return 0;\n}\n\nsub get_process_memory {\n my $pid = shift;\n my @mem = `ps -p $pid -o rss`;\n return 0 if scalar @mem != 2;\n return $mem[1] * 1024;\n}\n\nsub get_other_process_memory {\n return 0 if ( $opt{tbstat} == 0 );\n my @procs = `ps eaxo pid,command`;\n @procs = map {\n my $v = $_;\n $v =~ s/.*PID.*//;\n $v =~ s/.*mysqld.*//;\n $v =~ s/.*\\[.*\\].*//;\n $v =~ s/^\\s+$//g;\n $v =~ s/.*PID.*CMD.*//;\n $v =~ s/.*systemd.*//;\n $v =~ s/\\s*?(\\d+)\\s*.*/$1/g;\n $v;\n } @procs;\n @procs = remove_cr @procs;\n @procs = remove_empty @procs;\n my $totalMemOther = 0;\n map { $totalMemOther += get_process_memory($_); } @procs;\n return $totalMemOther;\n}\n\nsub get_os_release {\n if ( -f \"/etc/lsb-release\" ) {\n my @info_release = get_file_contents \"/etc/lsb-release\";\n my $os_release = $info_release[3];\n $os_release =~ s/.*=\"//;\n $os_release =~ s/\"$//;\n return $os_release;\n }\n\n if ( -f \"/etc/system-release\" ) {\n my @info_release = get_file_contents \"/etc/system-release\";\n return $info_release[0];\n }\n\n if ( -f \"/etc/os-release\" ) {\n my @info_release = get_file_contents \"/etc/os-release\";\n my $os_release = $info_release[0];\n $os_release =~ s/.*=\"//;\n $os_release =~ s/\"$//;\n return $os_release;\n }\n\n if ( -f \"/etc/issue\" ) {\n my @info_release = get_file_contents \"/etc/issue\";\n my $os_release = $info_release[0];\n $os_release =~ s/\\s+\\\\n.*//;\n return $os_release;\n }\n return \"Unknown OS release\";\n}\n\nsub get_fs_info {\n my @sinfo = `df -P | grep '%'`;\n my @iinfo = `df -Pi| grep '%'`;\n shift @sinfo;\n shift @iinfo;\n\n foreach my $info (@sinfo) {\n\n #exit(0);\n if ( $info =~ /.*?(\\d+)\\s+(\\d+)\\s+(\\d+)\\s+(\\d+)%\\s+(.*)$/ ) {\n next if $5 =~ m{(run|dev|sys|proc|snap|init)};\n if ( $4 > 85 ) {\n badprint \"mount point $5 is using $4 % total space (\"\n . human_size( $2 * 1024 ) . \" / \"\n . human_size( $1 * 1024 ) . \")\";\n push( @generalrec, \"Add some space to $4 mountpoint.\" );\n }\n else {\n infoprint \"mount point $5 is using $4 % total space (\"\n . human_size( $2 * 1024 ) . \" / \"\n . human_size( $1 * 1024 ) . \")\";\n }\n $result{'Filesystem'}{'Space Pct'}{$5} = $4;\n $result{'Filesystem'}{'Used Space'}{$5} = $2;\n $result{'Filesystem'}{'Free Space'}{$5} = $3;\n $result{'Filesystem'}{'Total Space'}{$5} = $1;\n }\n }\n\n @iinfo = map {\n my $v = $_;\n $v =~ s/.*\\s(\\d+)%\\s+(.*)/$1\\t$2/g;\n $v;\n } @iinfo;\n foreach my $info (@iinfo) {\n next if $info =~ m{(\\d+)\\t/(run|dev|sys|proc|snap)($|/)};\n if ( $info =~ /(\\d+)\\t(.*)/ ) {\n if ( $1 > 85 ) {\n badprint \"mount point $2 is using $1 % of max allowed inodes\";\n push( @generalrec,\n\"Cleanup files from $2 mountpoint or reformat your filesystem.\"\n );\n }\n else {\n infoprint \"mount point $2 is using $1 % of max allowed inodes\";\n }\n $result{'Filesystem'}{'Inode Pct'}{$2} = $1;\n }\n }\n}\n\nsub merge_hash {\n my $h1 = shift;\n my $h2 = shift;\n my %result = {};\n foreach my $substanceref ( $h1, $h2 ) {\n while ( my ( $k, $v ) = each %$substanceref ) {\n next if ( exists $result{$k} );\n $result{$k} = $v;\n }\n }\n return \\%result;\n}\n\nsub is_virtual_machine {\n if ( $^O eq 'linux' ) {\n my $isVm = `grep -Ec '^flags.*\\ hypervisor\\ ' /proc/cpuinfo`;\n return ( $isVm == 0 ? 0 : 1 );\n }\n\n if ( $^O eq 'freebsd' ) {\n my $isVm = `sysctl -n kern.vm_guest`;\n chomp $isVm;\n print \"FARK DEBUG isVm=[$isVm]\";\n return ( $isVm eq 'none' ? 0 : 1 );\n }\n return 0;\n}\n\nsub infocmd {\n my $cmd = \"@_\";\n debugprint \"CMD: $cmd\";\n my @result = `$cmd`;\n @result = remove_cr @result;\n for my $l (@result) {\n infoprint \"$l\";\n }\n}\n\nsub infocmd_tab {\n my $cmd = \"@_\";\n debugprint \"CMD: $cmd\";\n my @result = `$cmd`;\n @result = remove_cr @result;\n for my $l (@result) {\n infoprint \"\\t$l\";\n }\n}\n\nsub infocmd_one {\n my $cmd = \"@_\";\n my @result = `$cmd 2>&1`;\n @result = remove_cr @result;\n return join ', ', @result;\n}\n\nsub get_kernel_info {\n my @params = (\n 'fs.aio-max-nr', 'fs.aio-nr',\n 'fs.nr_open', 'fs.file-max',\n 'sunrpc.tcp_fin_timeout', 'sunrpc.tcp_max_slot_table_entries',\n 'sunrpc.tcp_slot_table_entries', 'vm.swappiness'\n );\n infoprint \"Information about kernel tuning:\";\n foreach my $param (@params) {\n infocmd_tab(\"sysctl $param 2>/dev/null\");\n $result{'OS'}{'Config'}{$param} = `sysctl -n $param 2>/dev/null`;\n }\n if ( `sysctl -n vm.swappiness` > 10 ) {\n badprint\n \"Swappiness is > 10, please consider having a value lower than 10\";\n push @generalrec, \"setup swappiness lower or equal to 10\";\n push @adjvars,\n'vm.swappiness <= 10 (echo 10 > /proc/sys/vm/swappiness) or vm.swappiness=10 in /etc/sysctl.conf';\n }\n else {\n infoprint \"Swappiness is < 10.\";\n }\n\n # only if /proc/sys/sunrpc exists\n my $tcp_slot_entries =\n `sysctl -n sunrpc.tcp_slot_table_entries 2>/dev/null`;\n if ( -f \"/proc/sys/sunrpc\"\n and ( $tcp_slot_entries eq '' or $tcp_slot_entries < 100 ) )\n {\n badprint\n\"Initial TCP slot entries is < 1M, please consider having a value greater than 100\";\n push @generalrec, \"setup Initial TCP slot entries greater than 100\";\n push @adjvars,\n'sunrpc.tcp_slot_table_entries > 100 (echo 128 > /proc/sys/sunrpc/tcp_slot_table_entries) or sunrpc.tcp_slot_table_entries=128 in /etc/sysctl.conf';\n }\n else {\n infoprint \"TCP slot entries is > 100.\";\n }\n\n if ( -f \"/proc/sys/fs/aio-max-nr\" ) {\n if ( `sysctl -n fs.aio-max-nr` < 1000000 ) {\n badprint\n\"Max running total of the number of max. events is < 1M, please consider having a value greater than 1M\";\n push @generalrec, \"setup Max running number events greater than 1M\";\n push @adjvars,\n'fs.aio-max-nr > 1M (echo 1048576 > /proc/sys/fs/aio-max-nr) or fs.aio-max-nr=1048576 in /etc/sysctl.conf';\n }\n else {\n infoprint \"Max Number of AIO events is > 1M.\";\n }\n }\n if ( -f \"/proc/sys/fs/nr_open\" ) {\n if ( `sysctl -n fs.nr_open` < 1000000 ) {\n badprint\n\"Max running total of the number of file open request is < 1M, please consider having a value greater than 1M\";\n push @generalrec,\n \"setup running number of open request greater than 1M\";\n push @adjvars,\n'fs.aio-nr > 1M (echo 1048576 > /proc/sys/fs/nr_open) or fs.nr_open=1048576 in /etc/sysctl.conf';\n }\n else {\n infoprint \"Max Number of open file requests is > 1M.\";\n }\n }\n}\n\nsub get_system_info {\n $result{'OS'}{'Release'} = get_os_release();\n infoprint get_os_release;\n if (is_virtual_machine) {\n infoprint \"Machine type : Virtual machine\";\n $result{'OS'}{'Virtual Machine'} = 'YES';\n }\n else {\n infoprint \"Machine type : Physical machine\";\n $result{'OS'}{'Virtual Machine'} = 'NO';\n }\n\n $result{'Network'}{'Connected'} = 'NO';\n `ping -c 1 ipecho.net &>/dev/null`;\n my $isConnected = $?;\n if ( $? == 0 ) {\n infoprint \"Internet : Connected\";\n $result{'Network'}{'Connected'} = 'YES';\n }\n else {\n badprint \"Internet : Disconnected\";\n }\n $result{'OS'}{'NbCore'} = cpu_cores;\n infoprint \"Number of Core CPU : \" . cpu_cores;\n $result{'OS'}{'Type'} = `uname -o`;\n infoprint \"Operating System Type : \" . infocmd_one \"uname -o\";\n $result{'OS'}{'Kernel'} = `uname -r`;\n infoprint \"Kernel Release : \" . infocmd_one \"uname -r\";\n $result{'OS'}{'Hostname'} = `hostname`;\n $result{'Network'}{'Internal Ip'} = `hostname -I`;\n infoprint \"Hostname : \" . infocmd_one \"hostname\";\n infoprint \"Network Cards : \";\n infocmd_tab \"ifconfig| grep -A1 mtu\";\n infoprint \"Internal IP : \" . infocmd_one \"hostname -I\";\n $result{'Network'}{'Internal Ip'} = `ifconfig| grep -A1 mtu`;\n my $httpcli = get_http_cli();\n infoprint \"HTTP client found: $httpcli\" if defined $httpcli;\n\n my $ext_ip = \"\";\n if ( $httpcli =~ /curl$/ ) {\n $ext_ip = infocmd_one \"$httpcli -m 3 ipecho.net/plain\";\n }\n elsif ( $httpcli =~ /wget$/ ) {\n\n $ext_ip = infocmd_one \"$httpcli -t 1 -T 3 -q -O - ipecho.net/plain\";\n }\n infoprint \"External IP : \" . $ext_ip;\n $result{'Network'}{'External Ip'} = $ext_ip;\n badprint \"External IP : Can't check, no Internet connectivity\"\n unless defined($httpcli);\n infoprint \"Name Servers : \"\n . infocmd_one \"grep 'nameserver' /etc/resolv.conf \\| awk '{print \\$2}'\";\n infoprint \"Logged In users : \";\n infocmd_tab \"who\";\n $result{'OS'}{'Logged users'} = `who`;\n infoprint \"Ram Usages in MB : \";\n infocmd_tab \"free -m | grep -v +\";\n $result{'OS'}{'Free Memory RAM'} = `free -m | grep -v +`;\n infoprint \"Load Average : \";\n infocmd_tab \"top -n 1 -b | grep 'load average:'\";\n $result{'OS'}{'Load Average'} = `top -n 1 -b | grep 'load average:'`;\n\n infoprint \"System Uptime : \";\n infocmd_tab \"uptime\";\n $result{'OS'}{'Uptime'} = `uptime`;\n}\n\nsub system_recommendations {\n if ( is_remote eq 1 ) {\n infoprint \"Skipping system checks on remote host\";\n return;\n }\n return if ( $opt{sysstat} == 0 );\n subheaderprint \"System Linux Recommendations\";\n my $os = `uname`;\n unless ( $os =~ /Linux/i ) {\n infoprint \"Skipped due to non Linux server\";\n return;\n }\n prettyprint \"Look for related Linux system recommendations\";\n\n #prettyprint '-'x78;\n get_system_info();\n\n my $nb_cpus = cpu_cores;\n if ( $nb_cpus > 1 ) {\n goodprint \"There is at least one CPU dedicated to database server.\";\n }\n else {\n badprint\n\"There is only one CPU, consider dedicated one CPU for your database server\";\n push @generalrec,\n \"Consider increasing number of CPU for your database server\";\n }\n\n if ( $physical_memory >= 1.5 * 1024 ) {\n goodprint \"There is at least 1 Gb of RAM dedicated to Linux server.\";\n }\n else {\n badprint\n\"There is less than 1,5 Gb of RAM, consider dedicated 1 Gb for your Linux server\";\n push @generalrec,\n \"Consider increasing 1,5 / 2 Gb of RAM for your Linux server\";\n }\n\n my $omem = get_other_process_memory;\n infoprint \"User process except mysqld used \"\n . hr_bytes_rnd($omem) . \" RAM.\";\n if ( ( 0.15 * $physical_memory ) < $omem ) {\n badprint\n\"Other user process except mysqld used more than 15% of total physical memory \"\n . percentage( $omem, $physical_memory ) . \"% (\"\n . hr_bytes_rnd($omem) . \" / \"\n . hr_bytes_rnd($physical_memory) . \")\";\n push( @generalrec,\n\"Consider stopping or dedicate server for additional process other than mysqld.\"\n );\n push( @adjvars,\n\"DON'T APPLY SETTINGS BECAUSE THERE ARE TOO MANY PROCESSES RUNNING ON THIS SERVER. OOM KILL CAN OCCUR!\"\n );\n }\n else {\n infoprint\n\"Other user process except mysqld used less than 15% of total physical memory \"\n . percentage( $omem, $physical_memory ) . \"% (\"\n . hr_bytes_rnd($omem) . \" / \"\n . hr_bytes_rnd($physical_memory) . \")\";\n }\n\n if ( $opt{'maxportallowed'} > 0 ) {\n my @opened_ports = get_opened_ports;\n infoprint \"There is \"\n . scalar @opened_ports\n . \" listening port(s) on this server.\";\n if ( scalar(@opened_ports) > $opt{'maxportallowed'} ) {\n badprint \"There are too many listening ports: \"\n . scalar(@opened_ports)\n . \" opened > \"\n . $opt{'maxportallowed'}\n . \"allowed.\";\n push( @generalrec,\n\"Consider dedicating a server for your database installation with fewer services running on it!\"\n );\n }\n else {\n goodprint \"There are less than \"\n . $opt{'maxportallowed'}\n . \" opened ports on this server.\";\n }\n }\n\n foreach my $banport (@banned_ports) {\n if ( is_open_port($banport) ) {\n badprint \"Banned port: $banport is opened..\";\n push( @generalrec,\n\"Port $banport is opened. Consider stopping the program over this port.\"\n );\n }\n else {\n goodprint \"$banport is not opened.\";\n }\n }\n\n subheaderprint \"Filesystem Linux Recommendations\";\n get_fs_info;\n subheaderprint \"Kernel Information Recommendations\";\n get_kernel_info;\n}\n\nsub security_recommendations {\n subheaderprint \"Security Recommendations\";\n\n if ( mysql_version_eq(8) ) {\n infoprint \"Skipped due to unsupported feature for MySQL 8.0+\";\n return;\n }\n\n #exit 0;\n if ( $opt{skippassword} eq 1 ) {\n infoprint \"Skipped due to --skippassword option\";\n return;\n }\n\n my $PASS_COLUMN_NAME = 'password';\n\n # New table schema available since mysql-5.7 and mariadb-10.2\n # But need to be checked\n if ( $myvar{'version'} =~ /5\\.7|10\\.[2-5]\\..*MariaDB*/ ) {\n my $password_column_exists =\n`$mysqlcmd $mysqllogin -Bse \"SELECT 1 FROM information_schema.columns WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user' AND COLUMN_NAME = 'password'\" 2>>/dev/null`;\n my $authstring_column_exists =\n`$mysqlcmd $mysqllogin -Bse \"SELECT 1 FROM information_schema.columns WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user' AND COLUMN_NAME = 'authentication_string'\" 2>>/dev/null`;\n if ( $password_column_exists && $authstring_column_exists ) {\n $PASS_COLUMN_NAME =\n\"IF(plugin='mysql_native_password', authentication_string, password)\";\n }\n elsif ($authstring_column_exists) {\n $PASS_COLUMN_NAME = 'authentication_string';\n }\n elsif ( !$password_column_exists ) {\n infoprint \"Skipped due to none of known auth columns exists\";\n return;\n }\n }\n debugprint \"Password column = $PASS_COLUMN_NAME\";\n\n # IS THERE A ROLE COLUMN\n my $is_role_column = select_one\n\"select count(*) from information_schema.columns where TABLE_NAME='user' AND TABLE_SCHEMA='mysql' and COLUMN_NAME='IS_ROLE'\";\n\n my $extra_user_condition = \"\";\n $extra_user_condition = \"IS_ROLE = 'N' AND\" if $is_role_column > 0;\n my @mysqlstatlist;\n if ( $is_role_column > 0 ) {\n @mysqlstatlist = select_array\n\"SELECT CONCAT(QUOTE(user), '\\@', QUOTE(host)) FROM mysql.user WHERE IS_ROLE='Y'\";\n foreach my $line ( sort @mysqlstatlist ) {\n chomp($line);\n infoprint \"User $line is User Role\";\n }\n }\n else {\n debugprint \"No Role user detected\";\n goodprint \"No Role user detected\";\n }\n\n # Looking for Anonymous users\n @mysqlstatlist = select_array\n\"SELECT CONCAT(QUOTE(user), '\\@', QUOTE(host)) FROM mysql.user WHERE $extra_user_condition (TRIM(USER) = '' OR USER IS NULL)\";\n\n #debugprint Dumper \\@mysqlstatlist;\n\n #exit 0;\n if (@mysqlstatlist) {\n push( @generalrec,\n \"Remove Anonymous User accounts: there are \"\n . scalar(@mysqlstatlist)\n . \" anonymous accounts.\" );\n foreach my $line ( sort @mysqlstatlist ) {\n chomp($line);\n badprint \"User \"\n . $line\n . \" is an anonymous account. Remove with DROP USER \"\n . $line . \";\";\n }\n }\n else {\n goodprint \"There are no anonymous accounts for any database users\";\n }\n if ( mysql_version_le( 5, 1 ) ) {\n badprint \"No more password checks for MySQL version <=5.1\";\n badprint \"MySQL version <=5.1 is deprecated and end of support.\";\n return;\n }\n\n # Looking for Empty Password\n if ( mysql_version_ge( 10, 4 ) ) {\n @mysqlstatlist = select_array\nq{SELECT CONCAT(QUOTE(user), '@', QUOTE(host)) FROM mysql.global_priv WHERE\n ( user != ''\n AND JSON_CONTAINS(Priv, '\"mysql_native_password\"', '$.plugin') AND JSON_CONTAINS(Priv, '\"\"', '$.authentication_string')\n AND NOT JSON_CONTAINS(Priv, 'true', '$.account_locked')\n )};\n }\n else {\n @mysqlstatlist = select_array\n\"SELECT CONCAT(QUOTE(user), '\\@', QUOTE(host)) FROM mysql.user WHERE ($PASS_COLUMN_NAME = '' OR $PASS_COLUMN_NAME IS NULL)\n AND user != ''\n /*!50501 AND plugin NOT IN ('auth_socket', 'unix_socket', 'win_socket', 'auth_pam_compat') */\n /*!80000 AND account_locked = 'N' AND password_expired = 'N' */\";\n }\n if (@mysqlstatlist) {\n foreach my $line ( sort @mysqlstatlist ) {\n chomp($line);\n badprint \"User '\" . $line . \"' has no password set.\";\n push( @generalrec,\n\"Set up a Secure Password for $line user: SET PASSWORD FOR $line = PASSWORD('secure_password');\"\n );\n }\n }\n else {\n goodprint \"All database users have passwords assigned\";\n }\n\n if ( mysql_version_ge( 5, 7 ) ) {\n my $valPlugin = select_one(\n\"select count(*) from information_schema.plugins where PLUGIN_NAME='validate_password' AND PLUGIN_STATUS='ACTIVE'\"\n );\n if ( $valPlugin >= 1 ) {\n infoprint\n\"Bug #80860 MySQL 5.7: Avoid testing password when validate_password is activated\";\n return;\n }\n }\n\n # Looking for User with user/ uppercase /capitalise user as password\n @mysqlstatlist = select_array\n\"SELECT CONCAT(QUOTE(user), '\\@', QUOTE(host)) FROM mysql.user WHERE user != '' AND (CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(user) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(UPPER(user)) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(CONCAT(UPPER(LEFT(User, 1)), SUBSTRING(User, 2, LENGTH(User)))))\";\n if (@mysqlstatlist) {\n foreach my $line ( sort @mysqlstatlist ) {\n chomp($line);\n badprint \"User \" . $line . \" has user name as password.\";\n push( @generalrec,\n\"Set up a Secure Password for $line user: SET PASSWORD FOR $line = PASSWORD('secure_password');\"\n );\n }\n }\n\n @mysqlstatlist = select_array\n \"SELECT CONCAT(QUOTE(user), '\\@', host) FROM mysql.user WHERE HOST='%'\";\n if (@mysqlstatlist) {\n foreach my $line ( sort @mysqlstatlist ) {\n chomp($line);\n my $luser = ( split /@/, $line )[0];\n badprint \"User \" . $line\n . \" does not specify hostname restrictions.\";\n push( @generalrec,\n\"Restrict Host for $luser\\@'%' to $luser\\@LimitedIPRangeOrLocalhost\"\n );\n push( @generalrec,\n \"RENAME USER $luser\\@'%' TO \"\n . $luser\n . \"\\@LimitedIPRangeOrLocalhost;\" );\n }\n }\n\n unless ( -f $basic_password_files ) {\n badprint \"There is no basic password file list!\";\n return;\n }\n\n my @passwords = get_basic_passwords $basic_password_files;\n infoprint \"There are \"\n . scalar(@passwords)\n . \" basic passwords in the list.\";\n my $nbins = 0;\n my $passreq;\n if (@passwords) {\n my $nbInterPass = 0;\n foreach my $pass (@passwords) {\n $nbInterPass++;\n\n $pass =~ s/\\s//g;\n $pass =~ s/\\'/\\\\\\'/g;\n chomp($pass);\n\n # Looking for User with user/ uppercase /capitalise weak password\n @mysqlstatlist =\n select_array\n\"SELECT CONCAT(user, '\\@', host) FROM mysql.user WHERE $PASS_COLUMN_NAME = PASSWORD('\"\n . $pass\n . \"') OR $PASS_COLUMN_NAME = PASSWORD(UPPER('\"\n . $pass\n . \"')) OR $PASS_COLUMN_NAME = PASSWORD(CONCAT(UPPER(LEFT('\"\n . $pass\n . \"', 1)), SUBSTRING('\"\n . $pass\n . \"', 2, LENGTH('\"\n . $pass . \"'))))\";\n debugprint \"There are \" . scalar(@mysqlstatlist) . \" items.\";\n if (@mysqlstatlist) {\n foreach my $line (@mysqlstatlist) {\n chomp($line);\n badprint \"User '\" . $line\n . \"' is using weak password: $pass in a lower, upper or capitalize derivative version.\";\n\n push( @generalrec,\n\"Set up a Secure Password for $line user: SET PASSWORD FOR '\"\n . ( split /@/, $line )[0] . \"'\\@'\"\n . ( split /@/, $line )[1]\n . \"' = PASSWORD('secure_password');\" );\n $nbins++;\n }\n }\n debugprint \"$nbInterPass / \" . scalar(@passwords)\n if ( $nbInterPass % 1000 == 0 );\n }\n }\n if ( $nbins > 0 ) {\n push( @generalrec,\n $nbins\n . \" user(s) used basic or weak password from basic dictionary.\" );\n }\n}\n\nsub get_replication_status {\n subheaderprint \"Replication Metrics\";\n infoprint \"Galera Synchronous replication: \" . $myvar{'have_galera'};\n if ( scalar( keys %myslaves ) == 0 ) {\n infoprint \"No replication slave(s) for this server.\";\n }\n else {\n infoprint \"This server is acting as master for \"\n . scalar( keys %myslaves )\n . \" server(s).\";\n }\n infoprint \"Binlog format: \" . $myvar{'binlog_format'};\n infoprint \"XA support enabled: \" . $myvar{'innodb_support_xa'};\n\n infoprint \"Semi synchronous replication Master: \"\n . (\n (\n defined( $myvar{'rpl_semi_sync_master_enabled'} )\n or defined( $myvar{'rpl_semi_sync_source_enabled'} )\n )\n ? ( $myvar{'rpl_semi_sync_master_enabled'}\n // $myvar{'rpl_semi_sync_source_enabled'} )\n : 'Not Activated'\n );\n infoprint \"Semi synchronous replication Slave: \"\n . (\n (\n defined( $myvar{'rpl_semi_sync_slave_enabled'} )\n or defined( $myvar{'rpl_semi_sync_replica_enabled'} )\n )\n ? ( $myvar{'rpl_semi_sync_slave_enabled'}\n // $myvar{'rpl_semi_sync_replica_enabled'} )\n : 'Not Activated'\n );\n if ( scalar( keys %myrepl ) == 0 and scalar( keys %myslaves ) == 0 ) {\n infoprint \"This is a standalone server\";\n return;\n }\n if ( scalar( keys %myrepl ) == 0 ) {\n infoprint\n \"No replication setup for this server or replication not started.\";\n return;\n }\n\n $result{'Replication'}{'status'} = \\%myrepl;\n my ($io_running) = $myrepl{'Slave_IO_Running'}\n // $myrepl{'Replica_IO_Running'};\n debugprint \"IO RUNNING: $io_running \";\n my ($sql_running) = $myrepl{'Slave_SQL_Running'}\n // $myrepl{'Replica_SQL_Running'};\n debugprint \"SQL RUNNING: $sql_running \";\n\n my ($seconds_behind_master) = $myrepl{'Seconds_Behind_Master'}\n // $myrepl{'Seconds_Behind_Source'};\n $seconds_behind_master = 1000000 unless defined($seconds_behind_master);\n debugprint \"SECONDS : $seconds_behind_master \";\n\n if ( defined($io_running)\n and ( $io_running !~ /yes/i or $sql_running !~ /yes/i ) )\n {\n badprint\n \"This replication slave is not running but seems to be configured.\";\n }\n if ( defined($io_running)\n && $io_running =~ /yes/i\n && $sql_running =~ /yes/i )\n {\n if ( $myvar{'read_only'} eq 'OFF' ) {\n badprint\n\"This replication slave is running with the read_only option disabled.\";\n }\n else {\n goodprint\n\"This replication slave is running with the read_only option enabled.\";\n }\n if ( $seconds_behind_master > 0 ) {\n badprint\n\"This replication slave is lagging and slave has $seconds_behind_master second(s) behind master host.\";\n }\n else {\n goodprint \"This replication slave is up to date with master.\";\n }\n }\n}\n\n# https://endoflife.software/applications/databases/mysql\n# https://endoflife.date/mariadb\nsub validate_mysql_version {\n ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) =\n $myvar{'version'} =~ /^(\\d+)(?:\\.(\\d+)|)(?:\\.(\\d+)|)/;\n $mysqlverminor ||= 0;\n $mysqlvermicro ||= 0;\n\n prettyprint \" \";\n\n if ( mysql_version_eq(8)\n or mysql_version_eq( 5, 7 )\n or mysql_version_eq( 10, 3 )\n or mysql_version_eq( 10, 4 )\n or mysql_version_eq( 10, 5 )\n or mysql_version_eq( 10, 6 )\n or mysql_version_eq( 10, 7 )\n or mysql_version_eq( 10, 8 )\n or mysql_version_eq( 10, 9 )\n or mysql_version_eq( 10, 10 )\n or mysql_version_eq( 10, 11 ) )\n {\n goodprint \"Currently running supported MySQL version \"\n . $myvar{'version'} . \"\";\n return;\n }\n else {\n badprint \"Your MySQL version \"\n . $myvar{'version'}\n . \" is EOL software. Upgrade soon!\";\n push( @generalrec,\n \"You are using an unsupported version for production environments\"\n );\n push( @generalrec,\n \"Upgrade as soon as possible to a supported version !\" );\n\n }\n}\n\n# Checks if MySQL version is equal to (major, minor, micro)\nsub mysql_version_eq {\n my ( $maj, $min, $mic ) = @_;\n my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) =\n $myvar{'version'} =~ /^(\\d+)(?:\\.(\\d+)|)(?:\\.(\\d+)|)/;\n\n return int($mysqlvermajor) == int($maj)\n if ( !defined($min) && !defined($mic) );\n return int($mysqlvermajor) == int($maj) && int($mysqlverminor) == int($min)\n if ( !defined($mic) );\n return ( int($mysqlvermajor) == int($maj)\n && int($mysqlverminor) == int($min)\n && int($mysqlvermicro) == int($mic) );\n}\n\n# Checks if MySQL version is greater than equal to (major, minor, micro)\nsub mysql_version_ge {\n my ( $maj, $min, $mic ) = @_;\n $min ||= 0;\n $mic ||= 0;\n my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) =\n $myvar{'version'} =~ /^(\\d+)(?:\\.(\\d+)|)(?:\\.(\\d+)|)/;\n\n return\n int($mysqlvermajor) > int($maj)\n || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) > int($min) )\n || ( int($mysqlvermajor) == int($maj)\n && int($mysqlverminor) == int($min)\n && int($mysqlvermicro) >= int($mic) );\n}\n\n# Checks if MySQL version is lower than equal to (major, minor, micro)\nsub mysql_version_le {\n my ( $maj, $min, $mic ) = @_;\n $min ||= 0;\n $mic ||= 0;\n my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) =\n $myvar{'version'} =~ /^(\\d+)(?:\\.(\\d+)|)(?:\\.(\\d+)|)/;\n return\n int($mysqlvermajor) < int($maj)\n || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) < int($min) )\n || ( int($mysqlvermajor) == int($maj)\n && int($mysqlverminor) == int($min)\n && int($mysqlvermicro) <= int($mic) );\n}\n\n# Checks for 32-bit boxes with more than 2GB of RAM\nmy ($arch);\n\nsub check_architecture {\n if ( is_remote eq 1 ) {\n infoprint \"Skipping architecture check on remote host\";\n infoprint \"Using default $opt{defaultarch} bits as target architecture\";\n $arch = $opt{defaultarch};\n return;\n }\n if ( `uname` =~ /SunOS/ && `isainfo -b` =~ /64/ ) {\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` !~ /SunOS/ && `uname -m` =~ /(64|s390x)/ ) {\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` =~ /AIX/ && `bootinfo -K` =~ /64/ ) {\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` =~ /NetBSD|OpenBSD/ && `sysctl -b hw.machine` =~ /64/ ) {\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` =~ /FreeBSD/ && `sysctl -b hw.machine_arch` =~ /64/ ) {\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` =~ /Darwin/ && `uname -m` =~ /Power Macintosh/ ) {\n\n# Darwin box.local 9.8.0 Darwin Kernel Version 9.8.0: Wed Jul 15 16:57:01 PDT 2009; root:xnu1228.15.4~1/RELEASE_PPC Power Macintosh\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` =~ /Darwin/ && `uname -m` =~ /x86_64/ ) {\n\n# Darwin gibas.local 12.5.2 Darwin Kernel Version 12.3.0: Sun Jan 6 22:37:10 PST 2013; root:xnu-2050.22.13~1/RELEASE_X86_64 x86_64\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n else {\n $arch = 32;\n if ( $physical_memory > 2147483648 ) {\n badprint\n\"Switch to 64-bit OS - MySQL cannot currently use all of your RAM\";\n }\n else {\n goodprint \"Operating on 32-bit architecture with less than 2GB RAM\";\n }\n }\n $result{'OS'}{'Architecture'} = \"$arch bits\";\n\n}\n\n# Start up a ton of storage engine counts/statistics\nmy ( %enginestats, %enginecount, $fragtables );\n\nsub check_storage_engines {\n subheaderprint \"Storage Engine Statistics\";\n if ( $opt{skipsize} eq 1 ) {\n infoprint \"Skipped due to --skipsize option\";\n return;\n }\n\n my $engines;\n if ( mysql_version_ge( 5, 5 ) ) {\n my @engineresults = select_array\n\"SELECT ENGINE,SUPPORT FROM information_schema.ENGINES ORDER BY ENGINE ASC\";\n foreach my $line (@engineresults) {\n my ( $engine, $engineenabled );\n ( $engine, $engineenabled ) = $line =~ /([a-zA-Z_]*)\\s+([a-zA-Z]+)/;\n $result{'Engine'}{$engine}{'Enabled'} = $engineenabled;\n $engines .=\n ( $engineenabled eq \"YES\" || $engineenabled eq \"DEFAULT\" )\n ? greenwrap \"+\" . $engine . \" \"\n : redwrap \"-\" . $engine . \" \";\n }\n }\n elsif ( mysql_version_ge( 5, 1, 5 ) ) {\n my @engineresults = select_array\n\"SELECT ENGINE, SUPPORT FROM information_schema.ENGINES WHERE ENGINE NOT IN ('MyISAM', 'MERGE', 'MEMORY') ORDER BY ENGINE\";\n foreach my $line (@engineresults) {\n my ( $engine, $engineenabled );\n ( $engine, $engineenabled ) = $line =~ /([a-zA-Z_]*)\\s+([a-zA-Z]+)/;\n $result{'Engine'}{$engine}{'Enabled'} = $engineenabled;\n $engines .=\n ( $engineenabled eq \"YES\" || $engineenabled eq \"DEFAULT\" )\n ? greenwrap \"+\" . $engine . \" \"\n : redwrap \"-\" . $engine . \" \";\n }\n }\n else {\n $engines .=\n ( defined $myvar{'have_archive'} && $myvar{'have_archive'} eq \"YES\" )\n ? greenwrap \"+Archive \"\n : redwrap \"-Archive \";\n $engines .=\n ( defined $myvar{'have_bdb'} && $myvar{'have_bdb'} eq \"YES\" )\n ? greenwrap \"+BDB \"\n : redwrap \"-BDB \";\n $engines .=\n ( defined $myvar{'have_federated_engine'}\n && $myvar{'have_federated_engine'} eq \"YES\" )\n ? greenwrap \"+Federated \"\n : redwrap \"-Federated \";\n $engines .=\n ( defined $myvar{'have_innodb'} && $myvar{'have_innodb'} eq \"YES\" )\n ? greenwrap \"+InnoDB \"\n : redwrap \"-InnoDB \";\n $engines .=\n ( defined $myvar{'have_isam'} && $myvar{'have_isam'} eq \"YES\" )\n ? greenwrap \"+ISAM \"\n : redwrap \"-ISAM \";\n $engines .=\n ( defined $myvar{'have_ndbcluster'}\n && $myvar{'have_ndbcluster'} eq \"YES\" )\n ? greenwrap \"+NDBCluster \"\n : redwrap \"-NDBCluster \";\n }\n\n my @dblist = grep { $_ ne 'lost+found' } select_array \"SHOW DATABASES\";\n\n $result{'Databases'}{'List'} = [@dblist];\n infoprint \"Status: $engines\";\n if ( mysql_version_ge( 5, 1, 5 ) ) {\n\n# MySQL 5+ servers can have table sizes calculated quickly from information schema\n my @templist = select_array\n\"SELECT ENGINE, SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(ENGINE), SUM(DATA_LENGTH), SUM(INDEX_LENGTH) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema', 'performance_schema', 'mysql') AND ENGINE IS NOT NULL GROUP BY ENGINE ORDER BY ENGINE ASC;\";\n\n my ( $engine, $size, $count, $dsize, $isize );\n foreach my $line (@templist) {\n ( $engine, $size, $count, $dsize, $isize ) =\n $line =~ /([a-zA-Z_]+)\\s+(\\d+)\\s+(\\d+)\\s+(\\d+)\\s+(\\d+)/;\n debugprint \"Engine Found: $engine\";\n next unless ( defined($engine) or trim($engine) eq '' );\n $size = 0 unless ( defined($size) or trim($engine) eq '' );\n $isize = 0 unless ( defined($isize) or trim($engine) eq '' );\n $dsize = 0 unless ( defined($dsize) or trim($engine) eq '' );\n $count = 0 unless ( defined($count) or trim($engine) eq '' );\n $enginestats{$engine} = $size;\n $enginecount{$engine} = $count;\n $result{'Engine'}{$engine}{'Table Number'} = $count;\n $result{'Engine'}{$engine}{'Total Size'} = $size;\n $result{'Engine'}{$engine}{'Data Size'} = $dsize;\n $result{'Engine'}{$engine}{'Index Size'} = $isize;\n }\n\n #print Dumper( \\%enginestats ) if $opt{debug};\n my $not_innodb = '';\n if ( not defined $result{'Variables'}{'innodb_file_per_table'} ) {\n $not_innodb = \"AND NOT ENGINE='InnoDB'\";\n }\n elsif ( $result{'Variables'}{'innodb_file_per_table'} eq 'OFF' ) {\n $not_innodb = \"AND NOT ENGINE='InnoDB'\";\n }\n $result{'Tables'}{'Fragmented tables'} =\n [ select_array\n\"SELECT TABLE_SCHEMA, TABLE_NAME, ENGINE, CAST(DATA_FREE AS SIGNED) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema', 'performance_schema', 'mysql') AND DATA_LENGTH/1024/1024>100 AND cast(DATA_FREE as signed)*100/(DATA_LENGTH+INDEX_LENGTH+cast(DATA_FREE as signed)) > 10 AND NOT ENGINE='MEMORY' $not_innodb\"\n ];\n $fragtables = scalar @{ $result{'Tables'}{'Fragmented tables'} };\n\n }\n else {\n\n # MySQL < 5 servers take a lot of work to get table sizes\n my @tblist;\n\n# Now we build a database list, and loop through it to get storage engine stats for tables\n foreach my $db (@dblist) {\n chomp($db);\n if ( $db eq \"information_schema\"\n or $db eq \"performance_schema\"\n or $db eq \"mysql\"\n or $db eq \"lost+found\" )\n {\n next;\n }\n my @ixs = ( 1, 6, 9 );\n if ( !mysql_version_ge( 4, 1 ) ) {\n\n # MySQL 3.23/4.0 keeps Data_Length in the 5th (0-based) column\n @ixs = ( 1, 5, 8 );\n }\n push( @tblist,\n map { [ (split)[@ixs] ] }\n select_array \"SHOW TABLE STATUS FROM \\\\\\`$db\\\\\\`\" );\n }\n\n # Parse through the table list to generate storage engine counts/statistics\n $fragtables = 0;\n foreach my $tbl (@tblist) {\n\n #debugprint \"Data dump \" . Dumper(@$tbl) if $opt{debug};\n my ( $engine, $size, $datafree ) = @$tbl;\n next if $engine eq 'NULL' or not defined($engine);\n $size = 0 if $size eq 'NULL' or not defined($size);\n $datafree = 0 if $datafree eq 'NULL' or not defined($datafree);\n if ( defined $enginestats{$engine} ) {\n $enginestats{$engine} += $size;\n $enginecount{$engine} += 1;\n }\n else {\n $enginestats{$engine} = $size;\n $enginecount{$engine} = 1;\n }\n if ( $datafree > 0 ) {\n $fragtables++;\n }\n }\n }\n while ( my ( $engine, $size ) = each(%enginestats) ) {\n infoprint \"Data in $engine tables: \"\n . hr_bytes($size)\n . \" (Tables: \"\n . $enginecount{$engine} . \")\" . \"\";\n }\n\n # If the storage engine isn't being used, recommend it to be disabled\n if ( !defined $enginestats{'InnoDB'}\n && defined $myvar{'have_innodb'}\n && $myvar{'have_innodb'} eq \"YES\" )\n {\n badprint \"InnoDB is enabled, but isn't being used\";\n push( @generalrec,\n \"Add skip-innodb to MySQL configuration to disable InnoDB\" );\n }\n if ( !defined $enginestats{'BerkeleyDB'}\n && defined $myvar{'have_bdb'}\n && $myvar{'have_bdb'} eq \"YES\" )\n {\n badprint \"BDB is enabled, but isn't being used\";\n push( @generalrec,\n \"Add skip-bdb to MySQL configuration to disable BDB\" );\n }\n if ( !defined $enginestats{'ISAM'}\n && defined $myvar{'have_isam'}\n && $myvar{'have_isam'} eq \"YES\" )\n {\n badprint \"MyISAM is enabled, but isn't being used\";\n push( @generalrec,\n\"Add skip-isam to MySQL configuration to disable MyISAM (MySQL > 4.1.0)\"\n );\n }\n\n # Fragmented tables\n if ( $fragtables > 0 ) {\n badprint \"Total fragmented tables: $fragtables\";\n push @generalrec,\n'Run ALTER TABLE ... FORCE or OPTIMIZE TABLE to defragment tables for better performance';\n my $total_free = 0;\n foreach my $table_line ( @{ $result{'Tables'}{'Fragmented tables'} } ) {\n my ( $table_schema, $table_name, $engine, $data_free ) =\n split /\\t/msx, $table_line;\n $data_free = $data_free / 1024 / 1024;\n $total_free += $data_free;\n my $generalrec;\n if ( $engine eq 'InnoDB' ) {\n $generalrec =\n \" ALTER TABLE `$table_schema`.`$table_name` FORCE;\";\n }\n else {\n $generalrec = \" OPTIMIZE TABLE `$table_schema`.`$table_name`;\";\n }\n $generalrec .= \" -- can free $data_free MiB\";\n push @generalrec, $generalrec;\n }\n push @generalrec,\n \"Total freed space after defragmentation: $total_free MiB\";\n }\n else {\n goodprint \"Total fragmented tables: $fragtables\";\n }\n\n # Auto increments\n my %tblist;\n\n # Find the maximum integer\n my $maxint = select_one \"SELECT ~0\";\n $result{'MaxInt'} = $maxint;\n\n# Now we use a database list, and loop through it to get storage engine stats for tables\n foreach my $db (@dblist) {\n chomp($db);\n\n if ( !$tblist{$db} ) {\n $tblist{$db} = ();\n }\n\n if ( $db eq \"information_schema\" ) { next; }\n my @ia = ( 0, 10 );\n if ( !mysql_version_ge( 4, 1 ) ) {\n\n # MySQL 3.23/4.0 keeps Data_Length in the 5th (0-based) column\n @ia = ( 0, 9 );\n }\n push(\n @{ $tblist{$db} },\n map { [ (split)[@ia] ] }\n select_array \"SHOW TABLE STATUS FROM \\\\\\`$db\\\\\\`\"\n );\n }\n\n my @dbnames = keys %tblist;\n\n foreach my $db (@dbnames) {\n foreach my $tbl ( @{ $tblist{$db} } ) {\n my ( $name, $autoincrement ) = @$tbl;\n\n if ( $autoincrement =~ /^\\d+?$/ ) {\n my $percent = percentage( $autoincrement, $maxint );\n $result{'PctAutoIncrement'}{\"$db.$name\"} = $percent;\n if ( $percent >= 75 ) {\n badprint\n\"Table '$db.$name' has an autoincrement value near max capacity ($percent%)\";\n }\n }\n }\n }\n}\n\nmy %mycalc;\n\nsub dump_into_file {\n my $file = shift;\n my $content = shift;\n if ( -d \"$opt{dumpdir}\" ) {\n $file = \"$opt{dumpdir}/$file\";\n open( FILE, \">$file\" ) or die \"Can't open $file: $!\";\n print FILE $content;\n close FILE;\n infoprint \"Data saved to $file\";\n }\n}\n\nsub calculations {\n if ( $mystat{'Questions'} < 1 ) {\n badprint \"Your server has not answered any queries: cannot continue...\";\n exit 2;\n }\n\n # Per-thread memory\n $mycalc{'per_thread_buffers'} = 0;\n $mycalc{'per_thread_buffers'} += $myvar{'read_buffer_size'}\n if is_int( $myvar{'read_buffer_size'} );\n $mycalc{'per_thread_buffers'} += $myvar{'read_rnd_buffer_size'}\n if is_int( $myvar{'read_rnd_buffer_size'} );\n $mycalc{'per_thread_buffers'} += $myvar{'sort_buffer_size'}\n if is_int( $myvar{'sort_buffer_size'} );\n $mycalc{'per_thread_buffers'} += $myvar{'thread_stack'}\n if is_int( $myvar{'thread_stack'} );\n $mycalc{'per_thread_buffers'} += $myvar{'join_buffer_size'}\n if is_int( $myvar{'join_buffer_size'} );\n $mycalc{'per_thread_buffers'} += $myvar{'binlog_cache_size'}\n if is_int( $myvar{'binlog_cache_size'} );\n debugprint \"per_thread_buffers: $mycalc{'per_thread_buffers'} (\"\n . human_size( $mycalc{'per_thread_buffers'} ) . \" )\";\n\n# Error max_allowed_packet is not included in thread buffers size\n#$mycalc{'per_thread_buffers'} += $myvar{'max_allowed_packet'} if is_int($myvar{'max_allowed_packet'});\n\n # Total per-thread memory\n $mycalc{'total_per_thread_buffers'} =\n $mycalc{'per_thread_buffers'} * $myvar{'max_connections'};\n\n # Max total per-thread memory reached\n $mycalc{'max_total_per_thread_buffers'} =\n $mycalc{'per_thread_buffers'} * $mystat{'Max_used_connections'};\n\n # Server-wide memory\n $mycalc{'max_tmp_table_size'} =\n ( $myvar{'tmp_table_size'} > $myvar{'max_heap_table_size'} )\n ? $myvar{'max_heap_table_size'}\n : $myvar{'tmp_table_size'};\n $mycalc{'server_buffers'} =\n $myvar{'key_buffer_size'} + $mycalc{'max_tmp_table_size'};\n $mycalc{'server_buffers'} +=\n ( defined $myvar{'innodb_buffer_pool_size'} )\n ? $myvar{'innodb_buffer_pool_size'}\n : 0;\n $mycalc{'server_buffers'} +=\n ( defined $myvar{'innodb_additional_mem_pool_size'} )\n ? $myvar{'innodb_additional_mem_pool_size'}\n : 0;\n $mycalc{'server_buffers'} +=\n ( defined $myvar{'innodb_log_buffer_size'} )\n ? $myvar{'innodb_log_buffer_size'}\n : 0;\n $mycalc{'server_buffers'} +=\n ( defined $myvar{'query_cache_size'} ) ? $myvar{'query_cache_size'} : 0;\n $mycalc{'server_buffers'} +=\n ( defined $myvar{'aria_pagecache_buffer_size'} )\n ? $myvar{'aria_pagecache_buffer_size'}\n : 0;\n\n# Global memory\n# Max used memory is memory used by MySQL based on Max_used_connections\n# This is the max memory used theoretically calculated with the max concurrent connection number reached by mysql\n $mycalc{'max_used_memory'} =\n $mycalc{'server_buffers'} +\n $mycalc{\"max_total_per_thread_buffers\"} +\n get_pf_memory();\n\n # + get_gcache_memory();\n $mycalc{'pct_max_used_memory'} =\n percentage( $mycalc{'max_used_memory'}, $physical_memory );\n\n# Total possible memory is memory needed by MySQL based on max_connections\n# This is the max memory MySQL can theoretically used if all connections allowed has opened by mysql\n $mycalc{'max_peak_memory'} =\n $mycalc{'server_buffers'} +\n $mycalc{'total_per_thread_buffers'} +\n get_pf_memory();\n\n # + get_gcache_memory();\n $mycalc{'pct_max_physical_memory'} =\n percentage( $mycalc{'max_peak_memory'}, $physical_memory );\n\n debugprint \"Max Used Memory: \"\n . hr_bytes( $mycalc{'max_used_memory'} ) . \"\";\n debugprint \"Max Used Percentage RAM: \"\n . $mycalc{'pct_max_used_memory'} . \"%\";\n\n debugprint \"Max Peak Memory: \"\n . hr_bytes( $mycalc{'max_peak_memory'} ) . \"\";\n debugprint \"Max Peak Percentage RAM: \"\n . $mycalc{'pct_max_physical_memory'} . \"%\";\n\n # Slow queries\n $mycalc{'pct_slow_queries'} =\n int( ( $mystat{'Slow_queries'} / $mystat{'Questions'} ) * 100 );\n\n # Connections\n $mycalc{'pct_connections_used'} = int(\n ( $mystat{'Max_used_connections'} / $myvar{'max_connections'} ) * 100 );\n $mycalc{'pct_connections_used'} =\n ( $mycalc{'pct_connections_used'} > 100 )\n ? 100\n : $mycalc{'pct_connections_used'};\n\n # Aborted Connections\n $mycalc{'pct_connections_aborted'} =\n percentage( $mystat{'Aborted_connects'}, $mystat{'Connections'} );\n debugprint \"Aborted_connects: \" . $mystat{'Aborted_connects'} . \"\";\n debugprint \"Connections: \" . $mystat{'Connections'} . \"\";\n debugprint \"pct_connections_aborted: \"\n . $mycalc{'pct_connections_aborted'} . \"\";\n\n # Key buffers\n if ( mysql_version_ge( 4, 1 ) && $myvar{'key_buffer_size'} > 0 ) {\n $mycalc{'pct_key_buffer_used'} = sprintf(\n \"%.1f\",\n (\n 1 - (\n (\n $mystat{'Key_blocks_unused'} *\n $myvar{'key_cache_block_size'}\n ) / $myvar{'key_buffer_size'}\n )\n ) * 100\n );\n }\n else {\n $mycalc{'pct_key_buffer_used'} = 0;\n }\n\n if ( $mystat{'Key_read_requests'} > 0 ) {\n $mycalc{'pct_keys_from_mem'} = sprintf(\n \"%.1f\",\n (\n 100 - (\n ( $mystat{'Key_reads'} / $mystat{'Key_read_requests'} ) *\n 100\n )\n )\n );\n }\n else {\n $mycalc{'pct_keys_from_mem'} = 0;\n }\n if ( defined $mystat{'Aria_pagecache_read_requests'}\n && $mystat{'Aria_pagecache_read_requests'} > 0 )\n {\n $mycalc{'pct_aria_keys_from_mem'} = sprintf(\n \"%.1f\",\n (\n 100 - (\n (\n $mystat{'Aria_pagecache_reads'} /\n $mystat{'Aria_pagecache_read_requests'}\n ) * 100\n )\n )\n );\n }\n else {\n $mycalc{'pct_aria_keys_from_mem'} = 0;\n }\n\n if ( $mystat{'Key_write_requests'} > 0 ) {\n $mycalc{'pct_wkeys_from_mem'} = sprintf( \"%.1f\",\n ( ( $mystat{'Key_writes'} / $mystat{'Key_write_requests'} ) * 100 )\n );\n }\n else {\n $mycalc{'pct_wkeys_from_mem'} = 0;\n }\n\n if ( $doremote eq 0 and !mysql_version_ge(5) ) {\n my $size = 0;\n $size += (split)[0]\n for\n`find \"$myvar{'datadir'}\" -name \"*.MYI\" -print0 2>&1 | xargs $xargsflags -0 du -L $duflags 2>&1`;\n $mycalc{'total_myisam_indexes'} = $size;\n $size = 0 + (split)[0]\n for\n`find \"$myvar{'datadir'}\" -name \"*.MAI\" -print0 2>&1 | xargs $xargsflags -0 du -L $duflags 2>&1`;\n $mycalc{'total_aria_indexes'} = $size;\n }\n elsif ( mysql_version_ge(5) ) {\n $mycalc{'total_myisam_indexes'} = select_one\n\"SELECT IFNULL(SUM(INDEX_LENGTH), 0) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema') AND ENGINE = 'MyISAM';\";\n $mycalc{'total_aria_indexes'} = select_one\n\"SELECT IFNULL(SUM(INDEX_LENGTH), 0) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema') AND ENGINE = 'Aria';\";\n }\n if ( defined $mycalc{'total_myisam_indexes'} ) {\n chomp( $mycalc{'total_myisam_indexes'} );\n }\n if ( defined $mycalc{'total_aria_indexes'} ) {\n chomp( $mycalc{'total_aria_indexes'} );\n }\n\n # Query cache\n if ( mysql_version_ge(8) and mysql_version_le(10) ) {\n $mycalc{'query_cache_efficiency'} = 0;\n }\n elsif ( mysql_version_ge(4) ) {\n $mycalc{'query_cache_efficiency'} = sprintf(\n \"%.1f\",\n (\n $mystat{'Qcache_hits'} /\n ( $mystat{'Com_select'} + $mystat{'Qcache_hits'} )\n ) * 100\n );\n if ( $myvar{'query_cache_size'} ) {\n $mycalc{'pct_query_cache_used'} = sprintf(\n \"%.1f\",\n 100 - (\n $mystat{'Qcache_free_memory'} / $myvar{'query_cache_size'}\n ) * 100\n );\n }\n if ( $mystat{'Qcache_lowmem_prunes'} == 0 ) {\n $mycalc{'query_cache_prunes_per_day'} = 0;\n }\n else {\n $mycalc{'query_cache_prunes_per_day'} = int(\n $mystat{'Qcache_lowmem_prunes'} / ( $mystat{'Uptime'} / 86400 )\n );\n }\n }\n\n # Sorting\n $mycalc{'total_sorts'} = $mystat{'Sort_scan'} + $mystat{'Sort_range'};\n if ( $mycalc{'total_sorts'} > 0 ) {\n $mycalc{'pct_temp_sort_table'} = int(\n ( $mystat{'Sort_merge_passes'} / $mycalc{'total_sorts'} ) * 100 );\n }\n\n # Joins\n $mycalc{'joins_without_indexes'} =\n $mystat{'Select_range_check'} + $mystat{'Select_full_join'};\n $mycalc{'joins_without_indexes_per_day'} =\n int( $mycalc{'joins_without_indexes'} / ( $mystat{'Uptime'} / 86400 ) );\n\n # Temporary tables\n if ( $mystat{'Created_tmp_tables'} > 0 ) {\n if ( $mystat{'Created_tmp_disk_tables'} > 0 ) {\n $mycalc{'pct_temp_disk'} = int(\n (\n $mystat{'Created_tmp_disk_tables'} /\n $mystat{'Created_tmp_tables'}\n ) * 100\n );\n }\n else {\n $mycalc{'pct_temp_disk'} = 0;\n }\n }\n\n # Table cache\n if ( $mystat{'Opened_tables'} > 0 ) {\n if ( not defined( $mystat{'Table_open_cache_hits'} ) ) {\n $mycalc{'table_cache_hit_rate'} =\n int( $mystat{'Open_tables'} * 100 / $mystat{'Opened_tables'} );\n }\n else {\n $mycalc{'table_cache_hit_rate'} = int(\n $mystat{'Table_open_cache_hits'} * 100 / (\n $mystat{'Table_open_cache_hits'} +\n $mystat{'Table_open_cache_misses'}\n )\n );\n }\n }\n else {\n $mycalc{'table_cache_hit_rate'} = 100;\n }\n\n # Open files\n if ( $myvar{'open_files_limit'} > 0 ) {\n $mycalc{'pct_files_open'} =\n int( $mystat{'Open_files'} * 100 / $myvar{'open_files_limit'} );\n }\n\n # Table locks\n if ( $mystat{'Table_locks_immediate'} > 0 ) {\n if ( $mystat{'Table_locks_waited'} == 0 ) {\n $mycalc{'pct_table_locks_immediate'} = 100;\n }\n else {\n $mycalc{'pct_table_locks_immediate'} = int(\n $mystat{'Table_locks_immediate'} * 100 / (\n $mystat{'Table_locks_waited'} +\n $mystat{'Table_locks_immediate'}\n )\n );\n }\n }\n\n # Thread cache\n $mycalc{'thread_cache_hit_rate'} =\n int( 100 -\n ( ( $mystat{'Threads_created'} / $mystat{'Connections'} ) * 100 ) );\n\n # Other\n if ( $mystat{'Connections'} > 0 ) {\n $mycalc{'pct_aborted_connections'} =\n int( ( $mystat{'Aborted_connects'} / $mystat{'Connections'} ) * 100 );\n }\n if ( $mystat{'Questions'} > 0 ) {\n $mycalc{'total_reads'} = $mystat{'Com_select'};\n $mycalc{'total_writes'} =\n $mystat{'Com_delete'} +\n $mystat{'Com_insert'} +\n $mystat{'Com_update'} +\n $mystat{'Com_replace'};\n if ( $mycalc{'total_reads'} == 0 ) {\n $mycalc{'pct_reads'} = 0;\n $mycalc{'pct_writes'} = 100;\n }\n else {\n $mycalc{'pct_reads'} = int(\n (\n $mycalc{'total_reads'} /\n ( $mycalc{'total_reads'} + $mycalc{'total_writes'} )\n ) * 100\n );\n $mycalc{'pct_writes'} = 100 - $mycalc{'pct_reads'};\n }\n }\n\n # InnoDB\n $myvar{'innodb_log_files_in_group'} = 1\n unless defined( $myvar{'innodb_log_files_in_group'} );\n $myvar{'innodb_log_files_in_group'} = 1\n if $myvar{'innodb_log_files_in_group'} == 0;\n\n $myvar{\"innodb_buffer_pool_instances\"} = 1\n unless defined( $myvar{'innodb_buffer_pool_instances'} );\n if ( $myvar{'have_innodb'} eq \"YES\" ) {\n $mycalc{'innodb_log_size_pct'} =\n ( $myvar{'innodb_log_file_size'} *\n $myvar{'innodb_log_files_in_group'} * 100 /\n $myvar{'innodb_buffer_pool_size'} );\n }\n if ( !defined $myvar{'innodb_buffer_pool_size'} ) {\n $mycalc{'innodb_log_size_pct'} = 0;\n $myvar{'innodb_buffer_pool_size'} = 0;\n }\n\n # InnoDB Buffer pool read cache efficiency\n (\n $mystat{'Innodb_buffer_pool_read_requests'},\n $mystat{'Innodb_buffer_pool_reads'}\n )\n = ( 1, 1 )\n unless defined $mystat{'Innodb_buffer_pool_reads'};\n $mycalc{'pct_read_efficiency'} = percentage(\n $mystat{'Innodb_buffer_pool_read_requests'},\n (\n $mystat{'Innodb_buffer_pool_read_requests'} +\n $mystat{'Innodb_buffer_pool_reads'}\n )\n ) if defined $mystat{'Innodb_buffer_pool_read_requests'};\n debugprint \"pct_read_efficiency: \" . $mycalc{'pct_read_efficiency'} . \"\";\n debugprint \"Innodb_buffer_pool_reads: \"\n . $mystat{'Innodb_buffer_pool_reads'} . \"\";\n debugprint \"Innodb_buffer_pool_read_requests: \"\n . $mystat{'Innodb_buffer_pool_read_requests'} . \"\";\n\n # InnoDB log write cache efficiency\n ( $mystat{'Innodb_log_write_requests'}, $mystat{'Innodb_log_writes'} ) =\n ( 1, 1 )\n unless defined $mystat{'Innodb_log_writes'};\n $mycalc{'pct_write_efficiency'} = percentage(\n ( $mystat{'Innodb_log_write_requests'} - $mystat{'Innodb_log_writes'} ),\n $mystat{'Innodb_log_write_requests'}\n ) if defined $mystat{'Innodb_log_write_requests'};\n debugprint \"pct_write_efficiency: \" . $mycalc{'pct_write_efficiency'} . \"\";\n debugprint \"Innodb_log_writes: \" . $mystat{'Innodb_log_writes'} . \"\";\n debugprint \"Innodb_log_write_requests: \"\n . $mystat{'Innodb_log_write_requests'} . \"\";\n $mycalc{'pct_innodb_buffer_used'} = percentage(\n (\n $mystat{'Innodb_buffer_pool_pages_total'} -\n $mystat{'Innodb_buffer_pool_pages_free'}\n ),\n $mystat{'Innodb_buffer_pool_pages_total'}\n ) if defined $mystat{'Innodb_buffer_pool_pages_total'};\n\n $mycalc{'innodb_buffer_alloc_pct'} = select_one(\n \"select round( 100* sum(allocated)/( select VARIABLE_VALUE \"\n . \"FROM performance_schema.global_variables \"\n . \"WHERE VARIABLE_NAME='innodb_buffer_pool_size' ) ,2)\"\n . 'FROM sys.x\\$innodb_buffer_stats_by_table;' );\n\n # Binlog Cache\n if ( $myvar{'log_bin'} ne 'OFF' ) {\n $mycalc{'pct_binlog_cache'} = percentage(\n $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'},\n $mystat{'Binlog_cache_use'} );\n }\n}\n\nsub mysql_stats {\n subheaderprint \"Performance Metrics\";\n\n # Show uptime, queries per second, connections, traffic stats\n my $qps;\n if ( $mystat{'Uptime'} > 0 ) {\n $qps = sprintf( \"%.3f\", $mystat{'Questions'} / $mystat{'Uptime'} );\n }\n push( @generalrec,\n\"MySQL was started within the last 24 hours: recommendations may be inaccurate\"\n ) if ( $mystat{'Uptime'} < 86400 );\n infoprint \"Up for: \"\n . pretty_uptime( $mystat{'Uptime'} ) . \" (\"\n . hr_num( $mystat{'Questions'} ) . \" q [\"\n . hr_num($qps)\n . \" qps], \"\n . hr_num( $mystat{'Connections'} )\n . \" conn,\" . \" TX: \"\n . hr_bytes_rnd( $mystat{'Bytes_sent'} )\n . \", RX: \"\n . hr_bytes_rnd( $mystat{'Bytes_received'} ) . \")\";\n infoprint \"Reads / Writes: \"\n . $mycalc{'pct_reads'} . \"% / \"\n . $mycalc{'pct_writes'} . \"%\";\n\n # Binlog Cache\n if ( $myvar{'log_bin'} eq 'OFF' ) {\n infoprint \"Binary logging is disabled\";\n }\n else {\n infoprint \"Binary logging is enabled (GTID MODE: \"\n . ( defined( $myvar{'gtid_mode'} ) ? $myvar{'gtid_mode'} : \"OFF\" )\n . \")\";\n }\n\n # Memory usage\n infoprint \"Physical Memory : \" . hr_bytes($physical_memory);\n infoprint \"Max MySQL memory : \" . hr_bytes( $mycalc{'max_peak_memory'} );\n infoprint \"Other process memory: \" . hr_bytes( get_other_process_memory() );\n\n infoprint \"Total buffers: \"\n . hr_bytes( $mycalc{'server_buffers'} )\n . \" global + \"\n . hr_bytes( $mycalc{'per_thread_buffers'} )\n . \" per thread ($myvar{'max_connections'} max threads)\";\n infoprint \"Performance_schema Max memory usage: \"\n . hr_bytes_rnd( get_pf_memory() );\n $result{'Performance_schema'}{'memory'} = get_pf_memory();\n $result{'Performance_schema'}{'pretty_memory'} =\n hr_bytes_rnd( get_pf_memory() );\n infoprint \"Galera GCache Max memory usage: \"\n . hr_bytes_rnd( get_gcache_memory() );\n $result{'Galera'}{'GCache'}{'memory'} = get_gcache_memory();\n $result{'Galera'}{'GCache'}{'pretty_memory'} =\n hr_bytes_rnd( get_gcache_memory() );\n\n if ( $opt{buffers} ne 0 ) {\n infoprint \"Global Buffers\";\n infoprint \" +-- Key Buffer: \"\n . hr_bytes( $myvar{'key_buffer_size'} ) . \"\";\n infoprint \" +-- Max Tmp Table: \"\n . hr_bytes( $mycalc{'max_tmp_table_size'} ) . \"\";\n\n if ( defined $myvar{'query_cache_type'} ) {\n infoprint \"Query Cache Buffers\";\n infoprint \" +-- Query Cache: \"\n . $myvar{'query_cache_type'} . \" - \"\n . (\n $myvar{'query_cache_type'} eq 0 |\n $myvar{'query_cache_type'} eq 'OFF' ? \"DISABLED\"\n : (\n $myvar{'query_cache_type'} eq 1 ? \"ALL REQUESTS\"\n : \"ON DEMAND\"\n )\n ) . \"\";\n infoprint \" +-- Query Cache Size: \"\n . hr_bytes( $myvar{'query_cache_size'} ) . \"\";\n }\n\n infoprint \"Per Thread Buffers\";\n infoprint \" +-- Read Buffer: \"\n . hr_bytes( $myvar{'read_buffer_size'} ) . \"\";\n infoprint \" +-- Read RND Buffer: \"\n . hr_bytes( $myvar{'read_rnd_buffer_size'} ) . \"\";\n infoprint \" +-- Sort Buffer: \"\n . hr_bytes( $myvar{'sort_buffer_size'} ) . \"\";\n infoprint \" +-- Thread stack: \"\n . hr_bytes( $myvar{'thread_stack'} ) . \"\";\n infoprint \" +-- Join Buffer: \"\n . hr_bytes( $myvar{'join_buffer_size'} ) . \"\";\n if ( $myvar{'log_bin'} ne 'OFF' ) {\n infoprint \"Binlog Cache Buffers\";\n infoprint \" +-- Binlog Cache: \"\n . hr_bytes( $myvar{'binlog_cache_size'} ) . \"\";\n }\n }\n\n if ( $arch\n && $arch == 32\n && $mycalc{'max_used_memory'} > 2 * 1024 * 1024 * 1024 )\n {\n badprint\n \"Allocating > 2GB RAM on 32-bit systems can cause system instability\";\n badprint \"Maximum reached memory usage: \"\n . hr_bytes( $mycalc{'max_used_memory'} )\n . \" ($mycalc{'pct_max_used_memory'}% of installed RAM)\";\n }\n elsif ( $mycalc{'pct_max_used_memory'} > 85 ) {\n badprint \"Maximum reached memory usage: \"\n . hr_bytes( $mycalc{'max_used_memory'} )\n . \" ($mycalc{'pct_max_used_memory'}% of installed RAM)\";\n }\n else {\n goodprint \"Maximum reached memory usage: \"\n . hr_bytes( $mycalc{'max_used_memory'} )\n . \" ($mycalc{'pct_max_used_memory'}% of installed RAM)\";\n }\n\n if ( $mycalc{'pct_max_physical_memory'} > 85 ) {\n badprint \"Maximum possible memory usage: \"\n . hr_bytes( $mycalc{'max_peak_memory'} )\n . \" ($mycalc{'pct_max_physical_memory'}% of installed RAM)\";\n push( @generalrec,\n \"Reduce your overall MySQL memory footprint for system stability\" );\n }\n else {\n goodprint \"Maximum possible memory usage: \"\n . hr_bytes( $mycalc{'max_peak_memory'} )\n . \" ($mycalc{'pct_max_physical_memory'}% of installed RAM)\";\n }\n\n if ( $physical_memory <\n ( $mycalc{'max_peak_memory'} + get_other_process_memory() ) )\n {\n badprint\n \"Overall possible memory usage with other process exceeded memory\";\n push( @generalrec,\n \"Dedicate this server to your database for highest performance.\" );\n }\n else {\n goodprint\n\"Overall possible memory usage with other process is compatible with memory available\";\n }\n\n # Slow queries\n if ( $mycalc{'pct_slow_queries'} > 5 ) {\n badprint \"Slow queries: $mycalc{'pct_slow_queries'}% (\"\n . hr_num( $mystat{'Slow_queries'} ) . \"/\"\n . hr_num( $mystat{'Questions'} ) . \")\";\n }\n else {\n goodprint \"Slow queries: $mycalc{'pct_slow_queries'}% (\"\n . hr_num( $mystat{'Slow_queries'} ) . \"/\"\n . hr_num( $mystat{'Questions'} ) . \")\";\n }\n if ( $myvar{'long_query_time'} > 10 ) {\n push( @adjvars, \"long_query_time (<= 10)\" );\n }\n if ( defined( $myvar{'log_slow_queries'} ) ) {\n if ( $myvar{'log_slow_queries'} eq \"OFF\" ) {\n push( @generalrec,\n \"Enable the slow query log to troubleshoot bad queries\" );\n }\n }\n\n # Connections\n if ( $mycalc{'pct_connections_used'} > 85 ) {\n badprint\n\"Highest connection usage: $mycalc{'pct_connections_used'}% ($mystat{'Max_used_connections'}/$myvar{'max_connections'})\";\n push( @adjvars,\n \"max_connections (> \" . $myvar{'max_connections'} . \")\" );\n push( @adjvars,\n \"wait_timeout (< \" . $myvar{'wait_timeout'} . \")\",\n \"interactive_timeout (< \" . $myvar{'interactive_timeout'} . \")\" );\n push( @generalrec,\n\"Reduce or eliminate persistent connections to reduce connection usage\"\n );\n }\n else {\n goodprint\n\"Highest usage of available connections: $mycalc{'pct_connections_used'}% ($mystat{'Max_used_connections'}/$myvar{'max_connections'})\";\n }\n\n # Aborted Connections\n if ( $mycalc{'pct_connections_aborted'} > 3 ) {\n badprint\n\"Aborted connections: $mycalc{'pct_connections_aborted'}% ($mystat{'Aborted_connects'}/$mystat{'Connections'})\";\n push( @generalrec,\n \"Reduce or eliminate unclosed connections and network issues\" );\n }\n else {\n goodprint\n\"Aborted connections: $mycalc{'pct_connections_aborted'}% ($mystat{'Aborted_connects'}/$mystat{'Connections'})\";\n }\n\n # name resolution\n debugprint \"skip name resolve: $result{'Variables'}{'skip_name_resolve'}\"\n if ( defined( $result{'Variables'}{'skip_name_resolve'} ) );\n if ( defined( $result{'Variables'}{'skip_networking'} )\n && $result{'Variables'}{'skip_networking'} eq 'ON' )\n {\n infoprint\n\"Skipped name resolution test due to skip_networking=ON in system variables.\";\n }\n elsif ( not defined( $result{'Variables'}{'skip_name_resolve'} ) ) {\n infoprint\n\"Skipped name resolution test due to missing skip_name_resolve in system variables.\";\n }\n\n #Cpanel and Skip name resolve\n elsif ( -r \"/usr/local/cpanel/cpanel\" ) {\n if ( $result{'Variables'}{'skip_name_resolve'} ne 'OFF' ) {\n infoprint \"CPanel and Flex system skip-name-resolve should be on\";\n }\n if ( $result{'Variables'}{'skip_name_resolve'} eq 'OFF' ) {\n badprint \"CPanel and Flex system skip-name-resolve should be on\";\n push( @generalrec,\n\"name resolution is enabled due to cPanel doesn't support this disabled.\"\n );\n push( @adjvars, \"skip-name-resolve=0\" );\n }\n }\n elsif ( $result{'Variables'}{'skip_name_resolve'} ne 'ON'\n and $result{'Variables'}{'skip_name_resolve'} ne '1' )\n {\n badprint\n\"Name resolution is active: a reverse name resolution is made for each new connection which can reduce performance\";\n push( @generalrec,\n\"Configure your accounts with ip or subnets only, then update your configuration with skip-name-resolve=ON\"\n );\n push( @adjvars, \"skip-name-resolve=ON\" );\n }\n\n # Query cache\n if ( !mysql_version_ge(4) ) {\n\n # MySQL versions < 4.01 don't support query caching\n push( @generalrec,\n \"Upgrade MySQL to version 4+ to utilize query caching\" );\n }\n elsif ( mysql_version_eq(8) ) {\n infoprint \"Query cache has been removed since MySQL 8.0\";\n\n #return;\n }\n elsif ($myvar{'query_cache_size'} < 1\n or $myvar{'query_cache_type'} eq \"OFF\" )\n {\n goodprint\n\"Query cache is disabled by default due to mutex contention on multiprocessor machines.\";\n }\n elsif ( $mystat{'Com_select'} == 0 ) {\n badprint\n \"Query cache cannot be analyzed: no SELECT statements executed\";\n }\n else {\n if ( $mycalc{'query_cache_efficiency'} < 20 ) {\n badprint\n \"Query cache efficiency: $mycalc{'query_cache_efficiency'}% (\"\n . hr_num( $mystat{'Qcache_hits'} )\n . \" cached / \"\n . hr_num( $mystat{'Qcache_hits'} + $mystat{'Com_select'} )\n . \" selects)\";\n push( @adjvars,\n \"query_cache_limit (> \"\n . hr_bytes_rnd( $myvar{'query_cache_limit'} )\n . \", or use smaller result sets)\" );\n badprint\n \"Query cache may be disabled by default due to mutex contention.\";\n push( @adjvars, \"query_cache_size (=0)\" );\n push( @adjvars, \"query_cache_type (=0)\" );\n }\n else {\n goodprint\n \"Query cache efficiency: $mycalc{'query_cache_efficiency'}% (\"\n . hr_num( $mystat{'Qcache_hits'} )\n . \" cached / \"\n . hr_num( $mystat{'Qcache_hits'} + $mystat{'Com_select'} )\n . \" selects)\";\n if ( $mycalc{'query_cache_prunes_per_day'} > 98 ) {\n badprint\n\"Query cache prunes per day: $mycalc{'query_cache_prunes_per_day'}\";\n if ( $myvar{'query_cache_size'} >= 128 * 1024 * 1024 ) {\n push( @generalrec,\n\"Increasing the query_cache size over 128M may reduce performance\"\n );\n push( @adjvars,\n \"query_cache_size (> \"\n . hr_bytes_rnd( $myvar{'query_cache_size'} )\n . \") [see warning above]\" );\n }\n else {\n push( @adjvars,\n \"query_cache_size (> \"\n . hr_bytes_rnd( $myvar{'query_cache_size'} )\n . \")\" );\n }\n }\n else {\n goodprint\n\"Query cache prunes per day: $mycalc{'query_cache_prunes_per_day'}\";\n }\n }\n\n }\n\n # Sorting\n if ( $mycalc{'total_sorts'} == 0 ) {\n goodprint \"No Sort requiring temporary tables\";\n }\n elsif ( $mycalc{'pct_temp_sort_table'} > 10 ) {\n badprint\n \"Sorts requiring temporary tables: $mycalc{'pct_temp_sort_table'}% (\"\n . hr_num( $mystat{'Sort_merge_passes'} )\n . \" temp sorts / \"\n . hr_num( $mycalc{'total_sorts'} )\n . \" sorts)\";\n push( @adjvars,\n \"sort_buffer_size (> \"\n . hr_bytes_rnd( $myvar{'sort_buffer_size'} )\n . \")\" );\n push( @adjvars,\n \"read_rnd_buffer_size (> \"\n . hr_bytes_rnd( $myvar{'read_rnd_buffer_size'} )\n . \")\" );\n }\n else {\n goodprint\n \"Sorts requiring temporary tables: $mycalc{'pct_temp_sort_table'}% (\"\n . hr_num( $mystat{'Sort_merge_passes'} )\n . \" temp sorts / \"\n . hr_num( $mycalc{'total_sorts'} )\n . \" sorts)\";\n }\n\n # Joins\n if ( $mycalc{'joins_without_indexes_per_day'} > 250 ) {\n badprint\n \"Joins performed without indexes: $mycalc{'joins_without_indexes'}\";\n push( @adjvars,\n \"join_buffer_size (> \"\n . hr_bytes( $myvar{'join_buffer_size'} )\n . \", or always use indexes with JOINs)\" );\n push(\n @generalrec,\n\"We will suggest raising the 'join_buffer_size' until JOINs not using indexes are found.\n See https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_join_buffer_size\"\n );\n }\n else {\n goodprint \"No joins without indexes\";\n\n # No joins have run without indexes\n }\n\n # Temporary tables\n if ( $mystat{'Created_tmp_tables'} > 0 ) {\n if ( $mycalc{'pct_temp_disk'} > 25\n && $mycalc{'max_tmp_table_size'} < 256 * 1024 * 1024 )\n {\n badprint\n \"Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (\"\n . hr_num( $mystat{'Created_tmp_disk_tables'} )\n . \" on disk / \"\n . hr_num( $mystat{'Created_tmp_tables'} )\n . \" total)\";\n push( @adjvars,\n \"tmp_table_size (> \"\n . hr_bytes_rnd( $myvar{'tmp_table_size'} )\n . \")\" );\n push( @adjvars,\n \"max_heap_table_size (> \"\n . hr_bytes_rnd( $myvar{'max_heap_table_size'} )\n . \")\" );\n push( @generalrec,\n\"When making adjustments, make tmp_table_size/max_heap_table_size equal\"\n );\n push( @generalrec,\n \"Reduce your SELECT DISTINCT queries which have no LIMIT clause\"\n );\n }\n elsif ($mycalc{'pct_temp_disk'} > 25\n && $mycalc{'max_tmp_table_size'} >= 256 * 1024 * 1024 )\n {\n badprint\n \"Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (\"\n . hr_num( $mystat{'Created_tmp_disk_tables'} )\n . \" on disk / \"\n . hr_num( $mystat{'Created_tmp_tables'} )\n . \" total)\";\n push( @generalrec,\n \"Temporary table size is already large: reduce result set size\"\n );\n push( @generalrec,\n \"Reduce your SELECT DISTINCT queries without LIMIT clauses\" );\n }\n else {\n goodprint\n \"Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (\"\n . hr_num( $mystat{'Created_tmp_disk_tables'} )\n . \" on disk / \"\n . hr_num( $mystat{'Created_tmp_tables'} )\n . \" total)\";\n }\n }\n else {\n goodprint \"No tmp tables created on disk\";\n }\n\n # Thread cache\n if ( defined( $myvar{'have_threadpool'} )\n and $myvar{'have_threadpool'} eq 'YES' )\n {\n# https://www.percona.com/doc/percona-server/5.7/performance/threadpool.html#status-variables\n# When thread pool is enabled, the value of the thread_cache_size variable\n# is ignored. The Threads_cached status variable contains 0 in this case.\n infoprint \"Thread cache not used with thread pool enabled\";\n }\n else {\n if ( $myvar{'thread_cache_size'} eq 0 ) {\n badprint \"Thread cache is disabled\";\n push( @generalrec,\n \"Set thread_cache_size to 4 as a starting value\" );\n push( @adjvars, \"thread_cache_size (start at 4)\" );\n }\n else {\n if ( $mycalc{'thread_cache_hit_rate'} <= 50 ) {\n badprint\n \"Thread cache hit rate: $mycalc{'thread_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Threads_created'} )\n . \" created / \"\n . hr_num( $mystat{'Connections'} )\n . \" connections)\";\n push( @adjvars,\n \"thread_cache_size (> $myvar{'thread_cache_size'})\" );\n }\n else {\n goodprint\n \"Thread cache hit rate: $mycalc{'thread_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Threads_created'} )\n . \" created / \"\n . hr_num( $mystat{'Connections'} )\n . \" connections)\";\n }\n }\n }\n\n # Table cache\n my $table_cache_var = \"\";\n if ( $mystat{'Open_tables'} > 0 ) {\n if ( $mycalc{'table_cache_hit_rate'} < 20 ) {\n\n unless ( defined( $mystat{'Table_open_cache_hits'} ) ) {\n badprint\n \"Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Open_tables'} )\n . \" hits / \"\n . hr_num( $mystat{'Opened_tables'} )\n . \" requests)\";\n }\n else {\n badprint\n \"Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Table_open_cache_hits'} )\n . \" hits / \"\n . hr_num( $mystat{'Table_open_cache_hits'} +\n $mystat{'Table_open_cache_misses'} )\n . \" requests)\";\n }\n\n if ( mysql_version_ge( 5, 1 ) ) {\n $table_cache_var = \"table_open_cache\";\n }\n else {\n $table_cache_var = \"table_cache\";\n }\n\n push( @adjvars,\n $table_cache_var . \" (> \" . $myvar{$table_cache_var} . \")\" );\n push( @generalrec,\n \"Increase \"\n . $table_cache_var\n . \" gradually to avoid file descriptor limits\" );\n push( @generalrec,\n \"Read this before increasing \"\n . $table_cache_var\n . \" over 64: https://bit.ly/2Fulv7r\" );\n push( @generalrec,\n \"Read this before increasing for MariaDB\"\n . \" https://mariadb.com/kb/en/library/optimizing-table_open_cache/\"\n );\n push( @generalrec,\n\"This is MyISAM only table_cache scalability problem, InnoDB not affected.\"\n );\n push( @generalrec,\n \"For more details see: https://bugs.mysql.com/bug.php?id=49177\"\n );\n push( @generalrec,\n\"This bug already fixed in MySQL 5.7.9 and newer MySQL versions.\"\n );\n push( @generalrec,\n \"Beware that open_files_limit (\"\n . $myvar{'open_files_limit'}\n . \") variable \" );\n push( @generalrec,\n \"should be greater than $table_cache_var (\"\n . $myvar{$table_cache_var}\n . \")\" );\n }\n else {\n unless ( defined( $mystat{'Table_open_cache_hits'} ) ) {\n goodprint\n \"Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Open_tables'} )\n . \" hits / \"\n . hr_num( $mystat{'Opened_tables'} )\n . \" requests)\";\n }\n else {\n goodprint\n \"Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Table_open_cache_hits'} )\n . \" hits / \"\n . hr_num( $mystat{'Table_open_cache_hits'} +\n $mystat{'Table_open_cache_misses'} )\n . \" requests)\";\n }\n }\n }\n\n # Table definition cache\n my $nbtables = select_one('SELECT COUNT(*) FROM information_schema.tables');\n $mycalc{'total_tables'} = $nbtables;\n if ( defined $myvar{'table_definition_cache'} ) {\n if ( $myvar{'table_definition_cache'} == -1 ) {\n infoprint( \"table_definition_cache (\"\n . $myvar{'table_definition_cache'}\n . \") is in autosizing mode\" );\n }\n elsif ( $myvar{'table_definition_cache'} < $nbtables ) {\n badprint \"table_definition_cache (\"\n . $myvar{'table_definition_cache'}\n . \") is less than number of tables ($nbtables) \";\n push( @adjvars,\n \"table_definition_cache (\"\n . $myvar{'table_definition_cache'} . \") > \"\n . $nbtables\n . \" or -1 (autosizing if supported)\" );\n }\n else {\n goodprint \"table_definition_cache (\"\n . $myvar{'table_definition_cache'}\n . \") is greater than number of tables ($nbtables)\";\n }\n }\n else {\n infoprint \"No table_definition_cache variable found.\";\n }\n\n # Open files\n if ( defined $mycalc{'pct_files_open'} ) {\n if ( $mycalc{'pct_files_open'} > 85 ) {\n badprint \"Open file limit used: $mycalc{'pct_files_open'}% (\"\n . hr_num( $mystat{'Open_files'} ) . \"/\"\n . hr_num( $myvar{'open_files_limit'} ) . \")\";\n push( @adjvars,\n \"open_files_limit (> \" . $myvar{'open_files_limit'} . \")\" );\n }\n else {\n goodprint \"Open file limit used: $mycalc{'pct_files_open'}% (\"\n . hr_num( $mystat{'Open_files'} ) . \"/\"\n . hr_num( $myvar{'open_files_limit'} ) . \")\";\n }\n }\n\n # Table locks\n if ( defined $mycalc{'pct_table_locks_immediate'} ) {\n if ( $mycalc{'pct_table_locks_immediate'} < 95 ) {\n badprint\n\"Table locks acquired immediately: $mycalc{'pct_table_locks_immediate'}%\";\n push( @generalrec,\n \"Optimize queries and/or use InnoDB to reduce lock wait\" );\n }\n else {\n goodprint\n\"Table locks acquired immediately: $mycalc{'pct_table_locks_immediate'}% (\"\n . hr_num( $mystat{'Table_locks_immediate'} )\n . \" immediate / \"\n . hr_num( $mystat{'Table_locks_waited'} +\n $mystat{'Table_locks_immediate'} )\n . \" locks)\";\n }\n }\n\n # Binlog cache\n if ( defined $mycalc{'pct_binlog_cache'} ) {\n if ( $mycalc{'pct_binlog_cache'} < 90\n && $mystat{'Binlog_cache_use'} > 0 )\n {\n badprint \"Binlog cache memory access: \"\n . $mycalc{'pct_binlog_cache'} . \"% (\"\n . (\n $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'} )\n . \" Memory / \"\n . $mystat{'Binlog_cache_use'}\n . \" Total)\";\n push( @generalrec,\n \"Increase binlog_cache_size (current value: \"\n . $myvar{'binlog_cache_size'}\n . \")\" );\n push( @adjvars,\n \"binlog_cache_size (\"\n . hr_bytes( $myvar{'binlog_cache_size'} + 16 * 1024 * 1024 )\n . \")\" );\n }\n else {\n goodprint \"Binlog cache memory access: \"\n . $mycalc{'pct_binlog_cache'} . \"% (\"\n . (\n $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'} )\n . \" Memory / \"\n . $mystat{'Binlog_cache_use'}\n . \" Total)\";\n debugprint \"Not enough data to validate binlog cache size\\n\"\n if $mystat{'Binlog_cache_use'} < 10;\n }\n }\n\n # Performance options\n if ( !mysql_version_ge( 5, 1 ) ) {\n push( @generalrec, \"Upgrade to MySQL 5.5+ to use asynchronous write\" );\n }\n elsif ( $myvar{'concurrent_insert'} eq \"OFF\" ) {\n push( @generalrec, \"Enable concurrent_insert by setting it to 'ON'\" );\n }\n elsif ( $myvar{'concurrent_insert'} eq 0 ) {\n push( @generalrec, \"Enable concurrent_insert by setting it to 1\" );\n }\n}\n\n# Recommendations for MyISAM\nsub mysql_myisam {\n return 0 unless ( $opt{'myisamstat'} > 0 );\n subheaderprint \"MyISAM Metrics\";\n my $nb_myisam_tables = select_one(\n\"SELECT COUNT(*) FROM information_schema.TABLES WHERE ENGINE='MyISAM' and TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema')\"\n );\n push( @generalrec,\n \"MyISAM engine is deprecated, consider migrating to InnoDB\" )\n if $nb_myisam_tables > 0;\n\n if ( $nb_myisam_tables > 0 ) {\n badprint\n \"Consider migrating $nb_myisam_tables following tables to InnoDB:\";\n my $sql_mig = \"\";\n for my $myisam_table (\n select_array(\n\"SELECT CONCAT(TABLE_SCHEMA, '.', TABLE_NAME) FROM information_schema.TABLES WHERE ENGINE='MyISAM' and TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema')\"\n )\n )\n {\n $sql_mig =\n\"${sql_mig}-- InnoDB migration for $myisam_table\\nALTER TABLE $myisam_table ENGINE=InnoDB;\\n\\n\";\n infoprint\n\"* InnoDB migration request for $myisam_table Table: ALTER TABLE $myisam_table ENGINE=InnoDB;\";\n }\n dump_into_file( \"migrate_myisam_to_innodb.sql\", $sql_mig );\n }\n infoprint(\"General MyIsam metrics:\");\n infoprint \" +-- Total MyISAM Tables : $nb_myisam_tables\";\n infoprint \" +-- Total MyISAM indexes : \"\n . hr_bytes( $mycalc{'total_myisam_indexes'} )\n if defined( $mycalc{'total_myisam_indexes'} );\n infoprint \" +-- KB Size :\" . hr_bytes( $myvar{'key_buffer_size'} );\n infoprint \" +-- KB Used Size :\"\n . hr_bytes( $myvar{'key_buffer_size'} -\n $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} );\n infoprint \" +-- KB used :\" . $mycalc{'pct_key_buffer_used'} . \"%\";\n infoprint \" +-- Read KB hit rate: $mycalc{'pct_keys_from_mem'}% (\"\n . hr_num( $mystat{'Key_read_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_reads'} )\n . \" reads)\";\n infoprint \" +-- Write KB hit rate: $mycalc{'pct_wkeys_from_mem'}% (\"\n . hr_num( $mystat{'Key_write_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_writes'} )\n . \" writes)\";\n\n if ( $nb_myisam_tables == 0 ) {\n infoprint \"No MyISAM table(s) detected ....\";\n return;\n }\n if ( mysql_version_ge(8) and mysql_version_le(10) ) {\n infoprint \"MyISAM Metrics are disabled since MySQL 8.0.\";\n if ( $myvar{'key_buffer_size'} > 0 ) {\n push( @adjvars, \"key_buffer_size=0\" );\n push( @generalrec,\n \"Buffer Key MyISAM set to 0, no MyISAM table detected\" );\n }\n return;\n }\n\n if ( !defined( $mycalc{'total_myisam_indexes'} ) ) {\n badprint\n \"Unable to calculate MyISAM index size on MySQL server < 5.0.0\";\n push( @generalrec,\n \"Unable to calculate MyISAM index size on MySQL server < 5.0.0\" );\n return;\n }\n if ( $mycalc{'pct_key_buffer_used'} == 0 ) {\n\n # No queries have run that would use keys\n infoprint \"Key buffer used: $mycalc{'pct_key_buffer_used'}% (\"\n . hr_bytes( $myvar{'key_buffer_size'} -\n $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} )\n . \" used / \"\n . hr_bytes( $myvar{'key_buffer_size'} )\n . \" cache)\";\n infoprint \"No SQL statement based on MyISAM table(s) detected ....\";\n return;\n }\n\n # Key buffer usage\n if ( $mycalc{'pct_key_buffer_used'} < 90 ) {\n badprint \"Key buffer used: $mycalc{'pct_key_buffer_used'}% (\"\n . hr_bytes( $myvar{'key_buffer_size'} -\n $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} )\n . \" used / \"\n . hr_bytes( $myvar{'key_buffer_size'} )\n . \" cache)\";\n\n push(\n @adjvars,\n \"key_buffer_size (\\~ \"\n . hr_num(\n $myvar{'key_buffer_size'} *\n $mycalc{'pct_key_buffer_used'} / 100\n )\n . \")\"\n );\n }\n else {\n goodprint \"Key buffer used: $mycalc{'pct_key_buffer_used'}% (\"\n . hr_bytes( $myvar{'key_buffer_size'} -\n $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} )\n . \" used / \"\n . hr_bytes( $myvar{'key_buffer_size'} )\n . \" cache)\";\n }\n\n # Key buffer size / total MyISAM indexes\n if ( $myvar{'key_buffer_size'} < $mycalc{'total_myisam_indexes'}\n && $mycalc{'pct_keys_from_mem'} < 95 )\n {\n badprint \"Key buffer size / total MyISAM indexes: \"\n . hr_bytes( $myvar{'key_buffer_size'} ) . \"/\"\n . hr_bytes( $mycalc{'total_myisam_indexes'} ) . \"\";\n push( @adjvars,\n \"key_buffer_size (> \"\n . hr_bytes( $mycalc{'total_myisam_indexes'} )\n . \")\" );\n }\n else {\n goodprint \"Key buffer size / total MyISAM indexes: \"\n . hr_bytes( $myvar{'key_buffer_size'} ) . \"/\"\n . hr_bytes( $mycalc{'total_myisam_indexes'} ) . \"\";\n }\n if ( $mystat{'Key_read_requests'} > 0 ) {\n if ( $mycalc{'pct_keys_from_mem'} < 95 ) {\n badprint\n \"Read Key buffer hit rate: $mycalc{'pct_keys_from_mem'}% (\"\n . hr_num( $mystat{'Key_read_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_reads'} )\n . \" reads)\";\n }\n else {\n goodprint\n \"Read Key buffer hit rate: $mycalc{'pct_keys_from_mem'}% (\"\n . hr_num( $mystat{'Key_read_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_reads'} )\n . \" reads)\";\n }\n }\n\n # No queries have run that would use keys\n debugprint \"Key buffer size / total MyISAM indexes: \"\n . hr_bytes( $myvar{'key_buffer_size'} ) . \"/\"\n . hr_bytes( $mycalc{'total_myisam_indexes'} ) . \"\";\n if ( $mystat{'Key_write_requests'} > 0 ) {\n if ( $mycalc{'pct_wkeys_from_mem'} < 95 ) {\n badprint\n \"Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (\"\n . hr_num( $mystat{'Key_write_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_writes'} )\n . \" writes)\";\n }\n else {\n goodprint\n \"Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (\"\n . hr_num( $mystat{'Key_write_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_writes'} )\n . \" writes)\";\n }\n }\n else {\n # No queries have run that would use keys\n debugprint\n \"Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (\"\n . hr_num( $mystat{'Key_write_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_writes'} )\n . \" writes)\";\n }\n}\n\n# Recommendations for ThreadPool\nsub mariadb_threadpool {\n subheaderprint \"ThreadPool Metrics\";\n\n # MariaDB\n unless ( defined $myvar{'have_threadpool'}\n && $myvar{'have_threadpool'} eq \"YES\" )\n {\n infoprint \"ThreadPool stat is disabled.\";\n return;\n }\n infoprint \"ThreadPool stat is enabled.\";\n infoprint \"Thread Pool Size: \" . $myvar{'thread_pool_size'} . \" thread(s).\";\n\n if ( $myvar{'version'} =~ /percona/i\n or $myvar{'version_comment'} =~ /percona/i )\n {\n my $np = cpu_cores;\n if ( $myvar{'thread_pool_size'} >= $np\n and $myvar{'thread_pool_size'} < ( $np * 1.5 ) )\n {\n goodprint\n\"thread_pool_size for Percona between 1 and 1.5 times number of CPUs (\"\n . $np . \" and \"\n . ( $np * 1.5 ) . \")\";\n }\n else {\n badprint\n\"thread_pool_size for Percona between 1 and 1.5 times number of CPUs (\"\n . $np . \" and \"\n . ( $np * 1.5 ) . \")\";\n push( @adjvars,\n \"thread_pool_size between \"\n . $np . \" and \"\n . ( $np * 1.5 )\n . \" for InnoDB usage\" );\n }\n return;\n }\n\n if ( $myvar{'version'} =~ /mariadb/i ) {\n infoprint \"Using default value is good enough for your version (\"\n . $myvar{'version'} . \")\";\n return;\n }\n\n if ( $myvar{'have_innodb'} eq 'YES' ) {\n if ( $myvar{'thread_pool_size'} < 16\n or $myvar{'thread_pool_size'} > 36 )\n {\n badprint\n\"thread_pool_size between 16 and 36 when using InnoDB storage engine.\";\n push( @generalrec,\n \"Thread pool size for InnoDB usage (\"\n . $myvar{'thread_pool_size'}\n . \")\" );\n push( @adjvars,\n \"thread_pool_size between 16 and 36 for InnoDB usage\" );\n }\n else {\n goodprint\n\"thread_pool_size between 16 and 36 when using InnoDB storage engine.\";\n }\n return;\n }\n if ( $myvar{'have_isam'} eq 'YES' ) {\n if ( $myvar{'thread_pool_size'} < 4 or $myvar{'thread_pool_size'} > 8 )\n {\n badprint\n\"thread_pool_size between 4 and 8 when using MyISAM storage engine.\";\n push( @generalrec,\n \"Thread pool size for MyISAM usage (\"\n . $myvar{'thread_pool_size'}\n . \")\" );\n push( @adjvars,\n \"thread_pool_size between 4 and 8 for MyISAM usage\" );\n }\n else {\n goodprint\n\"thread_pool_size between 4 and 8 when using MyISAM storage engine.\";\n }\n }\n}\n\nsub get_pf_memory {\n\n # Performance Schema\n return 0 unless defined $myvar{'performance_schema'};\n return 0 if $myvar{'performance_schema'} eq 'OFF';\n\n my @infoPFSMemory = grep { /\\tperformance_schema[.]memory\\t/msx }\n select_array(\"SHOW ENGINE PERFORMANCE_SCHEMA STATUS\");\n @infoPFSMemory == 1 || return 0;\n $infoPFSMemory[0] =~ s/.*\\s+(\\d+)$/$1/g;\n return $infoPFSMemory[0];\n}\n\n# Recommendations for Performance Schema\nsub mysql_pfs {\n subheaderprint \"Performance schema\";\n\n # Performance Schema\n debugprint \"Performance schema is \" . $myvar{'performance_schema'};\n $myvar{'performance_schema'} = 'OFF'\n unless defined( $myvar{'performance_schema'} );\n if ( $myvar{'performance_schema'} eq 'OFF' ) {\n badprint \"Performance_schema should be activated.\";\n push( @adjvars, \"performance_schema=ON\" );\n push( @generalrec,\n \"Performance schema should be activated for better diagnostics\" );\n }\n if ( $myvar{'performance_schema'} eq 'ON' ) {\n infoprint \"Performance_schema is activated.\";\n debugprint \"Performance schema is \" . $myvar{'performance_schema'};\n infoprint \"Memory used by Performance_schema: \"\n . hr_bytes( get_pf_memory() );\n }\n\n unless ( grep /^sys$/, select_array(\"SHOW DATABASES\") ) {\n infoprint \"Sys schema is not installed.\";\n push( @generalrec,\n mysql_version_ge( 10, 0 )\n ? \"Consider installing Sys schema from https://github.com/FromDual/mariadb-sys for MariaDB\"\n : \"Consider installing Sys schema from https://github.com/mysql/mysql-sys for MySQL\"\n ) unless ( mysql_version_le( 5, 6 ) );\n\n return;\n }\n infoprint \"Sys schema is installed.\";\n return if ( $opt{pfstat} == 0 or $myvar{'performance_schema'} ne 'ON' );\n\n infoprint \"Sys schema Version: \"\n . select_one(\"select sys_version from sys.version\");\n\n # Store all sys schema in dumpdir if defined\n if ( defined $opt{dumpdir} and -d \"$opt{dumpdir}\" ) {\n for my $sys_view ( select_array('use sys;show tables;') ) {\n infoprint \"Dumping $sys_view into $opt{dumpdir}\";\n my $sys_view_table = $sys_view;\n $sys_view_table =~ s/\\$/\\\\\\$/g;\n select_csv_file( \"$opt{dumpdir}/sys_$sys_view.csv\",\n 'select * from sys.\\`' . $sys_view_table . '\\`' );\n }\n return;\n\n #exit 0 if ( $opt{stop} == 1 );\n }\n\n # Top user per connection\n subheaderprint \"Performance schema: Top 5 user per connection\";\n my $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, total_connections from sys.user_summary order by total_connections desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery conn(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per statement\n subheaderprint \"Performance schema: Top 5 user per statement\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, statements from sys.user_summary order by statements desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery stmt(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per statement latency\n subheaderprint \"Performance schema: Top 5 user per statement latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, statement_avg_latency from sys.x\\\\$user_summary order by statement_avg_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per lock latency\n subheaderprint \"Performance schema: Top 5 user per lock latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, lock_latency from sys.x\\\\$user_summary_by_statement_latency order by lock_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per full scans\n subheaderprint \"Performance schema: Top 5 user per nb full scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, full_scans from sys.x\\\\$user_summary_by_statement_latency order by full_scans desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per row_sent\n subheaderprint \"Performance schema: Top 5 user per rows sent\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, rows_sent from sys.x\\\\$user_summary_by_statement_latency order by rows_sent desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per row modified\n subheaderprint \"Performance schema: Top 5 user per rows modified\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, rows_affected from sys.x\\\\$user_summary_by_statement_latency order by rows_affected desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per io\n subheaderprint \"Performance schema: Top 5 user per IO\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, file_ios from sys.x\\\\$user_summary order by file_ios desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per io latency\n subheaderprint \"Performance schema: Top 5 user per IO latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, file_io_latency from sys.x\\\\$user_summary order by file_io_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per connection\n subheaderprint \"Performance schema: Top 5 host per connection\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, total_connections from sys.x\\\\$host_summary order by total_connections desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery conn(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per statement\n subheaderprint \"Performance schema: Top 5 host per statement\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, statements from sys.x\\\\$host_summary order by statements desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery stmt(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per statement latency\n subheaderprint \"Performance schema: Top 5 host per statement latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, statement_avg_latency from sys.x\\\\$host_summary order by statement_avg_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per lock latency\n subheaderprint \"Performance schema: Top 5 host per lock latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, lock_latency from sys.x\\\\$host_summary_by_statement_latency order by lock_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per full scans\n subheaderprint \"Performance schema: Top 5 host per nb full scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, full_scans from sys.x\\\\$host_summary_by_statement_latency order by full_scans desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per rows sent\n subheaderprint \"Performance schema: Top 5 host per rows sent\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, rows_sent from sys.x\\\\$host_summary_by_statement_latency order by rows_sent desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per rows modified\n subheaderprint \"Performance schema: Top 5 host per rows modified\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, rows_affected from sys.x\\\\$host_summary_by_statement_latency order by rows_affected desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per io\n subheaderprint \"Performance schema: Top 5 host per io\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, file_ios from sys.x\\\\$host_summary order by file_ios desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top 5 host per io latency\n subheaderprint \"Performance schema: Top 5 host per io latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, file_io_latency from sys.x\\\\$host_summary order by file_io_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top IO type order by total io\n subheaderprint \"Performance schema: Top IO type order by total io\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select substring(event_name,14), SUM(total)AS total from sys.x\\\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY total DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery i/o\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top IO type order by total latency\n subheaderprint \"Performance schema: Top IO type order by total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select substring(event_name,14), ROUND(SUM(total_latency),1) AS total_latency from sys.x\\\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY total_latency DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top IO type order by max latency\n subheaderprint \"Performance schema: Top IO type order by max latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select substring(event_name,14), MAX(max_latency) as max_latency from sys.x\\\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY max_latency DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top Stages order by total io\n subheaderprint \"Performance schema: Top Stages order by total io\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select substring(event_name,7), SUM(total)AS total from sys.x\\\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY total DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery i/o\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top Stages order by total latency\n subheaderprint \"Performance schema: Top Stages order by total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select substring(event_name,7), ROUND(SUM(total_latency),1) AS total_latency from sys.x\\\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY total_latency DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top Stages order by avg latency\n subheaderprint \"Performance schema: Top Stages order by avg latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select substring(event_name,7), MAX(avg_latency) as avg_latency from sys.x\\\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY avg_latency DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per table scans\n subheaderprint \"Performance schema: Top 5 host per table scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, table_scans from sys.x\\\\$host_summary order by table_scans desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # InnoDB Buffer Pool by schema\n subheaderprint \"Performance schema: InnoDB Buffer Pool by schema\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select object_schema, allocated, data, pages from sys.x\\\\$innodb_buffer_stats_by_schema ORDER BY pages DESC'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery page(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # InnoDB Buffer Pool by table\n subheaderprint \"Performance schema: 40 InnoDB Buffer Pool by table\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select object_schema, object_name, allocated,data, pages from sys.x\\\\$innodb_buffer_stats_by_table ORDER BY pages DESC LIMIT 40'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery page(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Process per allocated memory\n subheaderprint \"Performance schema: Process per time\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, Command AS PROC, time from sys.x\\\\$processlist ORDER BY time DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # InnoDB Lock Waits\n subheaderprint \"Performance schema: InnoDB Lock Waits\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select wait_age_secs, locked_table, locked_type, waiting_query from sys.x\\\\$innodb_lock_waits order by wait_age_secs DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Threads IO Latency\n subheaderprint \"Performance schema: Thread IO Latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, total_latency, max_latency from sys.x\\\\$io_by_thread_by_latency order by total_latency DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # High Cost SQL statements\n subheaderprint \"Performance schema: Top 15 Most latency statements\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select LEFT(query, 120), avg_latency from sys.x\\\\$statement_analysis order by avg_latency desc LIMIT 15'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top 5% slower queries\n subheaderprint \"Performance schema: Top 15 slower queries\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select LEFT(query, 120), exec_count from sys.x\\\\$statements_with_runtimes_in_95th_percentile order by exec_count desc LIMIT 15'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery s\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top 10 nb statement type\n subheaderprint \"Performance schema: Top 15 nb statement type\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(total) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top statement by total latency\n subheaderprint \"Performance schema: Top 15 statement by total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(total_latency) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top statement by lock latency\n subheaderprint \"Performance schema: Top 15 statement by lock latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(lock_latency) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top statement by full scans\n subheaderprint \"Performance schema: Top 15 statement by full scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(full_scans) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top statement by rows sent\n subheaderprint \"Performance schema: Top 15 statement by rows sent\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(rows_sent) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top statement by rows modified\n subheaderprint \"Performance schema: Top 15 statement by rows modified\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(rows_affected) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Use temporary tables\n subheaderprint \"Performance schema: 15 sample queries using temp table\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select left(query, 120) from sys.x\\\\$statements_with_temp_tables LIMIT 15'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Unused Indexes\n subheaderprint \"Performance schema: Unused indexes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n\"select \\* from sys.schema_unused_indexes where object_schema not in ('performance_schema')\"\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Full table scans\n subheaderprint \"Performance schema: Tables with full table scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select * from sys.x\\\\$schema_tables_with_full_table_scans order by rows_full_scanned DESC'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Latest file IO by latency\n subheaderprint \"Performance schema: Latest File IO by latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select thread, file, latency, operation from sys.x\\\\$latest_file_io ORDER BY latency LIMIT 10;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # FILE by IO read bytes\n subheaderprint \"Performance schema: File by IO read bytes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select file, total_read from sys.x\\\\$io_global_by_file_by_bytes order by total_read DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # FILE by IO written bytes\n subheaderprint \"Performance schema: File by IO written bytes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select file, total_written from sys.x\\\\$io_global_by_file_by_bytes order by total_written DESC LIMIT 15'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # file per IO total latency\n subheaderprint \"Performance schema: File per IO total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select file, total_latency from sys.x\\\\$io_global_by_file_by_latency ORDER BY total_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # file per IO read latency\n subheaderprint \"Performance schema: file per IO read latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select file, read_latency from sys.x\\\\$io_global_by_file_by_latency ORDER BY read_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # file per IO write latency\n subheaderprint \"Performance schema: file per IO write latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select file, write_latency from sys.x\\\\$io_global_by_file_by_latency ORDER BY write_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Event Wait by read bytes\n subheaderprint \"Performance schema: Event Wait by read bytes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select event_name, total_read from sys.x\\\\$io_global_by_wait_by_bytes order by total_read DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Event Wait by write bytes\n subheaderprint \"Performance schema: Event Wait written bytes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select event_name, total_written from sys.x\\\\$io_global_by_wait_by_bytes order by total_written DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # event per wait total latency\n subheaderprint \"Performance schema: event per wait total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select event_name, total_latency from sys.x\\\\$io_global_by_wait_by_latency ORDER BY total_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # event per wait read latency\n subheaderprint \"Performance schema: event per wait read latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select event_name, read_latency from sys.x\\\\$io_global_by_wait_by_latency ORDER BY read_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # event per wait write latency\n subheaderprint \"Performance schema: event per wait write latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select event_name, write_latency from sys.x\\\\$io_global_by_wait_by_latency ORDER BY write_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n #schema_index_statistics\n # TOP 15 most read index\n subheaderprint \"Performance schema: Top 15 most read indexes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, rows_selected from sys.x\\\\$schema_index_statistics ORDER BY ROWs_selected DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 most used index\n subheaderprint \"Performance schema: Top 15 most modified indexes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, rows_inserted+rows_updated+rows_deleted AS changes from sys.x\\\\$schema_index_statistics ORDER BY rows_inserted+rows_updated+rows_deleted DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high read latency index\n subheaderprint \"Performance schema: Top 15 high read latency index\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, select_latency from sys.x\\\\$schema_index_statistics ORDER BY select_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high insert latency index\n subheaderprint \"Performance schema: Top 15 most modified indexes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, insert_latency from sys.x\\\\$schema_index_statistics ORDER BY insert_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high update latency index\n subheaderprint \"Performance schema: Top 15 high update latency index\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, update_latency from sys.x\\\\$schema_index_statistics ORDER BY update_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high delete latency index\n subheaderprint \"Performance schema: Top 15 high delete latency index\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, delete_latency from sys.x\\\\$schema_index_statistics ORDER BY delete_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 most read tables\n subheaderprint \"Performance schema: Top 15 most read tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, rows_fetched from sys.x\\\\$schema_table_statistics ORDER BY ROWs_fetched DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 most used tables\n subheaderprint \"Performance schema: Top 15 most modified tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, rows_inserted+rows_updated+rows_deleted AS changes from sys.x\\\\$schema_table_statistics ORDER BY rows_inserted+rows_updated+rows_deleted DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high read latency tables\n subheaderprint \"Performance schema: Top 15 high read latency tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, fetch_latency from sys.x\\\\$schema_table_statistics ORDER BY fetch_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high insert latency tables\n subheaderprint \"Performance schema: Top 15 high insert latency tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, insert_latency from sys.x\\\\$schema_table_statistics ORDER BY insert_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high update latency tables\n subheaderprint \"Performance schema: Top 15 high update latency tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, update_latency from sys.x\\\\$schema_table_statistics ORDER BY update_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high delete latency tables\n subheaderprint \"Performance schema: Top 15 high delete latency tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, delete_latency from sys.x\\\\$schema_table_statistics ORDER BY delete_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Redundant indexes\n subheaderprint \"Performance schema: Redundant indexes\";\n $nbL = 1;\n for my $lQuery (\n select_array('use sys;select * from schema_redundant_indexes;') )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Table not using InnoDB buffer\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n' Select table_schema, table_name from sys.x\\\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NULL;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 Tables using InnoDB buffer\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select table_schema,table_name,innodb_buffer_allocated from sys.x\\\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NOT NULL ORDER BY innodb_buffer_allocated DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 Tables with InnoDB buffer free\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select table_schema,table_name,innodb_buffer_free from sys.x\\\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NOT NULL ORDER BY innodb_buffer_free DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 Most executed queries\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), exec_count from sys.x\\\\$statement_analysis order by exec_count DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Latest SQL queries in errors or warnings\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select LEFT(query, 120), last_seen from sys.x\\\\$statements_with_errors_or_warnings ORDER BY last_seen LIMIT 40;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 20 queries with full table scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), exec_count from sys.x\\\\$statements_with_full_table_scans order BY exec_count DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Last 50 queries with full table scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), last_seen from sys.x\\\\$statements_with_full_table_scans order BY last_seen DESC LIMIT 50;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 reader queries (95% percentile)\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), rows_sent from sys.x\\\\$statements_with_runtimes_in_95th_percentile ORDER BY ROWs_sent DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 most row look queries (95% percentile)\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), rows_examined AS search from sys.x\\\\$statements_with_runtimes_in_95th_percentile ORDER BY rows_examined DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 total latency queries (95% percentile)\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), total_latency AS search from sys.x\\\\$statements_with_runtimes_in_95th_percentile ORDER BY total_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 max latency queries (95% percentile)\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), max_latency AS search from sys.x\\\\$statements_with_runtimes_in_95th_percentile ORDER BY max_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 average latency queries (95% percentile)\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), avg_latency AS search from sys.x\\\\$statements_with_runtimes_in_95th_percentile ORDER BY avg_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 20 queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), exec_count from sys.x\\\\$statements_with_sorting order BY exec_count DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Last 50 queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), last_seen from sys.x\\\\$statements_with_sorting order BY last_seen DESC LIMIT 50;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 row sorting queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), rows_sorted from sys.x\\\\$statements_with_sorting ORDER BY ROWs_sorted DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 total latency queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), total_latency AS search from sys.x\\\\$statements_with_sorting ORDER BY total_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 merge queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), sort_merge_passes AS search from sys.x\\\\$statements_with_sorting ORDER BY sort_merge_passes DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 average sort merges queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), avg_sort_merges AS search from sys.x\\\\$statements_with_sorting ORDER BY avg_sort_merges DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 scans queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), sorts_using_scans AS search from sys.x\\\\$statements_with_sorting ORDER BY sorts_using_scans DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 range queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), sort_using_range AS search from sys.x\\\\$statements_with_sorting ORDER BY sort_using_range DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n##################################################################################\n\n #statements_with_temp_tables\n\n#mysql> desc statements_with_temp_tables;\n#+--------------------------+---------------------+------+-----+---------------------+-------+\n#| Field | Type | Null | Key | Default | Extra |\n#+--------------------------+---------------------+------+-----+---------------------+-------+\n#| query | longtext | YES | | NULL | |\n#| db | varchar(64) | YES | | NULL | |\n#| exec_count | bigint(20) unsigned | NO | | NULL | |\n#| total_latency | text | YES | | NULL | |\n#| memory_tmp_tables | bigint(20) unsigned | NO | | NULL | |\n#| disk_tmp_tables | bigint(20) unsigned | NO | | NULL | |\n#| avg_tmp_tables_per_query | decimal(21,0) | NO | | 0 | |\n#| tmp_tables_to_disk_pct | decimal(24,0) | NO | | 0 | |\n#| first_seen | timestamp | NO | | 0000-00-00 00:00:00 | |\n#| last_seen | timestamp | NO | | 0000-00-00 00:00:00 | |\n#| digest | varchar(32) | YES | | NULL | |\n#+--------------------------+---------------------+------+-----+---------------------+-------+\n#11 rows in set (0,01 sec)#\n#\n subheaderprint \"Performance schema: Top 20 queries with temp table\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), exec_count from sys.x\\\\$statements_with_temp_tables order BY exec_count DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Last 50 queries with temp table\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), last_seen from sys.x\\\\$statements_with_temp_tables order BY last_seen DESC LIMIT 50;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 total latency queries with temp table\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), total_latency AS search from sys.x\\\\$statements_with_temp_tables ORDER BY total_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 queries with temp table to disk\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), disk_tmp_tables from sys.x\\\\$statements_with_temp_tables ORDER BY disk_tmp_tables DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n##################################################################################\n #wait_classes_global_by_latency\n\n#mysql> select * from wait_classes_global_by_latency;\n#-----------------+-------+---------------+-------------+-------------+-------------+\n# event_class | total | total_latency | min_latency | avg_latency | max_latency |\n#-----------------+-------+---------------+-------------+-------------+-------------+\n# wait/io/file | 15381 | 1.23 s | 0 ps | 80.12 us | 230.64 ms |\n# wait/io/table | 59 | 7.57 ms | 5.45 us | 128.24 us | 3.95 ms |\n# wait/lock/table | 69 | 3.22 ms | 658.84 ns | 46.64 us | 1.10 ms |\n#-----------------+-------+---------------+-------------+-------------+-------------+\n# rows in set (0,00 sec)\n\n subheaderprint \"Performance schema: Top 15 class events by number\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select event_class, total from sys.x\\\\$wait_classes_global_by_latency ORDER BY total DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 30 events by number\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select events, total from sys.x\\\\$waits_global_by_latency ORDER BY total DESC LIMIT 30;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 class events by total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select event_class, total_latency from sys.x\\\\$wait_classes_global_by_latency ORDER BY total_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 30 events by total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select events, total_latency from sys.x\\\\$waits_global_by_latency ORDER BY total_latency DESC LIMIT 30;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 class events by max latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select event_class, max_latency from sys.x\\\\$wait_classes_global_by_latency ORDER BY max_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 30 events by max latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select events, max_latency from sys.x\\\\$waits_global_by_latency ORDER BY max_latency DESC LIMIT 30;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n}\n\n# Recommendations for Aria Engine\nsub mariadb_aria {\n subheaderprint \"Aria Metrics\";\n\n # Aria\n if ( !defined $myvar{'have_aria'} ) {\n infoprint \"Aria Storage Engine not available.\";\n return;\n }\n if ( $myvar{'have_aria'} ne \"YES\" ) {\n infoprint \"Aria Storage Engine is disabled.\";\n return;\n }\n infoprint \"Aria Storage Engine is enabled.\";\n\n # Aria pagecache\n if ( !defined( $mycalc{'total_aria_indexes'} ) ) {\n push( @generalrec,\n \"Unable to calculate Aria index size on MySQL server\" );\n }\n else {\n if (\n $myvar{'aria_pagecache_buffer_size'} < $mycalc{'total_aria_indexes'}\n && $mycalc{'pct_aria_keys_from_mem'} < 95 )\n {\n badprint \"Aria pagecache size / total Aria indexes: \"\n . hr_bytes( $myvar{'aria_pagecache_buffer_size'} ) . \"/\"\n . hr_bytes( $mycalc{'total_aria_indexes'} ) . \"\";\n push( @adjvars,\n \"aria_pagecache_buffer_size (> \"\n . hr_bytes( $mycalc{'total_aria_indexes'} )\n . \")\" );\n }\n else {\n goodprint \"Aria pagecache size / total Aria indexes: \"\n . hr_bytes( $myvar{'aria_pagecache_buffer_size'} ) . \"/\"\n . hr_bytes( $mycalc{'total_aria_indexes'} ) . \"\";\n }\n if ( $mystat{'Aria_pagecache_read_requests'} > 0 ) {\n if ( $mycalc{'pct_aria_keys_from_mem'} < 95 ) {\n badprint\n\"Aria pagecache hit rate: $mycalc{'pct_aria_keys_from_mem'}% (\"\n . hr_num( $mystat{'Aria_pagecache_read_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Aria_pagecache_reads'} )\n . \" reads)\";\n }\n else {\n goodprint\n\"Aria pagecache hit rate: $mycalc{'pct_aria_keys_from_mem'}% (\"\n . hr_num( $mystat{'Aria_pagecache_read_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Aria_pagecache_reads'} )\n . \" reads)\";\n }\n }\n else {\n\n # No queries have run that would use keys\n }\n }\n}\n\n# Recommendations for TokuDB\nsub mariadb_tokudb {\n subheaderprint \"TokuDB Metrics\";\n\n # AriaDB\n unless ( defined $myvar{'have_tokudb'}\n && $myvar{'have_tokudb'} eq \"YES\" )\n {\n infoprint \"TokuDB is disabled.\";\n return;\n }\n infoprint \"TokuDB is enabled.\";\n\n # Not implemented\n}\n\n# Recommendations for XtraDB\nsub mariadb_xtradb {\n subheaderprint \"XtraDB Metrics\";\n\n # XtraDB\n unless ( defined $myvar{'have_xtradb'}\n && $myvar{'have_xtradb'} eq \"YES\" )\n {\n infoprint \"XtraDB is disabled.\";\n return;\n }\n infoprint \"XtraDB is enabled.\";\n infoprint \"Note that MariaDB 10.2 makes use of InnoDB, not XtraDB.\"\n\n # Not implemented\n}\n\n# Recommendations for RocksDB\nsub mariadb_rockdb {\n subheaderprint \"RocksDB Metrics\";\n\n # RocksDB\n unless ( defined $myvar{'have_rocksdb'}\n && $myvar{'have_rocksdb'} eq \"YES\" )\n {\n infoprint \"RocksDB is disabled.\";\n return;\n }\n infoprint \"RocksDB is enabled.\";\n\n # Not implemented\n}\n\n# Recommendations for Spider\nsub mariadb_spider {\n subheaderprint \"Spider Metrics\";\n\n # Spider\n unless ( defined $myvar{'have_spider'}\n && $myvar{'have_spider'} eq \"YES\" )\n {\n infoprint \"Spider is disabled.\";\n return;\n }\n infoprint \"Spider is enabled.\";\n\n # Not implemented\n}\n\n# Recommendations for Connect\nsub mariadb_connect {\n subheaderprint \"Connect Metrics\";\n\n # Connect\n unless ( defined $myvar{'have_connect'}\n && $myvar{'have_connect'} eq \"YES\" )\n {\n infoprint \"Connect is disabled.\";\n return;\n }\n infoprint \"Connect is enabled.\";\n\n # Not implemented\n}\n\n# Perl trim function to remove whitespace from the start and end of the string\nsub trim {\n my $string = shift;\n return \"\" unless defined($string);\n $string =~ s/^\\s+//;\n $string =~ s/\\s+$//;\n return $string;\n}\n\nsub get_wsrep_options {\n return () unless defined $myvar{'wsrep_provider_options'};\n\n my @galera_options = split /;/, $myvar{'wsrep_provider_options'};\n my $wsrep_slave_threads = $myvar{'wsrep_slave_threads'};\n push @galera_options, ' wsrep_slave_threads = ' . $wsrep_slave_threads;\n @galera_options = remove_cr @galera_options;\n @galera_options = remove_empty @galera_options;\n\n #debugprint Dumper( \\@galera_options ) if $opt{debug};\n return @galera_options;\n}\n\nsub get_gcache_memory {\n my $gCacheMem = hr_raw( get_wsrep_option('gcache.size') );\n\n return 0 unless defined $gCacheMem and $gCacheMem ne '';\n return $gCacheMem;\n}\n\nsub get_wsrep_option {\n my $key = shift;\n return '' unless defined $myvar{'wsrep_provider_options'};\n my @galera_options = get_wsrep_options;\n return '' unless scalar(@galera_options) > 0;\n my @memValues = grep /\\s*$key =/, @galera_options;\n my $memValue = $memValues[0];\n return 0 unless defined $memValue;\n $memValue =~ s/.*=\\s*(.+)$/$1/g;\n return $memValue;\n}\n\n# REcommendations for Tables\nsub mysql_table_structures {\n return 0 unless ( $opt{structstat} > 0 );\n subheaderprint \"Table structures analysis\";\n\n my @primaryKeysNbTables = select_array(\n \"Select CONCAT(c.table_schema, ',' , c.table_name)\nfrom information_schema.columns c\njoin information_schema.tables t using (TABLE_SCHEMA, TABLE_NAME)\nwhere c.table_schema not in ('sys', 'mysql', 'information_schema', 'performance_schema')\n and t.table_type = 'BASE TABLE'\ngroup by c.table_schema,c.table_name\nhaving sum(if(c.column_key in ('PRI', 'UNI'), 1, 0)) = 0\"\n );\n\n my $tmpContent = 'Schema,Table';\n if ( scalar(@primaryKeysNbTables) > 0 ) {\n badprint \"Following table(s) don't have primary key:\";\n foreach my $badtable (@primaryKeysNbTables) {\n badprint \"\\t$badtable\";\n push @{ $result{'Tables without PK'} }, $badtable;\n $tmpContent .= \"\\n$badtable\";\n }\n push @generalrec,\n\"Ensure that all table(s) get an explicit primary keys for performance, maintenance and also for replication\";\n\n }\n else {\n goodprint \"All tables get a primary key\";\n }\n dump_into_file( \"tables_without_primary_keys.csv\", $tmpContent );\n\n my @nonInnoDBTables = select_array(\n \"select CONCAT(table_schema, ',', table_name, ',', ENGINE) \nFROM information_schema.tables t\nWHERE ENGINE <> 'InnoDB' \nand t.table_type = 'BASE TABLE'\nand table_schema not in \n('sys', 'mysql', 'performance_schema', 'information_schema')\"\n );\n $tmpContent = 'Schema,Table,Engine';\n if ( scalar(@nonInnoDBTables) > 0 ) {\n badprint \"Following table(s) are not InnoDB table:\";\n push @generalrec,\n\"Ensure that all table(s) are InnoDB tables for performance and also for replication\";\n foreach my $badtable (@nonInnoDBTables) {\n if ( $badtable =~ /Memory/i ) {\n badprint\n\"Table $badtable is a MEMORY table. It's suggested to use only InnoDB tables in production\";\n }\n else {\n badprint \"\\t$badtable\";\n }\n $tmpContent .= \"\\n$badtable\";\n }\n }\n else {\n goodprint \"All tables are InnoDB tables\";\n }\n dump_into_file( \"tables_non_innodb.csv\", $tmpContent );\n\n my @nonutf8columns = select_array(\n\"SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', CHARacter_set_name, ',', COLLATION_name, ',', data_type, ',', CHARACTER_MAXIMUM_LENGTH)\nfrom information_schema.columns\nWHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema')\nand (CHARacter_set_name NOT LIKE 'utf8%'\nor COLLATION_name NOT LIKE 'utf8%');\"\n );\n $tmpContent =\n 'Schema,Table,Column, Charset, Collation, Data Type, Max Length';\n if ( scalar(@nonutf8columns) > 0 ) {\n badprint \"Following character columns(s) are not utf8 compliant:\";\n push @generalrec,\n\"Ensure that all text colums(s) are UTF-8 compliant for encoding support and performance\";\n foreach my $badtable (@nonutf8columns) {\n badprint \"\\t$badtable\";\n $tmpContent .= \"\\n$badtable\";\n }\n }\n else {\n goodprint \"All columns are UTF-8 compliant\";\n }\n dump_into_file( \"columns_non_utf8.csv\", $tmpContent );\n\n my @utf8columns = select_array(\n\"SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', CHARacter_set_name, ',', COLLATION_name, ',', data_type, ',', CHARACTER_MAXIMUM_LENGTH)\nfrom information_schema.columns\nWHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema')\nand (CHARacter_set_name LIKE 'utf8%'\nor COLLATION_name LIKE 'utf8%');\"\n );\n $tmpContent =\n 'Schema,Table,Column, Charset, Collation, Data Type, Max Length';\n foreach my $badtable (@utf8columns) {\n $tmpContent .= \"\\n$badtable\";\n }\n dump_into_file( \"columns_utf8.csv\", $tmpContent );\n\n my @ftcolumns = select_array(\n\"SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', data_type)\nfrom information_schema.columns\nWHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema')\nAND data_type='FULLTEXT';\"\n );\n $tmpContent = 'Schema,Table,Column, Data Type';\n foreach my $ctable (@ftcolumns) {\n $tmpContent .= \"\\n$ctable\";\n }\n dump_into_file( \"fulltext_columns.csv\", $tmpContent );\n\n}\n\n# Recommendations for Galera\nsub mariadb_galera {\n subheaderprint \"Galera Metrics\";\n\n # Galera Cluster\n unless ( defined $myvar{'have_galera'}\n && $myvar{'have_galera'} eq \"YES\" )\n {\n infoprint \"Galera is disabled.\";\n return;\n }\n infoprint \"Galera is enabled.\";\n debugprint \"Galera variables:\";\n foreach my $gvar ( keys %myvar ) {\n next unless $gvar =~ /^wsrep.*/;\n next if $gvar eq 'wsrep_provider_options';\n debugprint \"\\t\" . trim($gvar) . \" = \" . $myvar{$gvar};\n $result{'Galera'}{'variables'}{$gvar} = $myvar{$gvar};\n }\n if ( not defined( $myvar{'wsrep_on'} ) or $myvar{'wsrep_on'} ne \"ON\" ) {\n infoprint \"Galera is disabled.\";\n return;\n }\n debugprint \"Galera wsrep provider Options:\";\n my @galera_options = get_wsrep_options;\n $result{'Galera'}{'wsrep options'} = get_wsrep_options();\n foreach my $gparam (@galera_options) {\n debugprint \"\\t\" . trim($gparam);\n }\n debugprint \"Galera status:\";\n foreach my $gstatus ( keys %mystat ) {\n next unless $gstatus =~ /^wsrep.*/;\n debugprint \"\\t\" . trim($gstatus) . \" = \" . $mystat{$gstatus};\n $result{'Galera'}{'status'}{$gstatus} = $myvar{$gstatus};\n }\n infoprint \"GCache is using \"\n . hr_bytes_rnd( get_wsrep_option('gcache.mem_size') );\n\n infoprint \"CPU cores detected : \" . (cpu_cores);\n infoprint \"wsrep_slave_threads: \" . get_wsrep_option('wsrep_slave_threads');\n\n if ( get_wsrep_option('wsrep_slave_threads') > ( (cpu_cores) * 4 )\n or get_wsrep_option('wsrep_slave_threads') < ( (cpu_cores) * 2 ) )\n {\n badprint\n\"wsrep_slave_threads is not equal to 2, 3 or 4 times the number of CPU(s)\";\n push @adjvars, \"wsrep_slave_threads = \" . ( (cpu_cores) * 4 );\n }\n else {\n goodprint\n\"wsrep_slave_threads is equal to 2, 3 or 4 times the number of CPU(s)\";\n }\n\n if ( get_wsrep_option('wsrep_slave_threads') > 1 ) {\n infoprint\n \"wsrep parallel slave can cause frequent inconsistency crash.\";\n push @adjvars,\n\"Set wsrep_slave_threads to 1 in case of HA_ERR_FOUND_DUPP_KEY crash on slave\";\n\n # check options for parallel slave\n if ( get_wsrep_option('wsrep_slave_FK_checks') eq \"OFF\" ) {\n badprint \"wsrep_slave_FK_checks is off with parallel slave\";\n push @adjvars,\n \"wsrep_slave_FK_checks should be ON when using parallel slave\";\n }\n\n # wsrep_slave_UK_checks seems useless in MySQL source code\n if ( $myvar{'innodb_autoinc_lock_mode'} != 2 ) {\n badprint\n \"innodb_autoinc_lock_mode is incorrect with parallel slave\";\n push @adjvars,\n \"innodb_autoinc_lock_mode should be 2 when using parallel slave\";\n }\n }\n\n if ( get_wsrep_option('gcs.fc_limit') != $myvar{'wsrep_slave_threads'} * 5 )\n {\n badprint \"gcs.fc_limit should be equal to 5 * wsrep_slave_threads (=\"\n . ( $myvar{'wsrep_slave_threads'} * 5 ) . \")\";\n push @adjvars, \"gcs.fc_limit= wsrep_slave_threads * 5 (=\"\n . ( $myvar{'wsrep_slave_threads'} * 5 ) . \")\";\n }\n else {\n goodprint \"gcs.fc_limit is equal to 5 * wsrep_slave_threads ( =\"\n . get_wsrep_option('gcs.fc_limit') . \")\";\n }\n\n if ( get_wsrep_option('gcs.fc_factor') != 0.8 ) {\n badprint \"gcs.fc_factor should be equal to 0.8 (=\"\n . get_wsrep_option('gcs.fc_factor') . \")\";\n push @adjvars, \"gcs.fc_factor=0.8\";\n }\n else {\n goodprint \"gcs.fc_factor is equal to 0.8\";\n }\n if ( get_wsrep_option('wsrep_flow_control_paused') > 0.02 ) {\n badprint \"Fraction of time node pause flow control > 0.02\";\n }\n else {\n goodprint\n\"Flow control fraction seems to be OK (wsrep_flow_control_paused <= 0.02)\";\n }\n\n if ( $myvar{'binlog_format'} ne 'ROW' ) {\n badprint \"Binlog format should be in ROW mode.\";\n push @adjvars, \"binlog_format = ROW\";\n }\n else {\n goodprint \"Binlog format is in ROW mode.\";\n }\n if ( $myvar{'innodb_flush_log_at_trx_commit'} != 0 ) {\n badprint \"InnoDB flush log at each commit should be disabled.\";\n push @adjvars, \"innodb_flush_log_at_trx_commit = 0\";\n }\n else {\n goodprint \"InnoDB flush log at each commit is disabled for Galera.\";\n }\n\n infoprint \"Read consistency mode :\" . $myvar{'wsrep_causal_reads'};\n\n if ( defined( $myvar{'wsrep_cluster_name'} )\n and $myvar{'wsrep_on'} eq \"ON\" )\n {\n goodprint \"Galera WsREP is enabled.\";\n if ( defined( $myvar{'wsrep_cluster_address'} )\n and trim(\"$myvar{'wsrep_cluster_address'}\") ne \"\" )\n {\n goodprint \"Galera Cluster address is defined: \"\n . $myvar{'wsrep_cluster_address'};\n my @NodesTmp = split /,/, $myvar{'wsrep_cluster_address'};\n my $nbNodes = @NodesTmp;\n infoprint \"There are $nbNodes nodes in wsrep_cluster_address\";\n my $nbNodesSize = trim( $mystat{'wsrep_cluster_size'} );\n if ( $nbNodesSize == 3 or $nbNodesSize == 5 ) {\n goodprint \"There are $nbNodesSize nodes in wsrep_cluster_size.\";\n }\n else {\n badprint\n\"There are $nbNodesSize nodes in wsrep_cluster_size. Prefer 3 or 5 nodes architecture.\";\n push @generalrec, \"Prefer 3 or 5 nodes architecture.\";\n }\n\n # wsrep_cluster_address doesn't include garbd nodes\n if ( $nbNodes > $nbNodesSize ) {\n badprint\n\"All cluster nodes are not detected. wsrep_cluster_size less than node count in wsrep_cluster_address\";\n }\n else {\n goodprint \"All cluster nodes detected.\";\n }\n }\n else {\n badprint \"Galera Cluster address is undefined\";\n push @adjvars,\n \"set up wsrep_cluster_address variable for Galera replication\";\n }\n if ( defined( $myvar{'wsrep_cluster_name'} )\n and trim( $myvar{'wsrep_cluster_name'} ) ne \"\" )\n {\n goodprint \"Galera Cluster name is defined: \"\n . $myvar{'wsrep_cluster_name'};\n }\n else {\n badprint \"Galera Cluster name is undefined\";\n push @adjvars,\n \"set up wsrep_cluster_name variable for Galera replication\";\n }\n if ( defined( $myvar{'wsrep_node_name'} )\n and trim( $myvar{'wsrep_node_name'} ) ne \"\" )\n {\n goodprint \"Galera Node name is defined: \"\n . $myvar{'wsrep_node_name'};\n }\n else {\n badprint \"Galera node name is undefined\";\n push @adjvars,\n \"set up wsrep_node_name variable for Galera replication\";\n }\n if ( trim( $myvar{'wsrep_notify_cmd'} ) ne \"\" ) {\n goodprint \"Galera Notify command is defined.\";\n }\n else {\n badprint \"Galera Notify command is not defined.\";\n push( @adjvars,\n \"set up parameter wsrep_notify_cmd to be notified\" );\n }\n if ( trim( $myvar{'wsrep_sst_method'} ) !~ \"^xtrabackup.*\"\n and trim( $myvar{'wsrep_sst_method'} ) !~ \"^mariabackup\" )\n {\n badprint \"Galera SST method is not xtrabackup based.\";\n push( @adjvars,\n\"set up parameter wsrep_sst_method to xtrabackup based parameter\"\n );\n }\n else {\n goodprint \"SST Method is based on xtrabackup.\";\n }\n if (\n (\n defined( $myvar{'wsrep_OSU_method'} )\n && trim( $myvar{'wsrep_OSU_method'} ) eq \"TOI\"\n )\n || ( defined( $myvar{'wsrep_osu_method'} )\n && trim( $myvar{'wsrep_osu_method'} ) eq \"TOI\" )\n )\n {\n goodprint \"TOI is default mode for upgrade.\";\n }\n else {\n badprint \"Schema upgrade are not replicated automatically\";\n push( @adjvars, \"set up parameter wsrep_OSU_method to TOI\" );\n }\n infoprint \"Max WsRep message : \"\n . hr_bytes( $myvar{'wsrep_max_ws_size'} );\n }\n else {\n badprint \"Galera WsREP is disabled\";\n }\n\n if ( defined( $mystat{'wsrep_connected'} )\n and $mystat{'wsrep_connected'} eq \"ON\" )\n {\n goodprint \"Node is connected\";\n }\n else {\n badprint \"Node is disconnected\";\n }\n if ( defined( $mystat{'wsrep_ready'} ) and $mystat{'wsrep_ready'} eq \"ON\" )\n {\n goodprint \"Node is ready\";\n }\n else {\n badprint \"Node is not ready\";\n }\n infoprint \"Cluster status :\" . $mystat{'wsrep_cluster_status'};\n if ( defined( $mystat{'wsrep_cluster_status'} )\n and $mystat{'wsrep_cluster_status'} eq \"Primary\" )\n {\n goodprint \"Galera cluster is consistent and ready for operations\";\n }\n else {\n badprint \"Cluster is not consistent and ready\";\n }\n if ( $mystat{'wsrep_local_state_uuid'} eq\n $mystat{'wsrep_cluster_state_uuid'} )\n {\n goodprint \"Node and whole cluster at the same level: \"\n . $mystat{'wsrep_cluster_state_uuid'};\n }\n else {\n badprint \"Node and whole cluster not the same level\";\n infoprint \"Node state uuid: \" . $mystat{'wsrep_local_state_uuid'};\n infoprint \"Cluster state uuid: \" . $mystat{'wsrep_cluster_state_uuid'};\n }\n if ( $mystat{'wsrep_local_state_comment'} eq 'Synced' ) {\n goodprint \"Node is synced with whole cluster.\";\n }\n else {\n badprint \"Node is not synced\";\n infoprint \"Node State : \" . $mystat{'wsrep_local_state_comment'};\n }\n if ( $mystat{'wsrep_local_cert_failures'} == 0 ) {\n goodprint \"There is no certification failures detected.\";\n }\n else {\n badprint \"There is \"\n . $mystat{'wsrep_local_cert_failures'}\n . \" certification failure(s)detected.\";\n }\n\n for my $key ( keys %mystat ) {\n if ( $key =~ /wsrep_|galera/i ) {\n debugprint \"WSREP: $key = $mystat{$key}\";\n }\n }\n\n #debugprint Dumper get_wsrep_options() if $opt{debug};\n}\n\n# Recommendations for InnoDB\nsub mysql_innodb {\n subheaderprint \"InnoDB Metrics\";\n\n # InnoDB\n unless ( defined $myvar{'have_innodb'}\n && $myvar{'have_innodb'} eq \"YES\" )\n {\n infoprint \"InnoDB is disabled.\";\n if ( mysql_version_ge( 5, 5 ) ) {\n my $defengine = 'InnoDB';\n $defengine = $myvar{'default_storage_engine'}\n if defined( $myvar{'default_storage_engine'} );\n badprint\n\"InnoDB Storage engine is disabled. $defengine is the default storage engine\"\n if $defengine eq 'InnoDB';\n infoprint\n\"InnoDB Storage engine is disabled. $defengine is the default storage engine\"\n if $defengine ne 'InnoDB';\n }\n return;\n }\n infoprint \"InnoDB is enabled.\";\n if ( !defined $enginestats{'InnoDB'} ) {\n if ( $opt{skipsize} eq 1 ) {\n infoprint \"Skipped due to --skipsize option\";\n return;\n }\n badprint \"No tables are Innodb\";\n $enginestats{'InnoDB'} = 0;\n }\n\n if ( $opt{buffers} ne 0 ) {\n infoprint \"InnoDB Buffers\";\n if ( defined $myvar{'innodb_buffer_pool_size'} ) {\n infoprint \" +-- InnoDB Buffer Pool: \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . \"\";\n }\n if ( defined $myvar{'innodb_buffer_pool_instances'} ) {\n infoprint \" +-- InnoDB Buffer Pool Instances: \"\n . $myvar{'innodb_buffer_pool_instances'} . \"\";\n }\n\n if ( defined $myvar{'innodb_buffer_pool_chunk_size'} ) {\n infoprint \" +-- InnoDB Buffer Pool Chunk Size: \"\n . hr_bytes( $myvar{'innodb_buffer_pool_chunk_size'} ) . \"\";\n }\n if ( defined $myvar{'innodb_additional_mem_pool_size'} ) {\n infoprint \" +-- InnoDB Additional Mem Pool: \"\n . hr_bytes( $myvar{'innodb_additional_mem_pool_size'} ) . \"\";\n }\n if ( defined $myvar{'innodb_redo_log_capacity'} ) {\n infoprint \" +-- InnoDB Redo Log Capacity: \"\n . hr_bytes( $myvar{'innodb_redo_log_capacity'} );\n }\n else {\n if ( defined $myvar{'innodb_log_file_size'} ) {\n infoprint \" +-- InnoDB Log File Size: \"\n . hr_bytes( $myvar{'innodb_log_file_size'} );\n }\n if ( defined $myvar{'innodb_log_files_in_group'} ) {\n infoprint \" +-- InnoDB Log File In Group: \"\n . $myvar{'innodb_log_files_in_group'};\n infoprint \" +-- InnoDB Total Log File Size: \"\n . hr_bytes( $myvar{'innodb_log_files_in_group'} *\n $myvar{'innodb_log_file_size'} )\n . \"(\"\n . $mycalc{'innodb_log_size_pct'}\n . \" % of buffer pool)\";\n }\n else {\n infoprint \" +-- InnoDB Total Log File Size: \"\n . hr_bytes( $myvar{'innodb_log_file_size'} ) . \"(\"\n . $mycalc{'innodb_log_size_pct'}\n . \" % of buffer pool)\";\n }\n }\n if ( defined $myvar{'innodb_log_buffer_size'} ) {\n infoprint \" +-- InnoDB Log Buffer: \"\n . hr_bytes( $myvar{'innodb_log_buffer_size'} );\n }\n if ( defined $mystat{'Innodb_buffer_pool_pages_free'} ) {\n infoprint \" +-- InnoDB Buffer Free: \"\n . hr_bytes( $mystat{'Innodb_buffer_pool_pages_free'} ) . \"\";\n }\n if ( defined $mystat{'Innodb_buffer_pool_pages_total'} ) {\n infoprint \" +-- InnoDB Buffer Used: \"\n . hr_bytes( $mystat{'Innodb_buffer_pool_pages_total'} ) . \"\";\n }\n }\n\n if ( defined $myvar{'innodb_thread_concurrency'} ) {\n infoprint \"InnoDB Thread Concurrency: \"\n . $myvar{'innodb_thread_concurrency'};\n }\n\n # InnoDB Buffer Pool Size\n if ( $myvar{'innodb_file_per_table'} eq \"ON\" ) {\n goodprint \"InnoDB File per table is activated\";\n }\n else {\n badprint \"InnoDB File per table is not activated\";\n push( @adjvars, \"innodb_file_per_table=ON\" );\n }\n\n # InnoDB Buffer Pool Size\n if ( $arch == 32 && $myvar{'innodb_buffer_pool_size'} > 4294967295 ) {\n badprint\n \"InnoDB Buffer Pool size limit reached for 32 bits architecture: (\"\n . hr_bytes(4294967295) . \" )\";\n push( @adjvars,\n \"limit innodb_buffer_pool_size under \"\n . hr_bytes(4294967295)\n . \" for 32 bits architecture\" );\n }\n if ( $arch == 32 && $myvar{'innodb_buffer_pool_size'} < 4294967295 ) {\n goodprint \"InnoDB Buffer Pool size ( \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" ) under limit for 32 bits architecture: (\"\n . hr_bytes(4294967295) . \")\";\n }\n if ( $arch == 64\n && $myvar{'innodb_buffer_pool_size'} > 18446744073709551615 )\n {\n badprint \"InnoDB Buffer Pool size limit(\"\n . hr_bytes(18446744073709551615)\n . \") reached for 64 bits architecture\";\n push( @adjvars,\n \"limit innodb_buffer_pool_size under \"\n . hr_bytes(18446744073709551615)\n . \" for 64 bits architecture\" );\n }\n\n if ( $arch == 64\n && $myvar{'innodb_buffer_pool_size'} < 18446744073709551615 )\n {\n goodprint \"InnoDB Buffer Pool size ( \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" ) under limit for 64 bits architecture: (\"\n . hr_bytes(18446744073709551615) . \" )\";\n }\n if ( $myvar{'innodb_buffer_pool_size'} > $enginestats{'InnoDB'} ) {\n goodprint \"InnoDB buffer pool / data size: \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . \" / \"\n . hr_bytes( $enginestats{'InnoDB'} ) . \"\";\n }\n else {\n badprint \"InnoDB buffer pool / data size: \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . \" / \"\n . hr_bytes( $enginestats{'InnoDB'} ) . \"\";\n push( @adjvars,\n \"innodb_buffer_pool_size (>= \"\n . hr_bytes( $enginestats{'InnoDB'} )\n . \") if possible.\" );\n }\n\n # select round( 100* sum(allocated)/( select VARIABLE_VALUE\n # FROM performance_schema.global_variables\n # where VARIABLE_NAME='innodb_buffer_pool_size' )\n # ,2) as \"PCT ALLOC/BUFFER POOL\"\n #from sys.x$innodb_buffer_stats_by_table;\n\n if ( $mycalc{innodb_buffer_alloc_pct} < 80 ) {\n badprint \"Ratio Buffer Pool allocated / Buffer Pool Size: \"\n . $mycalc{'innodb_buffer_alloc_pct'} . '%';\n }\n else {\n goodprint \"Ratio Buffer Pool allocated / Buffer Pool Size: \"\n . $mycalc{'innodb_buffer_alloc_pct'} . '%';\n }\n if ( $mycalc{'innodb_log_size_pct'} < 20\n or $mycalc{'innodb_log_size_pct'} > 30 )\n {\n if ( defined $myvar{'innodb_redo_log_capacity'} ) {\n badprint\n \"Ratio InnoDB redo log capacity / InnoDB Buffer pool size (\"\n . $mycalc{'innodb_log_size_pct'} . \"%): \"\n . hr_bytes( $myvar{'innodb_redo_log_capacity'} ) . \" / \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" should be equal to 25%\";\n push( @adjvars,\n \"innodb_redo_log_capacity should be (=\"\n . hr_bytes_rnd( $myvar{'innodb_buffer_pool_size'} / 4 )\n . \") if possible, so InnoDB Redo log Capacity equals 25% of buffer pool size.\"\n );\n push( @generalrec,\n\"Be careful, increasing innodb_redo_log_capacity means higher crash recovery mean time\"\n );\n }\n else {\n badprint \"Ratio InnoDB log file size / InnoDB Buffer pool size (\"\n . $mycalc{'innodb_log_size_pct'} . \"%): \"\n . hr_bytes( $myvar{'innodb_log_file_size'} ) . \" * \"\n . $myvar{'innodb_log_files_in_group'} . \" / \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" should be equal to 25%\";\n push(\n @adjvars,\n \"innodb_log_file_size should be (=\"\n . hr_bytes_rnd(\n $myvar{'innodb_buffer_pool_size'} /\n $myvar{'innodb_log_files_in_group'} / 4\n )\n . \") if possible, so InnoDB total log file size equals 25% of buffer pool size.\"\n );\n push( @generalrec,\n\"Be careful, increasing innodb_log_file_size / innodb_log_files_in_group means higher crash recovery mean time\"\n );\n }\n if ( mysql_version_le( 5, 6, 2 ) ) {\n push( @generalrec,\n\"For MySQL 5.6.2 and lower, total innodb_log_file_size should have a ceiling of (4096MB / log files in group) - 1MB.\"\n );\n }\n\n }\n else {\n if ( defined $myvar{'innodb_redo_log_capacity'} ) {\n goodprint\n \"Ratio InnoDB Redo Log Capacity / InnoDB Buffer pool size: \"\n . hr_bytes( $myvar{'innodb_redo_log_capacity'} ) . \"/\"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" should be equal to 25%\";\n }\n else {\n push( @generalrec,\n\"Before changing innodb_log_file_size and/or innodb_log_files_in_group read this: https://bit.ly/2TcGgtU\"\n );\n goodprint \"Ratio InnoDB log file size / InnoDB Buffer pool size: \"\n . hr_bytes( $myvar{'innodb_log_file_size'} ) . \" * \"\n . $myvar{'innodb_log_files_in_group'} . \"/\"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" should be equal to 25%\";\n }\n }\n\n # InnoDB Buffer Pool Instances (MySQL 5.6.6+)\n if ( not mysql_version_ge( 10, 4 )\n and defined( $myvar{'innodb_buffer_pool_instances'} ) )\n {\n\n # Bad Value if > 64\n if ( $myvar{'innodb_buffer_pool_instances'} > 64 ) {\n badprint \"InnoDB buffer pool instances: \"\n . $myvar{'innodb_buffer_pool_instances'} . \"\";\n push( @adjvars, \"innodb_buffer_pool_instances (<= 64)\" );\n }\n\n # InnoDB Buffer Pool Size > 1Go\n if ( $myvar{'innodb_buffer_pool_size'} > 1024 * 1024 * 1024 ) {\n\n# InnoDB Buffer Pool Size / 1Go = InnoDB Buffer Pool Instances limited to 64 max.\n\n # InnoDB Buffer Pool Size > 64Go\n my $max_innodb_buffer_pool_instances =\n int( $myvar{'innodb_buffer_pool_size'} / ( 1024 * 1024 * 1024 ) );\n $max_innodb_buffer_pool_instances = 64\n if ( $max_innodb_buffer_pool_instances > 64 );\n\n if ( $myvar{'innodb_buffer_pool_instances'} !=\n $max_innodb_buffer_pool_instances )\n {\n badprint \"InnoDB buffer pool instances: \"\n . $myvar{'innodb_buffer_pool_instances'} . \"\";\n push( @adjvars,\n \"innodb_buffer_pool_instances(=\"\n . $max_innodb_buffer_pool_instances\n . \")\" );\n }\n else {\n goodprint \"InnoDB buffer pool instances: \"\n . $myvar{'innodb_buffer_pool_instances'} . \"\";\n }\n\n # InnoDB Buffer Pool Size < 1Go\n }\n else {\n if ( $myvar{'innodb_buffer_pool_instances'} != 1 ) {\n badprint\n\"InnoDB buffer pool <= 1G and Innodb_buffer_pool_instances(!=1).\";\n push( @adjvars, \"innodb_buffer_pool_instances (=1)\" );\n }\n else {\n goodprint \"InnoDB buffer pool instances: \"\n . $myvar{'innodb_buffer_pool_instances'} . \"\";\n }\n }\n }\n\n # InnoDB Used Buffer Pool Size vs CHUNK size\n if ( !defined( $myvar{'innodb_buffer_pool_chunk_size'} ) ) {\n infoprint\n \"InnoDB Buffer Pool Chunk Size not used or defined in your version\";\n }\n else {\n infoprint \"Number of InnoDB Buffer Pool Chunk: \"\n . int( $myvar{'innodb_buffer_pool_size'} ) /\n int( $myvar{'innodb_buffer_pool_chunk_size'} ) . \" for \"\n . $myvar{'innodb_buffer_pool_instances'}\n . \" Buffer Pool Instance(s)\";\n\n if (\n int( $myvar{'innodb_buffer_pool_size'} ) % (\n int( $myvar{'innodb_buffer_pool_chunk_size'} ) *\n int( $myvar{'innodb_buffer_pool_instances'} )\n ) eq 0\n )\n {\n goodprint\n\"Innodb_buffer_pool_size aligned with Innodb_buffer_pool_chunk_size & Innodb_buffer_pool_instances\";\n }\n else {\n badprint\n\"Innodb_buffer_pool_size aligned with Innodb_buffer_pool_chunk_size & Innodb_buffer_pool_instances\";\n\n#push( @adjvars, \"Adjust innodb_buffer_pool_instances, innodb_buffer_pool_chunk_size with innodb_buffer_pool_size\" );\n push( @adjvars,\n\"innodb_buffer_pool_size must always be equal to or a multiple of innodb_buffer_pool_chunk_size * innodb_buffer_pool_instances\"\n );\n }\n }\n\n # InnoDB Read efficiency\n if ( defined $mycalc{'pct_read_efficiency'}\n && $mycalc{'pct_read_efficiency'} < 90 )\n {\n badprint \"InnoDB Read buffer efficiency: \"\n . $mycalc{'pct_read_efficiency'} . \"% (\"\n . $mystat{'Innodb_buffer_pool_read_requests'}\n . \" hits / \"\n . ( $mystat{'Innodb_buffer_pool_reads'} +\n $mystat{'Innodb_buffer_pool_read_requests'} )\n . \" total)\";\n }\n else {\n goodprint \"InnoDB Read buffer efficiency: \"\n . $mycalc{'pct_read_efficiency'} . \"% (\"\n . $mystat{'Innodb_buffer_pool_read_requests'}\n . \" hits / \"\n . ( $mystat{'Innodb_buffer_pool_reads'} +\n $mystat{'Innodb_buffer_pool_read_requests'} )\n . \" total)\";\n }\n\n # InnoDB Write efficiency\n if ( defined $mycalc{'pct_write_efficiency'}\n && $mycalc{'pct_write_efficiency'} < 90 )\n {\n badprint \"InnoDB Write Log efficiency: \"\n . abs( $mycalc{'pct_write_efficiency'} ) . \"% (\"\n . abs( $mystat{'Innodb_log_write_requests'} -\n $mystat{'Innodb_log_writes'} )\n . \" hits / \"\n . $mystat{'Innodb_log_write_requests'}\n . \" total)\";\n push( @adjvars,\n \"innodb_log_buffer_size (> \"\n . hr_bytes_rnd( $myvar{'innodb_log_buffer_size'} )\n . \")\" );\n }\n else {\n goodprint \"InnoDB Write Log efficiency: \"\n . $mycalc{'pct_write_efficiency'} . \"% (\"\n . ( $mystat{'Innodb_log_write_requests'} -\n $mystat{'Innodb_log_writes'} )\n . \" hits / \"\n . $mystat{'Innodb_log_write_requests'}\n . \" total)\";\n }\n\n # InnoDB Log Waits\n $mystat{'Innodb_log_waits_computed'} = 0;\n\n if ( defined( $mystat{'Innodb_log_waits'} )\n and defined( $mystat{'Innodb_log_writes'} )\n and $mystat{'Innodb_log_writes'} > 0.000001 )\n {\n $mystat{'Innodb_log_waits_computed'} =\n $mystat{'Innodb_log_waits'} / $mystat{'Innodb_log_writes'};\n }\n else {\n undef $mystat{'Innodb_log_waits_computed'};\n }\n\n if ( defined $mystat{'Innodb_log_waits_computed'}\n && $mystat{'Innodb_log_waits_computed'} > 0.000001 )\n {\n badprint \"InnoDB log waits: \"\n . percentage( $mystat{'Innodb_log_waits'},\n $mystat{'Innodb_log_writes'} )\n . \"% (\"\n . $mystat{'Innodb_log_waits'}\n . \" waits / \"\n . $mystat{'Innodb_log_writes'}\n . \" writes)\";\n push( @adjvars,\n \"innodb_log_buffer_size (> \"\n . hr_bytes_rnd( $myvar{'innodb_log_buffer_size'} )\n . \")\" );\n }\n else {\n goodprint \"InnoDB log waits: \"\n . percentage( $mystat{'Innodb_log_waits'},\n $mystat{'Innodb_log_writes'} )\n . \"% (\"\n . $mystat{'Innodb_log_waits'}\n . \" waits / \"\n . $mystat{'Innodb_log_writes'}\n . \" writes)\";\n }\n $result{'Calculations'} = {%mycalc};\n}\n\nsub check_metadata_perf {\n subheaderprint \"Analysis Performance Metrics\";\n if ( defined $myvar{'innodb_stats_on_metadata'} ) {\n infoprint \"innodb_stats_on_metadata: \"\n . $myvar{'innodb_stats_on_metadata'};\n if ( $myvar{'innodb_stats_on_metadata'} eq 'ON' ) {\n badprint \"Stat are updated during querying INFORMATION_SCHEMA.\";\n push @adjvars, \"SET innodb_stats_on_metadata = OFF\";\n\n #Disabling innodb_stats_on_metadata\n select_one(\"SET GLOBAL innodb_stats_on_metadata = OFF;\");\n return 1;\n }\n }\n goodprint \"No stat updates during querying INFORMATION_SCHEMA.\";\n return 0;\n}\n\n# Recommendations for Database metrics\nsub mysql_databases {\n return if ( $opt{dbstat} == 0 );\n\n subheaderprint \"Database Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Database metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n\n @dblist = select_array(\n\"SELECT SCHEMA_NAME FROM information_schema.SCHEMATA WHERE SCHEMA_NAME NOT IN ( 'mysql', 'performance_schema', 'information_schema', 'sys' );\"\n );\n infoprint \"There is \" . scalar(@dblist) . \" Database(s).\";\n my @totaldbinfo = split /\\s/,\n select_one(\n\"SELECT SUM(TABLE_ROWS), SUM(DATA_LENGTH), SUM(INDEX_LENGTH), SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(TABLE_NAME), COUNT(DISTINCT(TABLE_COLLATION)), COUNT(DISTINCT(ENGINE)) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');\"\n );\n infoprint \"All User Databases:\";\n infoprint \" +-- TABLE : \"\n . select_one(\n\"SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')\"\n ) . \"\";\n infoprint \" +-- VIEW : \"\n . select_one(\n\"SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='VIEW' AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')\"\n ) . \"\";\n infoprint \" +-- INDEX : \"\n . select_one(\n\"SELECT count(distinct(concat(TABLE_NAME, TABLE_SCHEMA, INDEX_NAME))) from information_schema.STATISTICS WHERE TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')\"\n ) . \"\";\n\n infoprint \" +-- CHARS : \"\n . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"select distinct(CHARACTER_SET_NAME) from information_schema.columns WHERE CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');\"\n )\n ) . \")\";\n infoprint \" +-- COLLA : \"\n . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"SELECT DISTINCT(TABLE_COLLATION) FROM information_schema.TABLES WHERE TABLE_COLLATION IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');\"\n )\n ) . \")\";\n infoprint \" +-- ROWS : \"\n . ( $totaldbinfo[0] eq 'NULL' ? 0 : $totaldbinfo[0] ) . \"\";\n infoprint \" +-- DATA : \"\n . hr_bytes( $totaldbinfo[1] ) . \"(\"\n . percentage( $totaldbinfo[1], $totaldbinfo[3] ) . \"%)\";\n infoprint \" +-- INDEX : \"\n . hr_bytes( $totaldbinfo[2] ) . \"(\"\n . percentage( $totaldbinfo[2], $totaldbinfo[3] ) . \"%)\";\n infoprint \" +-- SIZE : \" . hr_bytes( $totaldbinfo[3] ) . \"\";\n infoprint \" +-- ENGINE: \"\n . ( $totaldbinfo[6] eq 'NULL' ? 0 : $totaldbinfo[6] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE ENGINE IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');\"\n )\n ) . \")\";\n\n $result{'Databases'}{'All databases'}{'Rows'} =\n ( $totaldbinfo[0] eq 'NULL' ? 0 : $totaldbinfo[0] );\n $result{'Databases'}{'All databases'}{'Data Size'} = $totaldbinfo[1];\n $result{'Databases'}{'All databases'}{'Data Pct'} =\n percentage( $totaldbinfo[1], $totaldbinfo[3] ) . \"%\";\n $result{'Databases'}{'All databases'}{'Index Size'} = $totaldbinfo[2];\n $result{'Databases'}{'All databases'}{'Index Pct'} =\n percentage( $totaldbinfo[2], $totaldbinfo[3] ) . \"%\";\n $result{'Databases'}{'All databases'}{'Total Size'} = $totaldbinfo[3];\n print \"\\n\" unless ( $opt{'silent'} or $opt{'json'} );\n my $nbViews = 0;\n my $nbTables = 0;\n\n foreach (@dblist) {\n my @dbinfo = split /\\s/,\n select_one(\n\"SELECT TABLE_SCHEMA, SUM(TABLE_ROWS), SUM(DATA_LENGTH), SUM(INDEX_LENGTH), SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(DISTINCT ENGINE), COUNT(TABLE_NAME), COUNT(DISTINCT(TABLE_COLLATION)), COUNT(DISTINCT(ENGINE)) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' GROUP BY TABLE_SCHEMA ORDER BY TABLE_SCHEMA\"\n );\n next unless defined $dbinfo[0];\n\n infoprint \"Database: \" . $dbinfo[0] . \"\";\n $nbTables = select_one(\n\"SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA='$_'\"\n );\n infoprint \" +-- TABLE : $nbTables\";\n infoprint \" +-- VIEW : \"\n . select_one(\n\"SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='VIEW' AND TABLE_SCHEMA='$_'\"\n ) . \"\";\n infoprint \" +-- INDEX : \"\n . select_one(\n\"SELECT count(distinct(concat(TABLE_NAME, TABLE_SCHEMA, INDEX_NAME))) from information_schema.STATISTICS WHERE TABLE_SCHEMA='$_'\"\n ) . \"\";\n infoprint \" +-- CHARS : \"\n . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"select distinct(CHARACTER_SET_NAME) from information_schema.columns WHERE CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA='$_';\"\n )\n ) . \")\";\n infoprint \" +-- COLLA : \"\n . ( $dbinfo[7] eq 'NULL' ? 0 : $dbinfo[7] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"SELECT DISTINCT(TABLE_COLLATION) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND TABLE_COLLATION IS NOT NULL;\"\n )\n ) . \")\";\n infoprint \" +-- ROWS : \"\n . ( !defined( $dbinfo[1] ) or $dbinfo[1] eq 'NULL' ? 0 : $dbinfo[1] )\n . \"\";\n infoprint \" +-- DATA : \"\n . hr_bytes( $dbinfo[2] ) . \"(\"\n . percentage( $dbinfo[2], $dbinfo[4] ) . \"%)\";\n infoprint \" +-- INDEX : \"\n . hr_bytes( $dbinfo[3] ) . \"(\"\n . percentage( $dbinfo[3], $dbinfo[4] ) . \"%)\";\n infoprint \" +-- TOTAL : \" . hr_bytes( $dbinfo[4] ) . \"\";\n infoprint \" +-- ENGINE: \"\n . ( $dbinfo[8] eq 'NULL' ? 0 : $dbinfo[8] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND ENGINE IS NOT NULL\"\n )\n ) . \")\";\n\n foreach my $eng (\n select_array(\n\"SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND ENGINE IS NOT NULL\"\n )\n )\n {\n infoprint \" +-- ENGINE $eng : \"\n . select_one(\n\"SELECT COUNT(*) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$dbinfo[0]' AND ENGINE='$eng'\"\n ) . \" TABLE(s)\";\n }\n\n if ( $nbTables == 0 ) {\n badprint \" No table in $dbinfo[0] database\";\n next;\n }\n badprint \"Index size is larger than data size for $dbinfo[0] \\n\"\n if ( $dbinfo[2] ne 'NULL' )\n and ( $dbinfo[3] ne 'NULL' )\n and ( $dbinfo[2] < $dbinfo[3] );\n if ( $dbinfo[5] > 1 and $nbTables > 0 ) {\n badprint \"There are \"\n . $dbinfo[5]\n . \" storage engines. Be careful. \\n\";\n push @generalrec,\n\"Select one storage engine (InnoDB is a good choice) for all tables in $dbinfo[0] database ($dbinfo[5] engines detected)\";\n }\n $result{'Databases'}{ $dbinfo[0] }{'Rows'} = $dbinfo[1];\n $result{'Databases'}{ $dbinfo[0] }{'Tables'} = $dbinfo[6];\n $result{'Databases'}{ $dbinfo[0] }{'Collations'} = $dbinfo[7];\n $result{'Databases'}{ $dbinfo[0] }{'Data Size'} = $dbinfo[2];\n $result{'Databases'}{ $dbinfo[0] }{'Data Pct'} =\n percentage( $dbinfo[2], $dbinfo[4] ) . \"%\";\n $result{'Databases'}{ $dbinfo[0] }{'Index Size'} = $dbinfo[3];\n $result{'Databases'}{ $dbinfo[0] }{'Index Pct'} =\n percentage( $dbinfo[3], $dbinfo[4] ) . \"%\";\n $result{'Databases'}{ $dbinfo[0] }{'Total Size'} = $dbinfo[4];\n\n if ( $dbinfo[7] > 1 ) {\n badprint $dbinfo[7]\n . \" different collations for database \"\n . $dbinfo[0];\n push( @generalrec,\n \"Check all table collations are identical for all tables in \"\n . $dbinfo[0]\n . \" database.\" );\n }\n else {\n goodprint $dbinfo[7]\n . \" collation for \"\n . $dbinfo[0]\n . \" database.\";\n }\n if ( $dbinfo[8] > 1 ) {\n badprint $dbinfo[8]\n . \" different engines for database \"\n . $dbinfo[0];\n push( @generalrec,\n \"Check all table engines are identical for all tables in \"\n . $dbinfo[0]\n . \" database.\" );\n }\n else {\n goodprint $dbinfo[8] . \" engine for \" . $dbinfo[0] . \" database.\";\n }\n\n my @distinct_column_charset = select_array(\n\"select DISTINCT(CHARACTER_SET_NAME) from information_schema.COLUMNS where CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA ='$_' AND CHARACTER_SET_NAME IS NOT NULL\"\n );\n infoprint \"Charsets for $dbinfo[0] database table column: \"\n . join( ', ', @distinct_column_charset );\n if ( scalar(@distinct_column_charset) > 1 ) {\n badprint $dbinfo[0]\n . \" table column(s) has several charsets defined for all text like column(s).\";\n push( @generalrec,\n \"Limit charset for column to one charset if possible for \"\n . $dbinfo[0]\n . \" database.\" );\n }\n else {\n goodprint $dbinfo[0]\n . \" table column(s) has same charset defined for all text like column(s).\";\n }\n\n my @distinct_column_collation = select_array(\n\"select DISTINCT(COLLATION_NAME) from information_schema.COLUMNS where COLLATION_NAME IS NOT NULL AND TABLE_SCHEMA ='$_' AND COLLATION_NAME IS NOT NULL\"\n );\n infoprint \"Collations for $dbinfo[0] database table column: \"\n . join( ', ', @distinct_column_collation );\n if ( scalar(@distinct_column_collation) > 1 ) {\n badprint $dbinfo[0]\n . \" table column(s) has several collations defined for all text like column(s).\";\n push( @generalrec,\n \"Limit collations for column to one collation if possible for \"\n . $dbinfo[0]\n . \" database.\" );\n }\n else {\n goodprint $dbinfo[0]\n . \" table column(s) has same collation defined for all text like column(s).\";\n }\n }\n}\n\n# Recommendations for database columns\nsub mysql_tables {\n return if ( $opt{tbstat} == 0 );\n\n subheaderprint \"Table Column Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Table column metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n if ( mysql_version_ge(8) and not mysql_version_eq(10) ) {\n infoprint\n\"MySQL and Percona version 8.0 and greater have removed PROCEDURE ANALYSE feature\";\n $opt{colstat} = 0;\n infoprint \"Disabling colstat parameter\";\n\n }\n\n infoprint(\"Dumpdir: $opt{dumpdir}\");\n\n # Store all information schema in dumpdir if defined\n if ( defined $opt{dumpdir} and -d \"$opt{dumpdir}\" ) {\n for my $info_s_table (\n select_array('use information_schema;show tables;') )\n {\n infoprint \"Dumping $info_s_table into $opt{dumpdir}\";\n select_csv_file(\n \"$opt{dumpdir}/ifs_${info_s_table}.csv\",\n \"select * from information_schema.$info_s_table\"\n );\n }\n\n #exit 0 if ( $opt{stop} == 1 );\n }\n foreach ( select_user_dbs() ) {\n my $dbname = $_;\n next unless defined $_;\n infoprint \"Database: \" . $_ . \"\";\n my @dbtable = select_array(\n\"SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='$dbname' AND TABLE_TYPE='BASE TABLE' ORDER BY TABLE_NAME\"\n );\n foreach (@dbtable) {\n my $tbname = $_;\n infoprint \" +-- TABLE: $tbname\";\n infoprint \" +-- TYPE: \"\n . select_one(\n\"SELECT ENGINE FROM information_schema.tables where TABLE_schema='$dbname' AND TABLE_NAME='$tbname'\"\n );\n\n my $selIdxReq = <<\"ENDSQL\";\n SELECT index_name AS idxname, \n GROUP_CONCAT(column_name ORDER BY seq_in_index) AS cols, \n INDEX_TYPE as type\n FROM information_schema.statistics\n WHERE INDEX_SCHEMA='$dbname'\n AND TABLE_NAME='$tbname'\n GROUP BY idxname, type\nENDSQL\n my @tbidx = select_array($selIdxReq);\n my $found = 0;\n foreach my $idx (@tbidx) {\n my @info = split /\\s/, $idx;\n next if $info[0] eq 'NULL';\n infoprint\n \" +-- Index $info[0] - Cols: $info[1] - Type: $info[2]\";\n $found++;\n }\n if ( $found == 0 ) {\n badprint(\"Table $dbname.$tbname has no index defined\");\n push @generalrec,\n \"Add at least a primary key on table $dbname.$tbname\";\n }\n my @tbcol = select_array(\n\"SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname'\"\n );\n foreach (@tbcol) {\n my $ctype = select_one(\n\"SELECT COLUMN_TYPE FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname' AND COLUMN_NAME='$_' \"\n );\n my $isnull = select_one(\n\"SELECT IS_NULLABLE FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname' AND COLUMN_NAME='$_' \"\n );\n\n my $current_type =\n uc($ctype) . ( $isnull eq 'NO' ? \" NOT NULL\" : \" NULL\" );\n my $optimal_type = '';\n infoprint \" +-- Column $tbname.$_: $current_type\";\n if ( $opt{colstat} == 1 ) {\n $optimal_type = select_str_g( \"Optimal_fieldtype\",\n\"SELECT \\\\`$_\\\\` FROM \\\\`$dbname\\\\`.\\\\`$tbname\\\\` PROCEDURE ANALYSE(100000)\"\n )\n unless ( mysql_version_ge(8)\n and not mysql_version_eq(10) );\n }\n if ( $optimal_type eq '' ) {\n\n #infoprint \" +-- Current Fieldtype: $current_type\";\n\n #infoprint \" Optimal Fieldtype: Not available\";\n }\n elsif ( $current_type ne $optimal_type\n and $current_type !~ /.*DATETIME.*/\n and $current_type !~ /.*TIMESTAMP.*/ )\n {\n infoprint \" +-- Current Fieldtype: $current_type\";\n if ( $optimal_type =~ /.*ENUM\\(.*/ ) {\n $optimal_type = \"ENUM( ... )\";\n }\n infoprint \" +-- Optimal Fieldtype: $optimal_type \";\n if ( $optimal_type !~ /.*ENUM\\(.*/ ) {\n badprint\n\"Consider changing type for column $_ in table $dbname.$tbname\";\n push( @generalrec,\n\"ALTER TABLE \\`$dbname\\`.\\`$tbname\\` MODIFY \\`$_\\` $optimal_type;\"\n );\n }\n }\n else {\n goodprint \"$dbname.$tbname ($_) type: $current_type\";\n }\n }\n }\n }\n}\n\n# Recommendations for Indexes metrics\nsub mysql_indexes {\n return if ( $opt{idxstat} == 0 );\n\n subheaderprint \"Indexes Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Index metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n\n# unless ( mysql_version_ge( 5, 6 ) ) {\n# infoprint\n#\"Skip Index metrics from information schema due to erroneous information provided in this version\";\n# return;\n# }\n my $selIdxReq = <<'ENDSQL';\nSELECT\n CONCAT(t.TABLE_SCHEMA, '.', t.TABLE_NAME) AS 'table', \n CONCAT(s.INDEX_NAME, '(', s.COLUMN_NAME, ')') AS 'index'\n , s.SEQ_IN_INDEX AS 'seq'\n , s2.max_columns AS 'maxcol'\n , s.CARDINALITY AS 'card'\n , t.TABLE_ROWS AS 'est_rows'\n , INDEX_TYPE as type\n , ROUND(((s.CARDINALITY / IFNULL(t.TABLE_ROWS, 0.01)) * 100), 2) AS 'sel'\nFROM INFORMATION_SCHEMA.STATISTICS s\n INNER JOIN INFORMATION_SCHEMA.TABLES t\n ON s.TABLE_SCHEMA = t.TABLE_SCHEMA\n AND s.TABLE_NAME = t.TABLE_NAME\n INNER JOIN (\n SELECT\n TABLE_SCHEMA\n , TABLE_NAME\n , INDEX_NAME\n , MAX(SEQ_IN_INDEX) AS max_columns\n FROM INFORMATION_SCHEMA.STATISTICS\n WHERE TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema')\n AND INDEX_TYPE <> 'FULLTEXT'\n GROUP BY TABLE_SCHEMA, TABLE_NAME, INDEX_NAME\n ) AS s2\n ON s.TABLE_SCHEMA = s2.TABLE_SCHEMA\n AND s.TABLE_NAME = s2.TABLE_NAME\n AND s.INDEX_NAME = s2.INDEX_NAME\nWHERE t.TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema')\nAND t.TABLE_ROWS > 10\nAND s.CARDINALITY IS NOT NULL\nAND (s.CARDINALITY / IFNULL(t.TABLE_ROWS, 0.01)) < 8.00\nORDER BY sel\nLIMIT 10;\nENDSQL\n my @idxinfo = select_array($selIdxReq);\n infoprint \"Worst selectivity indexes:\";\n foreach (@idxinfo) {\n debugprint \"$_\";\n my @info = split /\\s/;\n infoprint \"Index: \" . $info[1] . \"\";\n\n infoprint \" +-- COLUMN : \" . $info[0] . \"\";\n infoprint \" +-- NB SEQS : \" . $info[2] . \" sequence(s)\";\n infoprint \" +-- NB COLS : \" . $info[3] . \" column(s)\";\n infoprint \" +-- CARDINALITY : \" . $info[4] . \" distinct values\";\n infoprint \" +-- NB ROWS : \" . $info[5] . \" rows\";\n infoprint \" +-- TYPE : \" . $info[6];\n infoprint \" +-- SELECTIVITY : \" . $info[7] . \"%\";\n\n $result{'Indexes'}{ $info[1] }{'Column'} = $info[0];\n $result{'Indexes'}{ $info[1] }{'Sequence number'} = $info[2];\n $result{'Indexes'}{ $info[1] }{'Number of column'} = $info[3];\n $result{'Indexes'}{ $info[1] }{'Cardinality'} = $info[4];\n $result{'Indexes'}{ $info[1] }{'Row number'} = $info[5];\n $result{'Indexes'}{ $info[1] }{'Index Type'} = $info[6];\n $result{'Indexes'}{ $info[1] }{'Selectivity'} = $info[7];\n if ( $info[7] < 25 ) {\n badprint \"$info[1] has a low selectivity\";\n }\n }\n infoprint \"Indexes per database:\";\n foreach my $dbname ( select_user_dbs() ) {\n infoprint \"Database: \" . $dbname . \"\";\n $selIdxReq = <<\"ENDSQL\";\n SELECT concat(table_name, '.', index_name) AS idxname,\n GROUP_CONCAT(column_name ORDER BY seq_in_index) AS cols,\n SUM(CARDINALITY) as card,\n INDEX_TYPE as type\n FROM information_schema.statistics\n WHERE INDEX_SCHEMA='$dbname'\n AND index_name IS NOT NULL\n GROUP BY table_name, idxname, type\nENDSQL\n my $found = 0;\n foreach my $idxinfo ( select_array($selIdxReq) ) {\n my @info = split /\\s/, $idxinfo;\n next if $info[0] eq 'NULL';\n infoprint \" +-- INDEX : \" . $info[0];\n infoprint \" +-- COLUMNS : \" . $info[1];\n infoprint \" +-- CARDINALITY: \" . $info[2];\n infoprint \" +-- TYPE : \" . $info[4] if defined $info[4];\n infoprint \" +-- COMMENT : \" . $info[5] if defined $info[5];\n $found++;\n }\n my $nbTables = select_one(\n\"SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA='$dbname'\"\n );\n badprint \"No index found for $dbname database\"\n if $found == 0 and $nbTables > 1;\n push @generalrec, \"Add indexes on tables from $dbname database\"\n if $found == 0 and $nbTables > 1;\n }\n return\n unless ( defined( $myvar{'performance_schema'} )\n and $myvar{'performance_schema'} eq 'ON' );\n\n $selIdxReq = <<'ENDSQL';\nSELECT CONCAT(object_schema, '.', object_name) AS 'table', index_name\nFROM performance_schema.table_io_waits_summary_by_index_usage\nWHERE index_name IS NOT NULL\nAND count_star = 0\nAND index_name <> 'PRIMARY'\nAND object_schema NOT IN ('mysql', 'performance_schema', 'information_schema')\nORDER BY count_star, object_schema, object_name;\nENDSQL\n @idxinfo = select_array($selIdxReq);\n infoprint \"Unused indexes:\";\n push( @generalrec, \"Remove unused indexes.\" ) if ( scalar(@idxinfo) > 0 );\n foreach (@idxinfo) {\n debugprint \"$_\";\n my @info = split /\\s/;\n badprint \"Index: $info[1] on $info[0] is not used.\";\n push @{ $result{'Indexes'}{'Unused Indexes'} },\n $info[0] . \".\" . $info[1];\n }\n}\n\nsub mysql_views {\n subheaderprint \"Views Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Views metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n}\n\nsub mysql_routines {\n subheaderprint \"Routines Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Routines metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n}\n\nsub mysql_triggers {\n subheaderprint \"Triggers Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Trigger metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n}\n\n# Take the two recommendation arrays and display them at the end of the output\nsub make_recommendations {\n $result{'Recommendations'} = \\@generalrec;\n $result{'AdjustVariables'} = \\@adjvars;\n subheaderprint \"Recommendations\";\n if ( @generalrec > 0 ) {\n prettyprint \"General recommendations:\";\n foreach (@generalrec) { prettyprint \" \" . $_ . \"\"; }\n }\n if ( @adjvars > 0 ) {\n prettyprint \"Variables to adjust:\";\n if ( $mycalc{'pct_max_physical_memory'} > 90 ) {\n prettyprint\n \" *** MySQL's maximum memory usage is dangerously high ***\\n\"\n . \" *** Add RAM before increasing MySQL buffer variables ***\";\n }\n foreach (@adjvars) { prettyprint \" \" . $_ . \"\"; }\n }\n if ( @generalrec == 0 && @adjvars == 0 ) {\n prettyprint \"No additional performance recommendations are available.\";\n }\n}\n\nsub close_outputfile {\n close($fh) if defined($fh);\n}\n\nsub headerprint {\n prettyprint \" >> MySQLTuner $tunerversion\\n\"\n . \"\\t * Jean-Marie Renouard \\n\"\n . \"\\t * Major Hayden \\n\"\n . \" >> Bug reports, feature requests, and downloads at http://mysqltuner.pl/\\n\"\n . \" >> Run with '--help' for additional options and output filtering\";\n}\n\nsub string2file {\n my $filename = shift;\n my $content = shift;\n open my $fh, q(>), $filename\n or die\n\"Unable to open $filename in write mode. Please check permissions for this file or directory\";\n print $fh $content if defined($content);\n close $fh;\n debugprint $content if ( $opt{'debug'} );\n}\n\nsub file2array {\n my $filename = shift;\n debugprint \"* reading $filename\" if ( $opt{'debug'} );\n my $fh;\n open( $fh, q(<), \"$filename\" )\n or die \"Couldn't open $filename for reading: $!\\n\";\n my @lines = <$fh>;\n close($fh);\n return @lines;\n}\n\nsub file2string {\n return join( '', file2array(@_) );\n}\n\nmy $templateModel;\nif ( $opt{'template'} ne 0 ) {\n $templateModel = file2string( $opt{'template'} );\n}\nelse {\n # DEFAULT REPORT TEMPLATE\n $templateModel = <<'END_TEMPLATE';\n\n\n\n MySQLTuner Report\n \n\n\n\n

Result output

\n
\n{$data}\n
\n\n\n\nEND_TEMPLATE\n}\n\nsub dump_result {\n\n #debugprint Dumper( \\%result ) if ( $opt{'debug'} );\n debugprint \"HTML REPORT: $opt{'reportfile'}\";\n\n if ( $opt{'reportfile'} ne 0 ) {\n eval { require Text::Template };\n eval { require JSON };\n if ($@) {\n badprint \"Text::Template Module is needed.\";\n die \"Text::Template Module is needed.\";\n }\n\n my $json = JSON->new->allow_nonref;\n my $json_text = $json->pretty->encode( \\%result );\n my %vars = (\n 'data' => \\%result,\n 'debug' => $json_text,\n );\n my $template;\n {\n no warnings 'once';\n $template = Text::Template->new(\n TYPE => 'STRING',\n PREPEND => q{;},\n SOURCE => $templateModel,\n DELIMITERS => [ '[%', '%]' ]\n ) or die \"Couldn't construct template: $Text::Template::ERROR\";\n }\n\n open my $fh, q(>), $opt{'reportfile'}\n or die\n\"Unable to open $opt{'reportfile'} in write mode. please check permissions for this file or directory\";\n $template->fill_in( HASH => \\%vars, OUTPUT => $fh );\n close $fh;\n }\n\n if ( $opt{'json'} ne 0 ) {\n eval { require JSON };\n if ($@) {\n print \"$bad JSON Module is needed.\\n\";\n return 1;\n }\n\n my $json = JSON->new->allow_nonref;\n print $json->utf8(1)->pretty( ( $opt{'prettyjson'} ? 1 : 0 ) )\n ->encode( \\%result );\n\n if ( $opt{'outputfile'} ne 0 ) {\n unlink $opt{'outputfile'} if ( -e $opt{'outputfile'} );\n open my $fh, q(>), $opt{'outputfile'}\n or die\n\"Unable to open $opt{'outputfile'} in write mode. please check permissions for this file or directory\";\n print $fh $json->utf8(1)->pretty( ( $opt{'prettyjson'} ? 1 : 0 ) )\n ->encode( \\%result );\n close $fh;\n }\n }\n}\n\nsub which {\n my $prog_name = shift;\n my $path_string = shift;\n my @path_array = split /:/, $ENV{'PATH'};\n\n for my $path (@path_array) {\n return \"$path/$prog_name\" if ( -x \"$path/$prog_name\" );\n }\n\n return 0;\n}\n\n# ---------------------------------------------------------------------------\n# BEGIN 'MAIN'\n# ---------------------------------------------------------------------------\nheaderprint; # Header Print\n\nvalidate_tuner_version; # Check latest version\nmysql_setup; # Gotta login first\ndebugprint \"MySQL FINAL Client : $mysqlcmd $mysqllogin\";\ndebugprint \"MySQL Admin FINAL Client : $mysqladmincmd $mysqllogin\";\n\n#exit(0);\nos_setup; # Set up some OS variables\nget_all_vars; # Toss variables/status into hashes\nget_tuning_info; # Get information about the tuning connection\ncalculations; # Calculate everything we need\ncheck_architecture; # Suggest 64-bit upgrade\ncheck_storage_engines; # Show enabled storage engines\nif ( $opt{'feature'} ne '' ) {\n subheaderprint \"See FEATURES.md for more information\";\n no strict 'refs';\n for my $feature ( split /,/, $opt{'feature'} ) {\n subheaderprint \"Running feature: $opt{'feature'}\";\n $feature->();\n }\n make_recommendations;\n exit(0);\n}\nvalidate_mysql_version; # Check current MySQL version\n\nsystem_recommendations; # Avoid too many services on the same host\nlog_file_recommendations; # check log file content\n\ncheck_metadata_perf; # Show parameter impacting performance during analysis\nmysql_databases; # Show information about databases\nmysql_tables; # Show information about table column\nmysql_table_structures; # Show information about table structures\n\nmysql_indexes; # Show information about indexes\nmysql_views; # Show information about views\nmysql_triggers; # Show information about triggers\nmysql_routines; # Show information about routines\nsecurity_recommendations; # Display some security recommendations\ncve_recommendations; # Display related CVE\n\nmysql_stats; # Print the server stats\nmysql_pfs; # Print Performance schema info\n\nmariadb_threadpool; # Print MariaDB ThreadPool stats\nmysql_myisam; # Print MyISAM stats\nmysql_innodb; # Print InnoDB stats\nmariadb_aria; # Print MariaDB Aria stats\nmariadb_tokudb; # Print MariaDB Tokudb stats\nmariadb_xtradb; # Print MariaDB XtraDB stats\n\n#mariadb_rockdb; # Print MariaDB RockDB stats\n#mariadb_spider; # Print MariaDB Spider stats\n#mariadb_connect; # Print MariaDB Connect stats\nmariadb_galera; # Print MariaDB Galera Cluster stats\nget_replication_status; # Print replication info\nmake_recommendations; # Make recommendations based on stats\ndump_result; # Dump result if debug is on\nclose_outputfile; # Close reportfile if needed\n\n# ---------------------------------------------------------------------------\n# END 'MAIN'\n# ---------------------------------------------------------------------------\n1;\n\n__END__\n\n=pod\n\n=encoding UTF-8\n\n=head1 NAME\n\n MySQLTuner 2.5.2 - MySQL High Performance Tuning Script\n\n=head1 IMPORTANT USAGE GUIDELINES\n\nTo run the script with the default options, run the script without arguments\nAllow MySQL server to run for at least 24-48 hours before trusting suggestions\nSome routines may require root level privileges (script will provide warnings)\nYou must provide the remote server's total memory when connecting to other servers\n\n=head1 CONNECTION AND AUTHENTICATION\n\n --host Connect to a remote host to perform tests (default: localhost)\n --socket Use a different socket for a local connection\n --port Port to use for connection (default: 3306)\n --protocol tcp Force TCP connection instead of socket\n --user Username to use for authentication\n --userenv Name of env variable which contains username to use for authentication\n --pass Password to use for authentication\n --passenv Name of env variable which contains password to use for authentication\n --ssl-ca Path to public key\n --mysqladmin Path to a custom mysqladmin executable\n --mysqlcmd Path to a custom mysql executable\n --defaults-file Path to a custom .my.cnf\n --defaults-extra-file Path to an extra custom config file\n --server-log Path to explicit log file (error_log)\n\n=head1 PERFORMANCE AND REPORTING OPTIONS\n\n --skipsize Don't enumerate tables and their types/sizes (default: on)\n (Recommended for servers with many tables)\n --json Print result as JSON string\n --prettyjson Print result as JSON formatted string\n --skippassword Don't perform checks on user passwords (default: off)\n --checkversion Check for updates to MySQLTuner (default: don't check)\n --updateversion Check for updates to MySQLTuner and update when newer version is available (default: don't check)\n --forcemem Amount of RAM installed in megabytes\n --forceswap Amount of swap memory configured in megabytes\n --passwordfile Path to a password file list (one password by line)\n --cvefile CVE File for vulnerability checks\n --outputfile Path to a output txt file\n --reportfile Path to a report txt file\n --template Path to a template file\n --dumpdir Path to a directory where to dump information files\n --feature Run a specific feature (see FEATURES section)\n=head1 OUTPUT OPTIONS\n\n --silent Don't output anything on screen\n --verbose Print out all options (default: no verbose, dbstat, idxstat, sysstat, tbstat, pfstat)\n --color Print output in color\n --nocolor Don't print output in color\n --nogood Remove OK responses\n --nobad Remove negative/suggestion responses\n --noinfo Remove informational responses\n --debug Print debug information\n --noprocess Consider no other process is running\n --dbstat Print database information\n --nodbstat Don't print database information\n --tbstat Print table information\n --notbstat Don't print table information\n --colstat Print column information\n --nocolstat Don't print column information\n --idxstat Print index information\n --noidxstat Don't print index information\n --nomyisamstat Don't print MyIsam information\n --sysstat Print system information\n --nosysstat Don't print system information\n --nostructstat Don't print table structures information\n --pfstat Print Performance schema\n --nopfstat Don't print Performance schema\n --bannedports Ports banned separated by comma (,)\n --server-log Define specific error_log to analyze\n --maxportallowed Number of open ports allowable on this host\n --buffers Print global and per-thread buffer values\n\n=head1 PERLDOC\n\nYou can find documentation for this module with the perldoc command.\n\n perldoc mysqltuner\n\n=head2 INTERNALS\n\nL\n\n Internal documentation\n\n=head1 AUTHORS\n\nMajor Hayden - major@mhtx.net\nJean-Marie Renouard - jmrenouard@gmail.com\n\n=head1 CONTRIBUTORS\n\n=over 4\n\n=item *\n\nMatthew Montgomery\n\n=item *\n\nPaul Kehrer\n\n=item *\n\nDave Burgess\n\n=item *\n\nJonathan Hinds\n\n=item *\n\nMike Jackson\n\n=item *\n\nNils Breunese\n\n=item *\n\nShawn Ashlee\n\n=item *\n\nLuuk Vosslamber\n\n=item *\n\nVille Skytta\n\n=item *\n\nTrent Hornibrook\n\n=item *\n\nJason Gill\n\n=item *\n\nMark Imbriaco\n\n=item *\n\nGreg Eden\n\n=item *\n\nAubin Galinotti\n\n=item *\n\nGiovanni Bechis\n\n=item *\n\nBill Bradford\n\n=item *\n\nRyan Novosielski\n\n=item *\n\nMichael Scheidell\n\n=item *\n\nBlair Christensen\n\n=item *\n\nHans du Plooy\n\n=item *\n\nVictor Trac\n\n=item *\n\nEverett Barnes\n\n=item *\n\nTom Krouper\n\n=item *\n\nGary Barrueto\n\n=item *\n\nSimon Greenaway\n\n=item *\n\nAdam Stein\n\n=item *\n\nIsart Montane\n\n=item *\n\nBaptiste M.\n\n=item *\n\nCole Turner\n\n=item *\n\nMajor Hayden\n\n=item *\n\nJoe Ashcraft\n\n=item *\n\nJean-Marie Renouard\n\n=item *\n\nStephan GroBberndt\n\n=item *\n\nChristian Loos\n\n=item *\n\nLong Radix\n\n=back\n\n=head1 SUPPORT\n\n\nBug reports, feature requests, and downloads at http://mysqltuner.pl/\n\nBug tracker can be found at https://github.com/major/MySQLTuner-perl/issues\n\nMaintained by Jean-Marie Renouard (jmrenouard\\@gmail.com) - Licensed under GPL\n\n=head1 SOURCE CODE\n\nL\n\n git clone https://github.com/major/MySQLTuner-perl.git\n\n=head1 COPYRIGHT AND LICENSE\n\nCopyright (C) 2006-2023 Major Hayden - major@mhtx.net\n# Copyright (C) 2015-2023 Jean-Marie Renouard - jmrenouard@gmail.com\n\nFor the latest updates, please visit http://mysqltuner.pl/\n\nGit repository available at https://github.com/major/MySQLTuner-perl\n\nThis program is free software: you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation, either version 3 of the License, or\n(at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\n See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with this program. If not, see .\n\n=cut\n\n# Local variables:\n# indent-tabs-mode: t\n# cperl-indent-level: 8\n# perl-indent-level: 8\n# End:\n" }, { "path": "aegir/helpers/mysqltuner8", "content": "#!/usr/bin/env perl\n# mysqltuner.pl - Version 2.6.0\n# High Performance MySQL Tuning Script\n# Copyright (C) 2015-2023 Jean-Marie Renouard - jmrenouard@gmail.com\n# Copyright (C) 2006-2023 Major Hayden - major@mhtx.net\n\n# For the latest updates, please visit http://mysqltuner.pl/\n# Git repository available at https://github.com/major/MySQLTuner-perl\n#\n# This program is free software: you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation, either version 3 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program. If not, see .\n#\n# This project would not be possible without help from:\n# Matthew Montgomery Paul Kehrer Dave Burgess\n# Jonathan Hinds Mike Jackson Nils Breunese\n# Shawn Ashlee Luuk Vosslamber Ville Skytta\n# Trent Hornibrook Jason Gill Mark Imbriaco\n# Greg Eden Aubin Galinotti Giovanni Bechis\n# Bill Bradford Ryan Novosielski Michael Scheidell\n# Blair Christensen Hans du Plooy Victor Trac\n# Everett Barnes Tom Krouper Gary Barrueto\n# Simon Greenaway Adam Stein Isart Montane\n# Baptiste M. Cole Turner Major Hayden\n# Joe Ashcraft Jean-Marie Renouard Christian Loos\n# Julien Francoz Daniel Black Long Radix\n#\n# Inspired by Matthew Montgomery's tuning-primer.sh script:\n# http://www.day32.com/MySQL/\n#\npackage main;\n\nuse 5.005;\nuse strict;\nuse warnings;\n\nuse diagnostics;\nuse File::Spec;\nuse Getopt::Long;\nuse Pod::Usage;\nuse File::Basename;\nuse Cwd 'abs_path';\n\n#use Data::Dumper;\n#$Data::Dumper::Pair = \" : \";\n\n# for which()\n#use Env;\n\n# Set up a few variables for use in the script\nmy $tunerversion = \"2.6.0\";\nmy ( @adjvars, @generalrec );\n\n# Set defaults\nmy %opt = (\n \"silent\" => 0,\n \"nobad\" => 0,\n \"nogood\" => 0,\n \"noinfo\" => 0,\n \"debug\" => 0,\n \"nocolor\" => ( !-t STDOUT ),\n \"color\" => ( -t STDOUT ),\n \"forcemem\" => 0,\n \"forceswap\" => 0,\n \"host\" => 0,\n \"socket\" => 0,\n \"port\" => 0,\n \"user\" => 0,\n \"pass\" => 0,\n \"password\" => 0,\n \"ssl-ca\" => 0,\n \"skipsize\" => 0,\n \"checkversion\" => 0,\n \"updateversion\" => 0,\n \"buffers\" => 0,\n \"passwordfile\" => 0,\n \"bannedports\" => '',\n \"maxportallowed\" => 0,\n \"outputfile\" => 0,\n \"noprocess\" => 0,\n \"dbstat\" => 0,\n \"nodbstat\" => 0,\n \"server-log\" => '',\n \"tbstat\" => 0,\n \"notbstat\" => 0,\n \"colstat\" => 0,\n \"nocolstat\" => 0,\n \"idxstat\" => 0,\n \"noidxstat\" => 0,\n \"nomyisamstat\" => 0,\n \"nostructstat\" => 0,\n \"sysstat\" => 0,\n \"nosysstat\" => 0,\n \"pfstat\" => 0,\n \"nopfstat\" => 0,\n \"skippassword\" => 0,\n \"noask\" => 0,\n \"template\" => 0,\n \"json\" => 0,\n \"prettyjson\" => 0,\n \"reportfile\" => 0,\n \"verbose\" => 0,\n \"experimental\" => 0,\n \"nondedicated\" => 0,\n \"defaults-file\" => '',\n \"defaults-extra-file\" => '',\n \"protocol\" => '',\n \"dumpdir\" => '',\n \"feature\" => '',\n \"dbgpattern\" => '',\n \"defaultarch\" => 64\n);\n\n# Gather the options from the command line\nGetOptions(\n \\%opt, 'nobad',\n 'nogood', 'noinfo',\n 'debug', 'nocolor',\n 'forcemem=i', 'forceswap=i',\n 'host=s', 'socket=s',\n 'port=i', 'user=s',\n 'pass=s', 'skipsize',\n 'checkversion', 'mysqladmin=s',\n 'mysqlcmd=s', 'help',\n 'buffers', 'skippassword',\n 'passwordfile=s', 'outputfile=s',\n 'silent', 'noask',\n 'json', 'prettyjson',\n 'template=s', 'reportfile=s',\n 'cvefile=s', 'bannedports=s',\n 'updateversion', 'maxportallowed=s',\n 'verbose', 'password=s',\n 'passenv=s', 'userenv=s',\n 'defaults-file=s', 'ssl-ca=s',\n 'color', 'noprocess',\n 'dbstat', 'nodbstat',\n 'tbstat', 'notbstat',\n 'colstat', 'nocolstat',\n 'sysstat', 'nosysstat',\n 'pfstat', 'nopfstat',\n 'idxstat', 'noidxstat',\n 'structstat', 'nostructstat',\n 'myisamstat', 'nomyisamstat',\n 'server-log=s', 'protocol=s',\n 'defaults-extra-file=s', 'dumpdir=s',\n 'feature=s', 'dbgpattern=s',\n 'defaultarch=i', 'experimental',\n 'nondedicated'\n )\n or pod2usage(\n -exitval => 1,\n -verbose => 99,\n -sections => [\n \"NAME\",\n \"IMPORTANT USAGE GUIDELINES\",\n \"CONNECTION AND AUTHENTICATION\",\n \"PERFORMANCE AND REPORTING OPTIONS\",\n \"OUTPUT OPTIONS\"\n ]\n );\n\nif ( defined $opt{'help'} && $opt{'help'} == 1 ) {\n pod2usage(\n -exitval => 0,\n -verbose => 99,\n -sections => [\n \"NAME\",\n \"IMPORTANT USAGE GUIDELINES\",\n \"CONNECTION AND AUTHENTICATION\",\n \"PERFORMANCE AND REPORTING OPTIONS\",\n \"OUTPUT OPTIONS\"\n ]\n );\n}\n\nmy $devnull = File::Spec->devnull();\nmy $basic_password_files =\n ( $opt{passwordfile} eq \"0\" )\n ? abs_path( dirname(__FILE__) ) . \"/basic_passwords.txt\"\n : abs_path( $opt{passwordfile} );\n\n# Username from envvar\nif ( exists $opt{userenv} && exists $ENV{ $opt{userenv} } ) {\n $opt{user} = $ENV{ $opt{userenv} };\n}\n\n# Related to password option\nif ( exists $opt{passenv} && exists $ENV{ $opt{passenv} } ) {\n $opt{pass} = $ENV{ $opt{passenv} };\n}\n$opt{pass} = $opt{password} if ( $opt{pass} eq 0 and $opt{password} ne 0 );\n\nif ( $opt{dumpdir} ne '' ) {\n $opt{dumpdir} = abs_path( $opt{dumpdir} );\n if ( !-d $opt{dumpdir} ) {\n mkdir $opt{dumpdir} or die \"Cannot create directory $opt{dumpdir}: $!\";\n }\n}\n\n# for RPM distributions\n$basic_password_files = \"/usr/share/mysqltuner/basic_passwords.txt\"\n unless -f \"$basic_password_files\";\n\n$opt{dbgpattern} = '.*' if ( $opt{dbgpattern} eq '' );\n\n# Activate debug variables\n#if ( $opt{debug} ne '' ) { $opt{debug} = 2; }\n# Activate experimental calculations and analysis\n#if ( $opt{experimental} ne '' ) { $opt{experimental} = 1; }\n\n# check if we need to enable verbose mode\nif ( $opt{feature} ne '' ) { $opt{verbose} = 1; }\nif ( $opt{verbose} ) {\n $opt{checkversion} = 0; # Check for updates to MySQLTuner\n $opt{dbstat} = 1; # Print database information\n $opt{tbstat} = 1; # Print database information\n $opt{idxstat} = 1; # Print index information\n $opt{sysstat} = 1; # Print index information\n $opt{buffers} = 1; # Print global and per-thread buffer values\n $opt{pfstat} = 1; # Print performance schema info.\n $opt{structstat} = 1; # Print table structure information\n $opt{myisamstat} = 1; # Print MyISAM table information\n\n $opt{cvefile} = 'vulnerabilities.csv'; #CVE File for vulnerability checks\n}\n$opt{nocolor} = 1 if defined( $opt{outputfile} );\n$opt{tbstat} = 0 if ( $opt{notbstat} == 1 ); # Don't print table information\n$opt{colstat} = 0 if ( $opt{nocolstat} == 1 ); # Don't print column information\n$opt{dbstat} = 0 if ( $opt{nodbstat} == 1 ); # Don't print database information\n$opt{noprocess} = 0\n if ( $opt{noprocess} == 1 ); # Don't print process information\n$opt{sysstat} = 0 if ( $opt{nosysstat} == 1 ); # Don't print sysstat information\n$opt{pfstat} = 0\n if ( $opt{nopfstat} == 1 ); # Don't print performance schema information\n$opt{idxstat} = 0 if ( $opt{noidxstat} == 1 ); # Don't print index information\n$opt{structstat} = 0\n if ( not defined( $opt{structstat} ) or $opt{nostructstat} == 1 )\n ; # Don't print table struct information\n$opt{myisamstat} = 1\n if ( not defined( $opt{myisamstat} ) );\n$opt{myisamstat} = 0\n if ( $opt{nomyisamstat} == 1 ); # Don't print MyISAM table information\n\n# for RPM distributions\n$opt{cvefile} = \"/usr/share/mysqltuner/vulnerabilities.csv\"\n unless ( defined $opt{cvefile} and -f \"$opt{cvefile}\" );\n$opt{cvefile} = '' unless -f \"$opt{cvefile}\";\n$opt{cvefile} = './vulnerabilities.csv' if -f './vulnerabilities.csv';\n\n$opt{'bannedports'} = '' unless defined( $opt{'bannedports'} );\nmy @banned_ports = split ',', $opt{'bannedports'};\n\n#\nmy $outputfile = undef;\n$outputfile = abs_path( $opt{outputfile} ) unless $opt{outputfile} eq \"0\";\n\nmy $fh = undef;\nopen( $fh, '>', $outputfile )\n or die(\"Fail opening $outputfile\")\n if defined($outputfile);\n$opt{nocolor} = 1 if defined($outputfile);\n$opt{nocolor} = 1 unless ( -t STDOUT );\n\n$opt{nocolor} = 0 if ( $opt{color} == 1 );\n\n# Setting up the colors for the print styles\nmy $me = `whoami`;\n$me =~ s/\\n//g;\nmy $good = ( $opt{nocolor} == 0 ) ? \"[\\e[0;32mOK\\e[0m]\" : \"[OK]\";\nmy $bad = ( $opt{nocolor} == 0 ) ? \"[\\e[0;31m!!\\e[0m]\" : \"[!!]\";\nmy $info = ( $opt{nocolor} == 0 ) ? \"[\\e[0;34m--\\e[0m]\" : \"[--]\";\nmy $deb = ( $opt{nocolor} == 0 ) ? \"[\\e[0;31mDG\\e[0m]\" : \"[DG]\";\nmy $cmd = ( $opt{nocolor} == 0 ) ? \"\\e[1;32m[CMD]($me)\" : \"[CMD]($me)\";\nmy $end = ( $opt{nocolor} == 0 ) ? \"\\e[0m\" : \"\";\n\n# Maximum lines of log output to read from end\nmy $maxlines = 30000;\n\n# Checks for supported or EOL'ed MySQL versions\nmy ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro );\n\n# Database\nmy @dblist;\n\n# Super structure containing all information\nmy %result;\n$result{'MySQLTuner'}{'version'} = $tunerversion;\n$result{'MySQLTuner'}{'datetime'} = `date '+%d-%m-%Y %H:%M:%S'`;\n$result{'MySQLTuner'}{'options'} = \\%opt;\n\n# Functions that handle the print styles\nsub prettyprint {\n print $_[0] . \"\\n\" unless ( $opt{'silent'} or $opt{'json'} );\n print $fh $_[0] . \"\\n\" if defined($fh);\n}\n\nsub goodprint {\n prettyprint $good. \" \" . $_[0] unless ( $opt{nogood} == 1 );\n}\n\nsub infoprint {\n prettyprint $info. \" \" . $_[0] unless ( $opt{noinfo} == 1 );\n}\n\nsub badprint {\n prettyprint $bad. \" \" . $_[0] unless ( $opt{nobad} == 1 );\n}\n\nsub debugprint {\n prettyprint $deb. \" \" . $_[0] unless ( $opt{debug} == 0 );\n}\n\nsub redwrap {\n return ( $opt{nocolor} == 0 ) ? \"\\e[0;31m\" . $_[0] . \"\\e[0m\" : $_[0];\n}\n\nsub greenwrap {\n return ( $opt{nocolor} == 0 ) ? \"\\e[0;32m\" . $_[0] . \"\\e[0m\" : $_[0];\n}\n\nsub cmdprint {\n prettyprint $cmd. \" \" . $_[0] . $end;\n}\n\nsub infoprintml {\n for my $ln (@_) { $ln =~ s/\\n//g; infoprint \"\\t$ln\"; }\n}\n\nsub infoprintcmd {\n cmdprint \"@_\";\n infoprintml grep { $_ ne '' and $_ !~ /^\\s*$/ } `@_ 2>&1`;\n}\n\nsub subheaderprint {\n my $tln = 100;\n my $sln = 8;\n my $ln = length(\"@_\") + 2;\n\n prettyprint \" \";\n prettyprint \"-\" x $sln . \" @_ \" . \"-\" x ( $tln - $ln - $sln );\n}\n\nsub infoprinthcmd {\n subheaderprint \"$_[0]\";\n infoprintcmd \"$_[1]\";\n}\n\nsub is_remote() {\n my $host = $opt{'host'};\n return 0 if ( $host eq '' );\n return 0 if ( $host eq 'localhost' );\n return 0 if ( $host eq '127.0.0.1' );\n return 1;\n}\n\nsub is_int {\n return 0 unless defined $_[0];\n my $str = $_[0];\n\n #trim whitespace both sides\n $str =~ s/^\\s+|\\s+$//g;\n\n #Alternatively, to match any float-like numeric, use:\n # m/^([+-]?)(?=\\d|\\.\\d)\\d*(\\.\\d*)?([Ee]([+-]?\\d+))?$/\n\n #flatten to string and match dash or plus and one or more digits\n if ( $str =~ /^(\\-|\\+)?\\d+?$/ ) {\n return 1;\n }\n return 0;\n}\n\n# Calculates the number of physical cores considering HyperThreading\nsub cpu_cores {\n if ( $^O eq 'linux' ) {\n my $cntCPU =\n`awk -F: '/^core id/ && !P[\\$2] { CORES++; P[\\$2]=1 }; /^physical id/ && !N[\\$2] { CPUs++; N[\\$2]=1 }; END { print CPUs*CORES }' /proc/cpuinfo`;\n chomp $cntCPU;\n return ( $cntCPU == 0 ? `nproc` : $cntCPU );\n }\n\n if ( $^O eq 'freebsd' ) {\n my $cntCPU = `sysctl -n kern.smp.cores`;\n chomp $cntCPU;\n return $cntCPU + 0;\n }\n return 0;\n}\n\n# Calculates the parameter passed in bytes, then rounds it to one decimal place\nsub hr_bytes {\n my $num = shift;\n return \"0B\" unless defined($num);\n return \"0B\" if $num eq \"NULL\";\n return \"0B\" if $num eq \"\";\n\n if ( $num >= ( 1024**3 ) ) { # GB\n return sprintf( \"%.1f\", ( $num / ( 1024**3 ) ) ) . \"G\";\n }\n elsif ( $num >= ( 1024**2 ) ) { # MB\n return sprintf( \"%.1f\", ( $num / ( 1024**2 ) ) ) . \"M\";\n }\n elsif ( $num >= 1024 ) { # KB\n return sprintf( \"%.1f\", ( $num / 1024 ) ) . \"K\";\n }\n else {\n return $num . \"B\";\n }\n}\n\nsub hr_raw {\n my $num = shift;\n return \"0\" unless defined($num);\n return \"0\" if $num eq \"NULL\";\n if ( $num =~ /^(\\d+)G$/ ) {\n return $1 * 1024 * 1024 * 1024;\n }\n if ( $num =~ /^(\\d+)M$/ ) {\n return $1 * 1024 * 1024;\n }\n if ( $num =~ /^(\\d+)K$/ ) {\n return $1 * 1024;\n }\n if ( $num =~ /^(\\d+)$/ ) {\n return $1;\n }\n return $num;\n}\n\n# Calculates the parameter passed in bytes, then rounds it to the nearest integer\nsub hr_bytes_rnd {\n my $num = shift;\n return \"0B\" unless defined($num);\n return \"0B\" if $num eq \"NULL\";\n\n if ( $num >= ( 1024**3 ) ) { # GB\n return int( ( $num / ( 1024**3 ) ) ) . \"G\";\n }\n elsif ( $num >= ( 1024**2 ) ) { # MB\n return int( ( $num / ( 1024**2 ) ) ) . \"M\";\n }\n elsif ( $num >= 1024 ) { # KB\n return int( ( $num / 1024 ) ) . \"K\";\n }\n else {\n return $num . \"B\";\n }\n}\n\n# Calculates the parameter passed to the nearest power of 1000, then rounds it to the nearest integer\nsub hr_num {\n my $num = shift;\n if ( $num >= ( 1000**3 ) ) { # Billions\n return int( ( $num / ( 1000**3 ) ) ) . \"B\";\n }\n elsif ( $num >= ( 1000**2 ) ) { # Millions\n return int( ( $num / ( 1000**2 ) ) ) . \"M\";\n }\n elsif ( $num >= 1000 ) { # Thousands\n return int( ( $num / 1000 ) ) . \"K\";\n }\n else {\n return $num;\n }\n}\n\n# Calculate Percentage\nsub percentage {\n my $value = shift;\n my $total = shift;\n $total = 0 unless defined $total;\n $total = 0 if $total eq \"NULL\";\n return 100, 00 if $total == 0;\n return sprintf( \"%.2f\", ( $value * 100 / $total ) );\n}\n\n# Calculates uptime to display in a human-readable form\nsub pretty_uptime {\n my $uptime = shift;\n my $seconds = $uptime % 60;\n my $minutes = int( ( $uptime % 3600 ) / 60 );\n my $hours = int( ( $uptime % 86400 ) / (3600) );\n my $days = int( $uptime / (86400) );\n my $uptimestring;\n if ( $days > 0 ) {\n $uptimestring = \"${days}d ${hours}h ${minutes}m ${seconds}s\";\n }\n elsif ( $hours > 0 ) {\n $uptimestring = \"${hours}h ${minutes}m ${seconds}s\";\n }\n elsif ( $minutes > 0 ) {\n $uptimestring = \"${minutes}m ${seconds}s\";\n }\n else {\n $uptimestring = \"${seconds}s\";\n }\n return $uptimestring;\n}\n\n# Retrieves the memory installed on this machine\nmy ( $physical_memory, $swap_memory, $duflags, $xargsflags );\n\nsub memerror {\n badprint\n\"Unable to determine total memory/swap; use '--forcemem' and '--forceswap'\";\n exit 1;\n}\n\nsub os_setup {\n my $os = `uname`;\n $duflags = ( $os =~ /Linux/ ) ? '-b' : '';\n $xargsflags = ( $os =~ /Darwin|SunOS/ ) ? '' : '-r';\n if ( $opt{'forcemem'} > 0 ) {\n $physical_memory = $opt{'forcemem'} * 1048576;\n infoprint \"Assuming $opt{'forcemem'} MB of physical memory\";\n if ( $opt{'forceswap'} > 0 ) {\n $swap_memory = $opt{'forceswap'} * 1048576;\n infoprint \"Assuming $opt{'forceswap'} MB of swap space\";\n }\n else {\n $swap_memory = 0;\n badprint \"Assuming 0 MB of swap space (use --forceswap to specify)\";\n }\n }\n else {\n if ( $os =~ /Linux|CYGWIN/ ) {\n $physical_memory =\n `grep -i memtotal: /proc/meminfo | awk '{print \\$2}'`\n or memerror;\n $physical_memory *= 1024;\n\n $swap_memory =\n `grep -i swaptotal: /proc/meminfo | awk '{print \\$2}'`\n or memerror;\n $swap_memory *= 1024;\n }\n elsif ( $os =~ /Darwin/ ) {\n $physical_memory = `sysctl -n hw.memsize` or memerror;\n $swap_memory =\n `sysctl -n vm.swapusage | awk '{print \\$3}' | sed 's/\\..*\\$//'`\n or memerror;\n }\n elsif ( $os =~ /NetBSD|OpenBSD|FreeBSD/ ) {\n $physical_memory = `sysctl -n hw.physmem` or memerror;\n if ( $physical_memory < 0 ) {\n $physical_memory = `sysctl -n hw.physmem64` or memerror;\n }\n $swap_memory =\n `swapctl -l | grep '^/' | awk '{ s+= \\$2 } END { print s }'`\n or memerror;\n }\n elsif ( $os =~ /BSD/ ) {\n $physical_memory = `sysctl -n hw.realmem` or memerror;\n $swap_memory =\n `swapinfo | grep '^/' | awk '{ s+= \\$2 } END { print s }'`;\n }\n elsif ( $os =~ /SunOS/ ) {\n $physical_memory =\n `/usr/sbin/prtconf | grep Memory | cut -f 3 -d ' '`\n or memerror;\n chomp($physical_memory);\n $physical_memory = $physical_memory * 1024 * 1024;\n }\n elsif ( $os =~ /AIX/ ) {\n $physical_memory =\n `lsattr -El sys0 | grep realmem | awk '{print \\$2}'`\n or memerror;\n chomp($physical_memory);\n $physical_memory = $physical_memory * 1024;\n $swap_memory = `lsps -as | awk -F\"(MB| +)\" '/MB /{print \\$2}'`\n or memerror;\n chomp($swap_memory);\n $swap_memory = $swap_memory * 1024 * 1024;\n }\n elsif ( $os =~ /windows/i ) {\n $physical_memory =\n`wmic ComputerSystem get TotalPhysicalMemory | perl -ne \"chomp; print if /[0-9]+/;\"`\n or memerror;\n $swap_memory =\n`wmic OS get FreeVirtualMemory | perl -ne \"chomp; print if /[0-9]+/;\"`\n or memerror;\n }\n }\n debugprint \"Physical Memory: $physical_memory\";\n debugprint \"Swap Memory: $swap_memory\";\n chomp($physical_memory);\n chomp($swap_memory);\n chomp($os);\n $physical_memory = $opt{forcemem}\n if ( defined( $opt{forcemem} ) and $opt{forcemem} gt 0 );\n $result{'OS'}{'OS Type'} = $os;\n $result{'OS'}{'Physical Memory'}{'bytes'} = $physical_memory;\n $result{'OS'}{'Physical Memory'}{'pretty'} = hr_bytes($physical_memory);\n $result{'OS'}{'Swap Memory'}{'bytes'} = $swap_memory;\n $result{'OS'}{'Swap Memory'}{'pretty'} = hr_bytes($swap_memory);\n $result{'OS'}{'Other Processes'}{'bytes'} = get_other_process_memory();\n $result{'OS'}{'Other Processes'}{'pretty'} =\n hr_bytes( get_other_process_memory() );\n}\n\nsub get_http_cli {\n my $httpcli = which( \"curl\", $ENV{'PATH'} );\n chomp($httpcli);\n if ($httpcli) {\n return $httpcli;\n }\n\n $httpcli = which( \"wget\", $ENV{'PATH'} );\n chomp($httpcli);\n if ($httpcli) {\n return $httpcli;\n }\n return \"\";\n}\n\n# Checks for updates to MySQLTuner\nsub validate_tuner_version {\n if ( $opt{'checkversion'} eq 0 ) {\n print \"\\n\" unless ( $opt{'silent'} or $opt{'json'} );\n infoprint \"Skipped version check for MySQLTuner script\";\n return;\n }\n\n my $update;\n my $url =\n\"https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl\";\n my $httpcli = get_http_cli();\n if ( $httpcli =~ /curl$/ ) {\n debugprint \"$httpcli is available.\";\n\n debugprint\n\"$httpcli -m 3 -silent '$url' 2>/dev/null | grep 'my \\$tunerversion'| cut -d\\\\\\\" -f2\";\n $update =\n`$httpcli -m 3 -silent '$url' 2>/dev/null | grep 'my \\$tunerversion'| cut -d\\\\\\\" -f2`;\n chomp($update);\n debugprint \"VERSION: $update\";\n\n compare_tuner_version($update);\n return;\n }\n\n if ( $httpcli =~ /wget$/ ) {\n debugprint \"$httpcli is available.\";\n\n debugprint\n\"$httpcli -e timestamping=off -t 1 -T 3 -O - '$url' 2>$devnull| grep 'my \\$tunerversion'| cut -d\\\\\\\" -f2\";\n $update =\n`$httpcli -e timestamping=off -t 1 -T 3 -O - '$url' 2>$devnull| grep 'my \\$tunerversion'| cut -d\\\\\\\" -f2`;\n chomp($update);\n compare_tuner_version($update);\n return;\n }\n debugprint \"curl and wget are not available.\";\n infoprint \"Unable to check for the latest MySQLTuner version\";\n infoprint\n\"Using --pass and --password option is insecure during MySQLTuner execution (password disclosure)\"\n if ( defined( $opt{'pass'} ) );\n}\n\n# Checks for updates to MySQLTuner\nsub update_tuner_version {\n if ( $opt{'updateversion'} eq 0 ) {\n badprint \"Skipped version update for MySQLTuner script\";\n print \"\\n\" unless ( $opt{'silent'} or $opt{'json'} );\n return;\n }\n\n my $update;\n my $fullpath = \"\";\n my $url = \"https://raw.githubusercontent.com/major/MySQLTuner-perl/master/\";\n my @scripts =\n ( \"mysqltuner.pl\", \"basic_passwords.txt\", \"vulnerabilities.csv\" );\n my $totalScripts = scalar(@scripts);\n my $receivedScripts = 0;\n my $httpcli = get_http_cli();\n\n foreach my $script (@scripts) {\n\n if ( $httpcli =~ /curl$/ ) {\n debugprint \"$httpcli is available.\";\n\n $fullpath = dirname(__FILE__) . \"/\" . $script;\n debugprint \"FullPath: $fullpath\";\n debugprint\n\"$httpcli --connect-timeout 3 '$url$script' 2>$devnull > $fullpath\";\n $update =\n`$httpcli --connect-timeout 3 '$url$script' 2>$devnull > $fullpath`;\n chomp($update);\n debugprint \"$script updated: $update\";\n\n if ( -s $script eq 0 ) {\n badprint \"Couldn't update $script\";\n }\n else {\n ++$receivedScripts;\n debugprint \"$script updated: $update\";\n }\n }\n elsif ( $httpcli =~ /wget$/ ) {\n\n debugprint \"$httpcli is available.\";\n\n debugprint\n\"$httpcli -qe timestamping=off -t 1 -T 3 -O $script '$url$script'\";\n $update =\n`$httpcli -qe timestamping=off -t 1 -T 3 -O $script '$url$script'`;\n chomp($update);\n\n if ( -s $script eq 0 ) {\n badprint \"Couldn't update $script\";\n }\n else {\n ++$receivedScripts;\n debugprint \"$script updated: $update\";\n }\n }\n else {\n debugprint \"curl and wget are not available.\";\n infoprint \"Unable to check for the latest MySQLTuner version\";\n }\n\n }\n\n if ( $receivedScripts eq $totalScripts ) {\n goodprint \"Successfully updated MySQLTuner script\";\n }\n else {\n badprint \"Couldn't update MySQLTuner script\";\n }\n infoprint \"Stopping program: MySQLTuner script must be updated first.\";\n exit 0;\n}\n\nsub compare_tuner_version {\n my $remoteversion = shift;\n debugprint \"Remote data: $remoteversion\";\n\n #exit 0;\n if ( $remoteversion ne $tunerversion ) {\n badprint\n \"There is a new version of MySQLTuner available ($remoteversion)\";\n update_tuner_version();\n return;\n }\n goodprint \"You have the latest version of MySQLTuner ($tunerversion)\";\n return;\n}\n\n# Checks to see if a MySQL login is possible\nmy ( $mysqllogin, $doremote, $remotestring, $mysqlcmd, $mysqladmincmd );\n\nmy $osname = $^O;\nif ( $osname eq 'MSWin32' ) {\n eval { require Win32; } or last;\n $osname = Win32::GetOSName();\n infoprint \"* Windows OS ($osname) is not fully supported.\\n\";\n\n #exit 1;\n}\n\nsub mysql_setup {\n $doremote = 0;\n $remotestring = '';\n if ( $opt{mysqladmin} ) {\n $mysqladmincmd = $opt{mysqladmin};\n }\n else {\n $mysqladmincmd = which( \"mariadb-admin\", $ENV{'PATH'} );\n if ( !-e $mysqladmincmd ) {\n $mysqladmincmd = which( \"mysqladmin\", $ENV{'PATH'} );\n }\n }\n chomp($mysqladmincmd);\n if ( !-e $mysqladmincmd && $opt{mysqladmin} ) {\n badprint \"Unable to find the mysqladmin command you specified: \"\n . $mysqladmincmd . \"\";\n exit 1;\n }\n elsif ( !-e $mysqladmincmd ) {\n badprint\n\"Couldn't find mysqladmin/mariadb-admin in your \\$PATH. Is MySQL installed?\";\n\n #exit 1;\n }\n if ( $opt{mysqlcmd} ) {\n $mysqlcmd = $opt{mysqlcmd};\n }\n else {\n $mysqlcmd = which( \"mariadb\", $ENV{'PATH'} );\n if ( !-e $mysqlcmd ) {\n $mysqlcmd = which( \"mysql\", $ENV{'PATH'} );\n }\n }\n chomp($mysqlcmd);\n if ( !-e $mysqlcmd && $opt{mysqlcmd} ) {\n badprint \"Unable to find the mysql command you specified: \"\n . $mysqlcmd . \"\";\n exit 1;\n }\n elsif ( !-e $mysqlcmd ) {\n badprint\n \"Couldn't find mysql/mariadb in your \\$PATH. Is MySQL installed?\";\n exit 1;\n }\n $mysqlcmd =~ s/\\n$//g;\n my $mysqlclidefaults = `$mysqlcmd --print-defaults`;\n debugprint \"MySQL Client: $mysqlclidefaults\";\n if ( $mysqlclidefaults =~ /auto-vertical-output/ ) {\n badprint\n \"Avoid auto-vertical-output in configuration file(s) for MySQL like\";\n exit 1;\n }\n\n debugprint \"MySQL Client: $mysqlcmd\";\n\n # Are we being asked to connect via a socket?\n if ( $opt{socket} ne 0 ) {\n if ( $opt{port} ne 0 ) {\n $remotestring = \" -S $opt{socket} -P $opt{port}\";\n }\n else {\n $remotestring = \" -S $opt{socket}\";\n }\n }\n\n if ( $opt{protocol} ne '' ) {\n $remotestring = \" --protocol=$opt{protocol}\";\n }\n\n # Are we being asked to connect to a remote server?\n if ( $opt{host} ne 0 ) {\n chomp( $opt{host} );\n $opt{port} = ( $opt{port} eq 0 ) ? 3306 : $opt{port};\n\n# If we're doing a remote connection, but forcemem wasn't specified, we need to exit\n if ( $opt{'forcemem'} eq 0 && is_remote eq 1 ) {\n badprint \"The --forcemem option is required for remote connections\";\n badprint\n \"Assuming RAM memory is 1Gb for simplify remote connection usage\";\n $opt{'forcemem'} = 1024;\n\n #exit 1;\n }\n if ( $opt{'forceswap'} eq 0 && is_remote eq 1 ) {\n badprint\n \"The --forceswap option is required for remote connections\";\n badprint\n \"Assuming Swap size is 1Gb for simplify remote connection usage\";\n $opt{'forceswap'} = 1024;\n\n #exit 1;\n }\n infoprint \"Performing tests on $opt{host}:$opt{port}\";\n $remotestring = \" -h $opt{host} -P $opt{port}\";\n $doremote = is_remote();\n\n }\n else {\n $opt{host} = '127.0.0.1';\n }\n\n if ( $opt{'ssl-ca'} ne 0 ) {\n if ( -e -r -f $opt{'ssl-ca'} ) {\n $remotestring .= \" --ssl-ca=$opt{'ssl-ca'}\";\n infoprint\n \"Will connect using ssl public key passed on the command line\";\n return 1;\n }\n else {\n badprint\n\"Attempted to use passed ssl public key, but it was not found or could not be read\";\n exit 1;\n }\n }\n\n # Did we already get a username with or without password on the command line?\n if ( $opt{user} ne 0 ) {\n $mysqllogin =\n \"-u $opt{user} \"\n . ( ( $opt{pass} ne 0 ) ? \"-p'$opt{pass}' \" : \" \" )\n . $remotestring;\n my $loginstatus =\n `$mysqlcmd -Nrs -e 'select \"mysqld is alive\";' $mysqllogin 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n goodprint \"Logged in using credentials passed on the command line\";\n return 1;\n }\n else {\n badprint\n \"Attempted to use login credentials, but they were invalid\";\n exit 1;\n }\n }\n\n my $svcprop = which( \"svcprop\", $ENV{'PATH'} );\n if ( substr( $svcprop, 0, 1 ) =~ \"/\" ) {\n\n # We are on solaris\n ( my $mysql_login =\n`svcprop -p quickbackup/username svc:/network/mysql-quickbackup:default`\n ) =~ s/\\s+$//;\n ( my $mysql_pass =\n`svcprop -p quickbackup/password svc:/network/mysql-quickbackup:default`\n ) =~ s/\\s+$//;\n if ( substr( $mysql_login, 0, 7 ) ne \"svcprop\" ) {\n\n # mysql-quickbackup is installed\n $mysqllogin = \"-u $mysql_login -p$mysql_pass\";\n my $loginstatus = `mysqladmin $mysqllogin ping 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n goodprint \"Logged in using credentials from mysql-quickbackup.\";\n return 1;\n }\n else {\n badprint\n\"Attempted to use login credentials from mysql-quickbackup, but they failed.\";\n exit 1;\n }\n }\n }\n elsif ( -r \"/etc/psa/.psa.shadow\" and $doremote == 0 ) {\n\n # It's a Plesk box, use the available credentials\n $mysqllogin = \"-u admin -p`cat /etc/psa/.psa.shadow`\";\n my $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`;\n unless ( $loginstatus =~ /mysqld is alive/ ) {\n\n # Plesk 10+\n $mysqllogin =\n \"-u admin -p`/usr/local/psa/bin/admin --show-password`\";\n $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`;\n unless ( $loginstatus =~ /mysqld is alive/ ) {\n badprint\n\"Attempted to use login credentials from Plesk and Plesk 10+, but they failed.\";\n exit 1;\n }\n }\n }\n elsif ( -r \"/usr/local/directadmin/conf/mysql.conf\" and $doremote == 0 ) {\n\n # It's a DirectAdmin box, use the available credentials\n my $mysqluser =\n `cat /usr/local/directadmin/conf/mysql.conf | egrep '^user=.*'`;\n my $mysqlpass =\n `cat /usr/local/directadmin/conf/mysql.conf | egrep '^passwd=.*'`;\n\n $mysqluser =~ s/user=//;\n $mysqluser =~ s/[\\r\\n]//;\n $mysqlpass =~ s/passwd=//;\n $mysqlpass =~ s/[\\r\\n]//;\n\n $mysqllogin = \"-u $mysqluser -p$mysqlpass\";\n\n my $loginstatus = `mysqladmin ping $mysqllogin 2>&1`;\n unless ( $loginstatus =~ /mysqld is alive/ ) {\n badprint\n\"Attempted to use login credentials from DirectAdmin, but they failed.\";\n exit 1;\n }\n }\n elsif ( -r \"/etc/mysql/debian.cnf\"\n and $doremote == 0\n and $opt{'defaults-file'} eq '' )\n {\n\n # We have a Debian maintenance account, use it\n $mysqllogin = \"--defaults-file=/etc/mysql/debian.cnf\";\n my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n goodprint\n \"Logged in using credentials from Debian maintenance account.\";\n return 1;\n }\n else {\n badprint\n\"Attempted to use login credentials from Debian maintenance account, but they failed.\";\n exit 1;\n }\n }\n elsif ( $opt{'defaults-file'} ne '' and -r \"$opt{'defaults-file'}\" ) {\n\n # defaults-file\n debugprint \"defaults file detected: $opt{'defaults-file'}\";\n my $mysqlclidefaults = `$mysqlcmd --print-defaults`;\n debugprint \"MySQL Client Default File: $opt{'defaults-file'}\";\n\n $mysqllogin = \"--defaults-file=\" . $opt{'defaults-file'};\n my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n goodprint \"Logged in using credentials from defaults file account.\";\n return 1;\n }\n }\n elsif ( $opt{'defaults-extra-file'} ne ''\n and -r \"$opt{'defaults-extra-file'}\" )\n {\n\n # defaults-extra-file\n debugprint \"defaults extra file detected: $opt{'defaults-extra-file'}\";\n my $mysqlclidefaults = `$mysqlcmd --print-defaults`;\n debugprint\n \"MySQL Client Extra Default File: $opt{'defaults-extra-file'}\";\n\n $mysqllogin = \"--defaults-extra-file=\" . $opt{'defaults-extra-file'};\n my $loginstatus = `$mysqladmincmd $mysqllogin ping 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n goodprint\n \"Logged in using credentials from extra defaults file account.\";\n return 1;\n }\n }\n else {\n # It's not Plesk or Debian, we should try a login\n debugprint \"$mysqladmincmd $remotestring ping 2>&1\";\n\n #my $loginstatus = \"\";\n debugprint \"Using mysqlcmd: $mysqlcmd\";\n\n #if (defined($mysqladmincmd)) {\n # infoprint \"Using mysqladmin to check login\";\n # $loginstatus=`$mysqladmincmd $remotestring ping 2>&1`;\n #} else {\n infoprint \"Using mysql to check login\";\n my $loginstatus =\n`$mysqlcmd $remotestring -Nrs -e 'select \"mysqld is alive\"' --connect-timeout=3 2>&1`;\n\n #}\n\n if ( $loginstatus =~ /mysqld is alive/ ) {\n\n # Login went just fine\n $mysqllogin = \" $remotestring \";\n\n # Did this go well because of a .my.cnf file or is there no password set?\n my $userpath = `printenv HOME`;\n if ( length($userpath) > 0 ) {\n chomp($userpath);\n }\n unless ( -e \"${userpath}/.my.cnf\" or -e \"${userpath}/.mylogin.cnf\" )\n {\n badprint\n \"SECURITY RISK: Successfully authenticated without password\";\n }\n return 1;\n }\n else {\n if ( $opt{'noask'} == 1 ) {\n badprint\n \"Attempted to use login credentials, but they were invalid\";\n exit 1;\n }\n my ( $name, $password );\n\n # If --user is defined no need to ask for username\n if ( $opt{user} ne 0 ) {\n $name = $opt{user};\n }\n else {\n print STDERR \"Please enter your MySQL administrative login: \";\n $name = ;\n }\n\n # If --pass is defined no need to ask for password\n if ( $opt{pass} ne 0 ) {\n $password = $opt{pass};\n }\n else {\n print STDERR\n \"Please enter your MySQL administrative password: \";\n system(\"stty -echo >$devnull 2>&1\");\n $password = ;\n system(\"stty echo >$devnull 2>&1\");\n }\n chomp($password);\n chomp($name);\n $mysqllogin = \"-u $name\";\n\n if ( length($password) > 0 ) {\n $mysqllogin .= \" -p'$password'\";\n }\n $mysqllogin .= $remotestring;\n my $loginstatus = `$mysqladmincmd ping $mysqllogin 2>&1`;\n if ( $loginstatus =~ /mysqld is alive/ ) {\n\n #print STDERR \"\";\n if ( !length($password) ) {\n\n # Did this go well because of a .my.cnf file or is there no password set?\n my $userpath = `printenv HOME`;\n chomp($userpath);\n unless ( -e \"$userpath/.my.cnf\" ) {\n print STDERR \"\";\n badprint\n\"SECURITY RISK: Successfully authenticated without password\";\n }\n }\n return 1;\n }\n else {\n #print STDERR \"\";\n badprint\n \"Attempted to use login credentials, but they were invalid.\";\n exit 1;\n }\n exit 1;\n }\n }\n}\n\n# MySQL Request Array\nsub select_array {\n my $req = shift;\n debugprint \"PERFORM: $req \";\n my @result = `$mysqlcmd $mysqllogin -Bse \"\\\\w$req\" 2>>/dev/null`;\n if ( $? != 0 ) {\n badprint \"Failed to execute: $req\";\n badprint \"FAIL Execute SQL / return code: $?\";\n debugprint \"CMD : $mysqlcmd\";\n debugprint \"OPTIONS: $mysqllogin\";\n debugprint `$mysqlcmd $mysqllogin -Bse \"$req\" 2>&1`;\n\n #exit $?;\n }\n debugprint \"select_array: return code : $?\";\n chomp(@result);\n return @result;\n}\n\n# MySQL Request Array\nsub select_array_with_headers {\n my $req = shift;\n debugprint \"PERFORM: $req \";\n my @result = `$mysqlcmd $mysqllogin -Bre \"\\\\w$req\" 2>>/dev/null`;\n if ( $? != 0 ) {\n badprint \"Failed to execute: $req\";\n badprint \"FAIL Execute SQL / return code: $?\";\n debugprint \"CMD : $mysqlcmd\";\n debugprint \"OPTIONS: $mysqllogin\";\n debugprint `$mysqlcmd $mysqllogin -Bse \"$req\" 2>&1`;\n\n #exit $?;\n }\n debugprint \"select_array_with_headers: return code : $?\";\n chomp(@result);\n return @result;\n}\n\n# MySQL Request Array\nsub select_csv_file {\n my $tfile = shift;\n my $req = shift;\n debugprint \"PERFORM: $req CSV into $tfile\";\n\n #return;\n my @result = select_array_with_headers($req);\n open( my $fh, '>', $tfile ) or die \"Could not open file '$tfile' $!\";\n for my $l (@result) {\n $l =~ s/\\t/\",\"/g;\n $l =~ s/^/\"/;\n $l =~ s/$/\"\\n/;\n print $fh $l;\n print $l if $opt{debug};\n }\n close $fh;\n infoprint \"CSV file $tfile created\";\n}\n\nsub human_size {\n my ( $size, $n ) = ( shift, 0 );\n ++$n and $size /= 1024 until $size < 1024;\n return sprintf \"%.2f %s\", $size, (qw[ bytes KB MB GB TB ])[$n];\n}\n\n# MySQL Request one\nsub select_one {\n my $req = shift;\n debugprint \"PERFORM: $req \";\n my $result = `$mysqlcmd $mysqllogin -Bse \"\\\\w$req\" 2>>/dev/null`;\n if ( $? != 0 ) {\n badprint \"Failed to execute: $req\";\n badprint \"FAIL Execute SQL / return code: $?\";\n debugprint \"CMD : $mysqlcmd\";\n debugprint \"OPTIONS: $mysqllogin\";\n debugprint `$mysqlcmd $mysqllogin -Bse \"$req\" 2>&1`;\n\n #exit $?;\n }\n debugprint \"select_array: return code : $?\";\n chomp($result);\n return $result;\n}\n\n# MySQL Request one\nsub select_one_g {\n my $pattern = shift;\n\n my $req = shift;\n debugprint \"PERFORM: $req \";\n my @result = `$mysqlcmd $mysqllogin -re \"\\\\w$req\\\\G\" 2>>/dev/null`;\n if ( $? != 0 ) {\n badprint \"Failed to execute: $req\";\n badprint \"FAIL Execute SQL / return code: $?\";\n debugprint \"CMD : $mysqlcmd\";\n debugprint \"OPTIONS: $mysqllogin\";\n debugprint `$mysqlcmd $mysqllogin -Bse \"$req\" 2>&1`;\n\n #exit $?;\n }\n debugprint \"select_array: return code : $?\";\n chomp(@result);\n return ( grep { /$pattern/ } @result )[0];\n}\n\nsub select_str_g {\n my $pattern = shift;\n\n my $req = shift;\n my $str = select_one_g $pattern, $req;\n return () unless defined $str;\n my @val = split /:/, $str;\n shift @val;\n return trim(@val);\n}\n\nsub select_user_dbs {\n return select_array(\n\"SELECT DISTINCT TABLE_SCHEMA FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema', 'percona', 'sys')\"\n );\n}\n\nsub select_tables_db {\n my $schema = shift;\n return select_array(\n\"SELECT DISTINCT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='$schema'\"\n );\n}\n\nsub select_indexes_db {\n my $schema = shift;\n return select_array(\n\"SELECT DISTINCT INDEX_NAME FROM information_schema.STATISTICS WHERE TABLE_SCHEMA='$schema'\"\n );\n}\n\nsub select_views_db {\n my $schema = shift;\n return select_array(\n\"SELECT DISTINCT TABLE_NAME FROM information_schema.VIEWS WHERE TABLE_SCHEMA='$schema'\"\n );\n}\n\nsub select_triggers_db {\n my $schema = shift;\n return select_array(\n\"SELECT DISTINCT TRIGGER_NAME FROM information_schema.TRIGGERS WHERE TRIGGER_SCHEMA='$schema'\"\n );\n}\n\nsub select_routines_db {\n my $schema = shift;\n return select_array(\n\"SELECT DISTINCT ROUTINE_NAME FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA='$schema'\"\n );\n}\n\nsub select_table_indexes_db {\n my $schema = shift;\n my $tbname = shift;\n return select_array(\n\"SELECT INDEX_NAME FROM information_schema.STATISTICS WHERE TABLE_SCHEMA='$schema' AND TABLE_NAME='$tbname'\"\n );\n}\n\nsub select_table_columns_db {\n my $schema = shift;\n my $table = shift;\n return select_array(\n\"SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$schema' AND TABLE_NAME='$table'\"\n );\n}\n\nsub get_tuning_info {\n my @infoconn = select_array \"\\\\s\";\n my ( $tkey, $tval );\n @infoconn =\n grep { !/Threads:/ and !/Connection id:/ and !/pager:/ and !/Using/ }\n @infoconn;\n foreach my $line (@infoconn) {\n if ( $line =~ /\\s*(.*):\\s*(.*)/ ) {\n debugprint \"$1 => $2\";\n $tkey = $1;\n $tval = $2;\n chomp($tkey);\n chomp($tval);\n $result{'MySQL Client'}{$tkey} = $tval;\n }\n }\n $result{'MySQL Client'}{'Client Path'} = $mysqlcmd;\n $result{'MySQL Client'}{'Admin Path'} = $mysqladmincmd;\n $result{'MySQL Client'}{'Authentication Info'} = $mysqllogin;\n\n}\n\n# Populates all of the variable and status hashes\nmy ( %mystat, %myvar, $dummyselect, %myrepl, %myslaves );\n\nsub arr2hash {\n my $href = shift;\n my $harr = shift;\n my $sep = shift;\n my $key = '';\n my $val = '';\n\n $sep = '\\s' unless defined($sep);\n foreach my $line (@$harr) {\n next if ( $line =~ m/^\\*\\*\\*\\*\\*\\*\\*/ );\n $line =~ /([a-zA-Z_]*)\\s*$sep\\s*(.*)/;\n $key = $1;\n $val = $2;\n $$href{$key} = $val;\n\n debugprint \" * $key = $val\" if $key =~ /$opt{dbgpattern}/i;\n }\n}\n\nsub get_all_vars {\n\n # We need to initiate at least one query so that our data is useable\n $dummyselect = select_one \"SELECT VERSION()\";\n if ( not defined($dummyselect) or $dummyselect eq \"\" ) {\n badprint\n \"You probably do not have enough privileges to run MySQLTuner ...\";\n exit(256);\n }\n $dummyselect =~ s/(.*?)\\-.*/$1/;\n debugprint \"VERSION: \" . $dummyselect . \"\";\n $result{'MySQL Client'}{'Version'} = $dummyselect;\n\n my @mysqlvarlist = select_array(\"SHOW VARIABLES\");\n push( @mysqlvarlist, select_array(\"SHOW GLOBAL VARIABLES\") );\n arr2hash( \\%myvar, \\@mysqlvarlist );\n $result{'Variables'} = \\%myvar;\n\n my @mysqlstatlist = select_array(\"SHOW STATUS\");\n push( @mysqlstatlist, select_array(\"SHOW GLOBAL STATUS\") );\n arr2hash( \\%mystat, \\@mysqlstatlist );\n $result{'Status'} = \\%mystat;\n unless ( defined( $myvar{'innodb_support_xa'} ) ) {\n $myvar{'innodb_support_xa'} = 'ON';\n }\n $mystat{'Uptime'} = 1\n unless defined( $mystat{'Uptime'} )\n and $mystat{'Uptime'} > 0;\n $myvar{'have_galera'} = \"NO\";\n if ( defined( $myvar{'wsrep_provider_options'} )\n && $myvar{'wsrep_provider_options'} ne \"\"\n && $myvar{'wsrep_on'} ne \"OFF\" )\n {\n $myvar{'have_galera'} = \"YES\";\n debugprint \"Galera options: \" . $myvar{'wsrep_provider_options'};\n }\n\n # Workaround for MySQL bug #59393 wrt. ignore-builtin-innodb\n if ( ( $myvar{'ignore_builtin_innodb'} || \"\" ) eq \"ON\" ) {\n $myvar{'have_innodb'} = \"NO\";\n }\n\n # Support GTID MODE FOR MARIADB\n # Issue MariaDB GTID mode #513\n $myvar{'gtid_mode'} = 'ON'\n if ( defined( $myvar{'gtid_current_pos'} )\n and $myvar{'gtid_current_pos'} ne '' );\n\n # Whether the server uses a thread pool to handle client connections\n # MariaDB: thread_handling = pool-of-threads\n # MySQL: thread_handling = loaded-dynamically\n $myvar{'have_threadpool'} = \"NO\";\n if (\n defined( $myvar{'thread_handling'} )\n and ( $myvar{'thread_handling'} eq 'pool-of-threads'\n || $myvar{'thread_handling'} eq 'loaded-dynamically' )\n )\n {\n $myvar{'have_threadpool'} = \"YES\";\n }\n\n # have_* for engines is deprecated and will be removed in MySQL 5.6;\n # check SHOW ENGINES and set corresponding old style variables.\n # Also works around MySQL bug #59393 wrt. skip-innodb\n my @mysqlenginelist = select_array \"SHOW ENGINES\";\n foreach my $line (@mysqlenginelist) {\n if ( $line =~ /^([a-zA-Z_]+)\\s+(\\S+)/ ) {\n my $engine = lc($1);\n\n if ( $engine eq \"federated\" || $engine eq \"blackhole\" ) {\n $engine .= \"_engine\";\n }\n elsif ( $engine eq \"berkeleydb\" ) {\n $engine = \"bdb\";\n }\n my $val = ( $2 eq \"DEFAULT\" ) ? \"YES\" : $2;\n $myvar{\"have_$engine\"} = $val;\n $result{'Storage Engines'}{$engine} = $2;\n }\n }\n\n #debugprint Dumper(@mysqlenginelist);\n\n my @mysqlslave;\n if ( mysql_version_eq(8) or mysql_version_ge( 10, 5 ) ) {\n @mysqlslave = select_array(\"SHOW REPLICA STATUS\\\\G\");\n }\n else {\n @mysqlslave = select_array(\"SHOW SLAVE STATUS\\\\G\");\n }\n arr2hash( \\%myrepl, \\@mysqlslave, ':' );\n $result{'Replication'}{'Status'} = \\%myrepl;\n\n my @mysqlslaves;\n if ( mysql_version_eq(8) or mysql_version_ge( 10, 5 ) ) {\n @mysqlslaves = select_array \"SHOW SLAVE STATUS\";\n }\n else {\n @mysqlslaves = select_array(\"SHOW SLAVE HOSTS\\\\G\");\n }\n\n my @lineitems = ();\n foreach my $line (@mysqlslaves) {\n debugprint \"L: $line \";\n @lineitems = split /\\s+/, $line;\n $myslaves{ $lineitems[0] } = $line;\n $result{'Replication'}{'Slaves'}{ $lineitems[0] } = $lineitems[4];\n }\n}\n\nsub remove_cr {\n return map {\n my $line = $_;\n $line =~ s/\\n$//g;\n $line =~ s/^\\s+$//g;\n $line;\n } @_;\n}\n\nsub remove_empty {\n grep { $_ ne '' } @_;\n}\n\nsub grep_file_contents {\n my $file = shift;\n my $patt;\n}\n\nsub get_file_contents {\n my $file = shift;\n open( my $fh, \"<\", $file ) or die \"Can't open $file for read: $!\";\n my @lines = <$fh>;\n close $fh or die \"Cannot close $file: $!\";\n @lines = remove_cr @lines;\n return @lines;\n}\n\nsub get_basic_passwords {\n return get_file_contents(shift);\n}\n\nsub get_log_file_real_path {\n my $file = shift;\n my $hostname = shift;\n my $datadir = shift;\n if ( -f \"$file\" ) {\n return $file;\n }\n elsif ( -f \"$hostname.log\" ) {\n return \"$hostname.log\";\n }\n elsif ( -f \"$hostname.err\" ) {\n return \"$hostname.err\";\n }\n elsif ( -f \"$datadir$hostname.err\" ) {\n return \"$datadir$hostname.err\";\n }\n elsif ( -f \"$datadir$hostname.log\" ) {\n return \"$datadir$hostname.log\";\n }\n elsif ( -f \"$datadir\" . \"mysql_error.log\" ) {\n return \"$datadir\" . \"mysql_error.log\";\n }\n elsif ( -f \"/var/log/mysql.log\" ) {\n return \"/var/log/mysql.log\";\n }\n elsif ( -f \"/var/log/mysqld.log\" ) {\n return \"/var/log/mysqld.log\";\n }\n elsif ( -f \"/var/log/mysql/$hostname.err\" ) {\n return \"/var/log/mysql/$hostname.err\";\n }\n elsif ( -f \"/var/log/mysql/$hostname.log\" ) {\n return \"/var/log/mysql/$hostname.log\";\n }\n elsif ( -f \"/var/log/mysql/\" . \"mysql_error.log\" ) {\n return \"/var/log/mysql/\" . \"mysql_error.log\";\n }\n else {\n return $file;\n }\n}\n\nsub log_file_recommendations {\n if ( is_remote eq 1 ) {\n infoprint \"Skipping error log files checks on remote host\";\n return;\n }\n my $fh;\n $myvar{'log_error'} = $opt{'server-log'}\n || get_log_file_real_path( $myvar{'log_error'}, $myvar{'hostname'},\n $myvar{'datadir'} );\n\n subheaderprint \"Log file Recommendations\";\n if ( \"$myvar{'log_error'}\" eq \"stderr\" ) {\n badprint\n\"log_error is set to $myvar{'log_error'}, but this script can't read stderr\";\n return;\n }\n elsif ( $myvar{'log_error'} =~ /^(docker|podman|kubectl):(.*)/ ) {\n open( $fh, '-|', \"$1 logs --tail=$maxlines '$2'\" )\n // die \"Can't start $1 $!\";\n goodprint \"Log from cloud` $myvar{'log_error'} exists\";\n }\n elsif ( $myvar{'log_error'} =~ /^systemd:(.*)/ ) {\n open( $fh, '-|', \"journalctl -n $maxlines -b -u '$1'\" )\n // die \"Can't start journalctl $!\";\n goodprint \"Log journal` $myvar{'log_error'} exists\";\n }\n elsif ( -f \"$myvar{'log_error'}\" ) {\n goodprint \"Log file $myvar{'log_error'} exists\";\n my $size = ( stat $myvar{'log_error'} )[7];\n infoprint \"Log file: \"\n . $myvar{'log_error'} . \" (\"\n . hr_bytes_rnd($size) . \")\";\n\n if ( $size > 0 ) {\n goodprint \"Log file $myvar{'log_error'} is not empty\";\n if ( $size < 32 * 1024 * 1024 ) {\n goodprint \"Log file $myvar{'log_error'} is smaller than 32 MB\";\n }\n else {\n badprint \"Log file $myvar{'log_error'} is bigger than 32 MB\";\n push @generalrec,\n $myvar{'log_error'}\n . \" is > 32MB, you should analyze why or implement a rotation log strategy such as logrotate!\";\n }\n }\n else {\n infoprint\n\"Log file $myvar{'log_error'} is empty. Assuming log-rotation. Use --server-log={file} for explicit file\";\n return;\n }\n if ( !open( $fh, '<', $myvar{'log_error'} ) ) {\n badprint \"Log file $myvar{'log_error'} isn't readable.\";\n return;\n }\n goodprint \"Log file $myvar{'log_error'} is readable.\";\n\n if ( $maxlines * 80 < $size ) {\n seek( $fh, -$maxlines * 80, 2 );\n <$fh>; # discard line fragment\n }\n }\n else {\n badprint \"Log file $myvar{'log_error'} doesn't exist\";\n return;\n }\n\n my $numLi = 0;\n my $nbWarnLog = 0;\n my $nbErrLog = 0;\n my @lastShutdowns;\n my @lastStarts;\n\n while ( my $logLi = <$fh> ) {\n chomp $logLi;\n $numLi++;\n debugprint \"$numLi: $logLi\"\n if $logLi =~ /warning|error/i and $logLi !~ /Logging to/;\n $nbErrLog++\n if $logLi =~ /error/i\n and $logLi !~ /(Logging to|\\[Warning\\].*ERROR_FOR_DIVISION_BY_ZERO)/;\n $nbWarnLog++ if $logLi =~ /warning/i;\n push @lastShutdowns, $logLi\n if $logLi =~ /Shutdown complete/ and $logLi !~ /Innodb/i;\n push @lastStarts, $logLi if $logLi =~ /ready for connections/;\n }\n close $fh;\n\n if ( $nbWarnLog > 0 ) {\n badprint \"$myvar{'log_error'} contains $nbWarnLog warning(s).\";\n push @generalrec, \"Check warning line(s) in $myvar{'log_error'} file\";\n }\n else {\n goodprint \"$myvar{'log_error'} doesn't contain any warning.\";\n }\n if ( $nbErrLog > 0 ) {\n badprint \"$myvar{'log_error'} contains $nbErrLog error(s).\";\n push @generalrec, \"Check error line(s) in $myvar{'log_error'} file\";\n }\n else {\n goodprint \"$myvar{'log_error'} doesn't contain any error.\";\n }\n\n infoprint scalar @lastStarts . \" start(s) detected in $myvar{'log_error'}\";\n my $nStart = 0;\n my $nEnd = 10;\n if ( scalar @lastStarts < $nEnd ) {\n $nEnd = scalar @lastStarts;\n }\n for my $startd ( reverse @lastStarts[ -$nEnd .. -1 ] ) {\n $nStart++;\n infoprint \"$nStart) $startd\";\n }\n infoprint scalar @lastShutdowns\n . \" shutdown(s) detected in $myvar{'log_error'}\";\n $nStart = 0;\n $nEnd = 10;\n if ( scalar @lastShutdowns < $nEnd ) {\n $nEnd = scalar @lastShutdowns;\n }\n for my $shutd ( reverse @lastShutdowns[ -$nEnd .. -1 ] ) {\n $nStart++;\n infoprint \"$nStart) $shutd\";\n }\n\n #exit 0;\n}\n\nsub cve_recommendations {\n subheaderprint \"CVE Security Recommendations\";\n unless ( defined( $opt{cvefile} ) && -f \"$opt{cvefile}\" ) {\n infoprint \"Skipped due to --cvefile option undefined\";\n return;\n }\n\n#$mysqlvermajor=10;\n#$mysqlverminor=1;\n#$mysqlvermicro=17;\n#prettyprint \"Look for related CVE for $myvar{'version'} or lower in $opt{cvefile}\";\n my $cvefound = 0;\n open( my $fh, \"<\", $opt{cvefile} )\n or die \"Can't open $opt{cvefile} for read: $!\";\n while ( my $cveline = <$fh> ) {\n my @cve = split( ';', $cveline );\n debugprint\n\"Comparing $mysqlvermajor\\.$mysqlverminor\\.$mysqlvermicro with $cve[1]\\.$cve[2]\\.$cve[3] : \"\n . ( mysql_version_le( $cve[1], $cve[2], $cve[3] ) ? '<=' : '>' );\n\n # Avoid not major/minor version corresponding CVEs\n next\n unless ( int( $cve[1] ) == $mysqlvermajor\n && int( $cve[2] ) == $mysqlverminor );\n if ( int( $cve[3] ) >= $mysqlvermicro ) {\n badprint \"$cve[4](<= $cve[1]\\.$cve[2]\\.$cve[3]) : $cve[6]\";\n $result{'CVE'}{'List'}{$cvefound} =\n \"$cve[4](<= $cve[1]\\.$cve[2]\\.$cve[3]) : $cve[6]\";\n $cvefound++;\n }\n }\n close $fh or die \"Cannot close $opt{cvefile}: $!\";\n $result{'CVE'}{'nb'} = $cvefound;\n\n my $cve_warning_notes = \"\";\n if ( $cvefound == 0 ) {\n goodprint \"NO SECURITY CVE FOUND FOR YOUR VERSION\";\n return;\n }\n if ( $mysqlvermajor eq 5 and $mysqlverminor eq 5 ) {\n infoprint\n \"False positive CVE(s) for MySQL and MariaDB 5.5.x can be found.\";\n infoprint \"Check carefully each CVE for those particular versions\";\n }\n badprint $cvefound . \" CVE(s) found for your MySQL release.\";\n push( @generalrec,\n $cvefound\n . \" CVE(s) found for your MySQL release. Consider upgrading your version !\"\n );\n}\n\nsub get_opened_ports {\n my @opened_ports = `netstat -ltn`;\n @opened_ports = map {\n my $v = $_;\n $v =~ s/.*:(\\d+)\\s.*$/$1/;\n $v =~ s/\\D//g;\n $v;\n } @opened_ports;\n @opened_ports = sort { $a <=> $b } grep { !/^$/ } @opened_ports;\n\n #debugprint Dumper \\@opened_ports;\n $result{'Network'}{'TCP Opened'} = \\@opened_ports;\n return @opened_ports;\n}\n\nsub is_open_port {\n my $port = shift;\n if ( grep { /^$port$/ } get_opened_ports ) {\n return 1;\n }\n return 0;\n}\n\nsub get_process_memory {\n my $pid = shift;\n my @mem = `ps -p $pid -o rss`;\n return 0 if scalar @mem != 2;\n return $mem[1] * 1024;\n}\n\nsub get_other_process_memory {\n return 0 if ( $opt{tbstat} == 0 );\n my @procs = `ps eaxo pid,command`;\n @procs = map {\n my $v = $_;\n $v =~ s/.*PID.*//;\n $v =~ s/.*mysqld.*//;\n $v =~ s/.*\\[.*\\].*//;\n $v =~ s/^\\s+$//g;\n $v =~ s/.*PID.*CMD.*//;\n $v =~ s/.*systemd.*//;\n $v =~ s/\\s*?(\\d+)\\s*.*/$1/g;\n $v;\n } @procs;\n @procs = remove_cr @procs;\n @procs = remove_empty @procs;\n my $totalMemOther = 0;\n map { $totalMemOther += get_process_memory($_); } @procs;\n return $totalMemOther;\n}\n\nsub get_os_release {\n if ( -f \"/etc/lsb-release\" ) {\n my @info_release = get_file_contents \"/etc/lsb-release\";\n my $os_release = $info_release[3];\n $os_release =~ s/.*=\"//;\n $os_release =~ s/\"$//;\n return $os_release;\n }\n\n if ( -f \"/etc/system-release\" ) {\n my @info_release = get_file_contents \"/etc/system-release\";\n return $info_release[0];\n }\n\n if ( -f \"/etc/os-release\" ) {\n my @info_release = get_file_contents \"/etc/os-release\";\n my $os_release = $info_release[0];\n $os_release =~ s/.*=\"//;\n $os_release =~ s/\"$//;\n return $os_release;\n }\n\n if ( -f \"/etc/issue\" ) {\n my @info_release = get_file_contents \"/etc/issue\";\n my $os_release = $info_release[0];\n $os_release =~ s/\\s+\\\\n.*//;\n return $os_release;\n }\n return \"Unknown OS release\";\n}\n\nsub get_fs_info {\n my @sinfo = `df -P | grep '%'`;\n my @iinfo = `df -Pi| grep '%'`;\n shift @sinfo;\n shift @iinfo;\n\n foreach my $info (@sinfo) {\n\n #exit(0);\n if ( $info =~ /.*?(\\d+)\\s+(\\d+)\\s+(\\d+)\\s+(\\d+)%\\s+(.*)$/ ) {\n next if $5 =~ m{(run|dev|sys|proc|snap|init)};\n if ( $4 > 85 ) {\n badprint \"mount point $5 is using $4 % total space (\"\n . human_size( $2 * 1024 ) . \" / \"\n . human_size( $1 * 1024 ) . \")\";\n push( @generalrec, \"Add some space to $4 mountpoint.\" );\n }\n else {\n infoprint \"mount point $5 is using $4 % total space (\"\n . human_size( $2 * 1024 ) . \" / \"\n . human_size( $1 * 1024 ) . \")\";\n }\n $result{'Filesystem'}{'Space Pct'}{$5} = $4;\n $result{'Filesystem'}{'Used Space'}{$5} = $2;\n $result{'Filesystem'}{'Free Space'}{$5} = $3;\n $result{'Filesystem'}{'Total Space'}{$5} = $1;\n }\n }\n\n @iinfo = map {\n my $v = $_;\n $v =~ s/.*\\s(\\d+)%\\s+(.*)/$1\\t$2/g;\n $v;\n } @iinfo;\n foreach my $info (@iinfo) {\n next if $info =~ m{(\\d+)\\t/(run|dev|sys|proc|snap)($|/)};\n if ( $info =~ /(\\d+)\\t(.*)/ ) {\n if ( $1 > 85 ) {\n badprint \"mount point $2 is using $1 % of max allowed inodes\";\n push( @generalrec,\n\"Cleanup files from $2 mountpoint or reformat your filesystem.\"\n );\n }\n else {\n infoprint \"mount point $2 is using $1 % of max allowed inodes\";\n }\n $result{'Filesystem'}{'Inode Pct'}{$2} = $1;\n }\n }\n}\n\nsub merge_hash {\n my $h1 = shift;\n my $h2 = shift;\n my %result = {};\n foreach my $substanceref ( $h1, $h2 ) {\n while ( my ( $k, $v ) = each %$substanceref ) {\n next if ( exists $result{$k} );\n $result{$k} = $v;\n }\n }\n return \\%result;\n}\n\nsub is_virtual_machine {\n if ( $^O eq 'linux' ) {\n my $isVm = `grep -Ec '^flags.*\\ hypervisor\\ ' /proc/cpuinfo`;\n return ( $isVm == 0 ? 0 : 1 );\n }\n\n if ( $^O eq 'freebsd' ) {\n my $isVm = `sysctl -n kern.vm_guest`;\n chomp $isVm;\n print \"FARK DEBUG isVm=[$isVm]\";\n return ( $isVm eq 'none' ? 0 : 1 );\n }\n return 0;\n}\n\nsub infocmd {\n my $cmd = \"@_\";\n debugprint \"CMD: $cmd\";\n my @result = `$cmd`;\n @result = remove_cr @result;\n for my $l (@result) {\n infoprint \"$l\";\n }\n}\n\nsub infocmd_tab {\n my $cmd = \"@_\";\n debugprint \"CMD: $cmd\";\n my @result = `$cmd`;\n @result = remove_cr @result;\n for my $l (@result) {\n infoprint \"\\t$l\";\n }\n}\n\nsub infocmd_one {\n my $cmd = \"@_\";\n my @result = `$cmd 2>&1`;\n @result = remove_cr @result;\n return join ', ', @result;\n}\n\nsub get_kernel_info {\n my @params = (\n 'fs.aio-max-nr', 'fs.aio-nr',\n 'fs.nr_open', 'fs.file-max',\n 'sunrpc.tcp_fin_timeout', 'sunrpc.tcp_max_slot_table_entries',\n 'sunrpc.tcp_slot_table_entries', 'vm.swappiness'\n );\n infoprint \"Information about kernel tuning:\";\n foreach my $param (@params) {\n infocmd_tab(\"sysctl $param 2>/dev/null\");\n $result{'OS'}{'Config'}{$param} = `sysctl -n $param 2>/dev/null`;\n }\n if ( `sysctl -n vm.swappiness` > 10 ) {\n badprint\n \"Swappiness is > 10, please consider having a value lower than 10\";\n push @generalrec, \"setup swappiness lower or equal to 10\";\n push @adjvars,\n'vm.swappiness <= 10 (echo 10 > /proc/sys/vm/swappiness) or vm.swappiness=10 in /etc/sysctl.conf';\n }\n else {\n infoprint \"Swappiness is < 10.\";\n }\n\n # only if /proc/sys/sunrpc exists\n my $tcp_slot_entries =\n `sysctl -n sunrpc.tcp_slot_table_entries 2>/dev/null`;\n if ( -f \"/proc/sys/sunrpc\"\n and ( $tcp_slot_entries eq '' or $tcp_slot_entries < 100 ) )\n {\n badprint\n\"Initial TCP slot entries is < 1M, please consider having a value greater than 100\";\n push @generalrec, \"setup Initial TCP slot entries greater than 100\";\n push @adjvars,\n'sunrpc.tcp_slot_table_entries > 100 (echo 128 > /proc/sys/sunrpc/tcp_slot_table_entries) or sunrpc.tcp_slot_table_entries=128 in /etc/sysctl.conf';\n }\n else {\n infoprint \"TCP slot entries is > 100.\";\n }\n\n if ( -f \"/proc/sys/fs/aio-max-nr\" ) {\n if ( `sysctl -n fs.aio-max-nr` < 1000000 ) {\n badprint\n\"Max running total of the number of max. events is < 1M, please consider having a value greater than 1M\";\n push @generalrec, \"setup Max running number events greater than 1M\";\n push @adjvars,\n'fs.aio-max-nr > 1M (echo 1048576 > /proc/sys/fs/aio-max-nr) or fs.aio-max-nr=1048576 in /etc/sysctl.conf';\n }\n else {\n infoprint \"Max Number of AIO events is > 1M.\";\n }\n }\n if ( -f \"/proc/sys/fs/nr_open\" ) {\n if ( `sysctl -n fs.nr_open` < 1000000 ) {\n badprint\n\"Max running total of the number of file open request is < 1M, please consider having a value greater than 1M\";\n push @generalrec,\n \"setup running number of open request greater than 1M\";\n push @adjvars,\n'fs.aio-nr > 1M (echo 1048576 > /proc/sys/fs/nr_open) or fs.nr_open=1048576 in /etc/sysctl.conf';\n }\n else {\n infoprint \"Max Number of open file requests is > 1M.\";\n }\n }\n}\n\nsub get_system_info {\n $result{'OS'}{'Release'} = get_os_release();\n infoprint get_os_release;\n if (is_virtual_machine) {\n infoprint \"Machine type : Virtual machine\";\n $result{'OS'}{'Virtual Machine'} = 'YES';\n }\n else {\n infoprint \"Machine type : Physical machine\";\n $result{'OS'}{'Virtual Machine'} = 'NO';\n }\n\n $result{'Network'}{'Connected'} = 'NO';\n `ping -c 1 ipecho.net &>/dev/null`;\n my $isConnected = $?;\n if ( $? == 0 ) {\n infoprint \"Internet : Connected\";\n $result{'Network'}{'Connected'} = 'YES';\n }\n else {\n badprint \"Internet : Disconnected\";\n }\n $result{'OS'}{'NbCore'} = cpu_cores;\n infoprint \"Number of Core CPU : \" . cpu_cores;\n $result{'OS'}{'Type'} = `uname -o`;\n infoprint \"Operating System Type : \" . infocmd_one \"uname -o\";\n $result{'OS'}{'Kernel'} = `uname -r`;\n infoprint \"Kernel Release : \" . infocmd_one \"uname -r\";\n $result{'OS'}{'Hostname'} = `hostname`;\n $result{'Network'}{'Internal Ip'} = `hostname -I`;\n infoprint \"Hostname : \" . infocmd_one \"hostname\";\n infoprint \"Network Cards : \";\n infocmd_tab \"ifconfig| grep -A1 mtu\";\n infoprint \"Internal IP : \" . infocmd_one \"hostname -I\";\n $result{'Network'}{'Internal Ip'} = `ifconfig| grep -A1 mtu`;\n my $httpcli = get_http_cli();\n infoprint \"HTTP client found: $httpcli\" if defined $httpcli;\n\n my $ext_ip = \"\";\n if ( $httpcli =~ /curl$/ ) {\n $ext_ip = infocmd_one \"$httpcli -m 3 ipecho.net/plain\";\n }\n elsif ( $httpcli =~ /wget$/ ) {\n\n $ext_ip = infocmd_one \"$httpcli -t 1 -T 3 -q -O - ipecho.net/plain\";\n }\n infoprint \"External IP : \" . $ext_ip;\n $result{'Network'}{'External Ip'} = $ext_ip;\n badprint \"External IP : Can't check, no Internet connectivity\"\n unless defined($httpcli);\n infoprint \"Name Servers : \"\n . infocmd_one \"grep 'nameserver' /etc/resolv.conf \\| awk '{print \\$2}'\";\n infoprint \"Logged In users : \";\n infocmd_tab \"who\";\n $result{'OS'}{'Logged users'} = `who`;\n infoprint \"Ram Usages in MB : \";\n infocmd_tab \"free -m | grep -v +\";\n $result{'OS'}{'Free Memory RAM'} = `free -m | grep -v +`;\n infoprint \"Load Average : \";\n infocmd_tab \"top -n 1 -b | grep 'load average:'\";\n $result{'OS'}{'Load Average'} = `top -n 1 -b | grep 'load average:'`;\n\n infoprint \"System Uptime : \";\n infocmd_tab \"uptime\";\n $result{'OS'}{'Uptime'} = `uptime`;\n}\n\nsub system_recommendations {\n if ( is_remote eq 1 ) {\n infoprint \"Skipping system checks on remote host\";\n return;\n }\n return if ( $opt{sysstat} == 0 );\n subheaderprint \"System Linux Recommendations\";\n my $os = `uname`;\n unless ( $os =~ /Linux/i ) {\n infoprint \"Skipped due to non Linux server\";\n return;\n }\n prettyprint \"Look for related Linux system recommendations\";\n\n #prettyprint '-'x78;\n get_system_info();\n\n my $nb_cpus = cpu_cores;\n if ( $nb_cpus > 1 ) {\n goodprint \"There is at least one CPU dedicated to database server.\";\n }\n else {\n badprint\n\"There is only one CPU, consider dedicated one CPU for your database server\";\n push @generalrec,\n \"Consider increasing number of CPU for your database server\";\n }\n\n if ( $physical_memory >= 1.5 * 1024 ) {\n goodprint \"There is at least 1 Gb of RAM dedicated to Linux server.\";\n }\n else {\n badprint\n\"There is less than 1,5 Gb of RAM, consider dedicated 1 Gb for your Linux server\";\n push @generalrec,\n \"Consider increasing 1,5 / 2 Gb of RAM for your Linux server\";\n }\n\n my $omem = get_other_process_memory;\n infoprint \"User process except mysqld used \"\n . hr_bytes_rnd($omem) . \" RAM.\";\n if ( ( 0.15 * $physical_memory ) < $omem ) {\n if ( $opt{nondedicated} ) {\n infoprint \"No warning with --nondedicated option\";\n infoprint\n\"Other user process except mysqld used more than 15% of total physical memory \"\n . percentage( $omem, $physical_memory ) . \"% (\"\n . hr_bytes_rnd($omem) . \" / \"\n . hr_bytes_rnd($physical_memory) . \")\";\n }\n else {\n\n badprint\n\"Other user process except mysqld used more than 15% of total physical memory \"\n . percentage( $omem, $physical_memory ) . \"% (\"\n . hr_bytes_rnd($omem) . \" / \"\n . hr_bytes_rnd($physical_memory) . \")\";\n push( @generalrec,\n\"Consider stopping or dedicate server for additional process other than mysqld.\"\n );\n push( @adjvars,\n\"DON'T APPLY SETTINGS BECAUSE THERE ARE TOO MANY PROCESSES RUNNING ON THIS SERVER. OOM KILL CAN OCCUR!\"\n );\n }\n }\n else {\n infoprint\n\"Other user process except mysqld used less than 15% of total physical memory \"\n . percentage( $omem, $physical_memory ) . \"% (\"\n . hr_bytes_rnd($omem) . \" / \"\n . hr_bytes_rnd($physical_memory) . \")\";\n }\n\n if ( $opt{'maxportallowed'} > 0 ) {\n my @opened_ports = get_opened_ports;\n infoprint \"There is \"\n . scalar @opened_ports\n . \" listening port(s) on this server.\";\n if ( scalar(@opened_ports) > $opt{'maxportallowed'} ) {\n badprint \"There are too many listening ports: \"\n . scalar(@opened_ports)\n . \" opened > \"\n . $opt{'maxportallowed'}\n . \"allowed.\";\n push( @generalrec,\n\"Consider dedicating a server for your database installation with fewer services running on it!\"\n );\n }\n else {\n goodprint \"There are less than \"\n . $opt{'maxportallowed'}\n . \" opened ports on this server.\";\n }\n }\n\n foreach my $banport (@banned_ports) {\n if ( is_open_port($banport) ) {\n badprint \"Banned port: $banport is opened..\";\n push( @generalrec,\n\"Port $banport is opened. Consider stopping the program over this port.\"\n );\n }\n else {\n goodprint \"$banport is not opened.\";\n }\n }\n\n subheaderprint \"Filesystem Linux Recommendations\";\n get_fs_info;\n subheaderprint \"Kernel Information Recommendations\";\n get_kernel_info;\n}\n\nsub security_recommendations {\n subheaderprint \"Security Recommendations\";\n\n if ( mysql_version_eq(8) ) {\n infoprint \"Skipped due to unsupported feature for MySQL 8.0+\";\n return;\n }\n\n #exit 0;\n if ( $opt{skippassword} eq 1 ) {\n infoprint \"Skipped due to --skippassword option\";\n return;\n }\n\n my $PASS_COLUMN_NAME = 'password';\n\n # New table schema available since mysql-5.7 and mariadb-10.2\n # But need to be checked\n if ( $myvar{'version'} =~ /5\\.7|10\\.[2-5]\\..*MariaDB*/ ) {\n my $password_column_exists =\n`$mysqlcmd $mysqllogin -Bse \"SELECT 1 FROM information_schema.columns WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user' AND COLUMN_NAME = 'password'\" 2>>/dev/null`;\n my $authstring_column_exists =\n`$mysqlcmd $mysqllogin -Bse \"SELECT 1 FROM information_schema.columns WHERE TABLE_SCHEMA = 'mysql' AND TABLE_NAME = 'user' AND COLUMN_NAME = 'authentication_string'\" 2>>/dev/null`;\n if ( $password_column_exists && $authstring_column_exists ) {\n $PASS_COLUMN_NAME =\n\"IF(plugin='mysql_native_password', authentication_string, password)\";\n }\n elsif ($authstring_column_exists) {\n $PASS_COLUMN_NAME = 'authentication_string';\n }\n elsif ( !$password_column_exists ) {\n infoprint \"Skipped due to none of known auth columns exists\";\n return;\n }\n }\n debugprint \"Password column = $PASS_COLUMN_NAME\";\n\n # IS THERE A ROLE COLUMN\n my $is_role_column = select_one\n\"select count(*) from information_schema.columns where TABLE_NAME='user' AND TABLE_SCHEMA='mysql' and COLUMN_NAME='IS_ROLE'\";\n\n my $extra_user_condition = \"\";\n $extra_user_condition = \"IS_ROLE = 'N' AND\" if $is_role_column > 0;\n my @mysqlstatlist;\n if ( $is_role_column > 0 ) {\n @mysqlstatlist = select_array\n\"SELECT CONCAT(QUOTE(user), '\\@', QUOTE(host)) FROM mysql.user WHERE IS_ROLE='Y'\";\n foreach my $line ( sort @mysqlstatlist ) {\n chomp($line);\n infoprint \"User $line is User Role\";\n }\n }\n else {\n debugprint \"No Role user detected\";\n goodprint \"No Role user detected\";\n }\n\n # Looking for Anonymous users\n @mysqlstatlist = select_array\n\"SELECT CONCAT(QUOTE(user), '\\@', QUOTE(host)) FROM mysql.user WHERE $extra_user_condition (TRIM(USER) = '' OR USER IS NULL)\";\n\n #debugprint Dumper \\@mysqlstatlist;\n\n #exit 0;\n if (@mysqlstatlist) {\n push( @generalrec,\n \"Remove Anonymous User accounts: there are \"\n . scalar(@mysqlstatlist)\n . \" anonymous accounts.\" );\n foreach my $line ( sort @mysqlstatlist ) {\n chomp($line);\n badprint \"User \"\n . $line\n . \" is an anonymous account. Remove with DROP USER \"\n . $line . \";\";\n }\n }\n else {\n goodprint \"There are no anonymous accounts for any database users\";\n }\n if ( mysql_version_le( 5, 1 ) ) {\n badprint \"No more password checks for MySQL version <=5.1\";\n badprint \"MySQL version <=5.1 is deprecated and end of support.\";\n return;\n }\n\n # Looking for Empty Password\n if ( mysql_version_ge( 10, 4 ) ) {\n @mysqlstatlist = select_array\nq{SELECT CONCAT(QUOTE(user), '@', QUOTE(host)) FROM mysql.global_priv WHERE\n ( user != ''\n AND JSON_CONTAINS(Priv, '\"mysql_native_password\"', '$.plugin') AND JSON_CONTAINS(Priv, '\"\"', '$.authentication_string')\n AND NOT JSON_CONTAINS(Priv, 'true', '$.account_locked')\n )};\n }\n else {\n @mysqlstatlist = select_array\n\"SELECT CONCAT(QUOTE(user), '\\@', QUOTE(host)) FROM mysql.user WHERE ($PASS_COLUMN_NAME = '' OR $PASS_COLUMN_NAME IS NULL)\n AND user != ''\n /*!50501 AND plugin NOT IN ('auth_socket', 'unix_socket', 'win_socket', 'auth_pam_compat') */\n /*!80000 AND account_locked = 'N' AND password_expired = 'N' */\";\n }\n if (@mysqlstatlist) {\n foreach my $line ( sort @mysqlstatlist ) {\n chomp($line);\n badprint \"User '\" . $line . \"' has no password set.\";\n push( @generalrec,\n\"Set up a Secure Password for $line user: SET PASSWORD FOR $line = PASSWORD('secure_password');\"\n );\n }\n }\n else {\n goodprint \"All database users have passwords assigned\";\n }\n\n if ( mysql_version_ge( 5, 7 ) ) {\n my $valPlugin = select_one(\n\"select count(*) from information_schema.plugins where PLUGIN_NAME='validate_password' AND PLUGIN_STATUS='ACTIVE'\"\n );\n if ( $valPlugin >= 1 ) {\n infoprint\n\"Bug #80860 MySQL 5.7: Avoid testing password when validate_password is activated\";\n return;\n }\n }\n\n # Looking for User with user/ uppercase /capitalise user as password\n @mysqlstatlist = select_array\n\"SELECT CONCAT(QUOTE(user), '\\@', QUOTE(host)) FROM mysql.user WHERE user != '' AND (CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(user) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(UPPER(user)) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(CONCAT(UPPER(LEFT(User, 1)), SUBSTRING(User, 2, LENGTH(User)))))\";\n if (@mysqlstatlist) {\n foreach my $line ( sort @mysqlstatlist ) {\n chomp($line);\n badprint \"User \" . $line . \" has user name as password.\";\n push( @generalrec,\n\"Set up a Secure Password for $line user: SET PASSWORD FOR $line = PASSWORD('secure_password');\"\n );\n }\n }\n\n @mysqlstatlist = select_array\n \"SELECT CONCAT(QUOTE(user), '\\@', host) FROM mysql.user WHERE HOST='%'\";\n if (@mysqlstatlist) {\n foreach my $line ( sort @mysqlstatlist ) {\n chomp($line);\n my $luser = ( split /@/, $line )[0];\n badprint \"User \" . $line\n . \" does not specify hostname restrictions.\";\n push( @generalrec,\n\"Restrict Host for $luser\\@'%' to $luser\\@LimitedIPRangeOrLocalhost\"\n );\n push( @generalrec,\n \"RENAME USER $luser\\@'%' TO \"\n . $luser\n . \"\\@LimitedIPRangeOrLocalhost;\" );\n }\n }\n\n unless ( -f $basic_password_files ) {\n badprint \"There is no basic password file list!\";\n return;\n }\n\n my @passwords = get_basic_passwords $basic_password_files;\n infoprint \"There are \"\n . scalar(@passwords)\n . \" basic passwords in the list.\";\n my $nbins = 0;\n my $passreq;\n if (@passwords) {\n my $nbInterPass = 0;\n foreach my $pass (@passwords) {\n $nbInterPass++;\n\n $pass =~ s/\\s//g;\n $pass =~ s/\\'/\\\\\\'/g;\n chomp($pass);\n\n # Looking for User with user/ uppercase /capitalise weak password\n @mysqlstatlist =\n select_array\n\"SELECT CONCAT(user, '\\@', host) FROM mysql.user WHERE $PASS_COLUMN_NAME = PASSWORD('\"\n . $pass\n . \"') OR $PASS_COLUMN_NAME = PASSWORD(UPPER('\"\n . $pass\n . \"')) OR $PASS_COLUMN_NAME = PASSWORD(CONCAT(UPPER(LEFT('\"\n . $pass\n . \"', 1)), SUBSTRING('\"\n . $pass\n . \"', 2, LENGTH('\"\n . $pass . \"'))))\";\n debugprint \"There are \" . scalar(@mysqlstatlist) . \" items.\";\n if (@mysqlstatlist) {\n foreach my $line (@mysqlstatlist) {\n chomp($line);\n badprint \"User '\" . $line\n . \"' is using weak password: $pass in a lower, upper or capitalize derivative version.\";\n\n push( @generalrec,\n\"Set up a Secure Password for $line user: SET PASSWORD FOR '\"\n . ( split /@/, $line )[0] . \"'\\@'\"\n . ( split /@/, $line )[1]\n . \"' = PASSWORD('secure_password');\" );\n $nbins++;\n }\n }\n debugprint \"$nbInterPass / \" . scalar(@passwords)\n if ( $nbInterPass % 1000 == 0 );\n }\n }\n if ( $nbins > 0 ) {\n push( @generalrec,\n $nbins\n . \" user(s) used basic or weak password from basic dictionary.\" );\n }\n}\n\nsub get_replication_status {\n subheaderprint \"Replication Metrics\";\n infoprint \"Galera Synchronous replication: \" . $myvar{'have_galera'};\n if ( scalar( keys %myslaves ) == 0 ) {\n infoprint \"No replication slave(s) for this server.\";\n }\n else {\n infoprint \"This server is acting as master for \"\n . scalar( keys %myslaves )\n . \" server(s).\";\n }\n infoprint \"Binlog format: \" . $myvar{'binlog_format'};\n infoprint \"XA support enabled: \" . $myvar{'innodb_support_xa'};\n\n infoprint \"Semi synchronous replication Master: \"\n . (\n (\n defined( $myvar{'rpl_semi_sync_master_enabled'} )\n or defined( $myvar{'rpl_semi_sync_source_enabled'} )\n )\n ? ( $myvar{'rpl_semi_sync_master_enabled'}\n // $myvar{'rpl_semi_sync_source_enabled'} )\n : 'Not Activated'\n );\n infoprint \"Semi synchronous replication Slave: \"\n . (\n (\n defined( $myvar{'rpl_semi_sync_slave_enabled'} )\n or defined( $myvar{'rpl_semi_sync_replica_enabled'} )\n )\n ? ( $myvar{'rpl_semi_sync_slave_enabled'}\n // $myvar{'rpl_semi_sync_replica_enabled'} )\n : 'Not Activated'\n );\n if ( scalar( keys %myrepl ) == 0 and scalar( keys %myslaves ) == 0 ) {\n infoprint \"This is a standalone server\";\n return;\n }\n if ( scalar( keys %myrepl ) == 0 ) {\n infoprint\n \"No replication setup for this server or replication not started.\";\n return;\n }\n\n $result{'Replication'}{'status'} = \\%myrepl;\n my ($io_running) = $myrepl{'Slave_IO_Running'}\n // $myrepl{'Replica_IO_Running'};\n debugprint \"IO RUNNING: $io_running \";\n my ($sql_running) = $myrepl{'Slave_SQL_Running'}\n // $myrepl{'Replica_SQL_Running'};\n debugprint \"SQL RUNNING: $sql_running \";\n\n my ($seconds_behind_master) = $myrepl{'Seconds_Behind_Master'}\n // $myrepl{'Seconds_Behind_Source'};\n $seconds_behind_master = 1000000 unless defined($seconds_behind_master);\n debugprint \"SECONDS : $seconds_behind_master \";\n\n if ( defined($io_running)\n and ( $io_running !~ /yes/i or $sql_running !~ /yes/i ) )\n {\n badprint\n \"This replication slave is not running but seems to be configured.\";\n }\n if ( defined($io_running)\n && $io_running =~ /yes/i\n && $sql_running =~ /yes/i )\n {\n if ( $myvar{'read_only'} eq 'OFF' ) {\n badprint\n\"This replication slave is running with the read_only option disabled.\";\n }\n else {\n goodprint\n\"This replication slave is running with the read_only option enabled.\";\n }\n if ( $seconds_behind_master > 0 ) {\n badprint\n\"This replication slave is lagging and slave has $seconds_behind_master second(s) behind master host.\";\n }\n else {\n goodprint \"This replication slave is up to date with master.\";\n }\n }\n}\n\n# https://endoflife.software/applications/databases/mysql\n# https://endoflife.date/mariadb\nsub validate_mysql_version {\n ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) =\n $myvar{'version'} =~ /^(\\d+)(?:\\.(\\d+)|)(?:\\.(\\d+)|)/;\n $mysqlverminor ||= 0;\n $mysqlvermicro ||= 0;\n\n prettyprint \" \";\n\n if ( mysql_version_eq(9)\n or mysql_version_eq(8, 4)\n\t\t\t\tor mysql_version_eq(8, 0)\n or mysql_version_eq( 10, 5 )\n or mysql_version_eq( 10, 6 )\n or mysql_version_eq( 10, 11 )\n or mysql_version_eq( 11, 4 ) )\n {\n goodprint \"Currently running supported MySQL version \"\n . $myvar{'version'} . \"\";\n return;\n }\n else {\n badprint \"Your MySQL version \"\n . $myvar{'version'}\n . \" is EOL software. Upgrade soon!\";\n push( @generalrec,\n \"You are using an unsupported version for production environments\"\n );\n push( @generalrec,\n \"Upgrade as soon as possible to a supported version !\" );\n\n }\n}\n\n# Checks if MySQL version is equal to (major, minor, micro)\nsub mysql_version_eq {\n my ( $maj, $min, $mic ) = @_;\n my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) =\n $myvar{'version'} =~ /^(\\d+)(?:\\.(\\d+)|)(?:\\.(\\d+)|)/;\n\n return int($mysqlvermajor) == int($maj)\n if ( !defined($min) && !defined($mic) );\n return int($mysqlvermajor) == int($maj) && int($mysqlverminor) == int($min)\n if ( !defined($mic) );\n return ( int($mysqlvermajor) == int($maj)\n && int($mysqlverminor) == int($min)\n && int($mysqlvermicro) == int($mic) );\n}\n\n# Checks if MySQL version is greater than equal to (major, minor, micro)\nsub mysql_version_ge {\n my ( $maj, $min, $mic ) = @_;\n $min ||= 0;\n $mic ||= 0;\n my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) =\n $myvar{'version'} =~ /^(\\d+)(?:\\.(\\d+)|)(?:\\.(\\d+)|)/;\n\n return\n int($mysqlvermajor) > int($maj)\n || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) > int($min) )\n || ( int($mysqlvermajor) == int($maj)\n && int($mysqlverminor) == int($min)\n && int($mysqlvermicro) >= int($mic) );\n}\n\n# Checks if MySQL version is lower than equal to (major, minor, micro)\nsub mysql_version_le {\n my ( $maj, $min, $mic ) = @_;\n $min ||= 0;\n $mic ||= 0;\n my ( $mysqlvermajor, $mysqlverminor, $mysqlvermicro ) =\n $myvar{'version'} =~ /^(\\d+)(?:\\.(\\d+)|)(?:\\.(\\d+)|)/;\n return\n int($mysqlvermajor) < int($maj)\n || ( int($mysqlvermajor) == int($maj) && int($mysqlverminor) < int($min) )\n || ( int($mysqlvermajor) == int($maj)\n && int($mysqlverminor) == int($min)\n && int($mysqlvermicro) <= int($mic) );\n}\n\n# Checks for 32-bit boxes with more than 2GB of RAM\nmy ($arch);\n\nsub check_architecture {\n if ( is_remote eq 1 ) {\n infoprint \"Skipping architecture check on remote host\";\n infoprint \"Using default $opt{defaultarch} bits as target architecture\";\n $arch = $opt{defaultarch};\n return;\n }\n if ( `uname` =~ /SunOS/ && `isainfo -b` =~ /64/ ) {\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` !~ /SunOS/ && `uname -m` =~ /(64|s390x)/ ) {\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` =~ /AIX/ && `bootinfo -K` =~ /64/ ) {\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` =~ /NetBSD|OpenBSD/ && `sysctl -b hw.machine` =~ /64/ ) {\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` =~ /FreeBSD/ && `sysctl -b hw.machine_arch` =~ /64/ ) {\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` =~ /Darwin/ && `uname -m` =~ /Power Macintosh/ ) {\n\n# Darwin box.local 9.8.0 Darwin Kernel Version 9.8.0: Wed Jul 15 16:57:01 PDT 2009; root:xnu1228.15.4~1/RELEASE_PPC Power Macintosh\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n elsif ( `uname` =~ /Darwin/ && `uname -m` =~ /x86_64/ ) {\n\n# Darwin gibas.local 12.6.0 Darwin Kernel Version 12.3.0: Sun Jan 6 22:37:10 PST 2013; root:xnu-2050.22.13~1/RELEASE_X86_64 x86_64\n $arch = 64;\n goodprint \"Operating on 64-bit architecture\";\n }\n else {\n $arch = 32;\n if ( $physical_memory > 2147483648 ) {\n badprint\n\"Switch to 64-bit OS - MySQL cannot currently use all of your RAM\";\n }\n else {\n goodprint \"Operating on 32-bit architecture with less than 2GB RAM\";\n }\n }\n $result{'OS'}{'Architecture'} = \"$arch bits\";\n\n}\n\n# Start up a ton of storage engine counts/statistics\nmy ( %enginestats, %enginecount, $fragtables );\n\nsub check_storage_engines {\n subheaderprint \"Storage Engine Statistics\";\n if ( $opt{skipsize} eq 1 ) {\n infoprint \"Skipped due to --skipsize option\";\n return;\n }\n\n my $engines;\n if ( mysql_version_ge( 5, 5 ) ) {\n my @engineresults = select_array\n\"SELECT ENGINE,SUPPORT FROM information_schema.ENGINES ORDER BY ENGINE ASC\";\n foreach my $line (@engineresults) {\n my ( $engine, $engineenabled );\n ( $engine, $engineenabled ) = $line =~ /([a-zA-Z_]*)\\s+([a-zA-Z]+)/;\n $result{'Engine'}{$engine}{'Enabled'} = $engineenabled;\n $engines .=\n ( $engineenabled eq \"YES\" || $engineenabled eq \"DEFAULT\" )\n ? greenwrap \"+\" . $engine . \" \"\n : redwrap \"-\" . $engine . \" \";\n }\n }\n elsif ( mysql_version_ge( 5, 1, 5 ) ) {\n my @engineresults = select_array\n\"SELECT ENGINE, SUPPORT FROM information_schema.ENGINES WHERE ENGINE NOT IN ('MyISAM', 'MERGE', 'MEMORY') ORDER BY ENGINE\";\n foreach my $line (@engineresults) {\n my ( $engine, $engineenabled );\n ( $engine, $engineenabled ) = $line =~ /([a-zA-Z_]*)\\s+([a-zA-Z]+)/;\n $result{'Engine'}{$engine}{'Enabled'} = $engineenabled;\n $engines .=\n ( $engineenabled eq \"YES\" || $engineenabled eq \"DEFAULT\" )\n ? greenwrap \"+\" . $engine . \" \"\n : redwrap \"-\" . $engine . \" \";\n }\n }\n else {\n $engines .=\n ( defined $myvar{'have_archive'} && $myvar{'have_archive'} eq \"YES\" )\n ? greenwrap \"+Archive \"\n : redwrap \"-Archive \";\n $engines .=\n ( defined $myvar{'have_bdb'} && $myvar{'have_bdb'} eq \"YES\" )\n ? greenwrap \"+BDB \"\n : redwrap \"-BDB \";\n $engines .=\n ( defined $myvar{'have_federated_engine'}\n && $myvar{'have_federated_engine'} eq \"YES\" )\n ? greenwrap \"+Federated \"\n : redwrap \"-Federated \";\n $engines .=\n ( defined $myvar{'have_innodb'} && $myvar{'have_innodb'} eq \"YES\" )\n ? greenwrap \"+InnoDB \"\n : redwrap \"-InnoDB \";\n $engines .=\n ( defined $myvar{'have_isam'} && $myvar{'have_isam'} eq \"YES\" )\n ? greenwrap \"+ISAM \"\n : redwrap \"-ISAM \";\n $engines .=\n ( defined $myvar{'have_ndbcluster'}\n && $myvar{'have_ndbcluster'} eq \"YES\" )\n ? greenwrap \"+NDBCluster \"\n : redwrap \"-NDBCluster \";\n }\n\n my @dblist = grep { $_ ne 'lost+found' } select_array \"SHOW DATABASES\";\n\n $result{'Databases'}{'List'} = [@dblist];\n infoprint \"Status: $engines\";\n if ( mysql_version_ge( 5, 1, 5 ) ) {\n\n# MySQL 5+ servers can have table sizes calculated quickly from information schema\n my @templist = select_array\n\"SELECT ENGINE, SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(ENGINE), SUM(DATA_LENGTH), SUM(INDEX_LENGTH) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema', 'performance_schema', 'mysql') AND ENGINE IS NOT NULL GROUP BY ENGINE ORDER BY ENGINE ASC;\";\n\n my ( $engine, $size, $count, $dsize, $isize );\n foreach my $line (@templist) {\n ( $engine, $size, $count, $dsize, $isize ) =\n $line =~ /([a-zA-Z_]+)\\s+(\\d+)\\s+(\\d+)\\s+(\\d+)\\s+(\\d+)/;\n debugprint \"Engine Found: $engine\";\n next unless ( defined($engine) or trim($engine) eq '' );\n $size = 0 unless ( defined($size) or trim($engine) eq '' );\n $isize = 0 unless ( defined($isize) or trim($engine) eq '' );\n $dsize = 0 unless ( defined($dsize) or trim($engine) eq '' );\n $count = 0 unless ( defined($count) or trim($engine) eq '' );\n $enginestats{$engine} = $size;\n $enginecount{$engine} = $count;\n $result{'Engine'}{$engine}{'Table Number'} = $count;\n $result{'Engine'}{$engine}{'Total Size'} = $size;\n $result{'Engine'}{$engine}{'Data Size'} = $dsize;\n $result{'Engine'}{$engine}{'Index Size'} = $isize;\n }\n\n #print Dumper( \\%enginestats ) if $opt{debug};\n my $not_innodb = '';\n if ( not defined $result{'Variables'}{'innodb_file_per_table'} ) {\n $not_innodb = \"AND NOT ENGINE='InnoDB'\";\n }\n elsif ( $result{'Variables'}{'innodb_file_per_table'} eq 'OFF' ) {\n $not_innodb = \"AND NOT ENGINE='InnoDB'\";\n }\n $result{'Tables'}{'Fragmented tables'} =\n [ select_array\n\"SELECT TABLE_SCHEMA, TABLE_NAME, ENGINE, CAST(DATA_FREE AS SIGNED) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema', 'performance_schema', 'mysql') AND DATA_LENGTH/1024/1024>100 AND cast(DATA_FREE as signed)*100/(DATA_LENGTH+INDEX_LENGTH+cast(DATA_FREE as signed)) > 10 AND NOT ENGINE='MEMORY' $not_innodb\"\n ];\n $fragtables = scalar @{ $result{'Tables'}{'Fragmented tables'} };\n\n }\n else {\n\n # MySQL < 5 servers take a lot of work to get table sizes\n my @tblist;\n\n# Now we build a database list, and loop through it to get storage engine stats for tables\n foreach my $db (@dblist) {\n chomp($db);\n if ( $db eq \"information_schema\"\n or $db eq \"performance_schema\"\n or $db eq \"mysql\"\n or $db eq \"lost+found\" )\n {\n next;\n }\n my @ixs = ( 1, 6, 9 );\n if ( !mysql_version_ge( 4, 1 ) ) {\n\n # MySQL 3.23/4.0 keeps Data_Length in the 5th (0-based) column\n @ixs = ( 1, 5, 8 );\n }\n push( @tblist,\n map { [ (split)[@ixs] ] }\n select_array \"SHOW TABLE STATUS FROM \\\\\\`$db\\\\\\`\" );\n }\n\n # Parse through the table list to generate storage engine counts/statistics\n $fragtables = 0;\n foreach my $tbl (@tblist) {\n\n #debugprint \"Data dump \" . Dumper(@$tbl) if $opt{debug};\n my ( $engine, $size, $datafree ) = @$tbl;\n next if $engine eq 'NULL' or not defined($engine);\n $size = 0 if $size eq 'NULL' or not defined($size);\n $datafree = 0 if $datafree eq 'NULL' or not defined($datafree);\n if ( defined $enginestats{$engine} ) {\n $enginestats{$engine} += $size;\n $enginecount{$engine} += 1;\n }\n else {\n $enginestats{$engine} = $size;\n $enginecount{$engine} = 1;\n }\n if ( $datafree > 0 ) {\n $fragtables++;\n }\n }\n }\n while ( my ( $engine, $size ) = each(%enginestats) ) {\n infoprint \"Data in $engine tables: \"\n . hr_bytes($size)\n . \" (Tables: \"\n . $enginecount{$engine} . \")\" . \"\";\n }\n\n # If the storage engine isn't being used, recommend it to be disabled\n if ( !defined $enginestats{'InnoDB'}\n && defined $myvar{'have_innodb'}\n && $myvar{'have_innodb'} eq \"YES\" )\n {\n badprint \"InnoDB is enabled, but isn't being used\";\n push( @generalrec,\n \"Add skip-innodb to MySQL configuration to disable InnoDB\" );\n }\n if ( !defined $enginestats{'BerkeleyDB'}\n && defined $myvar{'have_bdb'}\n && $myvar{'have_bdb'} eq \"YES\" )\n {\n badprint \"BDB is enabled, but isn't being used\";\n push( @generalrec,\n \"Add skip-bdb to MySQL configuration to disable BDB\" );\n }\n if ( !defined $enginestats{'ISAM'}\n && defined $myvar{'have_isam'}\n && $myvar{'have_isam'} eq \"YES\" )\n {\n badprint \"MyISAM is enabled, but isn't being used\";\n push( @generalrec,\n\"Add skip-isam to MySQL configuration to disable MyISAM (MySQL > 4.1.0)\"\n );\n }\n\n # Fragmented tables\n if ( $fragtables > 0 ) {\n badprint \"Total fragmented tables: $fragtables\";\n push @generalrec,\n'Run ALTER TABLE ... FORCE or OPTIMIZE TABLE to defragment tables for better performance';\n my $total_free = 0;\n foreach my $table_line ( @{ $result{'Tables'}{'Fragmented tables'} } ) {\n my ( $table_schema, $table_name, $engine, $data_free ) =\n split /\\t/msx, $table_line;\n $data_free = $data_free / 1024 / 1024;\n $total_free += $data_free;\n my $generalrec;\n if ( $engine eq 'InnoDB' ) {\n $generalrec =\n \" ALTER TABLE `$table_schema`.`$table_name` FORCE;\";\n }\n else {\n $generalrec = \" OPTIMIZE TABLE `$table_schema`.`$table_name`;\";\n }\n $generalrec .= \" -- can free $data_free MiB\";\n push @generalrec, $generalrec;\n }\n push @generalrec,\n \"Total freed space after defragmentation: $total_free MiB\";\n }\n else {\n goodprint \"Total fragmented tables: $fragtables\";\n }\n\n # Auto increments\n my %tblist;\n\n # Find the maximum integer\n my $maxint = select_one \"SELECT ~0\";\n $result{'MaxInt'} = $maxint;\n\n# Now we use a database list, and loop through it to get storage engine stats for tables\n foreach my $db (@dblist) {\n chomp($db);\n\n if ( !$tblist{$db} ) {\n $tblist{$db} = ();\n }\n\n if ( $db eq \"information_schema\" ) { next; }\n my @ia = ( 0, 10 );\n if ( !mysql_version_ge( 4, 1 ) ) {\n\n # MySQL 3.23/4.0 keeps Data_Length in the 5th (0-based) column\n @ia = ( 0, 9 );\n }\n push(\n @{ $tblist{$db} },\n map { [ (split)[@ia] ] }\n select_array \"SHOW TABLE STATUS FROM \\\\\\`$db\\\\\\`\"\n );\n }\n\n my @dbnames = keys %tblist;\n\n foreach my $db (@dbnames) {\n foreach my $tbl ( @{ $tblist{$db} } ) {\n my ( $name, $autoincrement ) = @$tbl;\n\n if ( $autoincrement =~ /^\\d+?$/ ) {\n my $percent = percentage( $autoincrement, $maxint );\n $result{'PctAutoIncrement'}{\"$db.$name\"} = $percent;\n if ( $percent >= 75 ) {\n badprint\n\"Table '$db.$name' has an autoincrement value near max capacity ($percent%)\";\n }\n }\n }\n }\n}\n\nmy %mycalc;\n\nsub dump_into_file {\n my $file = shift;\n my $content = shift;\n if ( -d \"$opt{dumpdir}\" ) {\n $file = \"$opt{dumpdir}/$file\";\n open( FILE, \">$file\" ) or die \"Can't open $file: $!\";\n print FILE $content;\n close FILE;\n infoprint \"Data saved to $file\";\n }\n}\n\nsub calculations {\n if ( $mystat{'Questions'} < 1 ) {\n badprint \"Your server has not answered any queries: cannot continue...\";\n exit 2;\n }\n\n # Per-thread memory\n $mycalc{'per_thread_buffers'} = 0;\n $mycalc{'per_thread_buffers'} += $myvar{'read_buffer_size'}\n if is_int( $myvar{'read_buffer_size'} );\n $mycalc{'per_thread_buffers'} += $myvar{'read_rnd_buffer_size'}\n if is_int( $myvar{'read_rnd_buffer_size'} );\n $mycalc{'per_thread_buffers'} += $myvar{'sort_buffer_size'}\n if is_int( $myvar{'sort_buffer_size'} );\n $mycalc{'per_thread_buffers'} += $myvar{'thread_stack'}\n if is_int( $myvar{'thread_stack'} );\n $mycalc{'per_thread_buffers'} += $myvar{'join_buffer_size'}\n if is_int( $myvar{'join_buffer_size'} );\n $mycalc{'per_thread_buffers'} += $myvar{'binlog_cache_size'}\n if is_int( $myvar{'binlog_cache_size'} );\n debugprint \"per_thread_buffers: $mycalc{'per_thread_buffers'} (\"\n . human_size( $mycalc{'per_thread_buffers'} ) . \" )\";\n\n# Error max_allowed_packet is not included in thread buffers size\n#$mycalc{'per_thread_buffers'} += $myvar{'max_allowed_packet'} if is_int($myvar{'max_allowed_packet'});\n\n # Total per-thread memory\n $mycalc{'total_per_thread_buffers'} =\n $mycalc{'per_thread_buffers'} * $myvar{'max_connections'};\n\n # Max total per-thread memory reached\n $mycalc{'max_total_per_thread_buffers'} =\n $mycalc{'per_thread_buffers'} * $mystat{'Max_used_connections'};\n\n # Server-wide memory\n $mycalc{'max_tmp_table_size'} =\n ( $myvar{'tmp_table_size'} > $myvar{'max_heap_table_size'} )\n ? $myvar{'max_heap_table_size'}\n : $myvar{'tmp_table_size'};\n $mycalc{'server_buffers'} =\n $myvar{'key_buffer_size'} + $mycalc{'max_tmp_table_size'};\n $mycalc{'server_buffers'} +=\n ( defined $myvar{'innodb_buffer_pool_size'} )\n ? $myvar{'innodb_buffer_pool_size'}\n : 0;\n $mycalc{'server_buffers'} +=\n ( defined $myvar{'innodb_additional_mem_pool_size'} )\n ? $myvar{'innodb_additional_mem_pool_size'}\n : 0;\n $mycalc{'server_buffers'} +=\n ( defined $myvar{'innodb_log_buffer_size'} )\n ? $myvar{'innodb_log_buffer_size'}\n : 0;\n $mycalc{'server_buffers'} +=\n ( defined $myvar{'query_cache_size'} ) ? $myvar{'query_cache_size'} : 0;\n $mycalc{'server_buffers'} +=\n ( defined $myvar{'aria_pagecache_buffer_size'} )\n ? $myvar{'aria_pagecache_buffer_size'}\n : 0;\n\n# Global memory\n# Max used memory is memory used by MySQL based on Max_used_connections\n# This is the max memory used theoretically calculated with the max concurrent connection number reached by mysql\n $mycalc{'max_used_memory'} =\n $mycalc{'server_buffers'} +\n $mycalc{\"max_total_per_thread_buffers\"} +\n get_pf_memory();\n\n # + get_gcache_memory();\n $mycalc{'pct_max_used_memory'} =\n percentage( $mycalc{'max_used_memory'}, $physical_memory );\n\n# Total possible memory is memory needed by MySQL based on max_connections\n# This is the max memory MySQL can theoretically used if all connections allowed has opened by mysql\n $mycalc{'max_peak_memory'} =\n $mycalc{'server_buffers'} +\n $mycalc{'total_per_thread_buffers'} +\n get_pf_memory();\n\n # + get_gcache_memory();\n $mycalc{'pct_max_physical_memory'} =\n percentage( $mycalc{'max_peak_memory'}, $physical_memory );\n\n debugprint \"Max Used Memory: \"\n . hr_bytes( $mycalc{'max_used_memory'} ) . \"\";\n debugprint \"Max Used Percentage RAM: \"\n . $mycalc{'pct_max_used_memory'} . \"%\";\n\n debugprint \"Max Peak Memory: \"\n . hr_bytes( $mycalc{'max_peak_memory'} ) . \"\";\n debugprint \"Max Peak Percentage RAM: \"\n . $mycalc{'pct_max_physical_memory'} . \"%\";\n\n # Slow queries\n $mycalc{'pct_slow_queries'} =\n int( ( $mystat{'Slow_queries'} / $mystat{'Questions'} ) * 100 );\n\n # Connections\n $mycalc{'pct_connections_used'} = int(\n ( $mystat{'Max_used_connections'} / $myvar{'max_connections'} ) * 100 );\n $mycalc{'pct_connections_used'} =\n ( $mycalc{'pct_connections_used'} > 100 )\n ? 100\n : $mycalc{'pct_connections_used'};\n\n # Aborted Connections\n $mycalc{'pct_connections_aborted'} =\n percentage( $mystat{'Aborted_connects'}, $mystat{'Connections'} );\n debugprint \"Aborted_connects: \" . $mystat{'Aborted_connects'} . \"\";\n debugprint \"Connections: \" . $mystat{'Connections'} . \"\";\n debugprint \"pct_connections_aborted: \"\n . $mycalc{'pct_connections_aborted'} . \"\";\n\n # Key buffers\n if ( mysql_version_ge( 4, 1 ) && $myvar{'key_buffer_size'} > 0 ) {\n $mycalc{'pct_key_buffer_used'} = sprintf(\n \"%.1f\",\n (\n 1 - (\n (\n $mystat{'Key_blocks_unused'} *\n $myvar{'key_cache_block_size'}\n ) / $myvar{'key_buffer_size'}\n )\n ) * 100\n );\n }\n else {\n $mycalc{'pct_key_buffer_used'} = 0;\n }\n\n if ( $mystat{'Key_read_requests'} > 0 ) {\n $mycalc{'pct_keys_from_mem'} = sprintf(\n \"%.1f\",\n (\n 100 - (\n ( $mystat{'Key_reads'} / $mystat{'Key_read_requests'} ) *\n 100\n )\n )\n );\n }\n else {\n $mycalc{'pct_keys_from_mem'} = 0;\n }\n if ( defined $mystat{'Aria_pagecache_read_requests'}\n && $mystat{'Aria_pagecache_read_requests'} > 0 )\n {\n $mycalc{'pct_aria_keys_from_mem'} = sprintf(\n \"%.1f\",\n (\n 100 - (\n (\n $mystat{'Aria_pagecache_reads'} /\n $mystat{'Aria_pagecache_read_requests'}\n ) * 100\n )\n )\n );\n }\n else {\n $mycalc{'pct_aria_keys_from_mem'} = 0;\n }\n\n if ( $mystat{'Key_write_requests'} > 0 ) {\n $mycalc{'pct_wkeys_from_mem'} = sprintf( \"%.1f\",\n ( ( $mystat{'Key_writes'} / $mystat{'Key_write_requests'} ) * 100 )\n );\n }\n else {\n $mycalc{'pct_wkeys_from_mem'} = 0;\n }\n\n if ( $doremote eq 0 and !mysql_version_ge(5) ) {\n my $size = 0;\n $size += (split)[0]\n for\n`find \"$myvar{'datadir'}\" -name \"*.MYI\" -print0 2>&1 | xargs $xargsflags -0 du -L $duflags 2>&1`;\n $mycalc{'total_myisam_indexes'} = $size;\n $size = 0 + (split)[0]\n for\n`find \"$myvar{'datadir'}\" -name \"*.MAI\" -print0 2>&1 | xargs $xargsflags -0 du -L $duflags 2>&1`;\n $mycalc{'total_aria_indexes'} = $size;\n }\n elsif ( mysql_version_ge(5) ) {\n $mycalc{'total_myisam_indexes'} = select_one\n\"SELECT IFNULL(SUM(INDEX_LENGTH), 0) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema') AND ENGINE = 'MyISAM';\";\n $mycalc{'total_aria_indexes'} = select_one\n\"SELECT IFNULL(SUM(INDEX_LENGTH), 0) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('information_schema') AND ENGINE = 'Aria';\";\n }\n if ( defined $mycalc{'total_myisam_indexes'} ) {\n chomp( $mycalc{'total_myisam_indexes'} );\n }\n if ( defined $mycalc{'total_aria_indexes'} ) {\n chomp( $mycalc{'total_aria_indexes'} );\n }\n\n # Query cache\n if ( mysql_version_ge(8) and mysql_version_le(10) ) {\n $mycalc{'query_cache_efficiency'} = 0;\n }\n elsif ( mysql_version_ge(4) ) {\n $mycalc{'query_cache_efficiency'} = sprintf(\n \"%.1f\",\n (\n $mystat{'Qcache_hits'} /\n ( $mystat{'Com_select'} + $mystat{'Qcache_hits'} )\n ) * 100\n );\n if ( $myvar{'query_cache_size'} ) {\n $mycalc{'pct_query_cache_used'} = sprintf(\n \"%.1f\",\n 100 - (\n $mystat{'Qcache_free_memory'} / $myvar{'query_cache_size'}\n ) * 100\n );\n }\n if ( $mystat{'Qcache_lowmem_prunes'} == 0 ) {\n $mycalc{'query_cache_prunes_per_day'} = 0;\n }\n else {\n $mycalc{'query_cache_prunes_per_day'} = int(\n $mystat{'Qcache_lowmem_prunes'} / ( $mystat{'Uptime'} / 86400 )\n );\n }\n }\n\n # Sorting\n $mycalc{'total_sorts'} = $mystat{'Sort_scan'} + $mystat{'Sort_range'};\n if ( $mycalc{'total_sorts'} > 0 ) {\n $mycalc{'pct_temp_sort_table'} = int(\n ( $mystat{'Sort_merge_passes'} / $mycalc{'total_sorts'} ) * 100 );\n }\n\n # Joins\n $mycalc{'joins_without_indexes'} =\n $mystat{'Select_range_check'} + $mystat{'Select_full_join'};\n $mycalc{'joins_without_indexes_per_day'} =\n int( $mycalc{'joins_without_indexes'} / ( $mystat{'Uptime'} / 86400 ) );\n\n # Temporary tables\n if ( $mystat{'Created_tmp_tables'} > 0 ) {\n if ( $mystat{'Created_tmp_disk_tables'} > 0 ) {\n $mycalc{'pct_temp_disk'} = int(\n (\n $mystat{'Created_tmp_disk_tables'} /\n $mystat{'Created_tmp_tables'}\n ) * 100\n );\n }\n else {\n $mycalc{'pct_temp_disk'} = 0;\n }\n }\n\n # Table cache\n if ( $mystat{'Opened_tables'} > 0 ) {\n if ( not defined( $mystat{'Table_open_cache_hits'} ) ) {\n $mycalc{'table_cache_hit_rate'} =\n int( $mystat{'Open_tables'} * 100 / $mystat{'Opened_tables'} );\n }\n else {\n $mycalc{'table_cache_hit_rate'} = int(\n $mystat{'Table_open_cache_hits'} * 100 / (\n $mystat{'Table_open_cache_hits'} +\n $mystat{'Table_open_cache_misses'}\n )\n );\n }\n }\n else {\n $mycalc{'table_cache_hit_rate'} = 100;\n }\n\n # Open files\n if ( $myvar{'open_files_limit'} > 0 ) {\n $mycalc{'pct_files_open'} =\n int( $mystat{'Open_files'} * 100 / $myvar{'open_files_limit'} );\n }\n\n # Table locks\n if ( $mystat{'Table_locks_immediate'} > 0 ) {\n if ( $mystat{'Table_locks_waited'} == 0 ) {\n $mycalc{'pct_table_locks_immediate'} = 100;\n }\n else {\n $mycalc{'pct_table_locks_immediate'} = int(\n $mystat{'Table_locks_immediate'} * 100 / (\n $mystat{'Table_locks_waited'} +\n $mystat{'Table_locks_immediate'}\n )\n );\n }\n }\n\n # Thread cache\n $mycalc{'thread_cache_hit_rate'} =\n int( 100 -\n ( ( $mystat{'Threads_created'} / $mystat{'Connections'} ) * 100 ) );\n\n # Other\n if ( $mystat{'Connections'} > 0 ) {\n $mycalc{'pct_aborted_connections'} =\n int( ( $mystat{'Aborted_connects'} / $mystat{'Connections'} ) * 100 );\n }\n if ( $mystat{'Questions'} > 0 ) {\n $mycalc{'total_reads'} = $mystat{'Com_select'};\n $mycalc{'total_writes'} =\n $mystat{'Com_delete'} +\n $mystat{'Com_insert'} +\n $mystat{'Com_update'} +\n $mystat{'Com_replace'};\n if ( $mycalc{'total_reads'} == 0 ) {\n $mycalc{'pct_reads'} = 0;\n $mycalc{'pct_writes'} = 100;\n }\n else {\n $mycalc{'pct_reads'} = int(\n (\n $mycalc{'total_reads'} /\n ( $mycalc{'total_reads'} + $mycalc{'total_writes'} )\n ) * 100\n );\n $mycalc{'pct_writes'} = 100 - $mycalc{'pct_reads'};\n }\n }\n\n # InnoDB\n $myvar{'innodb_log_files_in_group'} = 1\n unless defined( $myvar{'innodb_log_files_in_group'} );\n $myvar{'innodb_log_files_in_group'} = 1\n if $myvar{'innodb_log_files_in_group'} == 0;\n\n $myvar{\"innodb_buffer_pool_instances\"} = 1\n unless defined( $myvar{'innodb_buffer_pool_instances'} );\n if ( $myvar{'have_innodb'} eq \"YES\" ) {\n $mycalc{'innodb_log_size_pct'} =\n ( $myvar{'innodb_log_file_size'} *\n $myvar{'innodb_log_files_in_group'} * 100 /\n $myvar{'innodb_buffer_pool_size'} );\n }\n if ( !defined $myvar{'innodb_buffer_pool_size'} ) {\n $mycalc{'innodb_log_size_pct'} = 0;\n $myvar{'innodb_buffer_pool_size'} = 0;\n }\n\n # InnoDB Buffer pool read cache efficiency\n (\n $mystat{'Innodb_buffer_pool_read_requests'},\n $mystat{'Innodb_buffer_pool_reads'}\n )\n = ( 1, 1 )\n unless defined $mystat{'Innodb_buffer_pool_reads'};\n $mycalc{'pct_read_efficiency'} = percentage(\n $mystat{'Innodb_buffer_pool_read_requests'},\n (\n $mystat{'Innodb_buffer_pool_read_requests'} +\n $mystat{'Innodb_buffer_pool_reads'}\n )\n ) if defined $mystat{'Innodb_buffer_pool_read_requests'};\n debugprint \"pct_read_efficiency: \" . $mycalc{'pct_read_efficiency'} . \"\";\n debugprint \"Innodb_buffer_pool_reads: \"\n . $mystat{'Innodb_buffer_pool_reads'} . \"\";\n debugprint \"Innodb_buffer_pool_read_requests: \"\n . $mystat{'Innodb_buffer_pool_read_requests'} . \"\";\n\n # InnoDB log write cache efficiency\n ( $mystat{'Innodb_log_write_requests'}, $mystat{'Innodb_log_writes'} ) =\n ( 1, 1 )\n unless defined $mystat{'Innodb_log_writes'};\n $mycalc{'pct_write_efficiency'} = percentage(\n ( $mystat{'Innodb_log_write_requests'} - $mystat{'Innodb_log_writes'} ),\n $mystat{'Innodb_log_write_requests'}\n ) if defined $mystat{'Innodb_log_write_requests'};\n debugprint \"pct_write_efficiency: \" . $mycalc{'pct_write_efficiency'} . \"\";\n debugprint \"Innodb_log_writes: \" . $mystat{'Innodb_log_writes'} . \"\";\n debugprint \"Innodb_log_write_requests: \"\n . $mystat{'Innodb_log_write_requests'} . \"\";\n $mycalc{'pct_innodb_buffer_used'} = percentage(\n (\n $mystat{'Innodb_buffer_pool_pages_total'} -\n $mystat{'Innodb_buffer_pool_pages_free'}\n ),\n $mystat{'Innodb_buffer_pool_pages_total'}\n ) if defined $mystat{'Innodb_buffer_pool_pages_total'};\n\n my $lreq =\n \"select ROUND( 100* sum(allocated)/ \"\n . $myvar{'innodb_buffer_pool_size'}\n . ',1) FROM sys.x\\$innodb_buffer_stats_by_table;';\n debugprint(\"lreq: $lreq\");\n $mycalc{'innodb_buffer_alloc_pct'} = select_one($lreq)\n if ( $opt{experimental} );\n\n # Binlog Cache\n if ( $myvar{'log_bin'} ne 'OFF' ) {\n $mycalc{'pct_binlog_cache'} = percentage(\n $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'},\n $mystat{'Binlog_cache_use'} );\n }\n}\n\nsub mysql_stats {\n subheaderprint \"Performance Metrics\";\n\n # Show uptime, queries per second, connections, traffic stats\n my $qps;\n if ( $mystat{'Uptime'} > 0 ) {\n $qps = sprintf( \"%.3f\", $mystat{'Questions'} / $mystat{'Uptime'} );\n }\n push( @generalrec,\n\"MySQL was started within the last 24 hours: recommendations may be inaccurate\"\n ) if ( $mystat{'Uptime'} < 86400 );\n infoprint \"Up for: \"\n . pretty_uptime( $mystat{'Uptime'} ) . \" (\"\n . hr_num( $mystat{'Questions'} ) . \" q [\"\n . hr_num($qps)\n . \" qps], \"\n . hr_num( $mystat{'Connections'} )\n . \" conn,\" . \" TX: \"\n . hr_bytes_rnd( $mystat{'Bytes_sent'} )\n . \", RX: \"\n . hr_bytes_rnd( $mystat{'Bytes_received'} ) . \")\";\n infoprint \"Reads / Writes: \"\n . $mycalc{'pct_reads'} . \"% / \"\n . $mycalc{'pct_writes'} . \"%\";\n\n # Binlog Cache\n if ( $myvar{'log_bin'} eq 'OFF' ) {\n infoprint \"Binary logging is disabled\";\n }\n else {\n infoprint \"Binary logging is enabled (GTID MODE: \"\n . ( defined( $myvar{'gtid_mode'} ) ? $myvar{'gtid_mode'} : \"OFF\" )\n . \")\";\n }\n\n # Memory usage\n infoprint \"Physical Memory : \" . hr_bytes($physical_memory);\n infoprint \"Max MySQL memory : \" . hr_bytes( $mycalc{'max_peak_memory'} );\n infoprint \"Other process memory: \" . hr_bytes( get_other_process_memory() );\n\n infoprint \"Total buffers: \"\n . hr_bytes( $mycalc{'server_buffers'} )\n . \" global + \"\n . hr_bytes( $mycalc{'per_thread_buffers'} )\n . \" per thread ($myvar{'max_connections'} max threads)\";\n infoprint \"Performance_schema Max memory usage: \"\n . hr_bytes_rnd( get_pf_memory() );\n $result{'Performance_schema'}{'memory'} = get_pf_memory();\n $result{'Performance_schema'}{'pretty_memory'} =\n hr_bytes_rnd( get_pf_memory() );\n infoprint \"Galera GCache Max memory usage: \"\n . hr_bytes_rnd( get_gcache_memory() );\n $result{'Galera'}{'GCache'}{'memory'} = get_gcache_memory();\n $result{'Galera'}{'GCache'}{'pretty_memory'} =\n hr_bytes_rnd( get_gcache_memory() );\n\n if ( $opt{buffers} ne 0 ) {\n infoprint \"Global Buffers\";\n infoprint \" +-- Key Buffer: \"\n . hr_bytes( $myvar{'key_buffer_size'} ) . \"\";\n infoprint \" +-- Max Tmp Table: \"\n . hr_bytes( $mycalc{'max_tmp_table_size'} ) . \"\";\n\n if ( defined $myvar{'query_cache_type'} ) {\n infoprint \"Query Cache Buffers\";\n infoprint \" +-- Query Cache: \"\n . $myvar{'query_cache_type'} . \" - \"\n . (\n $myvar{'query_cache_type'} eq 0 |\n $myvar{'query_cache_type'} eq 'OFF' ? \"DISABLED\"\n : (\n $myvar{'query_cache_type'} eq 1 ? \"ALL REQUESTS\"\n : \"ON DEMAND\"\n )\n ) . \"\";\n infoprint \" +-- Query Cache Size: \"\n . hr_bytes( $myvar{'query_cache_size'} ) . \"\";\n }\n\n infoprint \"Per Thread Buffers\";\n infoprint \" +-- Read Buffer: \"\n . hr_bytes( $myvar{'read_buffer_size'} ) . \"\";\n infoprint \" +-- Read RND Buffer: \"\n . hr_bytes( $myvar{'read_rnd_buffer_size'} ) . \"\";\n infoprint \" +-- Sort Buffer: \"\n . hr_bytes( $myvar{'sort_buffer_size'} ) . \"\";\n infoprint \" +-- Thread stack: \"\n . hr_bytes( $myvar{'thread_stack'} ) . \"\";\n infoprint \" +-- Join Buffer: \"\n . hr_bytes( $myvar{'join_buffer_size'} ) . \"\";\n if ( $myvar{'log_bin'} ne 'OFF' ) {\n infoprint \"Binlog Cache Buffers\";\n infoprint \" +-- Binlog Cache: \"\n . hr_bytes( $myvar{'binlog_cache_size'} ) . \"\";\n }\n }\n\n if ( $arch\n && $arch == 32\n && $mycalc{'max_used_memory'} > 2 * 1024 * 1024 * 1024 )\n {\n badprint\n \"Allocating > 2GB RAM on 32-bit systems can cause system instability\";\n badprint \"Maximum reached memory usage: \"\n . hr_bytes( $mycalc{'max_used_memory'} )\n . \" ($mycalc{'pct_max_used_memory'}% of installed RAM)\";\n }\n elsif ( $mycalc{'pct_max_used_memory'} > 85 ) {\n badprint \"Maximum reached memory usage: \"\n . hr_bytes( $mycalc{'max_used_memory'} )\n . \" ($mycalc{'pct_max_used_memory'}% of installed RAM)\";\n }\n else {\n goodprint \"Maximum reached memory usage: \"\n . hr_bytes( $mycalc{'max_used_memory'} )\n . \" ($mycalc{'pct_max_used_memory'}% of installed RAM)\";\n }\n\n if ( $mycalc{'pct_max_physical_memory'} > 85 ) {\n badprint \"Maximum possible memory usage: \"\n . hr_bytes( $mycalc{'max_peak_memory'} )\n . \" ($mycalc{'pct_max_physical_memory'}% of installed RAM)\";\n push( @generalrec,\n \"Reduce your overall MySQL memory footprint for system stability\" );\n }\n else {\n goodprint \"Maximum possible memory usage: \"\n . hr_bytes( $mycalc{'max_peak_memory'} )\n . \" ($mycalc{'pct_max_physical_memory'}% of installed RAM)\";\n }\n\n if ( $physical_memory <\n ( $mycalc{'max_peak_memory'} + get_other_process_memory() ) )\n {\n if ( $opt{nondedicated} ) {\n infoprint \"No warning with --nondedicated option\";\n infoprint\n\"Overall possible memory usage with other process exceeded memory\";\n }\n else {\n badprint\n\"Overall possible memory usage with other process exceeded memory\";\n push( @generalrec,\n \"Dedicate this server to your database for highest performance.\"\n );\n }\n }\n else {\n goodprint\n\"Overall possible memory usage with other process is compatible with memory available\";\n }\n\n # Slow queries\n if ( $mycalc{'pct_slow_queries'} > 5 ) {\n badprint \"Slow queries: $mycalc{'pct_slow_queries'}% (\"\n . hr_num( $mystat{'Slow_queries'} ) . \"/\"\n . hr_num( $mystat{'Questions'} ) . \")\";\n }\n else {\n goodprint \"Slow queries: $mycalc{'pct_slow_queries'}% (\"\n . hr_num( $mystat{'Slow_queries'} ) . \"/\"\n . hr_num( $mystat{'Questions'} ) . \")\";\n }\n if ( $myvar{'long_query_time'} > 10 ) {\n push( @adjvars, \"long_query_time (<= 10)\" );\n }\n if ( defined( $myvar{'log_slow_queries'} ) ) {\n if ( $myvar{'log_slow_queries'} eq \"OFF\" ) {\n push( @generalrec,\n \"Enable the slow query log to troubleshoot bad queries\" );\n }\n }\n\n # Connections\n if ( $mycalc{'pct_connections_used'} > 85 ) {\n badprint\n\"Highest connection usage: $mycalc{'pct_connections_used'}% ($mystat{'Max_used_connections'}/$myvar{'max_connections'})\";\n push( @adjvars,\n \"max_connections (> \" . $myvar{'max_connections'} . \")\" );\n push( @adjvars,\n \"wait_timeout (< \" . $myvar{'wait_timeout'} . \")\",\n \"interactive_timeout (< \" . $myvar{'interactive_timeout'} . \")\" );\n push( @generalrec,\n\"Reduce or eliminate persistent connections to reduce connection usage\"\n );\n }\n else {\n goodprint\n\"Highest usage of available connections: $mycalc{'pct_connections_used'}% ($mystat{'Max_used_connections'}/$myvar{'max_connections'})\";\n }\n\n # Aborted Connections\n if ( $mycalc{'pct_connections_aborted'} > 3 ) {\n badprint\n\"Aborted connections: $mycalc{'pct_connections_aborted'}% ($mystat{'Aborted_connects'}/$mystat{'Connections'})\";\n push( @generalrec,\n \"Reduce or eliminate unclosed connections and network issues\" );\n }\n else {\n goodprint\n\"Aborted connections: $mycalc{'pct_connections_aborted'}% ($mystat{'Aborted_connects'}/$mystat{'Connections'})\";\n }\n\n # name resolution\n debugprint \"skip name resolve: $result{'Variables'}{'skip_name_resolve'}\"\n if ( defined( $result{'Variables'}{'skip_name_resolve'} ) );\n if ( defined( $result{'Variables'}{'skip_networking'} )\n && $result{'Variables'}{'skip_networking'} eq 'ON' )\n {\n infoprint\n\"Skipped name resolution test due to skip_networking=ON in system variables.\";\n }\n elsif ( not defined( $result{'Variables'}{'skip_name_resolve'} ) ) {\n infoprint\n\"Skipped name resolution test due to missing skip_name_resolve in system variables.\";\n }\n\n #Cpanel and Skip name resolve\n elsif ( -r \"/usr/local/cpanel/cpanel\" ) {\n if ( $result{'Variables'}{'skip_name_resolve'} ne 'OFF' ) {\n infoprint \"CPanel and Flex system skip-name-resolve should be on\";\n }\n if ( $result{'Variables'}{'skip_name_resolve'} eq 'OFF' ) {\n badprint \"CPanel and Flex system skip-name-resolve should be on\";\n push( @generalrec,\n\"name resolution is enabled due to cPanel doesn't support this disabled.\"\n );\n push( @adjvars, \"skip-name-resolve=0\" );\n }\n }\n elsif ( $result{'Variables'}{'skip_name_resolve'} ne 'ON'\n and $result{'Variables'}{'skip_name_resolve'} ne '1' )\n {\n badprint\n\"Name resolution is active: a reverse name resolution is made for each new connection which can reduce performance\";\n push( @generalrec,\n\"Configure your accounts with ip or subnets only, then update your configuration with skip-name-resolve=ON\"\n );\n push( @adjvars, \"skip-name-resolve=ON\" );\n }\n\n # Query cache\n if ( !mysql_version_ge(4) ) {\n\n # MySQL versions < 4.01 don't support query caching\n push( @generalrec,\n \"Upgrade MySQL to version 4+ to utilize query caching\" );\n }\n elsif ( mysql_version_eq(8) ) {\n infoprint \"Query cache has been removed since MySQL 8.0\";\n\n #return;\n }\n elsif ($myvar{'query_cache_size'} < 1\n or $myvar{'query_cache_type'} eq \"OFF\" )\n {\n goodprint\n\"Query cache is disabled by default due to mutex contention on multiprocessor machines.\";\n }\n elsif ( $mystat{'Com_select'} == 0 ) {\n badprint\n \"Query cache cannot be analyzed: no SELECT statements executed\";\n }\n else {\n if ( $mycalc{'query_cache_efficiency'} < 20 ) {\n badprint\n \"Query cache efficiency: $mycalc{'query_cache_efficiency'}% (\"\n . hr_num( $mystat{'Qcache_hits'} )\n . \" cached / \"\n . hr_num( $mystat{'Qcache_hits'} + $mystat{'Com_select'} )\n . \" selects)\";\n push( @adjvars,\n \"query_cache_limit (> \"\n . hr_bytes_rnd( $myvar{'query_cache_limit'} )\n . \", or use smaller result sets)\" );\n badprint\n \"Query cache may be disabled by default due to mutex contention.\";\n push( @adjvars, \"query_cache_size (=0)\" );\n push( @adjvars, \"query_cache_type (=0)\" );\n }\n else {\n goodprint\n \"Query cache efficiency: $mycalc{'query_cache_efficiency'}% (\"\n . hr_num( $mystat{'Qcache_hits'} )\n . \" cached / \"\n . hr_num( $mystat{'Qcache_hits'} + $mystat{'Com_select'} )\n . \" selects)\";\n if ( $mycalc{'query_cache_prunes_per_day'} > 98 ) {\n badprint\n\"Query cache prunes per day: $mycalc{'query_cache_prunes_per_day'}\";\n if ( $myvar{'query_cache_size'} >= 128 * 1024 * 1024 ) {\n push( @generalrec,\n\"Increasing the query_cache size over 128M may reduce performance\"\n );\n push( @adjvars,\n \"query_cache_size (> \"\n . hr_bytes_rnd( $myvar{'query_cache_size'} )\n . \") [see warning above]\" );\n }\n else {\n push( @adjvars,\n \"query_cache_size (> \"\n . hr_bytes_rnd( $myvar{'query_cache_size'} )\n . \")\" );\n }\n }\n else {\n goodprint\n\"Query cache prunes per day: $mycalc{'query_cache_prunes_per_day'}\";\n }\n }\n\n }\n\n # Sorting\n if ( $mycalc{'total_sorts'} == 0 ) {\n goodprint \"No Sort requiring temporary tables\";\n }\n elsif ( $mycalc{'pct_temp_sort_table'} > 10 ) {\n badprint\n \"Sorts requiring temporary tables: $mycalc{'pct_temp_sort_table'}% (\"\n . hr_num( $mystat{'Sort_merge_passes'} )\n . \" temp sorts / \"\n . hr_num( $mycalc{'total_sorts'} )\n . \" sorts)\";\n push( @adjvars,\n \"sort_buffer_size (> \"\n . hr_bytes_rnd( $myvar{'sort_buffer_size'} )\n . \")\" );\n push( @adjvars,\n \"read_rnd_buffer_size (> \"\n . hr_bytes_rnd( $myvar{'read_rnd_buffer_size'} )\n . \")\" );\n }\n else {\n goodprint\n \"Sorts requiring temporary tables: $mycalc{'pct_temp_sort_table'}% (\"\n . hr_num( $mystat{'Sort_merge_passes'} )\n . \" temp sorts / \"\n . hr_num( $mycalc{'total_sorts'} )\n . \" sorts)\";\n }\n\n # Joins\n if ( $mycalc{'joins_without_indexes_per_day'} > 250 ) {\n badprint\n \"Joins performed without indexes: $mycalc{'joins_without_indexes'}\";\n push( @adjvars,\n \"join_buffer_size (> \"\n . hr_bytes( $myvar{'join_buffer_size'} )\n . \", or always use indexes with JOINs)\" );\n push(\n @generalrec,\n\"We will suggest raising the 'join_buffer_size' until JOINs not using indexes are found.\n See https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_join_buffer_size\"\n );\n }\n else {\n goodprint \"No joins without indexes\";\n\n # No joins have run without indexes\n }\n\n # Temporary tables\n if ( $mystat{'Created_tmp_tables'} > 0 ) {\n if ( $mycalc{'pct_temp_disk'} > 25\n && $mycalc{'max_tmp_table_size'} < 256 * 1024 * 1024 )\n {\n badprint\n \"Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (\"\n . hr_num( $mystat{'Created_tmp_disk_tables'} )\n . \" on disk / \"\n . hr_num( $mystat{'Created_tmp_tables'} )\n . \" total)\";\n push( @adjvars,\n \"tmp_table_size (> \"\n . hr_bytes_rnd( $myvar{'tmp_table_size'} )\n . \")\" );\n push( @adjvars,\n \"max_heap_table_size (> \"\n . hr_bytes_rnd( $myvar{'max_heap_table_size'} )\n . \")\" );\n push( @generalrec,\n\"When making adjustments, make tmp_table_size/max_heap_table_size equal\"\n );\n push( @generalrec,\n \"Reduce your SELECT DISTINCT queries which have no LIMIT clause\"\n );\n }\n elsif ($mycalc{'pct_temp_disk'} > 25\n && $mycalc{'max_tmp_table_size'} >= 256 * 1024 * 1024 )\n {\n badprint\n \"Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (\"\n . hr_num( $mystat{'Created_tmp_disk_tables'} )\n . \" on disk / \"\n . hr_num( $mystat{'Created_tmp_tables'} )\n . \" total)\";\n push( @generalrec,\n \"Temporary table size is already large: reduce result set size\"\n );\n push( @generalrec,\n \"Reduce your SELECT DISTINCT queries without LIMIT clauses\" );\n }\n else {\n goodprint\n \"Temporary tables created on disk: $mycalc{'pct_temp_disk'}% (\"\n . hr_num( $mystat{'Created_tmp_disk_tables'} )\n . \" on disk / \"\n . hr_num( $mystat{'Created_tmp_tables'} )\n . \" total)\";\n }\n }\n else {\n goodprint \"No tmp tables created on disk\";\n }\n\n # Thread cache\n if ( defined( $myvar{'have_threadpool'} )\n and $myvar{'have_threadpool'} eq 'YES' )\n {\n# https://www.percona.com/doc/percona-server/5.7/performance/threadpool.html#status-variables\n# When thread pool is enabled, the value of the thread_cache_size variable\n# is ignored. The Threads_cached status variable contains 0 in this case.\n infoprint \"Thread cache not used with thread pool enabled\";\n }\n else {\n if ( $myvar{'thread_cache_size'} eq 0 ) {\n badprint \"Thread cache is disabled\";\n push( @generalrec,\n \"Set thread_cache_size to 4 as a starting value\" );\n push( @adjvars, \"thread_cache_size (start at 4)\" );\n }\n else {\n if ( $mycalc{'thread_cache_hit_rate'} <= 50 ) {\n badprint\n \"Thread cache hit rate: $mycalc{'thread_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Threads_created'} )\n . \" created / \"\n . hr_num( $mystat{'Connections'} )\n . \" connections)\";\n push( @adjvars,\n \"thread_cache_size (> $myvar{'thread_cache_size'})\" );\n }\n else {\n goodprint\n \"Thread cache hit rate: $mycalc{'thread_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Threads_created'} )\n . \" created / \"\n . hr_num( $mystat{'Connections'} )\n . \" connections)\";\n }\n }\n }\n\n # Table cache\n my $table_cache_var = \"\";\n if ( $mystat{'Open_tables'} > 0 ) {\n if ( $mycalc{'table_cache_hit_rate'} < 20 ) {\n\n unless ( defined( $mystat{'Table_open_cache_hits'} ) ) {\n badprint\n \"Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Open_tables'} )\n . \" hits / \"\n . hr_num( $mystat{'Opened_tables'} )\n . \" requests)\";\n }\n else {\n badprint\n \"Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Table_open_cache_hits'} )\n . \" hits / \"\n . hr_num( $mystat{'Table_open_cache_hits'} +\n $mystat{'Table_open_cache_misses'} )\n . \" requests)\";\n }\n\n if ( mysql_version_ge( 5, 1 ) ) {\n $table_cache_var = \"table_open_cache\";\n }\n else {\n $table_cache_var = \"table_cache\";\n }\n\n push( @adjvars,\n $table_cache_var . \" (> \" . $myvar{$table_cache_var} . \")\" );\n push( @generalrec,\n \"Increase \"\n . $table_cache_var\n . \" gradually to avoid file descriptor limits\" );\n push( @generalrec,\n \"Read this before increasing \"\n . $table_cache_var\n . \" over 64: https://bit.ly/2Fulv7r\" );\n push( @generalrec,\n \"Read this before increasing for MariaDB\"\n . \" https://mariadb.com/kb/en/library/optimizing-table_open_cache/\"\n );\n push( @generalrec,\n\"This is MyISAM only table_cache scalability problem, InnoDB not affected.\"\n );\n push( @generalrec,\n \"For more details see: https://bugs.mysql.com/bug.php?id=49177\"\n );\n push( @generalrec,\n\"This bug already fixed in MySQL 5.7.9 and newer MySQL versions.\"\n );\n push( @generalrec,\n \"Beware that open_files_limit (\"\n . $myvar{'open_files_limit'}\n . \") variable \" );\n push( @generalrec,\n \"should be greater than $table_cache_var (\"\n . $myvar{$table_cache_var}\n . \")\" );\n }\n else {\n unless ( defined( $mystat{'Table_open_cache_hits'} ) ) {\n goodprint\n \"Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Open_tables'} )\n . \" hits / \"\n . hr_num( $mystat{'Opened_tables'} )\n . \" requests)\";\n }\n else {\n goodprint\n \"Table cache hit rate: $mycalc{'table_cache_hit_rate'}% (\"\n . hr_num( $mystat{'Table_open_cache_hits'} )\n . \" hits / \"\n . hr_num( $mystat{'Table_open_cache_hits'} +\n $mystat{'Table_open_cache_misses'} )\n . \" requests)\";\n }\n }\n }\n\n # Table definition cache\n my $nbtables = select_one('SELECT COUNT(*) FROM information_schema.tables');\n $mycalc{'total_tables'} = $nbtables;\n if ( defined $myvar{'table_definition_cache'} ) {\n if ( $myvar{'table_definition_cache'} == -1 ) {\n infoprint( \"table_definition_cache (\"\n . $myvar{'table_definition_cache'}\n . \") is in autosizing mode\" );\n }\n elsif ( $myvar{'table_definition_cache'} < $nbtables ) {\n badprint \"table_definition_cache (\"\n . $myvar{'table_definition_cache'}\n . \") is less than number of tables ($nbtables) \";\n push( @adjvars,\n \"table_definition_cache (\"\n . $myvar{'table_definition_cache'} . \") > \"\n . $nbtables\n . \" or -1 (autosizing if supported)\" );\n }\n else {\n goodprint \"table_definition_cache (\"\n . $myvar{'table_definition_cache'}\n . \") is greater than number of tables ($nbtables)\";\n }\n }\n else {\n infoprint \"No table_definition_cache variable found.\";\n }\n\n # Open files\n if ( defined $mycalc{'pct_files_open'} ) {\n if ( $mycalc{'pct_files_open'} > 85 ) {\n badprint \"Open file limit used: $mycalc{'pct_files_open'}% (\"\n . hr_num( $mystat{'Open_files'} ) . \"/\"\n . hr_num( $myvar{'open_files_limit'} ) . \")\";\n push( @adjvars,\n \"open_files_limit (> \" . $myvar{'open_files_limit'} . \")\" );\n }\n else {\n goodprint \"Open file limit used: $mycalc{'pct_files_open'}% (\"\n . hr_num( $mystat{'Open_files'} ) . \"/\"\n . hr_num( $myvar{'open_files_limit'} ) . \")\";\n }\n }\n\n # Table locks\n if ( defined $mycalc{'pct_table_locks_immediate'} ) {\n if ( $mycalc{'pct_table_locks_immediate'} < 95 ) {\n badprint\n\"Table locks acquired immediately: $mycalc{'pct_table_locks_immediate'}%\";\n push( @generalrec,\n \"Optimize queries and/or use InnoDB to reduce lock wait\" );\n }\n else {\n goodprint\n\"Table locks acquired immediately: $mycalc{'pct_table_locks_immediate'}% (\"\n . hr_num( $mystat{'Table_locks_immediate'} )\n . \" immediate / \"\n . hr_num( $mystat{'Table_locks_waited'} +\n $mystat{'Table_locks_immediate'} )\n . \" locks)\";\n }\n }\n\n # Binlog cache\n if ( defined $mycalc{'pct_binlog_cache'} ) {\n if ( $mycalc{'pct_binlog_cache'} < 90\n && $mystat{'Binlog_cache_use'} > 0 )\n {\n badprint \"Binlog cache memory access: \"\n . $mycalc{'pct_binlog_cache'} . \"% (\"\n . (\n $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'} )\n . \" Memory / \"\n . $mystat{'Binlog_cache_use'}\n . \" Total)\";\n push( @generalrec,\n \"Increase binlog_cache_size (current value: \"\n . $myvar{'binlog_cache_size'}\n . \")\" );\n push( @adjvars,\n \"binlog_cache_size (\"\n . hr_bytes( $myvar{'binlog_cache_size'} + 16 * 1024 * 1024 )\n . \")\" );\n }\n else {\n goodprint \"Binlog cache memory access: \"\n . $mycalc{'pct_binlog_cache'} . \"% (\"\n . (\n $mystat{'Binlog_cache_use'} - $mystat{'Binlog_cache_disk_use'} )\n . \" Memory / \"\n . $mystat{'Binlog_cache_use'}\n . \" Total)\";\n debugprint \"Not enough data to validate binlog cache size\\n\"\n if $mystat{'Binlog_cache_use'} < 10;\n }\n }\n\n # Performance options\n if ( !mysql_version_ge( 5, 1 ) ) {\n push( @generalrec, \"Upgrade to MySQL 5.5+ to use asynchronous write\" );\n }\n elsif ( $myvar{'concurrent_insert'} eq \"OFF\" ) {\n push( @generalrec, \"Enable concurrent_insert by setting it to 'ON'\" );\n }\n elsif ( $myvar{'concurrent_insert'} eq 0 ) {\n push( @generalrec, \"Enable concurrent_insert by setting it to 1\" );\n }\n}\n\n# Recommendations for MyISAM\nsub mysql_myisam {\n return 0 unless ( $opt{'myisamstat'} > 0 );\n subheaderprint \"MyISAM Metrics\";\n my $nb_myisam_tables = select_one(\n\"SELECT COUNT(*) FROM information_schema.TABLES WHERE ENGINE='MyISAM' and TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema')\"\n );\n push( @generalrec,\n \"MyISAM engine is deprecated, consider migrating to InnoDB\" )\n if $nb_myisam_tables > 0;\n\n if ( $nb_myisam_tables > 0 ) {\n badprint\n \"Consider migrating $nb_myisam_tables following tables to InnoDB:\";\n my $sql_mig = \"\";\n for my $myisam_table (\n select_array(\n\"SELECT CONCAT(TABLE_SCHEMA, '.', TABLE_NAME) FROM information_schema.TABLES WHERE ENGINE='MyISAM' and TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema')\"\n )\n )\n {\n $sql_mig =\n\"${sql_mig}-- InnoDB migration for $myisam_table\\nALTER TABLE $myisam_table ENGINE=InnoDB;\\n\\n\";\n infoprint\n\"* InnoDB migration request for $myisam_table Table: ALTER TABLE $myisam_table ENGINE=InnoDB;\";\n }\n dump_into_file( \"migrate_myisam_to_innodb.sql\", $sql_mig );\n }\n infoprint(\"General MyIsam metrics:\");\n infoprint \" +-- Total MyISAM Tables : $nb_myisam_tables\";\n infoprint \" +-- Total MyISAM indexes : \"\n . hr_bytes( $mycalc{'total_myisam_indexes'} )\n if defined( $mycalc{'total_myisam_indexes'} );\n infoprint \" +-- KB Size :\" . hr_bytes( $myvar{'key_buffer_size'} );\n infoprint \" +-- KB Used Size :\"\n . hr_bytes( $myvar{'key_buffer_size'} -\n $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} );\n infoprint \" +-- KB used :\" . $mycalc{'pct_key_buffer_used'} . \"%\";\n infoprint \" +-- Read KB hit rate: $mycalc{'pct_keys_from_mem'}% (\"\n . hr_num( $mystat{'Key_read_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_reads'} )\n . \" reads)\";\n infoprint \" +-- Write KB hit rate: $mycalc{'pct_wkeys_from_mem'}% (\"\n . hr_num( $mystat{'Key_write_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_writes'} )\n . \" writes)\";\n\n if ( $nb_myisam_tables == 0 ) {\n infoprint \"No MyISAM table(s) detected ....\";\n return;\n }\n if ( mysql_version_ge(8) and mysql_version_le(10) ) {\n infoprint \"MyISAM Metrics are disabled since MySQL 8.0.\";\n if ( $myvar{'key_buffer_size'} > 0 ) {\n push( @adjvars, \"key_buffer_size=0\" );\n push( @generalrec,\n \"Buffer Key MyISAM set to 0, no MyISAM table detected\" );\n }\n return;\n }\n\n if ( !defined( $mycalc{'total_myisam_indexes'} ) ) {\n badprint\n \"Unable to calculate MyISAM index size on MySQL server < 5.0.0\";\n push( @generalrec,\n \"Unable to calculate MyISAM index size on MySQL server < 5.0.0\" );\n return;\n }\n if ( $mycalc{'pct_key_buffer_used'} == 0 ) {\n\n # No queries have run that would use keys\n infoprint \"Key buffer used: $mycalc{'pct_key_buffer_used'}% (\"\n . hr_bytes( $myvar{'key_buffer_size'} -\n $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} )\n . \" used / \"\n . hr_bytes( $myvar{'key_buffer_size'} )\n . \" cache)\";\n infoprint \"No SQL statement based on MyISAM table(s) detected ....\";\n return;\n }\n\n # Key buffer usage\n if ( $mycalc{'pct_key_buffer_used'} < 90 ) {\n badprint \"Key buffer used: $mycalc{'pct_key_buffer_used'}% (\"\n . hr_bytes( $myvar{'key_buffer_size'} -\n $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} )\n . \" used / \"\n . hr_bytes( $myvar{'key_buffer_size'} )\n . \" cache)\";\n\n push(\n @adjvars,\n \"key_buffer_size (\\~ \"\n . hr_num(\n $myvar{'key_buffer_size'} *\n $mycalc{'pct_key_buffer_used'} / 100\n )\n . \")\"\n );\n }\n else {\n goodprint \"Key buffer used: $mycalc{'pct_key_buffer_used'}% (\"\n . hr_bytes( $myvar{'key_buffer_size'} -\n $mystat{'Key_blocks_unused'} * $myvar{'key_cache_block_size'} )\n . \" used / \"\n . hr_bytes( $myvar{'key_buffer_size'} )\n . \" cache)\";\n }\n\n # Key buffer size / total MyISAM indexes\n if ( $myvar{'key_buffer_size'} < $mycalc{'total_myisam_indexes'}\n && $mycalc{'pct_keys_from_mem'} < 95 )\n {\n badprint \"Key buffer size / total MyISAM indexes: \"\n . hr_bytes( $myvar{'key_buffer_size'} ) . \"/\"\n . hr_bytes( $mycalc{'total_myisam_indexes'} ) . \"\";\n push( @adjvars,\n \"key_buffer_size (> \"\n . hr_bytes( $mycalc{'total_myisam_indexes'} )\n . \")\" );\n }\n else {\n goodprint \"Key buffer size / total MyISAM indexes: \"\n . hr_bytes( $myvar{'key_buffer_size'} ) . \"/\"\n . hr_bytes( $mycalc{'total_myisam_indexes'} ) . \"\";\n }\n if ( $mystat{'Key_read_requests'} > 0 ) {\n if ( $mycalc{'pct_keys_from_mem'} < 95 ) {\n badprint\n \"Read Key buffer hit rate: $mycalc{'pct_keys_from_mem'}% (\"\n . hr_num( $mystat{'Key_read_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_reads'} )\n . \" reads)\";\n }\n else {\n goodprint\n \"Read Key buffer hit rate: $mycalc{'pct_keys_from_mem'}% (\"\n . hr_num( $mystat{'Key_read_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_reads'} )\n . \" reads)\";\n }\n }\n\n # No queries have run that would use keys\n debugprint \"Key buffer size / total MyISAM indexes: \"\n . hr_bytes( $myvar{'key_buffer_size'} ) . \"/\"\n . hr_bytes( $mycalc{'total_myisam_indexes'} ) . \"\";\n if ( $mystat{'Key_write_requests'} > 0 ) {\n if ( $mycalc{'pct_wkeys_from_mem'} < 95 ) {\n badprint\n \"Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (\"\n . hr_num( $mystat{'Key_write_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_writes'} )\n . \" writes)\";\n }\n else {\n goodprint\n \"Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (\"\n . hr_num( $mystat{'Key_write_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_writes'} )\n . \" writes)\";\n }\n }\n else {\n # No queries have run that would use keys\n debugprint\n \"Write Key buffer hit rate: $mycalc{'pct_wkeys_from_mem'}% (\"\n . hr_num( $mystat{'Key_write_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Key_writes'} )\n . \" writes)\";\n }\n}\n\n# Recommendations for ThreadPool\nsub mariadb_threadpool {\n subheaderprint \"ThreadPool Metrics\";\n\n # MariaDB\n unless ( defined $myvar{'have_threadpool'}\n && $myvar{'have_threadpool'} eq \"YES\" )\n {\n infoprint \"ThreadPool stat is disabled.\";\n return;\n }\n infoprint \"ThreadPool stat is enabled.\";\n infoprint \"Thread Pool Size: \" . $myvar{'thread_pool_size'} . \" thread(s).\";\n\n if ( $myvar{'version'} =~ /percona/i\n or $myvar{'version_comment'} =~ /percona/i )\n {\n my $np = cpu_cores;\n if ( $myvar{'thread_pool_size'} >= $np\n and $myvar{'thread_pool_size'} < ( $np * 1.5 ) )\n {\n goodprint\n\"thread_pool_size for Percona between 1 and 1.5 times number of CPUs (\"\n . $np . \" and \"\n . ( $np * 1.5 ) . \")\";\n }\n else {\n badprint\n\"thread_pool_size for Percona between 1 and 1.5 times number of CPUs (\"\n . $np . \" and \"\n . ( $np * 1.5 ) . \")\";\n push( @adjvars,\n \"thread_pool_size between \"\n . $np . \" and \"\n . ( $np * 1.5 )\n . \" for InnoDB usage\" );\n }\n return;\n }\n\n if ( $myvar{'version'} =~ /mariadb/i ) {\n infoprint \"Using default value is good enough for your version (\"\n . $myvar{'version'} . \")\";\n return;\n }\n\n if ( $myvar{'have_innodb'} eq 'YES' ) {\n if ( $myvar{'thread_pool_size'} < 16\n or $myvar{'thread_pool_size'} > 36 )\n {\n badprint\n\"thread_pool_size between 16 and 36 when using InnoDB storage engine.\";\n push( @generalrec,\n \"Thread pool size for InnoDB usage (\"\n . $myvar{'thread_pool_size'}\n . \")\" );\n push( @adjvars,\n \"thread_pool_size between 16 and 36 for InnoDB usage\" );\n }\n else {\n goodprint\n\"thread_pool_size between 16 and 36 when using InnoDB storage engine.\";\n }\n return;\n }\n if ( $myvar{'have_isam'} eq 'YES' ) {\n if ( $myvar{'thread_pool_size'} < 4 or $myvar{'thread_pool_size'} > 8 )\n {\n badprint\n\"thread_pool_size between 4 and 8 when using MyISAM storage engine.\";\n push( @generalrec,\n \"Thread pool size for MyISAM usage (\"\n . $myvar{'thread_pool_size'}\n . \")\" );\n push( @adjvars,\n \"thread_pool_size between 4 and 8 for MyISAM usage\" );\n }\n else {\n goodprint\n\"thread_pool_size between 4 and 8 when using MyISAM storage engine.\";\n }\n }\n}\n\nsub get_pf_memory {\n\n # Performance Schema\n return 0 unless defined $myvar{'performance_schema'};\n return 0 if $myvar{'performance_schema'} eq 'OFF';\n\n my @infoPFSMemory = grep { /\\tperformance_schema[.]memory\\t/msx }\n select_array(\"SHOW ENGINE PERFORMANCE_SCHEMA STATUS\");\n @infoPFSMemory == 1 || return 0;\n $infoPFSMemory[0] =~ s/.*\\s+(\\d+)$/$1/g;\n return $infoPFSMemory[0];\n}\n\n# Recommendations for Performance Schema\nsub mysql_pfs {\n subheaderprint \"Performance schema\";\n\n # Performance Schema\n debugprint \"Performance schema is \" . $myvar{'performance_schema'};\n $myvar{'performance_schema'} = 'OFF'\n unless defined( $myvar{'performance_schema'} );\n if ( $myvar{'performance_schema'} eq 'OFF' ) {\n badprint \"Performance_schema should be activated.\";\n push( @adjvars, \"performance_schema=ON\" );\n push( @generalrec,\n \"Performance schema should be activated for better diagnostics\" );\n }\n if ( $myvar{'performance_schema'} eq 'ON' ) {\n infoprint \"Performance_schema is activated.\";\n debugprint \"Performance schema is \" . $myvar{'performance_schema'};\n infoprint \"Memory used by Performance_schema: \"\n . hr_bytes( get_pf_memory() );\n }\n\n unless ( grep /^sys$/, select_array(\"SHOW DATABASES\") ) {\n infoprint \"Sys schema is not installed.\";\n push( @generalrec,\n mysql_version_ge( 10, 0 )\n ? \"Consider installing Sys schema from https://github.com/FromDual/mariadb-sys for MariaDB\"\n : \"Consider installing Sys schema from https://github.com/mysql/mysql-sys for MySQL\"\n ) unless ( mysql_version_le( 5, 6 ) );\n\n return;\n }\n infoprint \"Sys schema is installed.\";\n return if ( $opt{pfstat} == 0 or $myvar{'performance_schema'} ne 'ON' );\n\n infoprint \"Sys schema Version: \"\n . select_one(\"select sys_version from sys.version\");\n\n # Store all sys schema in dumpdir if defined\n if ( defined $opt{dumpdir} and -d \"$opt{dumpdir}\" ) {\n for my $sys_view ( select_array('use sys;show tables;') ) {\n infoprint \"Dumping $sys_view into $opt{dumpdir}\";\n my $sys_view_table = $sys_view;\n $sys_view_table =~ s/\\$/\\\\\\$/g;\n select_csv_file( \"$opt{dumpdir}/sys_$sys_view.csv\",\n 'select * from sys.\\`' . $sys_view_table . '\\`' );\n }\n return;\n\n #exit 0 if ( $opt{stop} == 1 );\n }\n\n # Top user per connection\n subheaderprint \"Performance schema: Top 5 user per connection\";\n my $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, total_connections from sys.user_summary order by total_connections desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery conn(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per statement\n subheaderprint \"Performance schema: Top 5 user per statement\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, statements from sys.user_summary order by statements desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery stmt(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per statement latency\n subheaderprint \"Performance schema: Top 5 user per statement latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, statement_avg_latency from sys.x\\\\$user_summary order by statement_avg_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per lock latency\n subheaderprint \"Performance schema: Top 5 user per lock latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, lock_latency from sys.x\\\\$user_summary_by_statement_latency order by lock_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per full scans\n subheaderprint \"Performance schema: Top 5 user per nb full scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, full_scans from sys.x\\\\$user_summary_by_statement_latency order by full_scans desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per row_sent\n subheaderprint \"Performance schema: Top 5 user per rows sent\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, rows_sent from sys.x\\\\$user_summary_by_statement_latency order by rows_sent desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per row modified\n subheaderprint \"Performance schema: Top 5 user per rows modified\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, rows_affected from sys.x\\\\$user_summary_by_statement_latency order by rows_affected desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per io\n subheaderprint \"Performance schema: Top 5 user per IO\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, file_ios from sys.x\\\\$user_summary order by file_ios desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top user per io latency\n subheaderprint \"Performance schema: Top 5 user per IO latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, file_io_latency from sys.x\\\\$user_summary order by file_io_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per connection\n subheaderprint \"Performance schema: Top 5 host per connection\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, total_connections from sys.x\\\\$host_summary order by total_connections desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery conn(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per statement\n subheaderprint \"Performance schema: Top 5 host per statement\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, statements from sys.x\\\\$host_summary order by statements desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery stmt(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per statement latency\n subheaderprint \"Performance schema: Top 5 host per statement latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, statement_avg_latency from sys.x\\\\$host_summary order by statement_avg_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per lock latency\n subheaderprint \"Performance schema: Top 5 host per lock latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, lock_latency from sys.x\\\\$host_summary_by_statement_latency order by lock_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per full scans\n subheaderprint \"Performance schema: Top 5 host per nb full scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, full_scans from sys.x\\\\$host_summary_by_statement_latency order by full_scans desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per rows sent\n subheaderprint \"Performance schema: Top 5 host per rows sent\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, rows_sent from sys.x\\\\$host_summary_by_statement_latency order by rows_sent desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per rows modified\n subheaderprint \"Performance schema: Top 5 host per rows modified\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, rows_affected from sys.x\\\\$host_summary_by_statement_latency order by rows_affected desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per io\n subheaderprint \"Performance schema: Top 5 host per io\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, file_ios from sys.x\\\\$host_summary order by file_ios desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top 5 host per io latency\n subheaderprint \"Performance schema: Top 5 host per io latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, file_io_latency from sys.x\\\\$host_summary order by file_io_latency desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top IO type order by total io\n subheaderprint \"Performance schema: Top IO type order by total io\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select substring(event_name,14), SUM(total)AS total from sys.x\\\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY total DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery i/o\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top IO type order by total latency\n subheaderprint \"Performance schema: Top IO type order by total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select substring(event_name,14), ROUND(SUM(total_latency),1) AS total_latency from sys.x\\\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY total_latency DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top IO type order by max latency\n subheaderprint \"Performance schema: Top IO type order by max latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select substring(event_name,14), MAX(max_latency) as max_latency from sys.x\\\\$host_summary_by_file_io_type GROUP BY substring(event_name,14) ORDER BY max_latency DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top Stages order by total io\n subheaderprint \"Performance schema: Top Stages order by total io\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select substring(event_name,7), SUM(total)AS total from sys.x\\\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY total DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery i/o\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top Stages order by total latency\n subheaderprint \"Performance schema: Top Stages order by total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select substring(event_name,7), ROUND(SUM(total_latency),1) AS total_latency from sys.x\\\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY total_latency DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top Stages order by avg latency\n subheaderprint \"Performance schema: Top Stages order by avg latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select substring(event_name,7), MAX(avg_latency) as avg_latency from sys.x\\\\$host_summary_by_stages GROUP BY substring(event_name,7) ORDER BY avg_latency DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top host per table scans\n subheaderprint \"Performance schema: Top 5 host per table scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select host, table_scans from sys.x\\\\$host_summary order by table_scans desc LIMIT 5'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # InnoDB Buffer Pool by schema\n subheaderprint \"Performance schema: InnoDB Buffer Pool by schema\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select object_schema, allocated, data, pages from sys.x\\\\$innodb_buffer_stats_by_schema ORDER BY pages DESC'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery page(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # InnoDB Buffer Pool by table\n subheaderprint \"Performance schema: 40 InnoDB Buffer Pool by table\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select object_schema, object_name, allocated,data, pages from sys.x\\\\$innodb_buffer_stats_by_table ORDER BY pages DESC LIMIT 40'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery page(s)\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Process per allocated memory\n subheaderprint \"Performance schema: Process per time\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, Command AS PROC, time from sys.x\\\\$processlist ORDER BY time DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # InnoDB Lock Waits\n subheaderprint \"Performance schema: InnoDB Lock Waits\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select wait_age_secs, locked_table, locked_type, waiting_query from sys.x\\\\$innodb_lock_waits order by wait_age_secs DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Threads IO Latency\n subheaderprint \"Performance schema: Thread IO Latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select user, total_latency, max_latency from sys.x\\\\$io_by_thread_by_latency order by total_latency DESC;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # High Cost SQL statements\n subheaderprint \"Performance schema: Top 15 Most latency statements\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select LEFT(query, 120), avg_latency from sys.x\\\\$statement_analysis order by avg_latency desc LIMIT 15'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top 5% slower queries\n subheaderprint \"Performance schema: Top 15 slower queries\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select LEFT(query, 120), exec_count from sys.x\\\\$statements_with_runtimes_in_95th_percentile order by exec_count desc LIMIT 15'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery s\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top 10 nb statement type\n subheaderprint \"Performance schema: Top 15 nb statement type\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(total) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top statement by total latency\n subheaderprint \"Performance schema: Top 15 statement by total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(total_latency) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top statement by lock latency\n subheaderprint \"Performance schema: Top 15 statement by lock latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(lock_latency) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top statement by full scans\n subheaderprint \"Performance schema: Top 15 statement by full scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(full_scans) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top statement by rows sent\n subheaderprint \"Performance schema: Top 15 statement by rows sent\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(rows_sent) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Top statement by rows modified\n subheaderprint \"Performance schema: Top 15 statement by rows modified\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select statement, sum(rows_affected) as total from sys.x\\\\$host_summary_by_statement_type group by statement order by total desc LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Use temporary tables\n subheaderprint \"Performance schema: 15 sample queries using temp table\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select left(query, 120) from sys.x\\\\$statements_with_temp_tables LIMIT 15'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Unused Indexes\n subheaderprint \"Performance schema: Unused indexes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n\"select \\* from sys.schema_unused_indexes where object_schema not in ('performance_schema')\"\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Full table scans\n subheaderprint \"Performance schema: Tables with full table scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select * from sys.x\\\\$schema_tables_with_full_table_scans order by rows_full_scanned DESC'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Latest file IO by latency\n subheaderprint \"Performance schema: Latest File IO by latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select thread, file, latency, operation from sys.x\\\\$latest_file_io ORDER BY latency LIMIT 10;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # FILE by IO read bytes\n subheaderprint \"Performance schema: File by IO read bytes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select file, total_read from sys.x\\\\$io_global_by_file_by_bytes order by total_read DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # FILE by IO written bytes\n subheaderprint \"Performance schema: File by IO written bytes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select file, total_written from sys.x\\\\$io_global_by_file_by_bytes order by total_written DESC LIMIT 15'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # file per IO total latency\n subheaderprint \"Performance schema: File per IO total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select file, total_latency from sys.x\\\\$io_global_by_file_by_latency ORDER BY total_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # file per IO read latency\n subheaderprint \"Performance schema: file per IO read latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select file, read_latency from sys.x\\\\$io_global_by_file_by_latency ORDER BY read_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # file per IO write latency\n subheaderprint \"Performance schema: file per IO write latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select file, write_latency from sys.x\\\\$io_global_by_file_by_latency ORDER BY write_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Event Wait by read bytes\n subheaderprint \"Performance schema: Event Wait by read bytes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select event_name, total_read from sys.x\\\\$io_global_by_wait_by_bytes order by total_read DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Event Wait by write bytes\n subheaderprint \"Performance schema: Event Wait written bytes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select event_name, total_written from sys.x\\\\$io_global_by_wait_by_bytes order by total_written DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # event per wait total latency\n subheaderprint \"Performance schema: event per wait total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select event_name, total_latency from sys.x\\\\$io_global_by_wait_by_latency ORDER BY total_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # event per wait read latency\n subheaderprint \"Performance schema: event per wait read latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select event_name, read_latency from sys.x\\\\$io_global_by_wait_by_latency ORDER BY read_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # event per wait write latency\n subheaderprint \"Performance schema: event per wait write latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select event_name, write_latency from sys.x\\\\$io_global_by_wait_by_latency ORDER BY write_latency DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n #schema_index_statistics\n # TOP 15 most read index\n subheaderprint \"Performance schema: Top 15 most read indexes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, rows_selected from sys.x\\\\$schema_index_statistics ORDER BY ROWs_selected DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 most used index\n subheaderprint \"Performance schema: Top 15 most modified indexes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, rows_inserted+rows_updated+rows_deleted AS changes from sys.x\\\\$schema_index_statistics ORDER BY rows_inserted+rows_updated+rows_deleted DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high read latency index\n subheaderprint \"Performance schema: Top 15 high read latency index\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, select_latency from sys.x\\\\$schema_index_statistics ORDER BY select_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high insert latency index\n subheaderprint \"Performance schema: Top 15 most modified indexes\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, insert_latency from sys.x\\\\$schema_index_statistics ORDER BY insert_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high update latency index\n subheaderprint \"Performance schema: Top 15 high update latency index\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, update_latency from sys.x\\\\$schema_index_statistics ORDER BY update_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high delete latency index\n subheaderprint \"Performance schema: Top 15 high delete latency index\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name,index_name, delete_latency from sys.x\\\\$schema_index_statistics ORDER BY delete_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 most read tables\n subheaderprint \"Performance schema: Top 15 most read tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, rows_fetched from sys.x\\\\$schema_table_statistics ORDER BY ROWs_fetched DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 most used tables\n subheaderprint \"Performance schema: Top 15 most modified tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, rows_inserted+rows_updated+rows_deleted AS changes from sys.x\\\\$schema_table_statistics ORDER BY rows_inserted+rows_updated+rows_deleted DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high read latency tables\n subheaderprint \"Performance schema: Top 15 high read latency tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, fetch_latency from sys.x\\\\$schema_table_statistics ORDER BY fetch_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high insert latency tables\n subheaderprint \"Performance schema: Top 15 high insert latency tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, insert_latency from sys.x\\\\$schema_table_statistics ORDER BY insert_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high update latency tables\n subheaderprint \"Performance schema: Top 15 high update latency tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, update_latency from sys.x\\\\$schema_table_statistics ORDER BY update_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # TOP 15 high delete latency tables\n subheaderprint \"Performance schema: Top 15 high delete latency tables\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select table_schema, table_name, delete_latency from sys.x\\\\$schema_table_statistics ORDER BY delete_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n # Redundant indexes\n subheaderprint \"Performance schema: Redundant indexes\";\n $nbL = 1;\n for my $lQuery (\n select_array('use sys;select * from schema_redundant_indexes;') )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Table not using InnoDB buffer\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n' Select table_schema, table_name from sys.x\\\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NULL;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 Tables using InnoDB buffer\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select table_schema,table_name,innodb_buffer_allocated from sys.x\\\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NOT NULL ORDER BY innodb_buffer_allocated DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 Tables with InnoDB buffer free\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select table_schema,table_name,innodb_buffer_free from sys.x\\\\$schema_table_statistics_with_buffer where innodb_buffer_allocated IS NOT NULL ORDER BY innodb_buffer_free DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 Most executed queries\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), exec_count from sys.x\\\\$statement_analysis order by exec_count DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Latest SQL queries in errors or warnings\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select LEFT(query, 120), last_seen from sys.x\\\\$statements_with_errors_or_warnings ORDER BY last_seen LIMIT 40;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 20 queries with full table scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), exec_count from sys.x\\\\$statements_with_full_table_scans order BY exec_count DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Last 50 queries with full table scans\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), last_seen from sys.x\\\\$statements_with_full_table_scans order BY last_seen DESC LIMIT 50;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 reader queries (95% percentile)\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), rows_sent from sys.x\\\\$statements_with_runtimes_in_95th_percentile ORDER BY ROWs_sent DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 most row look queries (95% percentile)\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), rows_examined AS search from sys.x\\\\$statements_with_runtimes_in_95th_percentile ORDER BY rows_examined DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 total latency queries (95% percentile)\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), total_latency AS search from sys.x\\\\$statements_with_runtimes_in_95th_percentile ORDER BY total_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 max latency queries (95% percentile)\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), max_latency AS search from sys.x\\\\$statements_with_runtimes_in_95th_percentile ORDER BY max_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 average latency queries (95% percentile)\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), avg_latency AS search from sys.x\\\\$statements_with_runtimes_in_95th_percentile ORDER BY avg_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 20 queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), exec_count from sys.x\\\\$statements_with_sorting order BY exec_count DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Last 50 queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), last_seen from sys.x\\\\$statements_with_sorting order BY last_seen DESC LIMIT 50;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 row sorting queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), rows_sorted from sys.x\\\\$statements_with_sorting ORDER BY ROWs_sorted DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 total latency queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), total_latency AS search from sys.x\\\\$statements_with_sorting ORDER BY total_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 merge queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), sort_merge_passes AS search from sys.x\\\\$statements_with_sorting ORDER BY sort_merge_passes DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 average sort merges queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), avg_sort_merges AS search from sys.x\\\\$statements_with_sorting ORDER BY avg_sort_merges DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 scans queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), sorts_using_scans AS search from sys.x\\\\$statements_with_sorting ORDER BY sorts_using_scans DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 range queries with sort\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), sort_using_range AS search from sys.x\\\\$statements_with_sorting ORDER BY sort_using_range DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n##################################################################################\n\n #statements_with_temp_tables\n\n#mysql> desc statements_with_temp_tables;\n#+--------------------------+---------------------+------+-----+---------------------+-------+\n#| Field | Type | Null | Key | Default | Extra |\n#+--------------------------+---------------------+------+-----+---------------------+-------+\n#| query | longtext | YES | | NULL | |\n#| db | varchar(64) | YES | | NULL | |\n#| exec_count | bigint(20) unsigned | NO | | NULL | |\n#| total_latency | text | YES | | NULL | |\n#| memory_tmp_tables | bigint(20) unsigned | NO | | NULL | |\n#| disk_tmp_tables | bigint(20) unsigned | NO | | NULL | |\n#| avg_tmp_tables_per_query | decimal(21,0) | NO | | 0 | |\n#| tmp_tables_to_disk_pct | decimal(24,0) | NO | | 0 | |\n#| first_seen | timestamp | NO | | 0000-00-00 00:00:00 | |\n#| last_seen | timestamp | NO | | 0000-00-00 00:00:00 | |\n#| digest | varchar(32) | YES | | NULL | |\n#+--------------------------+---------------------+------+-----+---------------------+-------+\n#11 rows in set (0,01 sec)#\n#\n subheaderprint \"Performance schema: Top 20 queries with temp table\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), exec_count from sys.x\\\\$statements_with_temp_tables order BY exec_count DESC LIMIT 20;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Last 50 queries with temp table\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), last_seen from sys.x\\\\$statements_with_temp_tables order BY last_seen DESC LIMIT 50;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint\n \"Performance schema: Top 15 total latency queries with temp table\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select db, LEFT(query, 120), total_latency AS search from sys.x\\\\$statements_with_temp_tables ORDER BY total_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 queries with temp table to disk\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select db, LEFT(query, 120), disk_tmp_tables from sys.x\\\\$statements_with_temp_tables ORDER BY disk_tmp_tables DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n##################################################################################\n #wait_classes_global_by_latency\n\n#mysql> select * from wait_classes_global_by_latency;\n#-----------------+-------+---------------+-------------+-------------+-------------+\n# event_class | total | total_latency | min_latency | avg_latency | max_latency |\n#-----------------+-------+---------------+-------------+-------------+-------------+\n# wait/io/file | 15381 | 1.23 s | 0 ps | 80.12 us | 230.64 ms |\n# wait/io/table | 59 | 7.57 ms | 5.45 us | 128.24 us | 3.95 ms |\n# wait/lock/table | 69 | 3.22 ms | 658.84 ns | 46.64 us | 1.10 ms |\n#-----------------+-------+---------------+-------------+-------------+-------------+\n# rows in set (0,00 sec)\n\n subheaderprint \"Performance schema: Top 15 class events by number\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select event_class, total from sys.x\\\\$wait_classes_global_by_latency ORDER BY total DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 30 events by number\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select events, total from sys.x\\\\$waits_global_by_latency ORDER BY total DESC LIMIT 30;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 class events by total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select event_class, total_latency from sys.x\\\\$wait_classes_global_by_latency ORDER BY total_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 30 events by total latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'use sys;select events, total_latency from sys.x\\\\$waits_global_by_latency ORDER BY total_latency DESC LIMIT 30;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 15 class events by max latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select event_class, max_latency from sys.x\\\\$wait_classes_global_by_latency ORDER BY max_latency DESC LIMIT 15;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n subheaderprint \"Performance schema: Top 30 events by max latency\";\n $nbL = 1;\n for my $lQuery (\n select_array(\n'select events, max_latency from sys.x\\\\$waits_global_by_latency ORDER BY max_latency DESC LIMIT 30;'\n )\n )\n {\n infoprint \" +-- $nbL: $lQuery\";\n $nbL++;\n }\n infoprint \"No information found or indicators deactivated.\"\n if ( $nbL == 1 );\n\n}\n\n# Recommendations for Aria Engine\nsub mariadb_aria {\n subheaderprint \"Aria Metrics\";\n\n # Aria\n if ( !defined $myvar{'have_aria'} ) {\n infoprint \"Aria Storage Engine not available.\";\n return;\n }\n if ( $myvar{'have_aria'} ne \"YES\" ) {\n infoprint \"Aria Storage Engine is disabled.\";\n return;\n }\n infoprint \"Aria Storage Engine is enabled.\";\n\n # Aria pagecache\n if ( !defined( $mycalc{'total_aria_indexes'} ) ) {\n push( @generalrec,\n \"Unable to calculate Aria index size on MySQL server\" );\n }\n else {\n if (\n $myvar{'aria_pagecache_buffer_size'} < $mycalc{'total_aria_indexes'}\n && $mycalc{'pct_aria_keys_from_mem'} < 95 )\n {\n badprint \"Aria pagecache size / total Aria indexes: \"\n . hr_bytes( $myvar{'aria_pagecache_buffer_size'} ) . \"/\"\n . hr_bytes( $mycalc{'total_aria_indexes'} ) . \"\";\n push( @adjvars,\n \"aria_pagecache_buffer_size (> \"\n . hr_bytes( $mycalc{'total_aria_indexes'} )\n . \")\" );\n }\n else {\n goodprint \"Aria pagecache size / total Aria indexes: \"\n . hr_bytes( $myvar{'aria_pagecache_buffer_size'} ) . \"/\"\n . hr_bytes( $mycalc{'total_aria_indexes'} ) . \"\";\n }\n if ( $mystat{'Aria_pagecache_read_requests'} > 0 ) {\n if ( $mycalc{'pct_aria_keys_from_mem'} < 95 ) {\n badprint\n\"Aria pagecache hit rate: $mycalc{'pct_aria_keys_from_mem'}% (\"\n . hr_num( $mystat{'Aria_pagecache_read_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Aria_pagecache_reads'} )\n . \" reads)\";\n }\n else {\n goodprint\n\"Aria pagecache hit rate: $mycalc{'pct_aria_keys_from_mem'}% (\"\n . hr_num( $mystat{'Aria_pagecache_read_requests'} )\n . \" cached / \"\n . hr_num( $mystat{'Aria_pagecache_reads'} )\n . \" reads)\";\n }\n }\n else {\n\n # No queries have run that would use keys\n }\n }\n}\n\n# Recommendations for TokuDB\nsub mariadb_tokudb {\n subheaderprint \"TokuDB Metrics\";\n\n # AriaDB\n unless ( defined $myvar{'have_tokudb'}\n && $myvar{'have_tokudb'} eq \"YES\" )\n {\n infoprint \"TokuDB is disabled.\";\n return;\n }\n infoprint \"TokuDB is enabled.\";\n\n # Not implemented\n}\n\n# Recommendations for XtraDB\nsub mariadb_xtradb {\n subheaderprint \"XtraDB Metrics\";\n\n # XtraDB\n unless ( defined $myvar{'have_xtradb'}\n && $myvar{'have_xtradb'} eq \"YES\" )\n {\n infoprint \"XtraDB is disabled.\";\n return;\n }\n infoprint \"XtraDB is enabled.\";\n infoprint \"Note that MariaDB 10.2 makes use of InnoDB, not XtraDB.\"\n\n # Not implemented\n}\n\n# Recommendations for RocksDB\nsub mariadb_rockdb {\n subheaderprint \"RocksDB Metrics\";\n\n # RocksDB\n unless ( defined $myvar{'have_rocksdb'}\n && $myvar{'have_rocksdb'} eq \"YES\" )\n {\n infoprint \"RocksDB is disabled.\";\n return;\n }\n infoprint \"RocksDB is enabled.\";\n\n # Not implemented\n}\n\n# Recommendations for Spider\nsub mariadb_spider {\n subheaderprint \"Spider Metrics\";\n\n # Spider\n unless ( defined $myvar{'have_spider'}\n && $myvar{'have_spider'} eq \"YES\" )\n {\n infoprint \"Spider is disabled.\";\n return;\n }\n infoprint \"Spider is enabled.\";\n\n # Not implemented\n}\n\n# Recommendations for Connect\nsub mariadb_connect {\n subheaderprint \"Connect Metrics\";\n\n # Connect\n unless ( defined $myvar{'have_connect'}\n && $myvar{'have_connect'} eq \"YES\" )\n {\n infoprint \"Connect is disabled.\";\n return;\n }\n infoprint \"Connect is enabled.\";\n\n # Not implemented\n}\n\n# Perl trim function to remove whitespace from the start and end of the string\nsub trim {\n my $string = shift;\n return \"\" unless defined($string);\n $string =~ s/^\\s+//;\n $string =~ s/\\s+$//;\n return $string;\n}\n\nsub get_wsrep_options {\n return () unless defined $myvar{'wsrep_provider_options'};\n\n my @galera_options = split /;/, $myvar{'wsrep_provider_options'};\n my $wsrep_slave_threads = $myvar{'wsrep_slave_threads'};\n push @galera_options, ' wsrep_slave_threads = ' . $wsrep_slave_threads;\n @galera_options = remove_cr @galera_options;\n @galera_options = remove_empty @galera_options;\n\n #debugprint Dumper( \\@galera_options ) if $opt{debug};\n return @galera_options;\n}\n\nsub get_gcache_memory {\n my $gCacheMem = hr_raw( get_wsrep_option('gcache.size') );\n\n return 0 unless defined $gCacheMem and $gCacheMem ne '';\n return $gCacheMem;\n}\n\nsub get_wsrep_option {\n my $key = shift;\n return '' unless defined $myvar{'wsrep_provider_options'};\n my @galera_options = get_wsrep_options;\n return '' unless scalar(@galera_options) > 0;\n my @memValues = grep /\\s*$key =/, @galera_options;\n my $memValue = $memValues[0];\n return 0 unless defined $memValue;\n $memValue =~ s/.*=\\s*(.+)$/$1/g;\n return $memValue;\n}\n\n# REcommendations for Tables\nsub mysql_table_structures {\n return 0 unless ( $opt{structstat} > 0 );\n subheaderprint \"Table structures analysis\";\n\n my @primaryKeysNbTables = select_array(\n \"Select CONCAT(c.table_schema, ',' , c.table_name)\nfrom information_schema.columns c\njoin information_schema.tables t using (TABLE_SCHEMA, TABLE_NAME)\nwhere c.table_schema not in ('sys', 'mysql', 'information_schema', 'performance_schema')\n and t.table_type = 'BASE TABLE'\ngroup by c.table_schema,c.table_name\nhaving sum(if(c.column_key in ('PRI', 'UNI'), 1, 0)) = 0\"\n );\n\n my $tmpContent = 'Schema,Table';\n if ( scalar(@primaryKeysNbTables) > 0 ) {\n badprint \"Following table(s) don't have primary key:\";\n foreach my $badtable (@primaryKeysNbTables) {\n badprint \"\\t$badtable\";\n push @{ $result{'Tables without PK'} }, $badtable;\n $tmpContent .= \"\\n$badtable\";\n }\n push @generalrec,\n\"Ensure that all table(s) get an explicit primary keys for performance, maintenance and also for replication\";\n\n }\n else {\n goodprint \"All tables get a primary key\";\n }\n dump_into_file( \"tables_without_primary_keys.csv\", $tmpContent );\n\n my @nonInnoDBTables = select_array(\n \"select CONCAT(table_schema, ',', table_name, ',', ENGINE) \nFROM information_schema.tables t\nWHERE ENGINE <> 'InnoDB' \nand t.table_type = 'BASE TABLE'\nand table_schema not in \n('sys', 'mysql', 'performance_schema', 'information_schema')\"\n );\n $tmpContent = 'Schema,Table,Engine';\n if ( scalar(@nonInnoDBTables) > 0 ) {\n badprint \"Following table(s) are not InnoDB table:\";\n push @generalrec,\n\"Ensure that all table(s) are InnoDB tables for performance and also for replication\";\n foreach my $badtable (@nonInnoDBTables) {\n if ( $badtable =~ /Memory/i ) {\n badprint\n\"Table $badtable is a MEMORY table. It's suggested to use only InnoDB tables in production\";\n }\n else {\n badprint \"\\t$badtable\";\n }\n $tmpContent .= \"\\n$badtable\";\n }\n }\n else {\n goodprint \"All tables are InnoDB tables\";\n }\n dump_into_file( \"tables_non_innodb.csv\", $tmpContent );\n\n my @nonutf8columns = select_array(\n\"SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', CHARacter_set_name, ',', COLLATION_name, ',', data_type, ',', CHARACTER_MAXIMUM_LENGTH)\nfrom information_schema.columns\nWHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema')\nand (CHARacter_set_name NOT LIKE 'utf8%'\nor COLLATION_name NOT LIKE 'utf8%');\"\n );\n $tmpContent =\n 'Schema,Table,Column, Charset, Collation, Data Type, Max Length';\n if ( scalar(@nonutf8columns) > 0 ) {\n badprint \"Following character columns(s) are not utf8 compliant:\";\n push @generalrec,\n\"Ensure that all text colums(s) are UTF-8 compliant for encoding support and performance\";\n foreach my $badtable (@nonutf8columns) {\n badprint \"\\t$badtable\";\n $tmpContent .= \"\\n$badtable\";\n }\n }\n else {\n goodprint \"All columns are UTF-8 compliant\";\n }\n dump_into_file( \"columns_non_utf8.csv\", $tmpContent );\n\n my @utf8columns = select_array(\n\"SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', CHARacter_set_name, ',', COLLATION_name, ',', data_type, ',', CHARACTER_MAXIMUM_LENGTH)\nfrom information_schema.columns\nWHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema')\nand (CHARacter_set_name LIKE 'utf8%'\nor COLLATION_name LIKE 'utf8%');\"\n );\n $tmpContent =\n 'Schema,Table,Column, Charset, Collation, Data Type, Max Length';\n foreach my $badtable (@utf8columns) {\n $tmpContent .= \"\\n$badtable\";\n }\n dump_into_file( \"columns_utf8.csv\", $tmpContent );\n\n my @ftcolumns = select_array(\n\"SELECT CONCAT(table_schema, ',', table_name, ',', column_name, ',', data_type)\nfrom information_schema.columns\nWHERE table_schema not in ('sys', 'mysql', 'performance_schema', 'information_schema')\nAND data_type='FULLTEXT';\"\n );\n $tmpContent = 'Schema,Table,Column, Data Type';\n foreach my $ctable (@ftcolumns) {\n $tmpContent .= \"\\n$ctable\";\n }\n dump_into_file( \"fulltext_columns.csv\", $tmpContent );\n\n}\n\n# Recommendations for Galera\nsub mariadb_galera {\n subheaderprint \"Galera Metrics\";\n\n # Galera Cluster\n unless ( defined $myvar{'have_galera'}\n && $myvar{'have_galera'} eq \"YES\" )\n {\n infoprint \"Galera is disabled.\";\n return;\n }\n infoprint \"Galera is enabled.\";\n debugprint \"Galera variables:\";\n foreach my $gvar ( keys %myvar ) {\n next unless $gvar =~ /^wsrep.*/;\n next if $gvar eq 'wsrep_provider_options';\n debugprint \"\\t\" . trim($gvar) . \" = \" . $myvar{$gvar};\n $result{'Galera'}{'variables'}{$gvar} = $myvar{$gvar};\n }\n if ( not defined( $myvar{'wsrep_on'} ) or $myvar{'wsrep_on'} ne \"ON\" ) {\n infoprint \"Galera is disabled.\";\n return;\n }\n debugprint \"Galera wsrep provider Options:\";\n my @galera_options = get_wsrep_options;\n $result{'Galera'}{'wsrep options'} = get_wsrep_options();\n foreach my $gparam (@galera_options) {\n debugprint \"\\t\" . trim($gparam);\n }\n debugprint \"Galera status:\";\n foreach my $gstatus ( keys %mystat ) {\n next unless $gstatus =~ /^wsrep.*/;\n debugprint \"\\t\" . trim($gstatus) . \" = \" . $mystat{$gstatus};\n $result{'Galera'}{'status'}{$gstatus} = $myvar{$gstatus};\n }\n infoprint \"GCache is using \"\n . hr_bytes_rnd( get_wsrep_option('gcache.mem_size') );\n\n infoprint \"CPU cores detected : \" . (cpu_cores);\n infoprint \"wsrep_slave_threads: \" . get_wsrep_option('wsrep_slave_threads');\n\n if ( get_wsrep_option('wsrep_slave_threads') > ( (cpu_cores) * 4 )\n or get_wsrep_option('wsrep_slave_threads') < ( (cpu_cores) * 2 ) )\n {\n badprint\n\"wsrep_slave_threads is not equal to 2, 3 or 4 times the number of CPU(s)\";\n push @adjvars, \"wsrep_slave_threads = \" . ( (cpu_cores) * 4 );\n }\n else {\n goodprint\n\"wsrep_slave_threads is equal to 2, 3 or 4 times the number of CPU(s)\";\n }\n\n if ( get_wsrep_option('wsrep_slave_threads') > 1 ) {\n infoprint\n \"wsrep parallel slave can cause frequent inconsistency crash.\";\n push @adjvars,\n\"Set wsrep_slave_threads to 1 in case of HA_ERR_FOUND_DUPP_KEY crash on slave\";\n\n # check options for parallel slave\n if ( get_wsrep_option('wsrep_slave_FK_checks') eq \"OFF\" ) {\n badprint \"wsrep_slave_FK_checks is off with parallel slave\";\n push @adjvars,\n \"wsrep_slave_FK_checks should be ON when using parallel slave\";\n }\n\n # wsrep_slave_UK_checks seems useless in MySQL source code\n if ( $myvar{'innodb_autoinc_lock_mode'} != 2 ) {\n badprint\n \"innodb_autoinc_lock_mode is incorrect with parallel slave\";\n push @adjvars,\n \"innodb_autoinc_lock_mode should be 2 when using parallel slave\";\n }\n }\n\n if ( get_wsrep_option('gcs.fc_limit') != $myvar{'wsrep_slave_threads'} * 5 )\n {\n badprint \"gcs.fc_limit should be equal to 5 * wsrep_slave_threads (=\"\n . ( $myvar{'wsrep_slave_threads'} * 5 ) . \")\";\n push @adjvars, \"gcs.fc_limit= wsrep_slave_threads * 5 (=\"\n . ( $myvar{'wsrep_slave_threads'} * 5 ) . \")\";\n }\n else {\n goodprint \"gcs.fc_limit is equal to 5 * wsrep_slave_threads ( =\"\n . get_wsrep_option('gcs.fc_limit') . \")\";\n }\n\n if ( get_wsrep_option('gcs.fc_factor') != 0.8 ) {\n badprint \"gcs.fc_factor should be equal to 0.8 (=\"\n . get_wsrep_option('gcs.fc_factor') . \")\";\n push @adjvars, \"gcs.fc_factor=0.8\";\n }\n else {\n goodprint \"gcs.fc_factor is equal to 0.8\";\n }\n if ( get_wsrep_option('wsrep_flow_control_paused') > 0.02 ) {\n badprint \"Fraction of time node pause flow control > 0.02\";\n }\n else {\n goodprint\n\"Flow control fraction seems to be OK (wsrep_flow_control_paused <= 0.02)\";\n }\n\n if ( $myvar{'binlog_format'} ne 'ROW' ) {\n badprint \"Binlog format should be in ROW mode.\";\n push @adjvars, \"binlog_format = ROW\";\n }\n else {\n goodprint \"Binlog format is in ROW mode.\";\n }\n if ( $myvar{'innodb_flush_log_at_trx_commit'} != 0 ) {\n badprint \"InnoDB flush log at each commit should be disabled.\";\n push @adjvars, \"innodb_flush_log_at_trx_commit = 0\";\n }\n else {\n goodprint \"InnoDB flush log at each commit is disabled for Galera.\";\n }\n\n infoprint \"Read consistency mode :\" . $myvar{'wsrep_causal_reads'};\n\n if ( defined( $myvar{'wsrep_cluster_name'} )\n and $myvar{'wsrep_on'} eq \"ON\" )\n {\n goodprint \"Galera WsREP is enabled.\";\n if ( defined( $myvar{'wsrep_cluster_address'} )\n and trim(\"$myvar{'wsrep_cluster_address'}\") ne \"\" )\n {\n goodprint \"Galera Cluster address is defined: \"\n . $myvar{'wsrep_cluster_address'};\n my @NodesTmp = split /,/, $myvar{'wsrep_cluster_address'};\n my $nbNodes = @NodesTmp;\n infoprint \"There are $nbNodes nodes in wsrep_cluster_address\";\n my $nbNodesSize = trim( $mystat{'wsrep_cluster_size'} );\n if ( $nbNodesSize == 3 or $nbNodesSize == 5 ) {\n goodprint \"There are $nbNodesSize nodes in wsrep_cluster_size.\";\n }\n else {\n badprint\n\"There are $nbNodesSize nodes in wsrep_cluster_size. Prefer 3 or 5 nodes architecture.\";\n push @generalrec, \"Prefer 3 or 5 nodes architecture.\";\n }\n\n # wsrep_cluster_address doesn't include garbd nodes\n if ( $nbNodes > $nbNodesSize ) {\n badprint\n\"All cluster nodes are not detected. wsrep_cluster_size less than node count in wsrep_cluster_address\";\n }\n else {\n goodprint \"All cluster nodes detected.\";\n }\n }\n else {\n badprint \"Galera Cluster address is undefined\";\n push @adjvars,\n \"set up wsrep_cluster_address variable for Galera replication\";\n }\n if ( defined( $myvar{'wsrep_cluster_name'} )\n and trim( $myvar{'wsrep_cluster_name'} ) ne \"\" )\n {\n goodprint \"Galera Cluster name is defined: \"\n . $myvar{'wsrep_cluster_name'};\n }\n else {\n badprint \"Galera Cluster name is undefined\";\n push @adjvars,\n \"set up wsrep_cluster_name variable for Galera replication\";\n }\n if ( defined( $myvar{'wsrep_node_name'} )\n and trim( $myvar{'wsrep_node_name'} ) ne \"\" )\n {\n goodprint \"Galera Node name is defined: \"\n . $myvar{'wsrep_node_name'};\n }\n else {\n badprint \"Galera node name is undefined\";\n push @adjvars,\n \"set up wsrep_node_name variable for Galera replication\";\n }\n if ( trim( $myvar{'wsrep_notify_cmd'} ) ne \"\" ) {\n goodprint \"Galera Notify command is defined.\";\n }\n else {\n badprint \"Galera Notify command is not defined.\";\n push( @adjvars,\n \"set up parameter wsrep_notify_cmd to be notified\" );\n }\n if ( trim( $myvar{'wsrep_sst_method'} ) !~ \"^xtrabackup.*\"\n and trim( $myvar{'wsrep_sst_method'} ) !~ \"^mariabackup\" )\n {\n badprint \"Galera SST method is not xtrabackup based.\";\n push( @adjvars,\n\"set up parameter wsrep_sst_method to xtrabackup based parameter\"\n );\n }\n else {\n goodprint \"SST Method is based on xtrabackup.\";\n }\n if (\n (\n defined( $myvar{'wsrep_OSU_method'} )\n && trim( $myvar{'wsrep_OSU_method'} ) eq \"TOI\"\n )\n || ( defined( $myvar{'wsrep_osu_method'} )\n && trim( $myvar{'wsrep_osu_method'} ) eq \"TOI\" )\n )\n {\n goodprint \"TOI is default mode for upgrade.\";\n }\n else {\n badprint \"Schema upgrade are not replicated automatically\";\n push( @adjvars, \"set up parameter wsrep_OSU_method to TOI\" );\n }\n infoprint \"Max WsRep message : \"\n . hr_bytes( $myvar{'wsrep_max_ws_size'} );\n }\n else {\n badprint \"Galera WsREP is disabled\";\n }\n\n if ( defined( $mystat{'wsrep_connected'} )\n and $mystat{'wsrep_connected'} eq \"ON\" )\n {\n goodprint \"Node is connected\";\n }\n else {\n badprint \"Node is disconnected\";\n }\n if ( defined( $mystat{'wsrep_ready'} ) and $mystat{'wsrep_ready'} eq \"ON\" )\n {\n goodprint \"Node is ready\";\n }\n else {\n badprint \"Node is not ready\";\n }\n infoprint \"Cluster status :\" . $mystat{'wsrep_cluster_status'};\n if ( defined( $mystat{'wsrep_cluster_status'} )\n and $mystat{'wsrep_cluster_status'} eq \"Primary\" )\n {\n goodprint \"Galera cluster is consistent and ready for operations\";\n }\n else {\n badprint \"Cluster is not consistent and ready\";\n }\n if ( $mystat{'wsrep_local_state_uuid'} eq\n $mystat{'wsrep_cluster_state_uuid'} )\n {\n goodprint \"Node and whole cluster at the same level: \"\n . $mystat{'wsrep_cluster_state_uuid'};\n }\n else {\n badprint \"Node and whole cluster not the same level\";\n infoprint \"Node state uuid: \" . $mystat{'wsrep_local_state_uuid'};\n infoprint \"Cluster state uuid: \" . $mystat{'wsrep_cluster_state_uuid'};\n }\n if ( $mystat{'wsrep_local_state_comment'} eq 'Synced' ) {\n goodprint \"Node is synced with whole cluster.\";\n }\n else {\n badprint \"Node is not synced\";\n infoprint \"Node State : \" . $mystat{'wsrep_local_state_comment'};\n }\n if ( $mystat{'wsrep_local_cert_failures'} == 0 ) {\n goodprint \"There is no certification failures detected.\";\n }\n else {\n badprint \"There is \"\n . $mystat{'wsrep_local_cert_failures'}\n . \" certification failure(s)detected.\";\n }\n\n for my $key ( keys %mystat ) {\n if ( $key =~ /wsrep_|galera/i ) {\n debugprint \"WSREP: $key = $mystat{$key}\";\n }\n }\n\n #debugprint Dumper get_wsrep_options() if $opt{debug};\n}\n\n# Recommendations for InnoDB\nsub mysql_innodb {\n subheaderprint \"InnoDB Metrics\";\n\n # InnoDB\n unless ( defined $myvar{'have_innodb'}\n && $myvar{'have_innodb'} eq \"YES\" )\n {\n infoprint \"InnoDB is disabled.\";\n if ( mysql_version_ge( 5, 5 ) ) {\n my $defengine = 'InnoDB';\n $defengine = $myvar{'default_storage_engine'}\n if defined( $myvar{'default_storage_engine'} );\n badprint\n\"InnoDB Storage engine is disabled. $defengine is the default storage engine\"\n if $defengine eq 'InnoDB';\n infoprint\n\"InnoDB Storage engine is disabled. $defengine is the default storage engine\"\n if $defengine ne 'InnoDB';\n }\n return;\n }\n infoprint \"InnoDB is enabled.\";\n if ( !defined $enginestats{'InnoDB'} ) {\n if ( $opt{skipsize} eq 1 ) {\n infoprint \"Skipped due to --skipsize option\";\n return;\n }\n badprint \"No tables are Innodb\";\n $enginestats{'InnoDB'} = 0;\n }\n\n if ( $opt{buffers} ne 0 ) {\n infoprint \"InnoDB Buffers\";\n if ( defined $myvar{'innodb_buffer_pool_size'} ) {\n infoprint \" +-- InnoDB Buffer Pool: \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . \"\";\n }\n if ( defined $myvar{'innodb_buffer_pool_instances'} ) {\n infoprint \" +-- InnoDB Buffer Pool Instances: \"\n . $myvar{'innodb_buffer_pool_instances'} . \"\";\n }\n\n if ( defined $myvar{'innodb_buffer_pool_chunk_size'} ) {\n infoprint \" +-- InnoDB Buffer Pool Chunk Size: \"\n . hr_bytes( $myvar{'innodb_buffer_pool_chunk_size'} ) . \"\";\n }\n if ( defined $myvar{'innodb_additional_mem_pool_size'} ) {\n infoprint \" +-- InnoDB Additional Mem Pool: \"\n . hr_bytes( $myvar{'innodb_additional_mem_pool_size'} ) . \"\";\n }\n if ( defined $myvar{'innodb_redo_log_capacity'} ) {\n infoprint \" +-- InnoDB Redo Log Capacity: \"\n . hr_bytes( $myvar{'innodb_redo_log_capacity'} );\n }\n else {\n if ( defined $myvar{'innodb_log_file_size'} ) {\n infoprint \" +-- InnoDB Log File Size: \"\n . hr_bytes( $myvar{'innodb_log_file_size'} );\n }\n if ( defined $myvar{'innodb_log_files_in_group'} ) {\n infoprint \" +-- InnoDB Log File In Group: \"\n . $myvar{'innodb_log_files_in_group'};\n infoprint \" +-- InnoDB Total Log File Size: \"\n . hr_bytes( $myvar{'innodb_log_files_in_group'} *\n $myvar{'innodb_log_file_size'} )\n . \"(\"\n . $mycalc{'innodb_log_size_pct'}\n . \" % of buffer pool)\";\n }\n else {\n infoprint \" +-- InnoDB Total Log File Size: \"\n . hr_bytes( $myvar{'innodb_log_file_size'} ) . \"(\"\n . $mycalc{'innodb_log_size_pct'}\n . \" % of buffer pool)\";\n }\n }\n if ( defined $myvar{'innodb_log_buffer_size'} ) {\n infoprint \" +-- InnoDB Log Buffer: \"\n . hr_bytes( $myvar{'innodb_log_buffer_size'} );\n }\n if ( defined $mystat{'Innodb_buffer_pool_pages_free'} ) {\n infoprint \" +-- InnoDB Buffer Free: \"\n . hr_bytes( $mystat{'Innodb_buffer_pool_pages_free'} ) . \"\";\n }\n if ( defined $mystat{'Innodb_buffer_pool_pages_total'} ) {\n infoprint \" +-- InnoDB Buffer Used: \"\n . hr_bytes( $mystat{'Innodb_buffer_pool_pages_total'} ) . \"\";\n }\n }\n\n if ( defined $myvar{'innodb_thread_concurrency'} ) {\n infoprint \"InnoDB Thread Concurrency: \"\n . $myvar{'innodb_thread_concurrency'};\n }\n\n # InnoDB Buffer Pool Size\n if ( $myvar{'innodb_file_per_table'} eq \"ON\" ) {\n goodprint \"InnoDB File per table is activated\";\n }\n else {\n badprint \"InnoDB File per table is not activated\";\n push( @adjvars, \"innodb_file_per_table=ON\" );\n }\n\n # InnoDB Buffer Pool Size\n if ( $arch == 32 && $myvar{'innodb_buffer_pool_size'} > 4294967295 ) {\n badprint\n \"InnoDB Buffer Pool size limit reached for 32 bits architecture: (\"\n . hr_bytes(4294967295) . \" )\";\n push( @adjvars,\n \"limit innodb_buffer_pool_size under \"\n . hr_bytes(4294967295)\n . \" for 32 bits architecture\" );\n }\n if ( $arch == 32 && $myvar{'innodb_buffer_pool_size'} < 4294967295 ) {\n goodprint \"InnoDB Buffer Pool size ( \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" ) under limit for 32 bits architecture: (\"\n . hr_bytes(4294967295) . \")\";\n }\n if ( $arch == 64\n && $myvar{'innodb_buffer_pool_size'} > 18446744073709551615 )\n {\n badprint \"InnoDB Buffer Pool size limit(\"\n . hr_bytes(18446744073709551615)\n . \") reached for 64 bits architecture\";\n push( @adjvars,\n \"limit innodb_buffer_pool_size under \"\n . hr_bytes(18446744073709551615)\n . \" for 64 bits architecture\" );\n }\n\n if ( $arch == 64\n && $myvar{'innodb_buffer_pool_size'} < 18446744073709551615 )\n {\n goodprint \"InnoDB Buffer Pool size ( \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" ) under limit for 64 bits architecture: (\"\n . hr_bytes(18446744073709551615) . \" )\";\n }\n if ( $myvar{'innodb_buffer_pool_size'} > $enginestats{'InnoDB'} ) {\n goodprint \"InnoDB buffer pool / data size: \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . \" / \"\n . hr_bytes( $enginestats{'InnoDB'} ) . \"\";\n }\n else {\n badprint \"InnoDB buffer pool / data size: \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} ) . \" / \"\n . hr_bytes( $enginestats{'InnoDB'} ) . \"\";\n push( @adjvars,\n \"innodb_buffer_pool_size (>= \"\n . hr_bytes( $enginestats{'InnoDB'} )\n . \") if possible.\" );\n }\n\n # select round( 100* sum(allocated)/( select VARIABLE_VALUE\n # FROM information_schema.global_variables\n # where VARIABLE_NAME='innodb_buffer_pool_size' )\n # ,2) as \"PCT ALLOC/BUFFER POOL\"\n #from sys.x$innodb_buffer_stats_by_table;\n\n if ( $opt{experimental} ) {\n debugprint( 'innodb_buffer_alloc_pct: \"'\n . $mycalc{innodb_buffer_alloc_pct}\n . '\"' );\n if ( defined $mycalc{innodb_buffer_alloc_pct}\n and $mycalc{innodb_buffer_alloc_pct} ne '' )\n {\n if ( $mycalc{innodb_buffer_alloc_pct} < 80 ) {\n badprint \"Ratio Buffer Pool allocated / Buffer Pool Size: \"\n . $mycalc{'innodb_buffer_alloc_pct'} . '%';\n }\n else {\n goodprint \"Ratio Buffer Pool allocated / Buffer Pool Size: \"\n . $mycalc{'innodb_buffer_alloc_pct'} . '%';\n }\n }\n }\n if ( $mycalc{'innodb_log_size_pct'} < 20\n or $mycalc{'innodb_log_size_pct'} > 30 )\n {\n if ( defined $myvar{'innodb_redo_log_capacity'} ) {\n badprint\n \"Ratio InnoDB redo log capacity / InnoDB Buffer pool size (\"\n . $mycalc{'innodb_log_size_pct'} . \"%): \"\n . hr_bytes( $myvar{'innodb_redo_log_capacity'} ) . \" / \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" should be equal to 25%\";\n push( @adjvars,\n \"innodb_redo_log_capacity should be (=\"\n . hr_bytes_rnd( $myvar{'innodb_buffer_pool_size'} / 4 )\n . \") if possible, so InnoDB Redo log Capacity equals 25% of buffer pool size.\"\n );\n push( @generalrec,\n\"Be careful, increasing innodb_redo_log_capacity means higher crash recovery mean time\"\n );\n }\n else {\n badprint \"Ratio InnoDB log file size / InnoDB Buffer pool size (\"\n . $mycalc{'innodb_log_size_pct'} . \"%): \"\n . hr_bytes( $myvar{'innodb_log_file_size'} ) . \" * \"\n . $myvar{'innodb_log_files_in_group'} . \" / \"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" should be equal to 25%\";\n push(\n @adjvars,\n \"innodb_log_file_size should be (=\"\n . hr_bytes_rnd(\n $myvar{'innodb_buffer_pool_size'} /\n $myvar{'innodb_log_files_in_group'} / 4\n )\n . \") if possible, so InnoDB total log file size equals 25% of buffer pool size.\"\n );\n push( @generalrec,\n\"Be careful, increasing innodb_log_file_size / innodb_log_files_in_group means higher crash recovery mean time\"\n );\n }\n if ( mysql_version_le( 5, 6, 2 ) ) {\n push( @generalrec,\n\"For MySQL 5.6.2 and lower, total innodb_log_file_size should have a ceiling of (4096MB / log files in group) - 1MB.\"\n );\n }\n\n }\n else {\n if ( defined $myvar{'innodb_redo_log_capacity'} ) {\n goodprint\n \"Ratio InnoDB Redo Log Capacity / InnoDB Buffer pool size: \"\n . hr_bytes( $myvar{'innodb_redo_log_capacity'} ) . \"/\"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" should be equal to 25%\";\n }\n else {\n push( @generalrec,\n\"Before changing innodb_log_file_size and/or innodb_log_files_in_group read this: https://bit.ly/2TcGgtU\"\n );\n goodprint \"Ratio InnoDB log file size / InnoDB Buffer pool size: \"\n . hr_bytes( $myvar{'innodb_log_file_size'} ) . \" * \"\n . $myvar{'innodb_log_files_in_group'} . \"/\"\n . hr_bytes( $myvar{'innodb_buffer_pool_size'} )\n . \" should be equal to 25%\";\n }\n }\n\n # InnoDB Buffer Pool Instances (MySQL 5.6.6+)\n if ( not mysql_version_ge( 10, 4 )\n and defined( $myvar{'innodb_buffer_pool_instances'} ) )\n {\n\n # Bad Value if > 64\n if ( $myvar{'innodb_buffer_pool_instances'} > 64 ) {\n badprint \"InnoDB buffer pool instances: \"\n . $myvar{'innodb_buffer_pool_instances'} . \"\";\n push( @adjvars, \"innodb_buffer_pool_instances (<= 64)\" );\n }\n\n # InnoDB Buffer Pool Size > 1Go\n if ( $myvar{'innodb_buffer_pool_size'} > 1024 * 1024 * 1024 ) {\n\n# InnoDB Buffer Pool Size / 1Go = InnoDB Buffer Pool Instances limited to 64 max.\n\n # InnoDB Buffer Pool Size > 64Go\n my $max_innodb_buffer_pool_instances =\n int( $myvar{'innodb_buffer_pool_size'} / ( 1024 * 1024 * 1024 ) );\n $max_innodb_buffer_pool_instances = 64\n if ( $max_innodb_buffer_pool_instances > 64 );\n\n if ( $myvar{'innodb_buffer_pool_instances'} !=\n $max_innodb_buffer_pool_instances )\n {\n badprint \"InnoDB buffer pool instances: \"\n . $myvar{'innodb_buffer_pool_instances'} . \"\";\n push( @adjvars,\n \"innodb_buffer_pool_instances(=\"\n . $max_innodb_buffer_pool_instances\n . \")\" );\n }\n else {\n goodprint \"InnoDB buffer pool instances: \"\n . $myvar{'innodb_buffer_pool_instances'} . \"\";\n }\n\n # InnoDB Buffer Pool Size < 1Go\n }\n else {\n if ( $myvar{'innodb_buffer_pool_instances'} != 1 ) {\n badprint\n\"InnoDB buffer pool <= 1G and Innodb_buffer_pool_instances(!=1).\";\n push( @adjvars, \"innodb_buffer_pool_instances (=1)\" );\n }\n else {\n goodprint \"InnoDB buffer pool instances: \"\n . $myvar{'innodb_buffer_pool_instances'} . \"\";\n }\n }\n }\n\n # InnoDB Used Buffer Pool Size vs CHUNK size\n if ( !defined( $myvar{'innodb_buffer_pool_chunk_size'} ) ) {\n infoprint\n \"InnoDB Buffer Pool Chunk Size not used or defined in your version\";\n }\n else {\n infoprint \"Number of InnoDB Buffer Pool Chunk: \"\n . int( $myvar{'innodb_buffer_pool_size'} ) /\n int( $myvar{'innodb_buffer_pool_chunk_size'} ) . \" for \"\n . $myvar{'innodb_buffer_pool_instances'}\n . \" Buffer Pool Instance(s)\";\n\n if (\n int( $myvar{'innodb_buffer_pool_size'} ) % (\n int( $myvar{'innodb_buffer_pool_chunk_size'} ) *\n int( $myvar{'innodb_buffer_pool_instances'} )\n ) eq 0\n )\n {\n goodprint\n\"Innodb_buffer_pool_size aligned with Innodb_buffer_pool_chunk_size & Innodb_buffer_pool_instances\";\n }\n else {\n badprint\n\"Innodb_buffer_pool_size aligned with Innodb_buffer_pool_chunk_size & Innodb_buffer_pool_instances\";\n\n#push( @adjvars, \"Adjust innodb_buffer_pool_instances, innodb_buffer_pool_chunk_size with innodb_buffer_pool_size\" );\n push( @adjvars,\n\"innodb_buffer_pool_size must always be equal to or a multiple of innodb_buffer_pool_chunk_size * innodb_buffer_pool_instances\"\n );\n }\n }\n\n # InnoDB Read efficiency\n if ( defined $mycalc{'pct_read_efficiency'}\n && $mycalc{'pct_read_efficiency'} < 90 )\n {\n badprint \"InnoDB Read buffer efficiency: \"\n . $mycalc{'pct_read_efficiency'} . \"% (\"\n . $mystat{'Innodb_buffer_pool_read_requests'}\n . \" hits / \"\n . ( $mystat{'Innodb_buffer_pool_reads'} +\n $mystat{'Innodb_buffer_pool_read_requests'} )\n . \" total)\";\n }\n else {\n goodprint \"InnoDB Read buffer efficiency: \"\n . $mycalc{'pct_read_efficiency'} . \"% (\"\n . $mystat{'Innodb_buffer_pool_read_requests'}\n . \" hits / \"\n . ( $mystat{'Innodb_buffer_pool_reads'} +\n $mystat{'Innodb_buffer_pool_read_requests'} )\n . \" total)\";\n }\n\n # InnoDB Write efficiency\n if ( defined $mycalc{'pct_write_efficiency'}\n && $mycalc{'pct_write_efficiency'} < 90 )\n {\n badprint \"InnoDB Write Log efficiency: \"\n . abs( $mycalc{'pct_write_efficiency'} ) . \"% (\"\n . abs( $mystat{'Innodb_log_write_requests'} -\n $mystat{'Innodb_log_writes'} )\n . \" hits / \"\n . $mystat{'Innodb_log_write_requests'}\n . \" total)\";\n push( @adjvars,\n \"innodb_log_buffer_size (> \"\n . hr_bytes_rnd( $myvar{'innodb_log_buffer_size'} )\n . \")\" );\n }\n else {\n goodprint \"InnoDB Write Log efficiency: \"\n . $mycalc{'pct_write_efficiency'} . \"% (\"\n . ( $mystat{'Innodb_log_write_requests'} -\n $mystat{'Innodb_log_writes'} )\n . \" hits / \"\n . $mystat{'Innodb_log_write_requests'}\n . \" total)\";\n }\n\n # InnoDB Log Waits\n $mystat{'Innodb_log_waits_computed'} = 0;\n\n if ( defined( $mystat{'Innodb_log_waits'} )\n and defined( $mystat{'Innodb_log_writes'} )\n and $mystat{'Innodb_log_writes'} > 0.000001 )\n {\n $mystat{'Innodb_log_waits_computed'} =\n $mystat{'Innodb_log_waits'} / $mystat{'Innodb_log_writes'};\n }\n else {\n undef $mystat{'Innodb_log_waits_computed'};\n }\n\n if ( defined $mystat{'Innodb_log_waits_computed'}\n && $mystat{'Innodb_log_waits_computed'} > 0.000001 )\n {\n badprint \"InnoDB log waits: \"\n . percentage( $mystat{'Innodb_log_waits'},\n $mystat{'Innodb_log_writes'} )\n . \"% (\"\n . $mystat{'Innodb_log_waits'}\n . \" waits / \"\n . $mystat{'Innodb_log_writes'}\n . \" writes)\";\n push( @adjvars,\n \"innodb_log_buffer_size (> \"\n . hr_bytes_rnd( $myvar{'innodb_log_buffer_size'} )\n . \")\" );\n }\n else {\n goodprint \"InnoDB log waits: \"\n . percentage( $mystat{'Innodb_log_waits'},\n $mystat{'Innodb_log_writes'} )\n . \"% (\"\n . $mystat{'Innodb_log_waits'}\n . \" waits / \"\n . $mystat{'Innodb_log_writes'}\n . \" writes)\";\n }\n $result{'Calculations'} = {%mycalc};\n}\n\nsub check_metadata_perf {\n subheaderprint \"Analysis Performance Metrics\";\n if ( defined $myvar{'innodb_stats_on_metadata'} ) {\n infoprint \"innodb_stats_on_metadata: \"\n . $myvar{'innodb_stats_on_metadata'};\n if ( $myvar{'innodb_stats_on_metadata'} eq 'ON' ) {\n badprint \"Stat are updated during querying INFORMATION_SCHEMA.\";\n push @adjvars, \"SET innodb_stats_on_metadata = OFF\";\n\n #Disabling innodb_stats_on_metadata\n select_one(\"SET GLOBAL innodb_stats_on_metadata = OFF;\");\n return 1;\n }\n }\n goodprint \"No stat updates during querying INFORMATION_SCHEMA.\";\n return 0;\n}\n\n# Recommendations for Database metrics\nsub mysql_databases {\n return if ( $opt{dbstat} == 0 );\n\n subheaderprint \"Database Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Database metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n\n @dblist = select_array(\n\"SELECT SCHEMA_NAME FROM information_schema.SCHEMATA WHERE SCHEMA_NAME NOT IN ( 'mysql', 'performance_schema', 'information_schema', 'sys' );\"\n );\n infoprint \"There is \" . scalar(@dblist) . \" Database(s).\";\n my @totaldbinfo = split /\\s/,\n select_one(\n\"SELECT SUM(TABLE_ROWS), SUM(DATA_LENGTH), SUM(INDEX_LENGTH), SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(TABLE_NAME), COUNT(DISTINCT(TABLE_COLLATION)), COUNT(DISTINCT(ENGINE)) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');\"\n );\n infoprint \"All User Databases:\";\n infoprint \" +-- TABLE : \"\n . select_one(\n\"SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')\"\n ) . \"\";\n infoprint \" +-- VIEW : \"\n . select_one(\n\"SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='VIEW' AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')\"\n ) . \"\";\n infoprint \" +-- INDEX : \"\n . select_one(\n\"SELECT count(distinct(concat(TABLE_NAME, TABLE_SCHEMA, INDEX_NAME))) from information_schema.STATISTICS WHERE TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys')\"\n ) . \"\";\n\n infoprint \" +-- CHARS : \"\n . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"select distinct(CHARACTER_SET_NAME) from information_schema.columns WHERE CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');\"\n )\n ) . \")\";\n infoprint \" +-- COLLA : \"\n . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"SELECT DISTINCT(TABLE_COLLATION) FROM information_schema.TABLES WHERE TABLE_COLLATION IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');\"\n )\n ) . \")\";\n infoprint \" +-- ROWS : \"\n . ( $totaldbinfo[0] eq 'NULL' ? 0 : $totaldbinfo[0] ) . \"\";\n infoprint \" +-- DATA : \"\n . hr_bytes( $totaldbinfo[1] ) . \"(\"\n . percentage( $totaldbinfo[1], $totaldbinfo[3] ) . \"%)\";\n infoprint \" +-- INDEX : \"\n . hr_bytes( $totaldbinfo[2] ) . \"(\"\n . percentage( $totaldbinfo[2], $totaldbinfo[3] ) . \"%)\";\n infoprint \" +-- SIZE : \" . hr_bytes( $totaldbinfo[3] ) . \"\";\n infoprint \" +-- ENGINE: \"\n . ( $totaldbinfo[6] eq 'NULL' ? 0 : $totaldbinfo[6] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE ENGINE IS NOT NULL AND TABLE_SCHEMA NOT IN ('mysql', 'performance_schema', 'information_schema', 'sys');\"\n )\n ) . \")\";\n\n $result{'Databases'}{'All databases'}{'Rows'} =\n ( $totaldbinfo[0] eq 'NULL' ? 0 : $totaldbinfo[0] );\n $result{'Databases'}{'All databases'}{'Data Size'} = $totaldbinfo[1];\n $result{'Databases'}{'All databases'}{'Data Pct'} =\n percentage( $totaldbinfo[1], $totaldbinfo[3] ) . \"%\";\n $result{'Databases'}{'All databases'}{'Index Size'} = $totaldbinfo[2];\n $result{'Databases'}{'All databases'}{'Index Pct'} =\n percentage( $totaldbinfo[2], $totaldbinfo[3] ) . \"%\";\n $result{'Databases'}{'All databases'}{'Total Size'} = $totaldbinfo[3];\n print \"\\n\" unless ( $opt{'silent'} or $opt{'json'} );\n my $nbViews = 0;\n my $nbTables = 0;\n\n foreach (@dblist) {\n my @dbinfo = split /\\s/,\n select_one(\n\"SELECT TABLE_SCHEMA, SUM(TABLE_ROWS), SUM(DATA_LENGTH), SUM(INDEX_LENGTH), SUM(DATA_LENGTH+INDEX_LENGTH), COUNT(DISTINCT ENGINE), COUNT(TABLE_NAME), COUNT(DISTINCT(TABLE_COLLATION)), COUNT(DISTINCT(ENGINE)) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' GROUP BY TABLE_SCHEMA ORDER BY TABLE_SCHEMA\"\n );\n next unless defined $dbinfo[0];\n\n infoprint \"Database: \" . $dbinfo[0] . \"\";\n $nbTables = select_one(\n\"SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA='$_'\"\n );\n infoprint \" +-- TABLE : $nbTables\";\n infoprint \" +-- VIEW : \"\n . select_one(\n\"SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='VIEW' AND TABLE_SCHEMA='$_'\"\n ) . \"\";\n infoprint \" +-- INDEX : \"\n . select_one(\n\"SELECT count(distinct(concat(TABLE_NAME, TABLE_SCHEMA, INDEX_NAME))) from information_schema.STATISTICS WHERE TABLE_SCHEMA='$_'\"\n ) . \"\";\n infoprint \" +-- CHARS : \"\n . ( $totaldbinfo[5] eq 'NULL' ? 0 : $totaldbinfo[5] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"select distinct(CHARACTER_SET_NAME) from information_schema.columns WHERE CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA='$_';\"\n )\n ) . \")\";\n infoprint \" +-- COLLA : \"\n . ( $dbinfo[7] eq 'NULL' ? 0 : $dbinfo[7] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"SELECT DISTINCT(TABLE_COLLATION) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND TABLE_COLLATION IS NOT NULL;\"\n )\n ) . \")\";\n infoprint \" +-- ROWS : \"\n . ( !defined( $dbinfo[1] ) or $dbinfo[1] eq 'NULL' ? 0 : $dbinfo[1] )\n . \"\";\n infoprint \" +-- DATA : \"\n . hr_bytes( $dbinfo[2] ) . \"(\"\n . percentage( $dbinfo[2], $dbinfo[4] ) . \"%)\";\n infoprint \" +-- INDEX : \"\n . hr_bytes( $dbinfo[3] ) . \"(\"\n . percentage( $dbinfo[3], $dbinfo[4] ) . \"%)\";\n infoprint \" +-- TOTAL : \" . hr_bytes( $dbinfo[4] ) . \"\";\n infoprint \" +-- ENGINE: \"\n . ( $dbinfo[8] eq 'NULL' ? 0 : $dbinfo[8] ) . \" (\"\n . (\n join \", \",\n select_array(\n\"SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND ENGINE IS NOT NULL\"\n )\n ) . \")\";\n\n foreach my $eng (\n select_array(\n\"SELECT DISTINCT(ENGINE) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$_' AND ENGINE IS NOT NULL\"\n )\n )\n {\n infoprint \" +-- ENGINE $eng : \"\n . select_one(\n\"SELECT COUNT(*) FROM information_schema.TABLES WHERE TABLE_SCHEMA='$dbinfo[0]' AND ENGINE='$eng'\"\n ) . \" TABLE(s)\";\n }\n\n if ( $nbTables == 0 ) {\n badprint \" No table in $dbinfo[0] database\";\n next;\n }\n badprint \"Index size is larger than data size for $dbinfo[0] \\n\"\n if ( $dbinfo[2] ne 'NULL' )\n and ( $dbinfo[3] ne 'NULL' )\n and ( $dbinfo[2] < $dbinfo[3] );\n if ( $dbinfo[5] > 1 and $nbTables > 0 ) {\n badprint \"There are \"\n . $dbinfo[5]\n . \" storage engines. Be careful. \\n\";\n push @generalrec,\n\"Select one storage engine (InnoDB is a good choice) for all tables in $dbinfo[0] database ($dbinfo[5] engines detected)\";\n }\n $result{'Databases'}{ $dbinfo[0] }{'Rows'} = $dbinfo[1];\n $result{'Databases'}{ $dbinfo[0] }{'Tables'} = $dbinfo[6];\n $result{'Databases'}{ $dbinfo[0] }{'Collations'} = $dbinfo[7];\n $result{'Databases'}{ $dbinfo[0] }{'Data Size'} = $dbinfo[2];\n $result{'Databases'}{ $dbinfo[0] }{'Data Pct'} =\n percentage( $dbinfo[2], $dbinfo[4] ) . \"%\";\n $result{'Databases'}{ $dbinfo[0] }{'Index Size'} = $dbinfo[3];\n $result{'Databases'}{ $dbinfo[0] }{'Index Pct'} =\n percentage( $dbinfo[3], $dbinfo[4] ) . \"%\";\n $result{'Databases'}{ $dbinfo[0] }{'Total Size'} = $dbinfo[4];\n\n if ( $dbinfo[7] > 1 ) {\n badprint $dbinfo[7]\n . \" different collations for database \"\n . $dbinfo[0];\n push( @generalrec,\n \"Check all table collations are identical for all tables in \"\n . $dbinfo[0]\n . \" database.\" );\n }\n else {\n goodprint $dbinfo[7]\n . \" collation for \"\n . $dbinfo[0]\n . \" database.\";\n }\n if ( $dbinfo[8] > 1 ) {\n badprint $dbinfo[8]\n . \" different engines for database \"\n . $dbinfo[0];\n push( @generalrec,\n \"Check all table engines are identical for all tables in \"\n . $dbinfo[0]\n . \" database.\" );\n }\n else {\n goodprint $dbinfo[8] . \" engine for \" . $dbinfo[0] . \" database.\";\n }\n\n my @distinct_column_charset = select_array(\n\"select DISTINCT(CHARACTER_SET_NAME) from information_schema.COLUMNS where CHARACTER_SET_NAME IS NOT NULL AND TABLE_SCHEMA ='$_' AND CHARACTER_SET_NAME IS NOT NULL\"\n );\n infoprint \"Charsets for $dbinfo[0] database table column: \"\n . join( ', ', @distinct_column_charset );\n if ( scalar(@distinct_column_charset) > 1 ) {\n badprint $dbinfo[0]\n . \" table column(s) has several charsets defined for all text like column(s).\";\n push( @generalrec,\n \"Limit charset for column to one charset if possible for \"\n . $dbinfo[0]\n . \" database.\" );\n }\n else {\n goodprint $dbinfo[0]\n . \" table column(s) has same charset defined for all text like column(s).\";\n }\n\n my @distinct_column_collation = select_array(\n\"select DISTINCT(COLLATION_NAME) from information_schema.COLUMNS where COLLATION_NAME IS NOT NULL AND TABLE_SCHEMA ='$_' AND COLLATION_NAME IS NOT NULL\"\n );\n infoprint \"Collations for $dbinfo[0] database table column: \"\n . join( ', ', @distinct_column_collation );\n if ( scalar(@distinct_column_collation) > 1 ) {\n badprint $dbinfo[0]\n . \" table column(s) has several collations defined for all text like column(s).\";\n push( @generalrec,\n \"Limit collations for column to one collation if possible for \"\n . $dbinfo[0]\n . \" database.\" );\n }\n else {\n goodprint $dbinfo[0]\n . \" table column(s) has same collation defined for all text like column(s).\";\n }\n }\n}\n\n# Recommendations for database columns\nsub mysql_tables {\n return if ( $opt{tbstat} == 0 );\n\n subheaderprint \"Table Column Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Table column metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n if ( mysql_version_ge(8) and not mysql_version_eq(10) ) {\n infoprint\n\"MySQL and Percona version 8.0 and greater have removed PROCEDURE ANALYSE feature\";\n $opt{colstat} = 0;\n infoprint \"Disabling colstat parameter\";\n\n }\n\n infoprint(\"Dumpdir: $opt{dumpdir}\");\n\n # Store all information schema in dumpdir if defined\n if ( defined $opt{dumpdir} and -d \"$opt{dumpdir}\" ) {\n for my $info_s_table (\n select_array('use information_schema;show tables;') )\n {\n infoprint \"Dumping $info_s_table into $opt{dumpdir}\";\n select_csv_file(\n \"$opt{dumpdir}/ifs_${info_s_table}.csv\",\n \"select * from information_schema.$info_s_table\"\n );\n }\n\n #exit 0 if ( $opt{stop} == 1 );\n }\n foreach ( select_user_dbs() ) {\n my $dbname = $_;\n next unless defined $_;\n infoprint \"Database: \" . $_ . \"\";\n my @dbtable = select_array(\n\"SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='$dbname' AND TABLE_TYPE='BASE TABLE' ORDER BY TABLE_NAME\"\n );\n foreach (@dbtable) {\n my $tbname = $_;\n infoprint \" +-- TABLE: $tbname\";\n infoprint \" +-- TYPE: \"\n . select_one(\n\"SELECT ENGINE FROM information_schema.tables where TABLE_schema='$dbname' AND TABLE_NAME='$tbname'\"\n );\n\n my $selIdxReq = <<\"ENDSQL\";\n SELECT index_name AS idxname, \n GROUP_CONCAT(column_name ORDER BY seq_in_index) AS cols, \n INDEX_TYPE as type\n FROM information_schema.statistics\n WHERE INDEX_SCHEMA='$dbname'\n AND TABLE_NAME='$tbname'\n GROUP BY idxname, type\nENDSQL\n my @tbidx = select_array($selIdxReq);\n my $found = 0;\n foreach my $idx (@tbidx) {\n my @info = split /\\s/, $idx;\n next if $info[0] eq 'NULL';\n infoprint\n \" +-- Index $info[0] - Cols: $info[1] - Type: $info[2]\";\n $found++;\n }\n if ( $found == 0 ) {\n badprint(\"Table $dbname.$tbname has no index defined\");\n push @generalrec,\n \"Add at least a primary key on table $dbname.$tbname\";\n }\n my @tbcol = select_array(\n\"SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname'\"\n );\n foreach (@tbcol) {\n my $ctype = select_one(\n\"SELECT COLUMN_TYPE FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname' AND COLUMN_NAME='$_' \"\n );\n my $isnull = select_one(\n\"SELECT IS_NULLABLE FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='$dbname' AND TABLE_NAME='$tbname' AND COLUMN_NAME='$_' \"\n );\n\n my $current_type =\n uc($ctype) . ( $isnull eq 'NO' ? \" NOT NULL\" : \" NULL\" );\n my $optimal_type = '';\n infoprint \" +-- Column $tbname.$_: $current_type\";\n if ( $opt{colstat} == 1 ) {\n $optimal_type = select_str_g( \"Optimal_fieldtype\",\n\"SELECT \\\\`$_\\\\` FROM \\\\`$dbname\\\\`.\\\\`$tbname\\\\` PROCEDURE ANALYSE(100000)\"\n )\n unless ( mysql_version_ge(8)\n and not mysql_version_eq(10) );\n }\n if ( $optimal_type eq '' ) {\n\n #infoprint \" +-- Current Fieldtype: $current_type\";\n\n #infoprint \" Optimal Fieldtype: Not available\";\n }\n elsif ( $current_type ne $optimal_type\n and $current_type !~ /.*DATETIME.*/\n and $current_type !~ /.*TIMESTAMP.*/ )\n {\n infoprint \" +-- Current Fieldtype: $current_type\";\n if ( $optimal_type =~ /.*ENUM\\(.*/ ) {\n $optimal_type = \"ENUM( ... )\";\n }\n infoprint \" +-- Optimal Fieldtype: $optimal_type \";\n if ( $optimal_type !~ /.*ENUM\\(.*/ ) {\n badprint\n\"Consider changing type for column $_ in table $dbname.$tbname\";\n push( @generalrec,\n\"ALTER TABLE \\`$dbname\\`.\\`$tbname\\` MODIFY \\`$_\\` $optimal_type;\"\n );\n }\n }\n else {\n goodprint \"$dbname.$tbname ($_) type: $current_type\";\n }\n }\n }\n }\n}\n\n# Recommendations for Indexes metrics\nsub mysql_indexes {\n return if ( $opt{idxstat} == 0 );\n\n subheaderprint \"Indexes Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Index metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n\n# unless ( mysql_version_ge( 5, 6 ) ) {\n# infoprint\n#\"Skip Index metrics from information schema due to erroneous information provided in this version\";\n# return;\n# }\n my $selIdxReq = <<'ENDSQL';\nSELECT\n CONCAT(t.TABLE_SCHEMA, '.', t.TABLE_NAME) AS 'table', \n CONCAT(s.INDEX_NAME, '(', s.COLUMN_NAME, ')') AS 'index'\n , s.SEQ_IN_INDEX AS 'seq'\n , s2.max_columns AS 'maxcol'\n , s.CARDINALITY AS 'card'\n , t.TABLE_ROWS AS 'est_rows'\n , INDEX_TYPE as type\n , ROUND(((s.CARDINALITY / IFNULL(t.TABLE_ROWS, 0.01)) * 100), 2) AS 'sel'\nFROM INFORMATION_SCHEMA.STATISTICS s\n INNER JOIN INFORMATION_SCHEMA.TABLES t\n ON s.TABLE_SCHEMA = t.TABLE_SCHEMA\n AND s.TABLE_NAME = t.TABLE_NAME\n INNER JOIN (\n SELECT\n TABLE_SCHEMA\n , TABLE_NAME\n , INDEX_NAME\n , MAX(SEQ_IN_INDEX) AS max_columns\n FROM INFORMATION_SCHEMA.STATISTICS\n WHERE TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema')\n AND INDEX_TYPE <> 'FULLTEXT'\n GROUP BY TABLE_SCHEMA, TABLE_NAME, INDEX_NAME\n ) AS s2\n ON s.TABLE_SCHEMA = s2.TABLE_SCHEMA\n AND s.TABLE_NAME = s2.TABLE_NAME\n AND s.INDEX_NAME = s2.INDEX_NAME\nWHERE t.TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema')\nAND t.TABLE_ROWS > 10\nAND s.CARDINALITY IS NOT NULL\nAND (s.CARDINALITY / IFNULL(t.TABLE_ROWS, 0.01)) < 8.00\nORDER BY sel\nLIMIT 10;\nENDSQL\n my @idxinfo = select_array($selIdxReq);\n infoprint \"Worst selectivity indexes:\";\n foreach (@idxinfo) {\n debugprint \"$_\";\n my @info = split /\\s/;\n infoprint \"Index: \" . $info[1] . \"\";\n\n infoprint \" +-- COLUMN : \" . $info[0] . \"\";\n infoprint \" +-- NB SEQS : \" . $info[2] . \" sequence(s)\";\n infoprint \" +-- NB COLS : \" . $info[3] . \" column(s)\";\n infoprint \" +-- CARDINALITY : \" . $info[4] . \" distinct values\";\n infoprint \" +-- NB ROWS : \" . $info[5] . \" rows\";\n infoprint \" +-- TYPE : \" . $info[6];\n infoprint \" +-- SELECTIVITY : \" . $info[7] . \"%\";\n\n $result{'Indexes'}{ $info[1] }{'Column'} = $info[0];\n $result{'Indexes'}{ $info[1] }{'Sequence number'} = $info[2];\n $result{'Indexes'}{ $info[1] }{'Number of column'} = $info[3];\n $result{'Indexes'}{ $info[1] }{'Cardinality'} = $info[4];\n $result{'Indexes'}{ $info[1] }{'Row number'} = $info[5];\n $result{'Indexes'}{ $info[1] }{'Index Type'} = $info[6];\n $result{'Indexes'}{ $info[1] }{'Selectivity'} = $info[7];\n if ( $info[7] < 25 ) {\n badprint \"$info[1] has a low selectivity\";\n }\n }\n infoprint \"Indexes per database:\";\n foreach my $dbname ( select_user_dbs() ) {\n infoprint \"Database: \" . $dbname . \"\";\n $selIdxReq = <<\"ENDSQL\";\n SELECT concat(table_name, '.', index_name) AS idxname,\n GROUP_CONCAT(column_name ORDER BY seq_in_index) AS cols,\n SUM(CARDINALITY) as card,\n INDEX_TYPE as type\n FROM information_schema.statistics\n WHERE INDEX_SCHEMA='$dbname'\n AND index_name IS NOT NULL\n GROUP BY table_name, idxname, type\nENDSQL\n my $found = 0;\n foreach my $idxinfo ( select_array($selIdxReq) ) {\n my @info = split /\\s/, $idxinfo;\n next if $info[0] eq 'NULL';\n infoprint \" +-- INDEX : \" . $info[0];\n infoprint \" +-- COLUMNS : \" . $info[1];\n infoprint \" +-- CARDINALITY: \" . $info[2];\n infoprint \" +-- TYPE : \" . $info[4] if defined $info[4];\n infoprint \" +-- COMMENT : \" . $info[5] if defined $info[5];\n $found++;\n }\n my $nbTables = select_one(\n\"SELECT count(*) from information_schema.TABLES WHERE TABLE_TYPE ='BASE TABLE' AND TABLE_SCHEMA='$dbname'\"\n );\n badprint \"No index found for $dbname database\"\n if $found == 0 and $nbTables > 1;\n push @generalrec, \"Add indexes on tables from $dbname database\"\n if $found == 0 and $nbTables > 1;\n }\n return\n unless ( defined( $myvar{'performance_schema'} )\n and $myvar{'performance_schema'} eq 'ON' );\n\n $selIdxReq = <<'ENDSQL';\nSELECT CONCAT(object_schema, '.', object_name) AS 'table', index_name\nFROM performance_schema.table_io_waits_summary_by_index_usage\nWHERE index_name IS NOT NULL\nAND count_star = 0\nAND index_name <> 'PRIMARY'\nAND object_schema NOT IN ('mysql', 'performance_schema', 'information_schema')\nORDER BY count_star, object_schema, object_name;\nENDSQL\n @idxinfo = select_array($selIdxReq);\n infoprint \"Unused indexes:\";\n push( @generalrec, \"Remove unused indexes.\" ) if ( scalar(@idxinfo) > 0 );\n foreach (@idxinfo) {\n debugprint \"$_\";\n my @info = split /\\s/;\n badprint \"Index: $info[1] on $info[0] is not used.\";\n push @{ $result{'Indexes'}{'Unused Indexes'} },\n $info[0] . \".\" . $info[1];\n }\n}\n\nsub mysql_views {\n subheaderprint \"Views Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Views metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n}\n\nsub mysql_routines {\n subheaderprint \"Routines Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Routines metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n}\n\nsub mysql_triggers {\n subheaderprint \"Triggers Metrics\";\n unless ( mysql_version_ge( 5, 5 ) ) {\n infoprint\n\"Trigger metrics from information schema are missing in this version. Skipping...\";\n return;\n }\n}\n\n# Take the two recommendation arrays and display them at the end of the output\nsub make_recommendations {\n $result{'Recommendations'} = \\@generalrec;\n $result{'AdjustVariables'} = \\@adjvars;\n subheaderprint \"Recommendations\";\n if ( @generalrec > 0 ) {\n prettyprint \"General recommendations:\";\n foreach (@generalrec) { prettyprint \" \" . $_ . \"\"; }\n }\n if ( @adjvars > 0 ) {\n prettyprint \"Variables to adjust:\";\n if ( $mycalc{'pct_max_physical_memory'} > 90 ) {\n prettyprint\n \" *** MySQL's maximum memory usage is dangerously high ***\\n\"\n . \" *** Add RAM before increasing MySQL buffer variables ***\";\n }\n foreach (@adjvars) { prettyprint \" \" . $_ . \"\"; }\n }\n if ( @generalrec == 0 && @adjvars == 0 ) {\n prettyprint \"No additional performance recommendations are available.\";\n }\n}\n\nsub close_outputfile {\n close($fh) if defined($fh);\n}\n\nsub headerprint {\n prettyprint \" >> MySQLTuner $tunerversion\\n\"\n . \"\\t * Jean-Marie Renouard \\n\"\n . \"\\t * Major Hayden \\n\"\n . \" >> Bug reports, feature requests, and downloads at http://mysqltuner.pl/\\n\"\n . \" >> Run with '--help' for additional options and output filtering\";\n debugprint( \"Debug: \" . $opt{debug} );\n debugprint( \"Experimental: \" . $opt{experimental} );\n}\n\nsub string2file {\n my $filename = shift;\n my $content = shift;\n open my $fh, q(>), $filename\n or die\n\"Unable to open $filename in write mode. Please check permissions for this file or directory\";\n print $fh $content if defined($content);\n close $fh;\n debugprint $content;\n}\n\nsub file2array {\n my $filename = shift;\n debugprint \"* reading $filename\";\n my $fh;\n open( $fh, q(<), \"$filename\" )\n or die \"Couldn't open $filename for reading: $!\\n\";\n my @lines = <$fh>;\n close($fh);\n return @lines;\n}\n\nsub file2string {\n return join( '', file2array(@_) );\n}\n\nmy $templateModel;\nif ( $opt{'template'} ne 0 ) {\n $templateModel = file2string( $opt{'template'} );\n}\nelse {\n # DEFAULT REPORT TEMPLATE\n $templateModel = <<'END_TEMPLATE';\n\n\n\n MySQLTuner Report\n \n\n\n\n

Result output

\n
\n{$data}\n
\n\n\n\nEND_TEMPLATE\n}\n\nsub dump_result {\n\n #debugprint Dumper( \\%result ) if ( $opt{'debug'} );\n debugprint \"HTML REPORT: $opt{'reportfile'}\";\n\n if ( $opt{'reportfile'} ne 0 ) {\n eval { require Text::Template };\n eval { require JSON };\n if ($@) {\n badprint \"Text::Template Module is needed.\";\n die \"Text::Template Module is needed.\";\n }\n\n my $json = JSON->new->allow_nonref;\n my $json_text = $json->pretty->encode( \\%result );\n my %vars = (\n 'data' => \\%result,\n 'debug' => $json_text,\n );\n my $template;\n {\n no warnings 'once';\n $template = Text::Template->new(\n TYPE => 'STRING',\n PREPEND => q{;},\n SOURCE => $templateModel,\n DELIMITERS => [ '[%', '%]' ]\n ) or die \"Couldn't construct template: $Text::Template::ERROR\";\n }\n\n open my $fh, q(>), $opt{'reportfile'}\n or die\n\"Unable to open $opt{'reportfile'} in write mode. please check permissions for this file or directory\";\n $template->fill_in( HASH => \\%vars, OUTPUT => $fh );\n close $fh;\n }\n\n if ( $opt{'json'} ne 0 ) {\n eval { require JSON };\n if ($@) {\n print \"$bad JSON Module is needed.\\n\";\n return 1;\n }\n\n my $json = JSON->new->allow_nonref;\n print $json->utf8(1)->pretty( ( $opt{'prettyjson'} ? 1 : 0 ) )\n ->encode( \\%result );\n\n if ( $opt{'outputfile'} ne 0 ) {\n unlink $opt{'outputfile'} if ( -e $opt{'outputfile'} );\n open my $fh, q(>), $opt{'outputfile'}\n or die\n\"Unable to open $opt{'outputfile'} in write mode. please check permissions for this file or directory\";\n print $fh $json->utf8(1)->pretty( ( $opt{'prettyjson'} ? 1 : 0 ) )\n ->encode( \\%result );\n close $fh;\n }\n }\n}\n\nsub which {\n my $prog_name = shift;\n my $path_string = shift;\n my @path_array = split /:/, $ENV{'PATH'};\n\n for my $path (@path_array) {\n return \"$path/$prog_name\" if ( -x \"$path/$prog_name\" );\n }\n\n return 0;\n}\n\n# ---------------------------------------------------------------------------\n# BEGIN 'MAIN'\n# ---------------------------------------------------------------------------\nheaderprint; # Header Print\n\nvalidate_tuner_version; # Check latest version\nmysql_setup; # Gotta login first\ndebugprint \"MySQL FINAL Client : $mysqlcmd $mysqllogin\";\ndebugprint \"MySQL Admin FINAL Client : $mysqladmincmd $mysqllogin\";\n\n#exit(0);\nos_setup; # Set up some OS variables\nget_all_vars; # Toss variables/status into hashes\nget_tuning_info; # Get information about the tuning connection\ncalculations; # Calculate everything we need\ncheck_architecture; # Suggest 64-bit upgrade\ncheck_storage_engines; # Show enabled storage engines\nif ( $opt{'feature'} ne '' ) {\n subheaderprint \"See FEATURES.md for more information\";\n no strict 'refs';\n for my $feature ( split /,/, $opt{'feature'} ) {\n subheaderprint \"Running feature: $opt{'feature'}\";\n $feature->();\n }\n make_recommendations;\n exit(0);\n}\nvalidate_mysql_version; # Check current MySQL version\n\nsystem_recommendations; # Avoid too many services on the same host\nlog_file_recommendations; # check log file content\n\ncheck_metadata_perf; # Show parameter impacting performance during analysis\nmysql_databases; # Show information about databases\nmysql_tables; # Show information about table column\nmysql_table_structures; # Show information about table structures\n\nmysql_indexes; # Show information about indexes\nmysql_views; # Show information about views\nmysql_triggers; # Show information about triggers\nmysql_routines; # Show information about routines\nsecurity_recommendations; # Display some security recommendations\ncve_recommendations; # Display related CVE\n\nmysql_stats; # Print the server stats\nmysql_pfs; # Print Performance schema info\n\nmariadb_threadpool; # Print MariaDB ThreadPool stats\nmysql_myisam; # Print MyISAM stats\nmysql_innodb; # Print InnoDB stats\nmariadb_aria; # Print MariaDB Aria stats\nmariadb_tokudb; # Print MariaDB Tokudb stats\nmariadb_xtradb; # Print MariaDB XtraDB stats\n\n#mariadb_rockdb; # Print MariaDB RockDB stats\n#mariadb_spider; # Print MariaDB Spider stats\n#mariadb_connect; # Print MariaDB Connect stats\nmariadb_galera; # Print MariaDB Galera Cluster stats\nget_replication_status; # Print replication info\nmake_recommendations; # Make recommendations based on stats\ndump_result; # Dump result if debug is on\nclose_outputfile; # Close reportfile if needed\n\n# ---------------------------------------------------------------------------\n# END 'MAIN'\n# ---------------------------------------------------------------------------\n1;\n\n__END__\n\n=pod\n\n=encoding UTF-8\n\n=head1 NAME\n\n MySQLTuner 2.6.0 - MySQL High Performance Tuning Script\n\n=head1 IMPORTANT USAGE GUIDELINES\n\nTo run the script with the default options, run the script without arguments\nAllow MySQL server to run for at least 24-48 hours before trusting suggestions\nSome routines may require root level privileges (script will provide warnings)\nYou must provide the remote server's total memory when connecting to other servers\n\n=head1 CONNECTION AND AUTHENTICATION\n\n --host Connect to a remote host to perform tests (default: localhost)\n --socket Use a different socket for a local connection\n --port Port to use for connection (default: 3306)\n --protocol tcp Force TCP connection instead of socket\n --user Username to use for authentication\n --userenv Name of env variable which contains username to use for authentication\n --pass Password to use for authentication\n --passenv Name of env variable which contains password to use for authentication\n --ssl-ca Path to public key\n --mysqladmin Path to a custom mysqladmin executable\n --mysqlcmd Path to a custom mysql executable\n --defaults-file Path to a custom .my.cnf\n --defaults-extra-file Path to an extra custom config file\n --server-log Path to explicit log file (error_log)\n\n=head1 PERFORMANCE AND REPORTING OPTIONS\n\n --skipsize Don't enumerate tables and their types/sizes (default: on)\n (Recommended for servers with many tables)\n --json Print result as JSON string\n --prettyjson Print result as JSON formatted string\n --skippassword Don't perform checks on user passwords (default: off)\n --checkversion Check for updates to MySQLTuner (default: don't check)\n --updateversion Check for updates to MySQLTuner and update when newer version is available (default: don't check)\n --forcemem Amount of RAM installed in megabytes\n --forceswap Amount of swap memory configured in megabytes\n --passwordfile Path to a password file list (one password by line)\n --cvefile CVE File for vulnerability checks\n --outputfile Path to a output txt file\n --reportfile Path to a report txt file\n --template Path to a template file\n --dumpdir Path to a directory where to dump information files\n --feature Run a specific feature (see FEATURES section)\n --dumpdir information_schema tables and sys views are dumped in CSV in this path\n\n=head1 OUTPUT OPTIONS\n\n --silent Don't output anything on screen\n --verbose Print out all options (default: no verbose, dbstat, idxstat, sysstat, tbstat, pfstat)\n --color Print output in color\n --nocolor Don't print output in color\n --nogood Remove OK responses\n --nobad Remove negative/suggestion responses\n --noinfo Remove informational responses\n --debug Print debug information\n --experimental Print experimental analysis (may fail)\n --nondedicated Consider server is not dedicated to Db server usage only\n --noprocess Consider no other process is running\n --dbstat Print database information\n --nodbstat Don't print database information\n --tbstat Print table information\n --notbstat Don't print table information\n --colstat Print column information\n --nocolstat Don't print column information\n --idxstat Print index information\n --noidxstat Don't print index information\n --nomyisamstat Don't print MyIsam information\n --sysstat Print system information\n --nosysstat Don't print system information\n --nostructstat Don't print table structures information\n --pfstat Print Performance schema\n --nopfstat Don't print Performance schema\n --bannedports Ports banned separated by comma (,)\n --server-log Define specific error_log to analyze\n --maxportallowed Number of open ports allowable on this host\n --buffers Print global and per-thread buffer values\n\n=head1 PERLDOC\n\nYou can find documentation for this module with the perldoc command.\n\n perldoc mysqltuner\n\n=head2 INTERNALS\n\nL\n\n Internal documentation\n\n=head1 AUTHORS\n\nMajor Hayden - major@mhtx.net\nJean-Marie Renouard - jmrenouard@gmail.com\n\n=head1 CONTRIBUTORS\n\n=over 4\n\n=item *\n\nMatthew Montgomery\n\n=item *\n\nPaul Kehrer\n\n=item *\n\nDave Burgess\n\n=item *\n\nJonathan Hinds\n\n=item *\n\nMike Jackson\n\n=item *\n\nNils Breunese\n\n=item *\n\nShawn Ashlee\n\n=item *\n\nLuuk Vosslamber\n\n=item *\n\nVille Skytta\n\n=item *\n\nTrent Hornibrook\n\n=item *\n\nJason Gill\n\n=item *\n\nMark Imbriaco\n\n=item *\n\nGreg Eden\n\n=item *\n\nAubin Galinotti\n\n=item *\n\nGiovanni Bechis\n\n=item *\n\nBill Bradford\n\n=item *\n\nRyan Novosielski\n\n=item *\n\nMichael Scheidell\n\n=item *\n\nBlair Christensen\n\n=item *\n\nHans du Plooy\n\n=item *\n\nVictor Trac\n\n=item *\n\nEverett Barnes\n\n=item *\n\nTom Krouper\n\n=item *\n\nGary Barrueto\n\n=item *\n\nSimon Greenaway\n\n=item *\n\nAdam Stein\n\n=item *\n\nIsart Montane\n\n=item *\n\nBaptiste M.\n\n=item *\n\nCole Turner\n\n=item *\n\nMajor Hayden\n\n=item *\n\nJoe Ashcraft\n\n=item *\n\nJean-Marie Renouard\n\n=item *\n\nStephan GroBberndt\n\n=item *\n\nChristian Loos\n\n=item *\n\nLong Radix\n\n=back\n\n=head1 SUPPORT\n\n\nBug reports, feature requests, and downloads at http://mysqltuner.pl/\n\nBug tracker can be found at https://github.com/major/MySQLTuner-perl/issues\n\nMaintained by Jean-Marie Renouard (jmrenouard\\@gmail.com) - Licensed under GPL\n\n=head1 SOURCE CODE\n\nL\n\n git clone https://github.com/major/MySQLTuner-perl.git\n\n=head1 COPYRIGHT AND LICENSE\n\nCopyright (C) 2006-2023 Major Hayden - major@mhtx.net\n# Copyright (C) 2015-2023 Jean-Marie Renouard - jmrenouard@gmail.com\n\nFor the latest updates, please visit http://mysqltuner.pl/\n\nGit repository available at https://github.com/major/MySQLTuner-perl\n\nThis program is free software: you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation, either version 3 of the License, or\n(at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\n See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with this program. If not, see .\n\n=cut\n\n# Local variables:\n# indent-tabs-mode: t\n# cperl-indent-level: 8\n# perl-indent-level: 8\n# End:\n" }, { "path": "aegir/helpers/rtoc.php.txt", "content": "1 || php_sapi_name()=='cli' || empty($_SERVER['REMOTE_ADDR']) ) { die; } // weak block against indirect access\n\n$time=time();\ndefine('CACHEPREFIX',function_exists('opcache_reset')?'opcache_':(function_exists('accelerator_reset')?'accelerator_':''));\n\nif ( !empty($_GET['RESET']) ) {\n\tif ( function_exists(CACHEPREFIX.'reset') ) { call_user_func(CACHEPREFIX.'reset'); }\n\theader( 'Location: '.str_replace('?'.$_SERVER['QUERY_STRING'],'',$_SERVER['REQUEST_URI']) );\n\texit;\n}\n\nif ( !empty($_GET['RECHECK']) ) {\n\tif ( function_exists(CACHEPREFIX.'invalidate') ) {\n\t\t$recheck=trim($_GET['RECHECK']); $files=call_user_func(CACHEPREFIX.'get_status');\n\t\tif (!empty($files['scripts'])) {\n\t\t\tforeach ($files['scripts'] as $file=>$value) {\n\t\t\t\tif ( $recheck==='1' || strpos($file,$recheck)===0 ) call_user_func(CACHEPREFIX.'invalidate',$file);\n\t\t\t}\n\t\t}\n\t\theader( 'Location: '.str_replace('?'.$_SERVER['QUERY_STRING'],'',$_SERVER['REQUEST_URI']) );\n\t} else { echo 'Sorry, this feature requires Zend Opcache newer than April 8th 2013'; }\n\texit;\n}\n\n?>\n\n\n\tOCP - Opcache Control Panel\n\t\n\n\n\n\n\n\n
\n\n

Opcache Control Panel

\n\n
\n\tDetails\n\tFiles\n\tReset\n\t\n\tRecheck\n\t\n\tRefresh\n
\n\nOpcache not detected?'; die; }\n\nif ( !empty($_GET['FILES']) ) { echo '

files cached

'; files_display(); echo '
'; exit; }\n\nif ( !(isset($_REQUEST['GRAPHS']) && !$_REQUEST['GRAPHS']) && CACHEPREFIX=='opcache_') { graphs_display(); if ( !empty($_REQUEST['GRAPHS']) ) { exit; } }\n\nob_start(); phpinfo(8); $phpinfo = ob_get_contents(); ob_end_clean(); \t\t // some info is only available via phpinfo? sadly buffering capture has to be used\nif ( !preg_match( '/module\\_Zend.(Optimizer\\+|OPcache).+?(\\]*\\>.+?\\<\\/table\\>).+?(\\]*\\>.+?\\<\\/table\\>)/is', $phpinfo, $opcache) ) { } // todo\n\nif ( function_exists(CACHEPREFIX.'get_configuration') ) { echo '

general

'; $configuration=call_user_func(CACHEPREFIX.'get_configuration'); }\n\n$host=function_exists('gethostname')?@gethostname():@php_uname('n'); if (empty($host)) { $host=empty($_SERVER['SERVER_NAME'])?$_SERVER['HOST_NAME']:$_SERVER['SERVER_NAME']; }\n$version=array('Host'=>$host);\n$version['PHP Version']='PHP '.(defined('PHP_VERSION')?PHP_VERSION:'???').' '.(defined('PHP_SAPI')?PHP_SAPI:'').' '.(defined('PHP_OS')?' '.PHP_OS:'');\n$version['Opcache Version']=empty($configuration['version']['version'])?'???':$configuration['version'][CACHEPREFIX.'product_name'].' '.$configuration['version']['version'];\nprint_table($version);\n\nif ( !empty($opcache[2]) ) { echo preg_replace('/\\\\[^>]+\\<\\/td\\>\\[0-9\\,\\. ]+\\<\\/td\\>\\<\\/tr\\>/','',$opcache[2]); }\n\nif ( function_exists(CACHEPREFIX.'get_status') && $status=call_user_func(CACHEPREFIX.'get_status') ) {\n\t$uptime=array();\n\tif ( !empty($status[CACHEPREFIX.'statistics']['start_time']) ) {\n\t\t$uptime['uptime']=time_since($time,$status[CACHEPREFIX.'statistics']['start_time'],1,'');\n\t}\n\tif ( !empty($status[CACHEPREFIX.'statistics']['last_restart_time']) ) {\n\t\t$uptime['last_restart']=time_since($time,$status[CACHEPREFIX.'statistics']['last_restart_time']);\n\t}\n\tif (!empty($uptime)) {print_table($uptime);}\n\n\tif ( !empty($status['cache_full']) ) { $status['memory_usage']['cache_full']=$status['cache_full']; }\n\n\techo '

memory

';\n\tprint_table($status['memory_usage']);\n\tunset($status[CACHEPREFIX.'statistics']['start_time'],$status[CACHEPREFIX.'statistics']['last_restart_time']);\n\techo '

statistics

';\n\tprint_table($status[CACHEPREFIX.'statistics']);\n}\n\nif ( empty($_GET['ALL']) ) { meta_display(); exit; }\n\nif ( !empty($configuration['blacklist']) ) { echo '

blacklist

'; print_table($configuration['blacklist']); }\n\nif ( !empty($opcache[3]) ) { echo '

runtime

'; echo $opcache[3]; }\n\n$name='zend opcache'; $functions=get_extension_funcs($name);\nif (!$functions) { $name='zend optimizer+'; $functions=get_extension_funcs($name); }\nif ($functions) { echo '

functions

'; print_table($functions); } else { $name=''; }\n\n$level=trim(CACHEPREFIX,'_').'.optimization_level';\nif (isset($configuration['directives'][$level])) {\n\techo '

optimization levels

';\n\t$levelset=strrev(base_convert($configuration['directives'][$level], 10, 2));\n\t$levels=array(\n \t1=>'Constants subexpressions elimination (CSE) true, false, null, etc.
Optimize series of ADD_STRING / ADD_CHAR
Convert CAST(IS_BOOL,x) into BOOL(x)
Convert INIT_FCALL_BY_NAME + DO_FCALL_BY_NAME into DO_FCALL',\n \t2=>'Convert constant operands to expected types
Convert conditional JMP with constant operands
Optimize static BRK and CONT',\n \t3=>'Convert $a = $a + expr into $a += expr
Convert $a++ into ++$a
Optimize series of JMP',\n \t4=>'PRINT and ECHO optimization (defunct)',\n\t5=>'Block Optimization - most expensive pass
Performs many different optimization patterns based on control flow graph (CFG)',\n\t9=>'Optimize register allocation (allows re-usage of temporary variables)',\n\t10=>'Remove NOPs'\n\t);\n\techo '';\n\tforeach ($levels as $pass=>$description) {\n\t\t$disabled=substr($levelset,$pass-1,1)!=='1' || $pass==4 ? ' white':'';\n\t\techo '';\n\t}\n\techo '
PassDescription
'.$pass.''.$description.'
';\n}\n\nif ( isset($_GET['DUMP']) ) {\n\tif ($name) { echo '

ini

'; print_table(ini_get_all($name,true)); }\n\tforeach ($configuration as $key=>$value) { echo '

',$key,'

'; print_table($configuration[$key]); }\n\texit;\n}\n\nmeta_display();\n\necho '';\n\nexit;\n\nfunction time_since($time,$original,$extended=0,$text='ago') {\n\t$time = $time - $original;\n\t$day = $extended? floor($time/86400) : round($time/86400,0);\n\t$amount=0; $unit='';\n\tif ( $time < 86400) {\n\t\tif ( $time < 60)\t\t{ $amount=$time; $unit='second'; }\n\t\telseif ( $time < 3600) { $amount=floor($time/60); $unit='minute'; }\n\t\telse\t\t\t\t{ $amount=floor($time/3600); $unit='hour'; }\n\t}\n\telseif ( $day < 14) \t{ $amount=$day; $unit='day'; }\n\telseif ( $day < 56) \t{ $amount=floor($day/7); $unit='week'; }\n\telseif ( $day < 672) { $amount=floor($day/30); $unit='month'; }\n\telse {\t\t\t $amount=intval(2*($day/365))/2; $unit='year'; }\n\n\tif ( $amount!=1) {$unit.='s';}\n\tif ($extended && $time>60) { $text=' and '.time_since($time,$time<86400?($time<3600?$amount*60:$amount*3600):$day*86400,0,'').$text; }\n\n\treturn $amount.' '.$unit.' '.$text;\n}\n\nfunction print_table($array,$headers=false) {\n\tif ( empty($array) || !is_array($array) ) {return;}\n \techo '';\n \tif (!empty($headers)) {\n \t\tif (!is_array($headers)) {$headers=array_keys(reset($array));}\n \t\techo '';\n \t\tforeach ($headers as $value) { echo ''; }\n \t\techo '';\n \t}\n \tforeach ($array as $key=>$value) {\n \t\techo '';\n \t\tif ( !is_numeric($key) ) {\n \t\t\t$key=ucwords(str_replace('_',' ',$key));\n \t\t\techo '';\n \t\t\tif ( is_numeric($value) ) {\n \t\t\t\tif ( $value>1048576) { $value=round($value/1048576,1).'M'; }\n \t\t\t\telseif ( is_float($value) ) { $value=round($value,1); }\n \t\t\t}\n \t\t}\n \t\tif ( is_array($value) ) {\n \t\t\tforeach ($value as $column) {\n \t\t\techo '';\n \t\t\t}\n \t\t\techo '';\n \t\t}\n \t\telse { echo ''; }\n\t}\n \techo '
',$value,'
',$key,'',$column,'
',$value,'
';\n}\n\nfunction files_display() {\n\t$status=call_user_func(CACHEPREFIX.'get_status');\n\tif ( empty($status['scripts']) ) {return;}\n\tif ( isset($_GET['DUMP']) ) { print_table($status['scripts']); exit;}\n \t$time=time(); $sort=0;\n\t$nogroup=preg_replace('/\\&?GROUP\\=[\\-0-9]+/','',$_SERVER['REQUEST_URI']);\n\t$nosort=preg_replace('/\\&?SORT\\=[\\-0-9]+/','',$_SERVER['REQUEST_URI']);\n\t$group=empty($_GET['GROUP'])?0:intval($_GET['GROUP']); if ( $group<0 || $group>9) { $group=1;}\n\t$groupset=array_fill(0,9,''); $groupset[$group]=' class=\"b\" ';\n\n\techo '
\n\t\tungroup |\n\t\t1 |\n\t\t2 |\n\t\t3 |\n\t\t4 |\n\t\t5\n\t
';\n\n\tif ( !$group ) { $files =& $status['scripts']; }\n\telse {\n\t\t$files=array();\n\t\tforeach ($status['scripts'] as $data) {\n\t\t\tif ( preg_match('@^[/]([^/]+[/]){'.$group.'}@',$data['full_path'],$path) ) {\n\t\t\t\tif ( empty($files[$path[0]])) { $files[$path[0]]=array('full_path'=>'','files'=>0,'hits'=>0,'memory_consumption'=>0,'last_used_timestamp'=>'','timestamp'=>''); }\n\t\t\t\t$files[$path[0]]['full_path']=$path[0];\n\t\t\t\t$files[$path[0]]['files']++;\n\t\t\t\t$files[$path[0]]['memory_consumption']+=$data['memory_consumption'];\n\t\t\t\t$files[$path[0]]['hits']+=$data['hits'];\n\t\t\t\tif ( $data['last_used_timestamp']>$files[$path[0]]['last_used_timestamp']) {$files[$path[0]]['last_used_timestamp']=$data['last_used_timestamp'];}\n\t\t\t\tif ( $data['timestamp']>$files[$path[0]]['timestamp']) {$files[$path[0]]['timestamp']=$data['timestamp'];}\n\t\t\t}\n\t\t}\n\t}\n\n\tif ( !empty($_GET['SORT']) ) {\n\t\t$keys=array(\n\t\t\t'full_path'=>SORT_STRING,\n\t\t\t'files'=>SORT_NUMERIC,\n\t\t\t'memory_consumption'=>SORT_NUMERIC,\n\t\t\t'hits'=>SORT_NUMERIC,\n\t\t\t'last_used_timestamp'=>SORT_NUMERIC,\n\t\t\t'timestamp'=>SORT_NUMERIC\n\t\t);\n\t\t$titles=array('','path',$group?'files':'','size','hits','last used','created');\n\t\t$offsets=array_keys($keys);\n\t\t$key=intval($_GET['SORT']);\n\t\t$direction=$key>0?1:-1;\n\t\t$key=abs($key)-1;\n\t\t$key=isset($offsets[$key])&&!($key==1&&empty($group))?$offsets[$key]:reset($offsets);\n\t\t$sort=array_search($key,$offsets)+1;\n\t\t$sortflip=range(0,7); $sortflip[$sort]=-$direction*$sort;\n\t\tif ( $keys[$key]==SORT_STRING) {$direction=-$direction; }\n\t\t$arrow=array_fill(0,7,''); $arrow[$sort]=$direction>0?' ▼':' ▲';\n\t\t$direction=$direction>0?SORT_DESC:SORT_ASC;\n\t\t$column=array(); foreach ($files as $data) { $column[]=$data[$key]; }\n\t\tarray_multisort($column, $keys[$key], $direction, $files);\n\t}\n\n\techo '\n \t\t';\n foreach ($titles as $column=>$title) {\n \tif ($title) echo '';\n }\n echo '\t';\n \tforeach ($files as $data) {\n \t\techo '\n \t\t\t\t',\n \t\t\t\t($group?'':''),\n \t\t\t'',\n \t\t\t'',\n \t\t\t'',\n \t\t\t'\n \t\t';\n\t}\n\techo '
',$title,$arrow[$column],'
x',$data['full_path'],''.number_format($data['files']).'',number_format(round($data['memory_consumption']/1024)),'K',number_format($data['hits']),'',time_since($time,$data['last_used_timestamp']),'',empty($data['timestamp'])?'':time_since($time,$data['timestamp']),'
';\n}\n\nfunction graphs_display() {\n\t$graphs=array();\n\t$colors=array('green','brown','red');\n\t$primes=array(223, 463, 983, 1979, 3907, 7963, 16229, 32531, 65407, 130987);\n\t$configuration=call_user_func(CACHEPREFIX.'get_configuration');\n\t$status=call_user_func(CACHEPREFIX.'get_status');\n\n\t$graphs['memory']['total']=$configuration['directives']['opcache.memory_consumption'];\n\t$graphs['memory']['free']=$status['memory_usage']['free_memory'];\n\t$graphs['memory']['used']=$status['memory_usage']['used_memory'];\n\t$graphs['memory']['wasted']=$status['memory_usage']['wasted_memory'];\n\n\t$graphs['keys']['total']=$status[CACHEPREFIX.'statistics']['max_cached_keys'];\n\tforeach ($primes as $prime) { if ($prime>=$graphs['keys']['total']) { $graphs['keys']['total']=$prime; break;} }\n\t$graphs['keys']['free']=$graphs['keys']['total']-$status[CACHEPREFIX.'statistics']['num_cached_keys'];\n\t$graphs['keys']['scripts']=$status[CACHEPREFIX.'statistics']['num_cached_scripts'];\n\t$graphs['keys']['wasted']=$status[CACHEPREFIX.'statistics']['num_cached_keys']-$status[CACHEPREFIX.'statistics']['num_cached_scripts'];\n\n\t$graphs['hits']['total']=0;\n\t$graphs['hits']['hits']=$status[CACHEPREFIX.'statistics']['hits'];\n\t$graphs['hits']['misses']=$status[CACHEPREFIX.'statistics']['misses'];\n\t$graphs['hits']['blacklist']=$status[CACHEPREFIX.'statistics']['blacklist_misses'];\n\t$graphs['hits']['total']=array_sum($graphs['hits']);\n\n\t$graphs['restarts']['total']=0;\n\t$graphs['restarts']['manual']=$status[CACHEPREFIX.'statistics']['manual_restarts'];\n\t$graphs['restarts']['keys']=$status[CACHEPREFIX.'statistics']['hash_restarts'];\n\t$graphs['restarts']['memory']=$status[CACHEPREFIX.'statistics']['oom_restarts'];\n\t$graphs['restarts']['total']=array_sum($graphs['restarts']);\n\n\tforeach ( $graphs as $caption=>$graph) {\n\t\techo '
',$caption,'
';\n\t\tforeach ($graph as $label=>$value) {\n\t\t\tif ($caption!='hits'){\n\t\t\t\tif ($label=='total') { $key=0; $total=$value; $totaldisplay=''; continue;}\n\t\t\t\t\t$percent=$total?floor($value*100/$total):''; $percent=!$percent||$percent>99?'':$percent.'%';\n\t\t\t\t\techo '',$totaldisplay,'';\n\t\t\t\t\t$key++; $totaldisplay='';\n\t\t\t}else{\n\t\t\t\tif ($label=='total') { $key=0; $total=$value; $totaldisplay=''; continue;}\n\t\t\t\t$percent=$total?floor($value*100/$total):''; $percent=!$percent||$percent>99?'':$percent.'%';\n\t\t\t\techo '',$totaldisplay,'';\n\t\t\t\t$key++; $totaldisplay='';\n\t\t\t}\n\t\t}\n\techo '
'.($total>999999?round($total/1024/1024).'M':($total>9999?round($total/1024).'K':$total)).'
', ($value>999999?round($value/1024/1024).'M':($value>9999?round($value/1024).'K':$value)),'',$percent,'',$label,'
'.($total>999999?round($total/1000/1000).'M':($total>9999?round($total/1000).'K':$total)).'
', ($value>999999?round($value/1000/1000).'M':($value>9999?round($value/1000).'K':$value)),'',$percent,'',$label,'
',\"\\n\";\n\t}\n}\n\nfunction meta_display() {\n?>\n
\n\tdirectives guide |\n\tfunctions guide |\n\twiki.php.net |\n\tpecl |\n\tZend source |\n\tOCP latest\n
\n $testecho\nif grep -q \"\\-ne\" $testecho; then\n while [ -e $1 ]\n do\n echo -n \".\"\n sleep 1\n done\n echo\nelse\n while [ -e $1 ]\n do\n echo -en \"\\b${sp:i++%${#sp}:1}\"\n sleep .2\n done\n echo -en \"${reset}\\b\"\nfi\n\n" }, { "path": "aegir/helpers/systemtime", "content": "#!/bin/bash\n#\n# system time hourly\n\nntpdate pool.ntp.org\n\nexit 0\n" }, { "path": "aegir/helpers/websh.sh.txt", "content": "#!/bin/bash\n\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec:/usr/local/ssl3\n\n_DEST_DRUSH=\"/opt/tools/drush/8/drush/drush.php\"\n\n_forward_to_dash() {\n if [[ \"${_ARGS}\" =~ \"sudo_noexec.so\" ]] && [[ \"${_LTD_GID}\" =~ \"ltd-shell-more\"($) ]]; then\n ### echo FWD 0 DIRECT\n _R_M=`echo -n ${_ARGS} | sed 's|LD_PRELOAD.*.so||'`\n ### echo _R_M is ${_R_M}\n exec /bin/dash -c \"${_R_M}\"\n exit 0\n fi\n # Path to the underlying shell (dash in this case)\n _shell=\"/bin/dash\"\n # Name under which the shell should think it was invoked\n _shell_name=\"sh\"\n # Arrays to hold options and positional parameters\n _options=()\n _positional=()\n # Variables to hold command strings or script files\n _command=\"\"\n _script=\"\"\n\n # Parse the options and arguments\n while [[ $# -gt 0 ]]; do\n case \"$1\" in\n --)\n # End of options\n shift\n _positional+=(\"$@\")\n break\n ;;\n -c)\n # Command option\n if [[ -n \"$2\" ]]; then\n _options+=(\"-c\" \"$2\")\n shift 2\n _positional+=(\"$@\")\n break\n else\n echo \"sh: option requires an argument -- 'c'\" >&2\n exit 1\n fi\n ;;\n -i|-l|-s)\n # Other common options\n _options+=(\"$1\")\n shift\n ;;\n -*)\n # Unrecognized options\n _options+=(\"$1\")\n shift\n ;;\n *)\n # First non-option argument is the script file\n _script=\"$1\"\n shift\n _positional+=(\"$@\")\n break\n ;;\n esac\n done\n\n # Prepare to execute the underlying shell\n if [[ -n \"${_script}\" ]]; then\n # Execute a script file\n ### echo FWD 1 PARSED\n exec -a \"${_shell_name}\" \"${_shell}\" \"${_options[@]}\" \"${_script}\" \"${_positional[@]}\"\n exit 0\n else\n # Execute commands or start an interactive shell\n ### echo FWD 2 PARSED\n exec -a \"${_shell_name}\" \"${_shell}\" \"${_options[@]}\" \"${_positional[@]}\"\n exit 0\n fi\n}\n\n# Capture all arguments\n_ALL=\"$@\"\n### echo \"_ALL is ${_ALL}\"\n\n# Capture environment variables\n_ENV=$(env 2>&1)\n### echo \"_ENV is ${_ENV}\"\n\n# Determine _ARGS based on the first argument\nif [ \"${1}\" = \"-c\" ]; then\n _ARGS=\"${2}\"\nelse\n _ARGS=\"${1}\"\nfi\n\n### echo \"_ARGS is ${_ARGS}\"\n\nif [[ \"${_ARGS}\" =~ \"--php=\" ]]; then\n PHP_FWD=YES\nelse\n PHP_FWD=\nfi\n\nif [[ \"${_ARGS}\" =~ \"true COLUMNS=\" ]]; then\n _R_M=`echo -n \"${_ARGS}\" | grep -o \"true COLUMNS=[0-9]\\+ \"`\n _ARGS=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\nfi\n\nif [[ \"${_ARGS}\" =~ \"'\" ]] && [[ \"${_ARGS}\" =~ \"drush\" ]]; then\n ### echo _ARGS RAW is ${_ARGS}\n _ARGS=$(echo -n ${_ARGS} | tr -d \"'\" 2>&1)\n ### echo _ARGS CLEAN is ${_ARGS}\nfi\n\nif [[ ! \"${_ARGS}\" =~ \"composer\" ]] \\\n && [[ ! \"${_ARGS}\" =~ \"git\" ]] \\\n && [[ ! \"${_ARGS}\" =~ \"cd \" ]] \\\n && [[ ! \"${_ARGS}\" =~ \"mysql\" ]] \\\n && [[ ! \"${_ARGS}\" =~ \"sudo\" ]]; then\n _ARR=\n if [[ \"${_ARGS}\" =~ \"/vendor/drush/drush/drush.php \" ]]; then\n _R_M=`echo -n ${_ARGS} | grep -o \".*/vendor/drush/drush/drush.php\"`\n ### echo _R_M is ${_R_M}\n _R_M=${_R_M//\\//\\\\\\/}\n ### echo _R_M is ${_R_M}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\n _ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_R_M} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _ARR+=(\"$arg\") ;;\n esac\n done\n ### echo _ARR is ${_ARR}\n elif [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php \" ]]; then\n _R_M=`echo -n ${_ARGS} | grep -o \"vendor/drush/drush/drush.php\"`\n ### echo _R_M is ${_R_M}\n _R_M=${_R_M//\\//\\\\\\/}\n ### echo _R_M is ${_R_M}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\n _ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_R_M} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _ARR+=(\"$arg\") ;;\n esac\n done\n ### echo _ARR is ${_ARR}\n elif [[ \"${_ARGS}\" =~ \"drush \" ]]; then\n if [[ \"${_ARGS}\" =~ \"set -m\" ]]; then\n _R_M=`echo -n ${_ARGS} | grep -o \"set -m\\; drush\"`\n else\n _R_M=`echo -n ${_ARGS} | grep -o \"drush\"`\n fi\n ### echo _R_M is ${_R_M}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\n _ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_R_M} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _ARR+=(\"$arg\") ;;\n esac\n done\n ### echo _ARR is ${_ARR}\n elif [[ \"${_ARGS}\" =~ \"drush8 \" ]]; then\n if [[ \"${_ARGS}\" =~ \"set -m\" ]]; then\n _R_M=`echo -n ${_ARGS} | grep -o \"set -m\\; drush8\"`\n else\n _R_M=`echo -n ${_ARGS} | grep -o \"drush8\"`\n fi\n ### echo _R_M is ${_R_M}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\n _ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_R_M} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _ARR+=(\"$arg\") ;;\n esac\n done\n ### echo _ARR is ${_ARR}\n elif [[ \"${_ARGS}\" =~ \"drush10 \" ]]; then\n if [[ \"${_ARGS}\" =~ \"set -m\" ]]; then\n _R_M=`echo -n ${_ARGS} | grep -o \"set -m\\; drush10\"`\n else\n _R_M=`echo -n ${_ARGS} | grep -o \"drush10\"`\n fi\n ### echo _R_M is ${_R_M}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\n _ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_R_M} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _ARR+=(\"$arg\") ;;\n esac\n done\n ### echo _ARR is ${_ARR}\n elif [[ \"${_ARGS}\" =~ \"drush11 \" ]]; then\n if [[ \"${_ARGS}\" =~ \"set -m\" ]]; then\n _R_M=`echo -n ${_ARGS} | grep -o \"set -m\\; drush11\"`\n else\n _R_M=`echo -n ${_ARGS} | grep -o \"drush11\"`\n fi\n ### echo _R_M is ${_R_M}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\n _ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_R_M} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _ARR+=(\"$arg\") ;;\n esac\n done\n ### echo _ARR is ${_ARR}\n elif [[ \"${_ARGS}\" =~ \"php /opt/tools/\" ]]; then\n _R_M=`echo -n ${_ARGS} | grep -o \"php /opt/tools/drush/.*/drush/drush.php\"`\n ### echo _R_M is ${_R_M}\n _R_M=${_R_M//\\//\\\\\\/}\n ### echo _R_M is ${_R_M}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\n _ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_R_M} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _ARR+=(\"$arg\") ;;\n\t esac\n done\n ### echo _ARR is ${_ARR}\n elif [[ \"${_ARGS}\" =~ \"php /data/disk/\" ]]; then\n _R_M=`echo -n ${_ARGS} | grep -o \"php /data/disk/.*/tools/drush/drush.php\"`\n ### echo _R_M is ${_R_M}\n _R_M=${_R_M//\\//\\\\\\/}\n ### echo _R_M is ${_R_M}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\n _ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_R_M} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _ARR+=(\"$arg\") ;;\n\t esac\n done\n ### echo _ARR is ${_ARR}\n elif [[ \"${_ARGS}\" =~ php\\ /mnt/.*/data/disk/ ]]; then\n _R_M=`echo -n ${_ARGS} | grep -o \"php /mnt/.*/data/disk/.*/tools/drush/drush.php\"`\n ### echo _R_M is ${_R_M}\n _R_M=${_R_M//\\//\\\\\\/}\n ### echo _R_M is ${_R_M}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\n _ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_R_M} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _ARR+=(\"$arg\") ;;\n\t esac\n done\n ### echo _ARR is ${_ARR}\n fi\nfi\n\n_C_ARR=\nif [[ \"${_ARGS}\" =~ \"composer \" ]] && [[ ! \"${_ARGS}\" =~ \"git remote add composer\" ]]; then\n if [[ \"${_ARGS}\" =~ \"set -m\" ]]; then\n _C_RM=`echo -n ${_ARGS} | grep -o \"set -m\\; composer \"`\n else\n _C_RM=`echo -n ${_ARGS} | grep -o \"composer \"`\n fi\n ### echo _C_RM is ${_C_RM}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_C_RM}//g\"`\n _C_ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_C_RM} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _C_ARR+=(\"$arg\") ;;\n esac\n done\n ### echo _C_ARR is ${_C_ARR}\nfi\n\n_INTERNAL=NO\n_LTD_GID=$(id -nG ${USER} 2>&1)\n_LTD_UID=$(id -nu ${USER} 2>&1)\nif [ -z \"${USER}\" ]; then\n USER=$(id -nu ${USER} 2>&1)\n _LTD_QQQ=YES\nfi\n_X_USR=\".*\"\nif [ \"${USER}\" = \"aegir\" ] \\\n || [ \"${HOME}\" = \"/var/aegir\" ]; then\n _Y_USR=aegir\n _DRUSH_CLI_CTRL=\"/var/aegir/static/control\"\n ### echo _DRUSH_CLI_CTRL is ${_DRUSH_CLI_CTRL}\nelse\n _Y_USR=${USER%${_X_USR}}\n _DRUSH_CLI_CTRL=\"/data/disk/${_Y_USR}/static/control\"\n ### echo _DRUSH_CLI_CTRL is ${_DRUSH_CLI_CTRL}\nfi\nif [ -z \"${HOME}\" ]; then\n if [ -d \"/home/${USER}/.tmp\" ]; then\n HOME=\"/home/${USER}\"\n elif [ -d \"/data/disk/${_Y_USR}/.tmp\" ]; then\n HOME=\"/data/disk/${_Y_USR}\"\n elif [ -d \"/var/${_Y_USR}/.tmp\" ]; then\n HOME=\"/var/${_Y_USR}\"\n fi\nfi\n\nif [[ \"${_ARR}\" =~ \" aliases\" ]] || [[ \"${_ARR}\" =~ \" sa\" ]]; then\n if [[ \"${_ALL}\" =~ \"drush10 \" ]] || [[ \"${_ALL}\" =~ \"drush11 \" ]]; then\n _ARR=\"sa --format=list | egrep -v \\\"(none|hostmaster|hm|server_|platform_|@none|@self)\\\"\"\n elif [[ \"${_ALL}\" =~ \"drush \" ]] || [[ \"${_ALL}\" =~ \"drush8 \" ]]; then\n _ARR=\"sa | egrep -v \\\"(none|hostmaster|hm|server_|platform_|@none|@self)\\\"\"\n fi\nfi\n\nif [[ \"${_ARR}\" =~ \"-c \" ]]; then\n _R_M=`echo -n \"${_ARR}\" | grep -o \"\\-c \"`\n _ARR=`echo ${_ARR} | sed \"s/\\${_R_M}//g\"`\nfi\n\nif [[ \"${HOME}\" =~ (^)\"/data/disk/\" ]] \\\n && [ -z \"${PHP_FWD}\" ] \\\n && [[ \"${_ARGS}\" =~ (^)\"php ${HOME}\" ]]; then\n _OCTO_SYS=\"${USER}\"\n _OCTO_SYS_ARR=\n if [[ \"${_ARGS}\" =~ \"tools/drush/drush.php\" ]]; then\n _R_M=`echo -n ${_ARGS} | grep -o \"php /data/disk/.*/tools/drush/drush.php\"`\n ### echo _R_M is ${_R_M}\n _R_M=${_R_M//\\//\\\\\\/}\n ### echo _R_M is ${_R_M}\n _CLR=`echo ${_ARGS} | sed \"s/\\${_R_M}//g\"`\n _OCTO_SYS_ARR=() # the buffer array for filtered parameters\n for arg in \"${_CLR}\"; do\n case ${_R_M} in\n $arg\\ * | *\\ $arg | *\\ $arg\\ *) ;;\n *) _OCTO_SYS_ARR+=(\"$arg\") ;;\n\t esac\n done\n ### echo _OCTO_SYS_ARR is ${_OCTO_SYS_ARR}\n fi\nelse\n _OCTO_SYS=\nfi\n\nif [[ \"${HOME}\" =~ (^)\"/yyydata/disk/\" ]]; then\n _DRUSH_CLI_CTRL=\n ### echo _DRUSH_CLI_CTRL has been disabled\nfi\n\nif [ -d \"/home/${USER}/.tmp\" ]; then\n export TMP=\"/home/${USER}/.tmp\"\n export TMPDIR=\"/home/${USER}/.tmp\"\n export TEMP=\"/home/${USER}/.tmp\"\n if [[ \"${_ARGS}\" =~ \" id \" ]] \\\n || [[ \"${_ARGS}\" =~ (^)\"id \" ]]; then\n exit 1\n elif [[ \"${_ARGS}\" =~ (^)\"newrelic\" ]] \\\n || [[ \"${_ARGS}\" =~ (^)\"nrsysm\" ]]; then\n exit 1\n fi\nelif [ -d \"/data/disk/${_Y_USR}/.tmp\" ]; then\n export TMP=\"/data/disk/${_Y_USR}/.tmp\"\n export TMPDIR=\"/data/disk/${_Y_USR}/.tmp\"\n export TEMP=\"/data/disk/${_Y_USR}/.tmp\"\nelif [ -d \"/var/${_Y_USR}/.tmp\" ]; then\n export TMP=\"/var/${_Y_USR}/.tmp\"\n export TMPDIR=\"/var/${_Y_USR}/.tmp\"\n export TEMP=\"/var/${_Y_USR}/.tmp\"\nelse\n export TMP=\"/tmp\"\n export TMPDIR=\"/tmp\"\n export TEMP=\"/tmp\"\nfi\n\nexport HOME=${HOME}\nexport TEMP=${TEMP}\nexport USER=${USER}\n\n### echo HOME is ${HOME}\n### echo TEMP is ${TEMP}\n### echo USER is ${USER}\n#\n### echo _ALL is ${_ALL}\n### echo _ARGS is ${_ARGS}\n### echo _LTD_GID is ${_LTD_GID}\n### echo _LTD_QQQ is ${_LTD_QQQ}\n### echo _LTD_UID is ${_LTD_UID}\n### echo _Y_USR is ${_Y_USR}\n#\n### echo 0 is $0\n### echo 1 is $1\n### echo 2 is $2\n### echo 3 is $3\n### echo 4 is $4\n### echo 5 is $5\n### echo 6 is $6\n### echo 7 is $7\n### echo 8 is $8\n### echo 9 is $9\n\n# Check PHP CLI version defined.\ncheck_php_cli_version() {\n ### echo CHK start check_php_cli_version\n if [ \"${HOME}\" = \"/var/aegir\" ] && [ -f \"/var/aegir/drush/drush.php\" ]; then\n _PHP_CLI=$(grep \"/opt/php\" /var/aegir/drush/drush.php 2>&1)\n else\n if [ -f \"/data/disk/${_Y_USR}/tools/drush/drush.php\" ]; then\n _PHP_CLI=$(grep \"/opt/php\" /data/disk/${_Y_USR}/tools/drush/drush.php 2>&1)\n elif [ -f \"/data/disk/${_Y_USR}/static/control/cli.info\" ]; then\n _PHP_CLI=\"php$(tr -d '.\\n' < /data/disk/${_Y_USR}/static/control/cli.info)\"\n fi\n fi\n ### echo CHK 1 _PHP_CLI is ${_PHP_CLI}\n\n _PHP_V=\"56 70 71 72 73 74 80 81 82 83 84 85\"\n for e in ${_PHP_V}; do\n if [[ \"${_PHP_CLI}\" =~ \"php${e}\" ]] && [ -x \"/opt/php${e}/bin/php\" ]; then\n DRUSH_PHP=\"/opt/php${e}/bin/php\"\n PHP_INI=\"/opt/php${e}/lib/php.ini\"\n PHPRC=\"/opt/php${e}/lib\"\n if [ -f \"${HOME}/.drush/php${e}/php.ini\" ]; then\n PHP_INI=\"${HOME}/.drush/php${e}/php.ini\"\n PHPRC=\"${HOME}/.drush/php${e}\"\n fi\n fi\n done\n ### echo CHK 2 DRUSH_PHP is ${DRUSH_PHP}\n ### echo CHK 2 PHP_INI is ${PHP_INI}\n ### echo CHK 2 PHPRC is ${PHPRC}\n\n for e in ${_PHP_V}; do\n if [ -e \"${_DRUSH_CLI_CTRL}/php${e}.info\" ] && [ -x \"/opt/php${e}/bin/php\" ]; then\n DRUSH_PHP=\"/opt/php${e}/bin/php\"\n PHP_INI=\"/opt/php${e}/lib/php.ini\"\n PHPRC=\"/opt/php${e}/lib\"\n if [ -f \"${HOME}/.drush/php${e}/php.ini\" ]; then\n PHP_INI=\"${HOME}/.drush/php${e}/php.ini\"\n PHPRC=\"${HOME}/.drush/php${e}\"\n fi\n fi\n done\n ### echo CHK 3 DRUSH_PHP is ${DRUSH_PHP}\n ### echo CHK 3 PHP_INI is ${PHP_INI}\n ### echo CHK 3 PHPRC is ${PHPRC}\n\n if [ ! -z \"${PHP_INI}\" ]; then\n export DRUSH_PHP;export PHP_INI;export PHPRC;\n else\n DRUSH_PHP=\"/usr/bin/php\"\n export DRUSH_PHP;\n ### echo CHK 4 DRUSH_PHP is ${DRUSH_PHP}\n fi\n\n ### echo CHK fin check_php_cli_version\n}\n\nif [ -n \"${JENKINS_HOME}\" ] \\\n || [ -n \"${JENKINS_NODE_COOKIE}\" ] \\\n || [ -n \"${WORKSPACE_TMP}\" ]; then\n _IS_JENKINS=TRUE\nelse\n _IS_JENKINS=FALSE\nfi\n\nif [ \"${_IS_JENKINS}\" = \"FALSE\" ]; then\n check_php_cli_version\nfi\n\nif [ \"${_LTD_GID}\" = \"www-data users\" ] \\\n || [[ \"${HOME}\" =~ (^)\"/var/aegir\" ]] \\\n || [[ \"${HOME}\" =~ (^)\"/data/disk/\" ]] \\\n || [[ \"${_LTD_GID}\" =~ \"lshellg\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ \"ltd-shell-more\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ \"lshellg rvm\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ \"ltd-shell\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ \"ltd-shell rvm\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ \"rvm ltd-shell\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ (^)\"users www-data\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ (^)\"aegir www-data users\"($) ]]; then\n if [ \"${1}\" = \"-c\" ]; then\n _IS_SH_PATH=NO\n if [ \"$0\" = \"/bin/sh\" ] || [ \"$0\" = \"/usr/bin/sh\" ]; then\n _IS_SH_PATH=YES\n else\n echo\n echo \" ERROR: Not Authorized Path\"\n echo\n exit 1\n fi\n if [[ $(whoami) == *.ftp ]] \\\n || [[ \"${2}\" =~ \"drush\" ]] \\\n || [[ \"${2}\" =~ \"mysql \" ]]; then\n _IN_PATH=YES\n _INTERNAL=YES\n if [[ \"${_ARGS}\" =~ \"mysql \" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php \" ]]; then\n _PWD=$(pwd 2>&1)\n _DEST_DRUSH=\"/opt/tools/drush/8/drush/drush.php\"\n if [[ \"${_ARGS}\" =~ \"vendor/bin/drush \" ]]; then\n _DEST_DRUSH=\"${_R_M}/vendor/drush/drush/drush.php\"\n fi\n if [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush \" ]]; then\n _DEST_DRUSH=\"${_R_M}/vendor/drush/drush/drush.php\"\n fi\n if [[ \"${_ARGS}\" =~ \"/vendor/bin/drush \" ]]; then\n _DEST_DRUSH=\"${_R_M}/vendor/drush/drush/drush.php\"\n fi\n if [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php \" ]]; then\n # Detect if PWD ends with /web, /html, or /docroot\n if [[ \"$PWD\" =~ /(web|html|docroot)$ ]]; then\n _DEST_DRUSH=\"../vendor/drush/drush/drush.php\"\n else\n _DEST_DRUSH=\"vendor/drush/drush/drush.php\"\n fi\n ### echo INF 0 _DEST_DRUSH is ${_DEST_DRUSH}\n fi\n if [[ \"${_ARGS}\" =~ \"drush11 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 \" ]]; then\n if [[ \"${_ARGS}\" =~ \"drush11 \" ]]; then\n _DEST_DRUSH=\"/usr/bin/drush11\"\n elif [[ \"${_ARGS}\" =~ \"drush10 \" ]]; then\n _DEST_DRUSH=\"/usr/bin/drush10\"\n fi\n if [[ ! \"${HOME}\" =~ (^)\"/data/disk/\" ]]; then\n _PHP_V=\"74 80 81 82 83 84 85\"\n for e in ${_PHP_V}; do\n if [ -e \"${_DRUSH_CLI_CTRL}/php${e}.info\" ] && [ -x \"/opt/php${e}/bin/php\" ]; then\n DRUSH_PHP=\"/opt/php${e}/bin/php\"\n PHP_INI=\"/opt/php${e}/lib/php.ini\"\n PHPRC=\"/opt/php${e}/lib\"\n if [ -f \"${HOME}/.drush/php${e}/php.ini\" ]; then\n PHP_INI=\"${HOME}/.drush/php${e}/php.ini\"\n PHPRC=\"${HOME}/.drush/php${e}\"\n fi\n fi\n done\n fi\n if [ ! -z \"${DRUSH_PHP}\" ] && [ ! -z \"${PHP_INI}\" ]; then\n export DRUSH_PHP;export PHP_INI;export PHPRC;\n ### echo INF 3 DRUSH_PHP is ${DRUSH_PHP}\n ### echo INF 3 PHP_INI is ${PHP_INI}\n ### echo INF 3 PHPRC is ${PHPRC}\n ### echo INF 3 _DEST_DRUSH is ${_DEST_DRUSH}\n else\n echo\n echo \" Drush 11 and Drush 10 require at least PHP 7.4\"\n echo \" Please create empty control file:\"\n echo\n echo \" ${_DRUSH_CLI_CTRL}/php74.info\"\n echo \" or\"\n echo \" ${_DRUSH_CLI_CTRL}/php81.info\"\n echo \" or\"\n echo \" ${_DRUSH_CLI_CTRL}/php82.info\"\n echo \" or\"\n echo \" ${_DRUSH_CLI_CTRL}/php83.info\"\n echo \" or\"\n echo \" ${_DRUSH_CLI_CTRL}/php84.info\"\n echo \" or\"\n echo \" ${_DRUSH_CLI_CTRL}/php85.info\"\n echo\n echo \" NOTE: If you create more than one,\"\n echo \" the highest version wins.\"\n echo \" Bye\"\n echo\n exit 0\n fi\n elif [[ \"${_ARGS}\" =~ \"drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 \" ]]; then\n _DEST_DRUSH=\"/opt/tools/drush/8/drush/drush.php\"\n if [[ \"${_ARGS}\" =~ \"vendor/bin/drush \" ]]; then\n _DEST_DRUSH=\"${_R_M}/vendor/drush/drush/drush.php\"\n fi\n if [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush \" ]]; then\n _DEST_DRUSH=\"${_R_M}/vendor/drush/drush/drush.php\"\n fi\n if [[ \"${_ARGS}\" =~ \"/vendor/bin/drush \" ]]; then\n _DEST_DRUSH=\"${_R_M}/vendor/drush/drush/drush.php\"\n fi\n if [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php \" ]]; then\n # Detect if PWD ends with /web, /html, or /docroot\n if [[ \"$PWD\" =~ /(web|html|docroot)$ ]]; then\n _DEST_DRUSH=\"../vendor/drush/drush/drush.php\"\n else\n _DEST_DRUSH=\"vendor/drush/drush/drush.php\"\n fi\n ### echo INF 1 _DEST_DRUSH is ${_DEST_DRUSH}\n fi\n if [[ ! \"${HOME}\" =~ (^)\"/data/disk/\" ]] && [ \"${_IS_JENKINS}\" = \"FALSE\" ]; then\n _PHP_V=\"56 70 71 72 73 74 80 81 82 83 84 85\"\n for e in ${_PHP_V}; do\n if [ -e \"${_DRUSH_CLI_CTRL}/php${e}.info\" ] && [ -x \"/opt/php${e}/bin/php\" ]; then\n DRUSH_PHP=\"/opt/php${e}/bin/php\"\n PHP_INI=\"/opt/php${e}/lib/php.ini\"\n PHPRC=\"/opt/php${e}/lib\"\n if [ -f \"${HOME}/.drush/php${e}/php.ini\" ]; then\n PHP_INI=\"${HOME}/.drush/php${e}/php.ini\"\n PHPRC=\"${HOME}/.drush/php${e}\"\n fi\n fi\n done\n fi\n if [ ! -z \"${DRUSH_PHP}\" ] && [ ! -z \"${PHP_INI}\" ] && [ \"${_IS_JENKINS}\" = \"FALSE\" ]; then\n export DRUSH_PHP;export PHP_INI;export PHPRC;\n ### echo INF 4 DRUSH_PHP is ${DRUSH_PHP}\n ### echo INF 4 PHP_INI is ${PHP_INI}\n ### echo INF 4 PHPRC is ${PHPRC}\n ### echo INF 4 _DEST_DRUSH is ${_DEST_DRUSH}\n fi\n fi\n if [[ \"${_ARGS}\" =~ \"drush make\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 make\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush cc drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 cc drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 cr drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 cr drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php cr drush\" ]]; then\n if [[ \"${_PWD}\" =~ \"/static\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush cc drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 cc drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 cr drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 cr drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php cr drush\" ]]; then\n _CORRECT=YES\n _CORRECT_PWD_R=$(pwd 2>&1)\n _CORRECT_ARGS_R=\"${_ARGS}\"\n ### echo _CORRECT_PWD_R is ${_CORRECT_PWD_R}\n ### echo _CORRECT_ARGS_R is ${_CORRECT_ARGS_R}\n else\n if [[ \"${_ARGS}\" =~ \"make-generate\" ]] \\\n && [ -f \"${_PWD}/settings.php\" ]; then\n _CORRECT=YES\n _CORRECT_PWD_S=$(pwd 2>&1)\n _CORRECT_ARGS_S=\"${_ARGS}\"\n ### echo _CORRECT_PWD_S is ${_CORRECT_PWD_S}\n ### echo _CORRECT_ARGS_S is ${_CORRECT_ARGS_S}\n else\n echo\n echo \" This drush command can not be run in ${_PWD}\"\n if [[ \"${2}\" =~ \"make-generate\" ]]; then\n echo \" Please cd to the valid sites/foo.com directory first\"\n echo \" or use a valid @alias, like: drush @foo.com status\"\n echo \" Hint: Use 'drush aliases' to display all Drush 8 aliases\"\n echo \" Hint: Use 'drush11 aliases' to display all Drush 10+ aliases\"\n else\n echo \" Please cd ~/static first\"\n fi\n echo\n exit 0\n fi\n fi\n else\n if [[ \"${_ARGS}\" =~ \"drush @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/bin/drush @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/bin/drush -vvv @\" ]]; then\n if [[ \"${2}\" =~ \"restore\"($) ]] \\\n || [[ \"${2}\" =~ \"arr\"($) ]] \\\n || [[ \"${2}\" =~ \"cli\"($) ]] \\\n || [[ \"${2}\" =~ \"conf\"($) ]] \\\n || [[ \"${2}\" =~ \"config\"($) ]] \\\n || [[ \"${2}\" =~ \"execute\"($) ]] \\\n || [[ \"${2}\" =~ \"core-quick-drupal\"($) ]] \\\n || [[ \"${2}\" =~ \"exec\"($) ]] \\\n || [[ \"${2}\" =~ \"xstatus\"($) ]] \\\n || [[ \"${2}\" =~ \"redis-flush\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"qd\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"rs\"($) ]] \\\n || [[ \"${2}\" =~ \"runserver\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"scr\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"sha\"($) ]] \\\n || [[ \"${2}\" =~ \"shell-alias\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"si\"($) ]] \\\n || [[ \"${2}\" =~ \"sql-create\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"ssh\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"sup\"($) ]]; then\n echo\n echo \" This drush command is not available (A)\"\n echo\n exit 0\n else\n _CORRECT=YES\n ### LSHELL ==> ALL vdrush commands WITH @alias START here\n ### LSHELL ==> ALL drush8 commands WITH @alias START here\n _CORRECT_PWD_T=$(pwd 2>&1)\n _CORRECT_ARGS_T=\"${_ARGS}\"\n ### echo _CORRECT_PWD_T is ${_CORRECT_PWD_T}\n ### echo _CORRECT_ARGS_T is ${_CORRECT_ARGS_T}\n fi\n ### LSHELL ==> BASIC vdrush commands WITH @alias END here\n ### LSHELL ==> ALL drush8 commands WITH @alias END here\n ### LSHELL ==> RESPAWNED vdrush commands WITH @alias like updatedb CONTINUE here\n _CORRECT_PWD_U=$(pwd 2>&1)\n _CORRECT_ARGS_U=\"${_ARGS}\"\n ### echo _CORRECT_PWD_U is ${_CORRECT_PWD_U}\n ### echo _CORRECT_ARGS_U is ${_CORRECT_ARGS_U}\n elif [[ \"${_ARGS}\" =~ \"cc drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"cr drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush --version\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush aliases\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush dl\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush help\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush sa\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 --version\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 aliases\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 help\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 sa\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 --version\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 aliases\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 help\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 sa\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 --version\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 aliases\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 dl\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 help\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 pm-download\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 sa\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush pm-download\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/bin/drush --version\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/bin/drush help\" ]] \\\n || [[ \"${_ARGS}\" =~ \"/data/disk/\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php --version\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php help\" ]]; then\n _CORRECT=YES\n ### LSHELL ==> RESPAWNED vdrush commands WITH @alias like updatedb END here\n ### LSHELL ==> Commands like drush11 aliases START and END here\n _CORRECT_PWD_V=$(pwd 2>&1)\n _CORRECT_ARGS_V=\"${_ARGS}\"\n ### echo _CORRECT_PWD_V is ${_CORRECT_PWD_V}\n ### echo _CORRECT_ARGS_V is ${_CORRECT_ARGS_V}\n else\n ### LSHELL ==> ALL drush8 commands WITHOUT @alias START here\n _CORRECT_PWD_X=$(pwd 2>&1)\n _CORRECT_ARGS_X=\"${_ARGS}\"\n ### echo _CORRECT_PWD_X is ${_CORRECT_PWD_X}\n ### echo _CORRECT_ARGS_X is ${_CORRECT_ARGS_X}\n if [ -f \"${_PWD}/settings.php\" ]; then\n if [[ \"${_ARGS}\" =~ \"drush \" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 \" ]]; then\n _CORRECT=YES\n ### LSHELL ==> ALL drush8 commands WITHOUT @alias END here\n _CORRECT_PWD_Y=$(pwd 2>&1)\n _CORRECT_ARGS_Y=\"${_ARGS}\"\n ### echo _CORRECT_PWD_Y is ${_CORRECT_PWD_Y}\n ### echo _CORRECT_ARGS_Y is ${_CORRECT_ARGS_Y}\n fi\n fi\n fi\n fi\n fi\n else\n if [[ \"${_ARGS}\" =~ \"drush @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/bin/drush @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/bin/drush -vvv @\" ]]; then\n if [[ \"${2}\" =~ \"restore\"($) ]] \\\n || [[ \"${2}\" =~ \"arr\"($) ]] \\\n || [[ \"${2}\" =~ \"cli\"($) ]] \\\n || [[ \"${2}\" =~ \"conf\"($) ]] \\\n || [[ \"${2}\" =~ \"config\"($) ]] \\\n || [[ \"${2}\" =~ \"execute\"($) ]] \\\n || [[ \"${2}\" =~ \"core-quick-drupal\"($) ]] \\\n || [[ \"${2}\" =~ \"exec\"($) ]] \\\n || [[ \"${2}\" =~ \"xstatus\"($) ]] \\\n || [[ \"${2}\" =~ \"redis-flush\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"qd\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"rs\"($) ]] \\\n || [[ \"${2}\" =~ \"runserver\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"scr\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"sha\"($) ]] \\\n || [[ \"${2}\" =~ \"shell-alias\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"si\"($) ]] \\\n || [[ \"${2}\" =~ \"sql-create\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"ssh\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"sup\"($) ]]; then\n echo\n echo \" This drush command is not available (B)\"\n echo\n exit 0\n fi\n _DEBUG_PWD_X=$(pwd 2>&1)\n _DEBUG_ARGS_X=\"${_ARGS}\"\n ### echo _DEBUG_PWD_X is ${_DEBUG_PWD_X}\n ### echo _DEBUG_ARGS_X is ${_DEBUG_ARGS_X}\n fi\n _RAW_IN_PATH=${2//[^a-z/]/}\n if [[ \"${2}\" =~ (^)\"/usr/\" ]] \\\n || [[ \"${2}\" =~ (^)\"/bin/\" ]] \\\n || [[ \"${2}\" =~ (^)\"/opt/\" ]]; then\n _IN_PATH=YES\n elif [[ \"${2}\" =~ (^)\"/data/disk/${_Y_USR}/tools/drush/drush.php\" ]]; then\n _IN_PATH=YES\n elif [[ \"${2}\" =~ (^)\"(/data/disk/${_Y_USR}/tools/drush/drush.php\" ]]; then\n _IN_PATH=YES\n elif [[ \"${2}\" =~ (^)\"/var/${_Y_USR}/drush/drush.php\" ]]; then\n _IN_PATH=YES\n elif [[ \"${2}\" =~ (^)\"(/var/${_Y_USR}/drush/drush.php\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/bin/wkhtmltopdf\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/bin/wkhtmltoimage\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/local/bin/wkhtmltopdf\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/local/bin/wkhtmltoimage\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/bin/wkhtmltopdf-0.12.4\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/bin/wkhtmltoimage-0.12.4\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/local/bin/composer\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/bin/composer\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/bin/unzip\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/bin/convert\" ]]; then\n _IN_PATH=YES\n elif [[ \"${_RAW_IN_PATH}\" =~ \"/usr/bin/gs\" ]]; then\n _IN_PATH=YES\n elif [[ \"${2}\" =~ (^)\"/home/\" ]] \\\n || [[ \"${2}\" =~ (^)\"/data/\" ]] \\\n || [[ \"${2}\" =~ (^)\"/tmp/\" ]]; then\n if [ -e \"${2}\" ]; then\n _IN_PATH=NO\n fi\n else\n _WHICH_TEST=\"$(which ${2})\"\n if [[ \"${_WHICH_TEST}\" =~ (^)\"/usr/\" ]] \\\n || [[ \"${_WHICH_TEST}\" =~ (^)\"/bin/\" ]] \\\n || [[ \"${_WHICH_TEST}\" =~ (^)\"/opt/\" ]]; then\n _IN_PATH=YES\n else\n _IN_PATH=NO\n fi\n fi\n fi\n else\n if [[ \"${_ARGS}\" =~ \"drush @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/bin/drush @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush8 -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush10 -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush11 -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/drush/drush/drush.php -vvv @\" ]] \\\n || [[ \"${_ARGS}\" =~ \"vendor/bin/drush -vvv @\" ]]; then\n if [[ \"${2}\" =~ \"restore\"($) ]] \\\n || [[ \"${2}\" =~ \"arr\"($) ]] \\\n || [[ \"${2}\" =~ \"cli\"($) ]] \\\n || [[ \"${2}\" =~ \"conf\"($) ]] \\\n || [[ \"${2}\" =~ \"config\"($) ]] \\\n || [[ \"${2}\" =~ \"execute\"($) ]] \\\n || [[ \"${2}\" =~ \"core-quick-drupal\"($) ]] \\\n || [[ \"${2}\" =~ \"exec\"($) ]] \\\n || [[ \"${2}\" =~ \"xstatus\"($) ]] \\\n || [[ \"${2}\" =~ \"redis-flush\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"qd\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"rs\"($) ]] \\\n || [[ \"${2}\" =~ \"runserver\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"scr\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"sha\"($) ]] \\\n || [[ \"${2}\" =~ \"shell-alias\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"si\"($) ]] \\\n || [[ \"${2}\" =~ \"sql-create\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"ssh\"($) ]] \\\n || [[ \"${2}\" =~ (^)\"sup\"($) ]]; then\n echo\n echo \" This drush command is not available (C)\"\n echo\n exit 0\n fi\n _DEBUG_PWD_Y=$(pwd 2>&1)\n _DEBUG_ARGS_Y=\"${_ARGS}\"\n ### echo _DEBUG_PWD_Y is ${_DEBUG_PWD_Y}\n ### echo _DEBUG_ARGS_Y is ${_DEBUG_ARGS_Y}\n fi\n if [[ \"${1}\" =~ (^)\"/usr/\" ]] \\\n || [[ \"${1}\" =~ (^)\"/bin/\" ]] \\\n || [[ \"${1}\" =~ (^)\"/opt/\" ]]; then\n _IN_PATH=YES\n elif [[ \"${1}\" =~ (^)\"/data/disk/${_Y_USR}/tools/drush/drush.php\" ]]; then\n _IN_PATH=YES\n elif [[ \"${1}\" =~ (^)\"(/data/disk/${_Y_USR}/tools/drush/drush.php\" ]]; then\n _IN_PATH=YES\n elif [[ \"${1}\" =~ (^)\"/var/${_Y_USR}/drush/drush.php\" ]]; then\n _IN_PATH=YES\n elif [[ \"${1}\" =~ (^)\"(/var/${_Y_USR}/drush/drush.php\" ]]; then\n _IN_PATH=YES\n elif [[ \"${1}\" =~ (^)\"/home/\" ]] \\\n || [[ \"${1}\" =~ (^)\"/data/\" ]] \\\n || [[ \"${1}\" =~ (^)\"/tmp/\" ]]; then\n if [ -e \"${1}\" ]; then\n _IN_PATH=NO\n fi\n else\n _WHICH_TEST=\"$(which ${1})\"\n if [[ \"${_WHICH_TEST}\" =~ (^)\"/usr/\" ]] \\\n || [[ \"${_WHICH_TEST}\" =~ (^)\"/bin/\" ]] \\\n || [[ \"${_WHICH_TEST}\" =~ (^)\"/opt/\" ]]; then\n _IN_PATH=YES\n else\n _IN_PATH=NO\n fi\n fi\n fi\n if [[ \"${_LTD_GID}\" =~ \"lshellg\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ \"ltd-shell-more\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ \"lshellg rvm\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ \"ltd-shell\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ \"rvm ltd-shell\"($) ]] \\\n || [[ \"${_LTD_GID}\" =~ \"ltd-shell rvm\"($) ]]; then\n if [[ \"${_ARGS}\" =~ \"*\" ]]; then\n if [[ $(whoami) == *.ftp ]]; then\n _SILENT=YES\n ####\n #### The [[ $(whoami) == *.ftp ]] ### OK for Drush and Drupal\n #### The [[ \"${_ARGS}\" =~ \"set -m; \" ]] ### Legacy defunct method\n ####\n else\n if [[ \"${_ARGS}\" =~ \"__build__\" ]] \\\n || [[ \"${_ARGS}\" =~ \"_tmp_\" ]] \\\n || [[ \"${_ARGS}\" =~ \".tmp\" ]] \\\n || [[ \"${_ARGS}\" =~ \"avconv\" ]] \\\n || [[ \"${_ARGS}\" =~ \"bzr \" ]] \\\n || [[ \"${_ARGS}\" =~ \"chdir \" ]] \\\n || [[ \"${_ARGS}\" =~ \"compass \" ]] \\\n || [[ \"${_ARGS}\" =~ \"composer \" ]] \\\n || [[ \"${_ARGS}\" =~ \"convert \" ]] \\\n || [[ \"${_ARGS}\" =~ \"curl \" ]] \\\n || [[ \"${_ARGS}\" =~ \"drush\" ]] \\\n || [[ \"${_ARGS}\" =~ \"ffmpeg \" ]] \\\n || [[ \"${_ARGS}\" =~ \"flvtool \" ]] \\\n || [[ \"${_ARGS}\" =~ \"git \" ]] \\\n || [[ \"${_ARGS}\" =~ \"is_\" ]] \\\n || [[ \"${_ARGS}\" =~ \"java\" ]] \\\n || [[ \"${_ARGS}\" =~ \"logger \" ]] \\\n || [[ \"${_ARGS}\" =~ \"php \" ]] \\\n || [[ \"${_ARGS}\" =~ \"php56 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"php74 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"php81 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"php82 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"php83 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"php84 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"php85 \" ]] \\\n || [[ \"${_ARGS}\" =~ \"unzip \" ]] \\\n || [[ \"${_ARGS}\" =~ \"rename \" ]] \\\n || [[ \"${_ARGS}\" =~ \"rrdtool \" ]] \\\n || [[ \"${_ARGS}\" =~ \"rsync \" ]] \\\n || [[ \"${_ARGS}\" =~ \"sass \" ]] \\\n || [[ \"${_ARGS}\" =~ \"scp \" ]] \\\n || [[ \"${_ARGS}\" =~ \"scss \" ]] \\\n || [[ \"${_ARGS}\" =~ \"sendmail \" ]] \\\n || [[ \"${_ARGS}\" =~ \"ssh \" ]] \\\n || [[ \"${_ARGS}\" =~ \"svn \" ]] \\\n || [[ \"${_ARGS}\" =~ \"tar \" ]] \\\n || [[ \"${_ARGS}\" =~ \"wget \" ]] \\\n || [[ \"${_ARGS}\" =~ \"wkhtmltoimage\" ]] \\\n || [[ \"${_ARGS}\" =~ \"wkhtmltopdf\" ]]; then\n _SILENT=YES\n else\n echo\n fi\n fi\n fi\n fi\n if [ \"${_IN_PATH}\" = \"YES\" ]; then\n if [ -x \"/usr/local/bin/ruby\" ] && [ -x \"/usr/local/bin/gem\" ]; then\n if [[ $(whoami) == *.ftp ]] || [ ! -z \"${SSH_CLIENT}\" ]; then\n _RUBY_ALLOW=YES\n fi\n fi\n if [ \"${_RUBY_ALLOW}\" = \"YES\" ]; then\n if [ -d \"/opt/user/gems/${USER}\" ]; then\n export GEM_HOME=\"/opt/user/gems/${USER}\"\n export GEM_PATH=\"/opt/user/gems/${USER}\"\n export PATH=\"/opt/user/gems/${USER}/bin:$PATH\"\n fi\n fi\n if [ -x \"/usr/bin/npm\" ] && [ -e \"/home/${USER}/.npmrc\" ]; then\n if [[ $(whoami) == *.ftp ]] || [ ! -z \"${SSH_CLIENT}\" ]; then\n _NPM_ALLOW=YES\n fi\n fi\n if [ \"${_NPM_ALLOW}\" = \"YES\" ]; then\n if [ -d \"/opt/user/npm/${USER}\" ]; then\n export NPM_PACKAGES=\"/opt/user/npm/${USER}/.npm-packages\"\n export PATH=\"${NPM_PACKAGES}/bin:${PATH}\"\n export NODE_PATH=\"${NPM_PACKAGES}/lib/node_modules:${NODE_PATH}\"\n fi\n fi\n if [ \"$0\" = \"/bin/sh\" ] \\\n || [ \"$0\" = \"/usr/bin/sh\" ] \\\n || [ \"$0\" = \"/opt/local/bin/websh\" ] \\\n || [ \"$0\" = \"/bin/websh\" ]; then\n if [ -x \"/bin/dash\" ]; then\n if [ ! -z \"${_ARR}\" ] && [ -z \"${_OCTO_SYS_ARR}\" ]; then\n _DEST_DRUSH=${_DEST_DRUSH//\\\\/}\n ### echo EXD 1 DRUSH_PHP is ${DRUSH_PHP}\n ### echo EXD 1 PHP_INI is ${PHP_INI}\n ### echo EXD 1 _DEST_DRUSH is ${_DEST_DRUSH}\n ### echo EXD 1 _ARR is ${_ARR}\n ### echo EXD 1 ${DRUSH_PHP} ${_DEST_DRUSH} ${_ARR}\n exec /bin/dash -c \"${DRUSH_PHP} ${_DEST_DRUSH} ${_ARR}\"\n exit 0\n elif [ ! -z \"${PHP_FWD}\" ] && [ ! -z \"${_OCTO_SYS_ARR}\" ]; then\n _DEST_DRUSH=${_DEST_DRUSH//\\\\/}\n ### echo EXD 3-PHP_FWD DRUSH_PHP is ${DRUSH_PHP}\n ### echo EXD 3-PHP_FWD PHP_INI is ${PHP_INI}\n ### echo EXD 3-PHP_FWD _DEST_DRUSH is ${_DEST_DRUSH}\n ### echo EXD 3-PHP_FWD _OCTO_SYS_ARR is ${_OCTO_SYS_ARR}\n ### echo EXD 3-PHP_FWD ${DRUSH_PHP} ${_DEST_DRUSH} ${_OCTO_SYS_ARR}\n exec /bin/dash -c \"${DRUSH_PHP} ${_DEST_DRUSH} ${_OCTO_SYS_ARR}\"\n exit 0\n elif [ -z \"${PHP_FWD}\" ] && [ ! -z \"${_OCTO_SYS_ARR}\" ]; then\n _DEST_DRUSH=${_DEST_DRUSH//\\\\/}\n ### echo EXD 3-NO-PHP_FWD DRUSH_PHP is ${DRUSH_PHP}\n ### echo EXD 3-NO-PHP_FWD PHP_INI is ${PHP_INI}\n ### echo EXD 3-NO-PHP_FWD _DEST_DRUSH is ${_DEST_DRUSH}\n ### echo EXD 3-NO-PHP_FWD _OCTO_SYS_ARR is ${_OCTO_SYS_ARR}\n ### echo EXD 3-NO-PHP_FWD ${DRUSH_PHP} ${_DEST_DRUSH} ${_OCTO_SYS_ARR}\n exec /bin/dash -c \"${DRUSH_PHP} ${_DEST_DRUSH} ${_OCTO_SYS_ARR}\"\n exit 0\n elif [ ! -z \"${_C_ARR}\" ]; then\n ### echo EXC 1 DRUSH_PHP is ${DRUSH_PHP}\n ### echo EXC 1 _C_ARR is ${_C_ARR}\n ### echo EXC 1 _F_ARR is \"$@\"\n ### echo EXC 1 ${DRUSH_PHP} /usr/local/bin/composer ${_C_ARR}\n exec /bin/dash -c \"${DRUSH_PHP} /usr/local/bin/composer ${_C_ARR}\"\n exit 0\n else\n ### echo EXH 1 _forward_to_dash \"$@\"\n _forward_to_dash \"$@\"\n exit 0\n fi\n else\n ### echo EXH 3 _F_ARR is \"$@\"\n ### echo EXH 3 /bin/bash \"$@\"\n exec /bin/bash \"$@\"\n exit 0\n fi\n else\n ### echo EXO 1 _F_ARR is \"$@\"\n ### echo EXO 1 $0 \"$@\"\n exec $0 \"$@\"\n exit 0\n fi\n else\n exit 1\n fi\nelse\n if [ \"${USER}\" = \"root\" ]; then\n if [[ \"${1}\" =~ \"drush\" ]] \\\n || [[ \"${2}\" =~ \"drush\" ]]; then\n if [[ \"${2}\" =~ \"uli\" ]] \\\n || [[ \"${2}\" =~ \"vget\" ]] \\\n || [[ \"${2}\" =~ \"config-list\" ]] \\\n || [[ \"${2}\" =~ \"config-edit\" ]] \\\n || [[ \"${2}\" =~ \"config-get\" ]] \\\n || [[ \"${2}\" =~ \"config-set\" ]] \\\n || [[ \"${2}\" =~ \"--version\" ]] \\\n || [[ \"${2}\" =~ \"vset\" ]] \\\n || [[ \"${2}\" =~ \"status\" ]]; then\n _ALLOW=YES\n else\n echo\n echo \" Drush should never be run as root!\"\n echo \" Please su to some non-root account\"\n echo\n exit 0\n fi\n fi\n fi\n if [ \"$0\" = \"/bin/sh\" ] \\\n || [ \"$0\" = \"/usr/bin/sh\" ] \\\n || [ \"$0\" = \"/opt/local/bin/websh\" ] \\\n || [ \"$0\" = \"/bin/websh\" ]; then\n if [ -x \"/bin/dash\" ]; then\n ### echo EXH 4 _F_ARR is \"$@\"\n ### echo EXH 4 /bin/dash \"$@\"\n exec /bin/dash \"$@\"\n exit 0\n else\n ### echo EXH 6 _F_ARR is \"$@\"\n ### echo EXH 6 /bin/bash \"$@\"\n exec /bin/bash \"$@\"\n exit 0\n fi\n else\n ### echo EXO 2 _F_ARR is \"$@\"\n ### echo EXO 2 $0 \"$@\"\n exec $0 \"$@\"\n exit 0\n fi\n exit 0\nfi\n" }, { "path": "aegir/makefiles/civicrm-4.5-d6.make", "content": "; CiviCRM 4.5-d6 master makefile\n;\n\napi = 2\ncore = 6.x\n\nprojects[pressflow][type] = \"core\"\nprojects[pressflow][download][type] = \"get\"\nprojects[pressflow][download][url] = \"http://files.aegir.cc/core/pressflow-6.60.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.5.8/civicrm-4.5.8-drupal6.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrm_l10n][type] = \"module\"\nprojects[civicrm_l10n][subdir] = \"civicrm\"\nprojects[civicrm_l10n][download][type] = \"get\"\nprojects[civicrm_l10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.5.8/civicrm-4.5.8-l10n.tar.gz/download?use_mirror=autoselect\"\nprojects[civicrm_l10n][overwrite] = TRUE\n\nprojects[civicrm_theme][type] = \"theme\"\nprojects[civicrm_theme][subdir] = \"contrib\"\nprojects[civicrm_theme][version] = \"1.4\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"1.8\"\n" }, { "path": "aegir/makefiles/civicrm-4.5-d7.make", "content": "; CiviCRM 4.5-d7 master makefile\n;\n\napi = 2\ncore = 7.x\n\nprojects[drupal][type] = \"core\"\nprojects[drupal][download][type] = \"get\"\nprojects[drupal][download][url] = \"http://files.aegir.cc/core/drupal-7.105.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.5.8/civicrm-4.5.8-drupal.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrml10n][type] = \"module\"\nprojects[civicrml10n][subdir] = \"civicrm\"\nprojects[civicrml10n][download][type] = \"get\"\nprojects[civicrml10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.5.8/civicrm-4.5.8-l10n.tar.gz/download?use_mirror=autoselect\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"3.0-rc6\"\n" }, { "path": "aegir/makefiles/civicrm-4.6-d6.make", "content": "; CiviCRM 4.6-d6 master makefile\n;\n\napi = 2\ncore = 6.x\n\nprojects[pressflow][type] = \"core\"\nprojects[pressflow][download][type] = \"get\"\nprojects[pressflow][download][url] = \"http://files.aegir.cc/core/pressflow-6.60.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.6.37/civicrm-4.6.37-drupal6.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrm_l10n][type] = \"module\"\nprojects[civicrm_l10n][subdir] = \"civicrm\"\nprojects[civicrm_l10n][download][type] = \"get\"\nprojects[civicrm_l10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.6.37/civicrm-4.6.37-l10n.tar.gz/download?use_mirror=autoselect\"\nprojects[civicrm_l10n][overwrite] = TRUE\n\nprojects[civicrm_theme][type] = \"theme\"\nprojects[civicrm_theme][subdir] = \"contrib\"\nprojects[civicrm_theme][version] = \"1.4\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"1.8\"\n" }, { "path": "aegir/makefiles/civicrm-4.6-d7.make", "content": "; CiviCRM 4.6-d7 master makefile\n;\n\napi = 2\ncore = 7.x\n\nprojects[drupal][type] = \"core\"\nprojects[drupal][download][type] = \"get\"\nprojects[drupal][download][url] = \"http://files.aegir.cc/core/drupal-7.105.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.6.37/civicrm-4.6.37-drupal.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrml10n][type] = \"module\"\nprojects[civicrml10n][subdir] = \"civicrm\"\nprojects[civicrml10n][download][type] = \"get\"\nprojects[civicrml10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.6.37/civicrm-4.6.37-l10n.tar.gz/download?use_mirror=autoselect\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"3.0-rc6\"\n" }, { "path": "aegir/makefiles/civicrm-4.7-d6.make", "content": "; CiviCRM 4.7-d6 master makefile\n;\n\napi = 2\ncore = 6.x\n\nprojects[pressflow][type] = \"core\"\nprojects[pressflow][download][type] = \"get\"\nprojects[pressflow][download][url] = \"http://files.aegir.cc/core/pressflow-6.60.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.7.31/civicrm-4.7.31-drupal6.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrm_l10n][type] = \"module\"\nprojects[civicrm_l10n][subdir] = \"civicrm\"\nprojects[civicrm_l10n][download][type] = \"get\"\nprojects[civicrm_l10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.7.31/civicrm-4.7.31-l10n.tar.gz/download?use_mirror=autoselect\"\nprojects[civicrm_l10n][overwrite] = TRUE\n\nprojects[civicrm_theme][type] = \"theme\"\nprojects[civicrm_theme][subdir] = \"contrib\"\nprojects[civicrm_theme][version] = \"1.4\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"1.8\"\n" }, { "path": "aegir/makefiles/civicrm-4.7-d7.make", "content": "; CiviCRM 4.7-d7 master makefile\n;\n\napi = 2\ncore = 7.x\n\nprojects[drupal][type] = \"core\"\nprojects[drupal][download][type] = \"get\"\nprojects[drupal][download][url] = \"http://files.aegir.cc/core/drupal-7.105.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.7.31/civicrm-4.7.31-drupal.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrml10n][type] = \"module\"\nprojects[civicrml10n][subdir] = \"civicrm\"\nprojects[civicrml10n][download][type] = \"get\"\nprojects[civicrml10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/4.7.31/civicrm-4.7.31-l10n.tar.gz/download?use_mirror=autoselect\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"3.0-rc6\"\n" }, { "path": "aegir/makefiles/civicrm-5.0-d6.make", "content": "; CiviCRM 5.0-d6 master makefile\n;\n\napi = 2\ncore = 6.x\n\nprojects[pressflow][type] = \"core\"\nprojects[pressflow][download][type] = \"get\"\nprojects[pressflow][download][url] = \"http://files.aegir.cc/core/pressflow-6.60.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.0.2/civicrm-5.0.2-drupal6.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrm_l10n][type] = \"module\"\nprojects[civicrm_l10n][subdir] = \"civicrm\"\nprojects[civicrm_l10n][download][type] = \"get\"\nprojects[civicrm_l10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.0.2/civicrm-5.0.2-l10n.tar.gz/download?use_mirror=autoselect\"\nprojects[civicrm_l10n][overwrite] = TRUE\n\nprojects[civicrm_theme][type] = \"theme\"\nprojects[civicrm_theme][subdir] = \"contrib\"\nprojects[civicrm_theme][version] = \"1.4\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"1.8\"\n" }, { "path": "aegir/makefiles/civicrm-5.0-d7.make", "content": "; CiviCRM 5.0-d7 master makefile\n;\n\napi = 2\ncore = 7.x\n\nprojects[drupal][type] = \"core\"\nprojects[drupal][download][type] = \"get\"\nprojects[drupal][download][url] = \"http://files.aegir.cc/core/drupal-7.105.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.0.2/civicrm-5.0.2-drupal.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrml10n][type] = \"module\"\nprojects[civicrml10n][subdir] = \"civicrm\"\nprojects[civicrml10n][download][type] = \"get\"\nprojects[civicrml10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.0.2/civicrm-5.0.2-l10n.tar.gz/download?use_mirror=autoselect\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"3.0-rc6\"\n" }, { "path": "aegir/makefiles/civicrm-5.1-d7.make", "content": "; CiviCRM 5.1-d7 master makefile\n;\n\napi = 2\ncore = 7.x\n\nprojects[drupal][type] = \"core\"\nprojects[drupal][download][type] = \"get\"\nprojects[drupal][download][url] = \"http://files.aegir.cc/core/drupal-7.105.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.1.2/civicrm-5.1.2-drupal.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrml10n][type] = \"module\"\nprojects[civicrml10n][subdir] = \"civicrm\"\nprojects[civicrml10n][download][type] = \"get\"\nprojects[civicrml10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.1.2/civicrm-5.1.2-l10n.tar.gz/download?use_mirror=autoselect\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"3.0-rc6\"\n" }, { "path": "aegir/makefiles/civicrm-5.2-d7.make", "content": "; CiviCRM 5.2-d7 master makefile\n;\n\napi = 2\ncore = 7.x\n\nprojects[drupal][type] = \"core\"\nprojects[drupal][download][type] = \"get\"\nprojects[drupal][download][url] = \"http://files.aegir.cc/core/drupal-7.105.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.2.2/civicrm-5.2.2-drupal.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrml10n][type] = \"module\"\nprojects[civicrml10n][subdir] = \"civicrm\"\nprojects[civicrml10n][download][type] = \"get\"\nprojects[civicrml10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.2.2/civicrm-5.2.2-l10n.tar.gz/download?use_mirror=autoselect\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"3.0-rc6\"\n" }, { "path": "aegir/makefiles/civicrm-5.3-d7.make", "content": "; CiviCRM 5.3-d7 master makefile\n;\n\napi = 2\ncore = 7.x\n\nprojects[drupal][type] = \"core\"\nprojects[drupal][download][type] = \"get\"\nprojects[drupal][download][url] = \"http://files.aegir.cc/core/drupal-7.105.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.3.0/civicrm-5.3.0-drupal.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrml10n][type] = \"module\"\nprojects[civicrml10n][subdir] = \"civicrm\"\nprojects[civicrml10n][download][type] = \"get\"\nprojects[civicrml10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.3.0/civicrm-5.3.0-l10n.tar.gz/download?use_mirror=autoselect\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"3.0-rc6\"\n" }, { "path": "aegir/makefiles/civicrm-5.35-d7.make", "content": "; CiviCRM 5.35-d7 master makefile\n;\n\napi = 2\ncore = 7.x\n\nprojects[drupal][type] = \"core\"\nprojects[drupal][download][type] = \"get\"\nprojects[drupal][download][url] = \"http://files.aegir.cc/core/drupal-7.105.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"https://download.civicrm.org/civicrm-5.35.0-drupal.tar.gz\"\n\nprojects[civicrml10n][type] = \"module\"\nprojects[civicrml10n][subdir] = \"civicrm\"\nprojects[civicrml10n][download][type] = \"get\"\nprojects[civicrml10n][download][url] = \"https://download.civicrm.org/civicrm-5.35.0-l10n.tar.gz\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"3.0-rc6\"\n" }, { "path": "aegir/makefiles/civicrm-5.9-d7.make", "content": "; CiviCRM 5.9-d7 master makefile\n;\n\napi = 2\ncore = 7.x\n\nprojects[drupal][type] = \"core\"\nprojects[drupal][download][type] = \"get\"\nprojects[drupal][download][url] = \"http://files.aegir.cc/core/drupal-7.105.1.tar.gz\"\n\nprojects[civicrm][type] = \"module\"\nprojects[civicrm][directory_name] = \"civicrm\"\nprojects[civicrm][download][type] = \"get\"\nprojects[civicrm][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.9.0/civicrm-5.9.0-drupal.tar.gz/download?use_mirror=autoselect\"\n\nprojects[civicrml10n][type] = \"module\"\nprojects[civicrml10n][subdir] = \"civicrm\"\nprojects[civicrml10n][download][type] = \"get\"\nprojects[civicrml10n][download][url] = \"http://sourceforge.net/projects/civicrm/files/civicrm-stable/5.9.0/civicrm-5.9.0-l10n.tar.gz/download?use_mirror=autoselect\"\n\nprojects[admin_menu][type] = \"module\"\nprojects[admin_menu][subdir] = \"contrib\"\nprojects[admin_menu][version] = \"3.0-rc6\"\n" }, { "path": "aegir/patches/0001-Print-site_footer-if-defined.patch", "content": "From c22f1e9aa41010d91f3105628a8652ef42e12efa Mon Sep 17 00:00:00 2001\nFrom: Barracuda Team \nDate: Sat, 16 Apr 2016 18:11:35 +0200\nSubject: [PATCH] Print $site_footer if defined\n\n---\n page.tpl.php | 5 +++++\n 1 file changed, 5 insertions(+)\n\ndiff --git a/page.tpl.php b/page.tpl.php\nindex 6a68dc4..a7eda81 100644\n--- a/page.tpl.php\n+++ b/page.tpl.php\n@@ -51,6 +51,11 @@\n \n \n
\n+\n+ \n+ \n+ \n+\n \n \n $secondary_menu, 'attributes' => array('id' => 'secondary-menu', 'class' => array('links', 'inline')))); ?>\n-- \n2.2.1\n\n" }, { "path": "aegir/patches/2106995-fatal-error-non-object-1.patch", "content": "diff -urp a/registration.install b/registration.install\n--- a/registration.install 2016-04-22 17:11:27.000000000 +0000\n+++ b/registration.install 2016-05-03 19:36:33.000000000 +0000\n@@ -5,6 +5,16 @@\n * Schema and installation hooks for registration module.\n */\n\n+// https://www.drupal.org/node/542202#comment-6065048\n+module_load_include('inc','registration','lib/registration.entity');\n+module_load_include('inc','registration','lib/registration_state.ui_controller');\n+module_load_include('inc','registration','lib/registration.metadata');\n+module_load_include('inc','registration','lib/registration_type.controller');\n+module_load_include('inc','registration','lib/registration_state.controller');\n+module_load_include('inc','registration','lib/registration_type.entity');\n+module_load_include('inc','registration','lib/registration_state.entity');\n+module_load_include('inc','registration','lib/registration_type.ui_controller');\n+\n /**\n * Implements hook_schema().\n */\n" }, { "path": "aegir/patches/6-core/SA-CORE-2018-002-D6.patch", "content": "From 2d234e178e17f3db557a0919eec303917ece09b0 Mon Sep 17 00:00:00 2001\nFrom: David Snopek \nDate: Wed, 28 Mar 2018 14:53:39 -0500\nSubject: [PATCH] Backport of fixes from SA-CORE-2018-002 (#116)\n\n---\n includes/bootstrap.inc | 55 ++++++++++++++++++++++++++++++++++++++++++++\n modules/system/system.module | 2 +-\n 2 files changed, 56 insertions(+), 1 deletion(-)\n\ndiff --git a/includes/bootstrap.inc b/includes/bootstrap.inc\nindex acc055e745..afed7408e4 100644\n--- a/includes/bootstrap.inc\n+++ b/includes/bootstrap.inc\n@@ -1483,6 +1483,7 @@ function _drupal_bootstrap($phase) {\n timer_start('page');\n // Initialize the configuration\n conf_init();\n+ _drupal_bootstrap_sanitize_request();\n break;\n \n case DRUPAL_BOOTSTRAP_EARLY_PAGE_CACHE:\n@@ -2207,3 +2208,57 @@ function filter_xss_bad_protocol($string, $decode = TRUE) {\n } while ($before != $string);\n return check_plain($string);\n }\n+\n+/**\n+ * Sanitizes unsafe keys from the request.\n+ */\n+function _drupal_bootstrap_sanitize_request() {\n+ global $conf;\n+ static $sanitized;\n+\n+ if (!$sanitized) {\n+ // Ensure the whitelist array exists.\n+ if (!isset($conf['sanitize_input_whitelist']) || !is_array($conf['sanitize_input_whitelist'])) {\n+ $conf['sanitize_input_whitelist'] = array();\n+ }\n+\n+ $sanitized_keys = _drupal_bootstrap_sanitize_input($_GET, $conf['sanitize_input_whitelist']);\n+ $sanitized_keys = array_merge($sanitized_keys, _drupal_bootstrap_sanitize_input($_POST, $conf['sanitize_input_whitelist']));\n+ $sanitized_keys = array_merge($sanitized_keys, _drupal_bootstrap_sanitize_input($_REQUEST, $conf['sanitize_input_whitelist']));\n+ $sanitized_keys = array_merge($sanitized_keys, _drupal_bootstrap_sanitize_input($_COOKIE, $conf['sanitize_input_whitelist']));\n+ $sanitized_keys = array_unique($sanitized_keys);\n+\n+ if (count($sanitized_keys) && !empty($conf['sanitize_input_logging'])) {\n+ trigger_error(check_plain(sprintf('Potentially unsafe keys removed from request parameters: %s', implode(', ', $sanitized_keys)), E_USER_WARNING));\n+ }\n+\n+ $sanitized = TRUE;\n+ }\n+}\n+\n+/**\n+ * Sanitizes unsafe keys from user input.\n+ *\n+ * @param mixed $input\n+ * Input to sanitize.\n+ * @param array $whitelist\n+ * Whitelist of values.\n+ * @return array\n+ */\n+function _drupal_bootstrap_sanitize_input(&$input, $whitelist = array()) {\n+ $sanitized_keys = array();\n+\n+ if (is_array($input)) {\n+ foreach ($input as $key => $value) {\n+ if ($key !== '' && $key[0] === '#' && !in_array($key, $whitelist, TRUE)) {\n+ unset($input[$key]);\n+ $sanitized_keys[] = $key;\n+ }\n+ elseif (is_array($input[$key])) {\n+ $sanitized_keys = array_merge($sanitized_keys, _drupal_bootstrap_sanitize_input($input[$key], $whitelist));\n+ }\n+ }\n+ }\n+\n+ return $sanitized_keys;\n+}\ndiff --git a/modules/system/system.module b/modules/system/system.module\nindex 93962ac5b5..ed372b8052 100644\n--- a/modules/system/system.module\n+++ b/modules/system/system.module\n@@ -8,7 +8,7 @@\n /**\n * The current system version.\n */\n-define('VERSION', '6.39');\n+define('VERSION', '6.40');\n \n /**\n * Core API compatibility.\n-- \n2.14.3 (Apple Git-98)\n\n" }, { "path": "aegir/patches/6-core/SA-CORE-2018-004-D6.patch", "content": "From f7876dcf6428b934c928aa76dbbaacf2c6e49875 Mon Sep 17 00:00:00 2001\nFrom: David Snopek \nDate: Wed, 25 Apr 2018 11:12:44 -0500\nSubject: [PATCH] Backport of fixes from SA-CORE-2018-004\n\n---\n includes/bootstrap.inc | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++\n 1 file changed, 93 insertions(+)\n\ndiff --git a/includes/bootstrap.inc b/includes/bootstrap.inc\nindex 5654ddec8b..72343aac79 100644\n--- a/includes/bootstrap.inc\n+++ b/includes/bootstrap.inc\n@@ -1202,6 +1202,10 @@ function _drupal_bootstrap($phase) {\n unset($_GET['destination']);\n unset($_REQUEST['destination']);\n }\n+ // Ensure that the destination's query parameters are not dangerous.\n+ if (isset($_GET['destination'])) {\n+ _drupal_bootstrap_clean_destination();\n+ }\n // If there's still something in $_REQUEST['destination'] that didn't\n // come from $_GET, check it too.\n if (isset($_REQUEST['destination']) && (!isset($_GET['destination']) || $_REQUEST['destination'] != $_GET['destination']) && menu_path_is_external($_REQUEST['destination'])) {\n@@ -1660,3 +1664,92 @@ function _drupal_bootstrap_sanitize_input(&$input, $whitelist = array()) {\n \n return $sanitized_keys;\n }\n+\n+/**\n+ * Removes the destination if it is dangerous.\n+ *\n+ * Note this can only be called after common.inc has been included.\n+ *\n+ * @return bool\n+ * TRUE if the destination has been removed from $_GET, FALSE if not.\n+ */\n+function _drupal_bootstrap_clean_destination() {\n+ $dangerous_keys = array();\n+\n+ $log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);\n+\n+ $parts = _drupal_parse_url($_GET['destination']);\n+ if (!empty($parts['query'])) {\n+ $whitelist = variable_get('sanitize_input_whitelist', array());\n+ $log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);\n+\n+ $dangerous_keys = _drupal_bootstrap_sanitize_input($parts['query'], $whitelist);\n+ if (!empty($dangerous_keys)) {\n+ // The destination is removed rather than sanitized to mirror the\n+ // handling of external destinations.\n+ unset($_GET['destination']);\n+ unset($_REQUEST['destination']);\n+ if ($log_sanitized_keys) {\n+ trigger_error(sprintf('Potentially unsafe destination removed from query string parameters (GET) because it contained the following keys: %s', implode(', ', $dangerous_keys)));\n+ }\n+ return TRUE;\n+ }\n+ }\n+ return FALSE;\n+}\n+\n+/**\n+ * Backport of drupal_parse_url() from Drupal 7.\n+ */\n+function _drupal_parse_url($url) {\n+ $options = array(\n+ 'path' => NULL,\n+ 'query' => array(),\n+ 'fragment' => '',\n+ );\n+\n+ // External URLs: not using parse_url() here, so we do not have to rebuild\n+ // the scheme, host, and path without having any use for it.\n+ if (strpos($url, '://') !== FALSE) {\n+\n+ // Split off everything before the query string into 'path'.\n+ $parts = explode('?', $url);\n+ $options['path'] = $parts[0];\n+\n+ // If there is a query string, transform it into keyed query parameters.\n+ if (isset($parts[1])) {\n+ $query_parts = explode('#', $parts[1]);\n+ parse_str($query_parts[0], $options['query']);\n+\n+ // Take over the fragment, if there is any.\n+ if (isset($query_parts[1])) {\n+ $options['fragment'] = $query_parts[1];\n+ }\n+ }\n+ }\n+ else {\n+\n+ // parse_url() does not support relative URLs, so make it absolute. E.g. the\n+ // relative URL \"foo/bar:1\" isn't properly parsed.\n+ $parts = parse_url('http://example.com/' . $url);\n+\n+ // Strip the leading slash that was just added.\n+ $options['path'] = substr($parts['path'], 1);\n+ if (isset($parts['query'])) {\n+ parse_str($parts['query'], $options['query']);\n+ }\n+ if (isset($parts['fragment'])) {\n+ $options['fragment'] = $parts['fragment'];\n+ }\n+ }\n+\n+ // The 'q' parameter contains the path of the current page if clean URLs are\n+ // disabled. It overrides the 'path' of the URL when present, even if clean\n+ // URLs are enabled, due to how Apache rewriting rules work. The path\n+ // parameter must be a string.\n+ if (isset($options['query']['q']) && is_string($options['query']['q'])) {\n+ $options['path'] = $options['query']['q'];\n+ unset($options['query']['q']);\n+ }\n+ return $options;\n+}\n" }, { "path": "aegir/patches/6-core/patch_commit_7a847db99f80.patch", "content": "diff --git a/modules/system/system.install b/modules/system/system.install\nindex 953ad1631f15d42529d76aeb9b7fe0adcfe1b2e4..4a75da5c1c0280c82df953ef8d620687b5f7e1ec 100644\n--- a/modules/system/system.install\n+++ b/modules/system/system.install\n@@ -119,14 +119,17 @@ function system_requirements($phase) {\n \n // Test the web server identity.\n if (isset($_SERVER['SERVER_SOFTWARE']) && preg_match(\"/(?:ApacheSolaris|Nginx)/i\", $_SERVER['SERVER_SOFTWARE'])) {\n- $is_nginx = TRUE; // Skip this on BOA since .htaccess is never used in Nginx.\n+ // Skip this on BOA and Nginx since .htaccess is never used in Nginx.\n+ $is_nginx = TRUE;\n }\n elseif (!isset($_SERVER['SERVER_SOFTWARE'])) {\n- $is_nginx = TRUE; // Skip this on BOA since .htaccess is never used in Nginx.\n+ // Skip this in Aegir backend where SERVER_SOFTWARE is not set, since .htaccess is never used in Nginx.\n+ $is_nginx = TRUE;\n }\n else {\n $is_nginx = FALSE;\n }\n+\n // Test the contents of the .htaccess files.\n if ($phase == 'runtime' && !$is_nginx) {\n // Try to write the .htaccess files first, to prevent false alarms in case\n" }, { "path": "aegir/patches/7-core/3143016-83-D7.patch", "content": "From 4e87afee1ea3aa5379b1726b53015545fcaa7d66 Mon Sep 17 00:00:00 2001\nFrom: mcdruid \nDate: Mon, 1 Jun 2020 12:23:57 +0100\nSubject: [PATCH] Issue #3143016 by dsnopek, mcdruid, effulgentsia, philltran,\n Fabianx, lauriii: Chrome 83 cancels jquery.form ajax requests over https\n\n---\n misc/ajax.js | 19 +++++++++++++++++++\n modules/system/system.install | 7 +++++++\n 2 files changed, 26 insertions(+)\n\ndiff --git a/misc/ajax.js b/misc/ajax.js\nindex c944ebbf24..0c9579b00d 100644\n--- a/misc/ajax.js\n+++ b/misc/ajax.js\n@@ -198,6 +198,25 @@ Drupal.ajax = function (base, element, element_settings) {\n type: 'POST'\n };\n\n+ // For multipart forms (e.g., file uploads), jQuery Form targets the form\n+ // submission to an iframe instead of using an XHR object. The initial \"src\"\n+ // of the iframe, prior to the form submission, is set to options.iframeSrc.\n+ // \"about:blank\" is the semantically correct, standards-compliant, way to\n+ // initialize a blank iframe; however, some old IE versions (possibly only 6)\n+ // incorrectly report a mixed content warning when iframes with an\n+ // \"about:blank\" src are added to a parent document with an https:// origin.\n+ // jQuery Form works around this by defaulting to \"javascript:false\" instead,\n+ // but that breaks on Chrome 83, so here we force the semantically correct\n+ // behavior for all browsers except old IE.\n+ // @see https://www.drupal.org/project/drupal/issues/3143016\n+ // @see https://github.com/jquery-form/form/blob/df9cb101b9c9c085c8d75ad980c7ff1cf62063a1/jquery.form.js#L68\n+ // @see https://bugs.chromium.org/p/chromium/issues/detail?id=1084874\n+ // @see https://html.spec.whatwg.org/multipage/browsers.html#creating-browsing-contexts\n+ // @see https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy\n+ if (navigator.userAgent.indexOf(\"MSIE\") === -1) {\n+ ajax.options.iframeSrc = 'about:blank';\n+ }\n+\n // Bind the ajaxSubmit function to the element event.\n $(ajax.element).bind(element_settings.event, function (event) {\n if (!Drupal.settings.urlIsAjaxTrusted[ajax.url] && !Drupal.urlIsLocal(ajax.url)) {\ndiff --git a/modules/system/system.install b/modules/system/system.install\nindex 93afb06f78..d6707bedf7 100644\n--- a/modules/system/system.install\n+++ b/modules/system/system.install\n@@ -3299,6 +3299,13 @@ function system_update_7083() {\n // Empty update to force a rebuild of hook_library() and JS aggregates.\n }\n\n+/**\n+ * Rebuild JavaScript aggregates to include 'ajax.js' fix for Chrome 83.\n+ */\n+function system_update_7084() {\n+ // Empty update to force a rebuild of JS aggregates.\n+}\n+\n /**\n * @} End of \"defgroup updates-7.x-extra\".\n * The next series of updates should start at 8000.\n--\n2.24.0\n\n" }, { "path": "aegir/patches/7-core/SA-CORE-2014-005-D7.patch", "content": "diff --git a/includes/database/database.inc b/includes/database/database.inc\nindex f78098b..01b6385 100644\n--- a/includes/database/database.inc\n+++ b/includes/database/database.inc\n@@ -736,7 +736,7 @@ abstract class DatabaseConnection extends PDO {\n // to expand it out into a comma-delimited set of placeholders.\n foreach (array_filter($args, 'is_array') as $key => $data) {\n $new_keys = array();\n- foreach ($data as $i => $value) {\n+ foreach (array_values($data) as $i => $value) {\n // This assumes that there are no other placeholders that use the same\n // name. For example, if the array placeholder is defined as :example\n // and there is already an :example_2 placeholder, this will generate\n" }, { "path": "aegir/patches/7-core/SA-CORE-2018-002-D7.patch", "content": "From 2266d2a83db50e2f97682d9a0fb8a18e2722cba5 Mon Sep 17 00:00:00 2001\nFrom: David Rothstein \nDate: Tue, 27 Mar 2018 15:24:40 -0400\nSubject: [PATCH] SA-CORE-2018-002 by Jasu_M, samuel.mortenson,\n David_Rothstein, xjm, mlhess, larowlan, pwolanin, alexpott, dsnopek, Pere\n Orga, cashwilliams, dawehner, tim.plunkett, drumm\n\n---\n includes/bootstrap.inc | 4 +++\n includes/request-sanitizer.inc | 82 ++++++++++++++++++++++++++++++++++++++++++\n 2 files changed, 86 insertions(+)\n create mode 100644 includes/request-sanitizer.inc\n\ndiff --git a/includes/bootstrap.inc b/includes/bootstrap.inc\nindex 655db6d63e..880557e77d 100644\n--- a/includes/bootstrap.inc\n+++ b/includes/bootstrap.inc\n@@ -2632,6 +2632,10 @@ function _drupal_bootstrap_configuration() {\n timer_start('page');\n // Initialize the configuration, including variables from settings.php.\n drupal_settings_initialize();\n+\n+ // Sanitize unsafe keys from the request.\n+ require_once DRUPAL_ROOT . '/includes/request-sanitizer.inc';\n+ DrupalRequestSanitizer::sanitize();\n }\n \n /**\ndiff --git a/includes/request-sanitizer.inc b/includes/request-sanitizer.inc\nnew file mode 100644\nindex 0000000000..1daa6b5348\n--- /dev/null\n+++ b/includes/request-sanitizer.inc\n@@ -0,0 +1,82 @@\n+ implode(', ', $get_sanitized_keys))), E_USER_NOTICE);\n+ }\n+\n+ // Process request body parameters.\n+ $post_sanitized_keys = array();\n+ $_POST = self::stripDangerousValues($_POST, $whitelist, $post_sanitized_keys);\n+ if ($log_sanitized_keys && $post_sanitized_keys) {\n+ _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from request body parameters (POST): @keys', array('@keys' => implode(', ', $post_sanitized_keys))), E_USER_NOTICE);\n+ }\n+\n+ // Process cookie parameters.\n+ $cookie_sanitized_keys = array();\n+ $_COOKIE = self::stripDangerousValues($_COOKIE, $whitelist, $cookie_sanitized_keys);\n+ if ($log_sanitized_keys && $cookie_sanitized_keys) {\n+ _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from cookie parameters (COOKIE): @keys', array('@keys' => implode(', ', $cookie_sanitized_keys))), E_USER_NOTICE);\n+ }\n+\n+ $request_sanitized_keys = array();\n+ $_REQUEST = self::stripDangerousValues($_REQUEST, $whitelist, $request_sanitized_keys);\n+\n+ self::$sanitized = TRUE;\n+ }\n+ }\n+\n+ /**\n+ * Strips dangerous keys from the provided input.\n+ *\n+ * @param mixed $input\n+ * The input to sanitize.\n+ * @param string[] $whitelist\n+ * An array of keys to whitelist as safe.\n+ * @param string[] $sanitized_keys\n+ * An array of keys that have been removed.\n+ *\n+ * @return mixed\n+ * The sanitized input.\n+ */\n+ protected static function stripDangerousValues($input, array $whitelist, array &$sanitized_keys) {\n+ if (is_array($input)) {\n+ foreach ($input as $key => $value) {\n+ if ($key !== '' && $key[0] === '#' && !in_array($key, $whitelist, TRUE)) {\n+ unset($input[$key]);\n+ $sanitized_keys[] = $key;\n+ }\n+ else {\n+ $input[$key] = self::stripDangerousValues($input[$key], $whitelist, $sanitized_keys);\n+ }\n+ }\n+ }\n+ return $input;\n+ }\n+\n+}\n-- \n2.14.3 (Apple Git-98)\n\n" }, { "path": "aegir/patches/7-core/SA-CORE-2018-004-D7.patch", "content": "From 080daa38f265ea28444c540832509a48861587d0 Mon Sep 17 00:00:00 2001\nFrom: David Rothstein \nDate: Wed, 25 Apr 2018 11:30:53 -0400\nSubject: [PATCH] SA-CORE-2018-004 by alexpott, Heine, larowlan,\n David_Rothstein, xjm, Pere Orga, mlhess, tim.plunkett, Jasu_M, quicksketch,\n cashwilliams, samuel.mortenson, pwolanin, drumm, dawehner\n\n---\n includes/bootstrap.inc | 5 +++++\n includes/common.inc | 5 +++--\n includes/request-sanitizer.inc | 32 ++++++++++++++++++++++++++++++++\n modules/file/file.module | 3 +++\n 4 files changed, 43 insertions(+), 2 deletions(-)\n\ndiff --git a/includes/bootstrap.inc b/includes/bootstrap.inc\nindex 06acf935e0..d5963a0aff 100644\n--- a/includes/bootstrap.inc\n+++ b/includes/bootstrap.inc\n@@ -2778,6 +2778,11 @@ function _drupal_bootstrap_variables() {\n unset($_GET['destination']);\n unset($_REQUEST['destination']);\n }\n+ // Use the DrupalRequestSanitizer to ensure that the destination's query\n+ // parameters are not dangerous.\n+ if (isset($_GET['destination'])) {\n+ DrupalRequestSanitizer::cleanDestination();\n+ }\n // If there's still something in $_REQUEST['destination'] that didn't come\n // from $_GET, check it too.\n if (isset($_REQUEST['destination']) && (!isset($_GET['destination']) || $_REQUEST['destination'] != $_GET['destination']) && url_is_external($_REQUEST['destination'])) {\ndiff --git a/includes/common.inc b/includes/common.inc\nindex d7dc47f229..f61d1eb0f2 100644\n--- a/includes/common.inc\n+++ b/includes/common.inc\n@@ -611,8 +611,9 @@ function drupal_parse_url($url) {\n }\n // The 'q' parameter contains the path of the current page if clean URLs are\n // disabled. It overrides the 'path' of the URL when present, even if clean\n- // URLs are enabled, due to how Apache rewriting rules work.\n- if (isset($options['query']['q'])) {\n+ // URLs are enabled, due to how Apache rewriting rules work. The path\n+ // parameter must be a string.\n+ if (isset($options['query']['q']) && is_string($options['query']['q'])) {\n $options['path'] = $options['query']['q'];\n unset($options['query']['q']);\n }\ndiff --git a/includes/request-sanitizer.inc b/includes/request-sanitizer.inc\nindex 1daa6b5348..7214436b8a 100644\n--- a/includes/request-sanitizer.inc\n+++ b/includes/request-sanitizer.inc\n@@ -51,6 +51,38 @@ class DrupalRequestSanitizer {\n }\n }\n \n+ /**\n+ * Removes the destination if it is dangerous.\n+ *\n+ * Note this can only be called after common.inc has been included.\n+ *\n+ * @return bool\n+ * TRUE if the destination has been removed from $_GET, FALSE if not.\n+ */\n+ public static function cleanDestination() {\n+ $dangerous_keys = array();\n+ $log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);\n+\n+ $parts = drupal_parse_url($_GET['destination']);\n+ // If there is a query string, check its query parameters.\n+ if (!empty($parts['query'])) {\n+ $whitelist = variable_get('sanitize_input_whitelist', array());\n+\n+ self::stripDangerousValues($parts['query'], $whitelist, $dangerous_keys);\n+ if (!empty($dangerous_keys)) {\n+ // The destination is removed rather than sanitized to mirror the\n+ // handling of external destinations.\n+ unset($_GET['destination']);\n+ unset($_REQUEST['destination']);\n+ if ($log_sanitized_keys) {\n+ trigger_error(format_string('Potentially unsafe destination removed from query string parameters (GET) because it contained the following keys: @keys', array('@keys' => implode(', ', $dangerous_keys))));\n+ }\n+ return TRUE;\n+ }\n+ }\n+ return FALSE;\n+ }\n+\n /**\n * Strips dangerous keys from the provided input.\n *\ndiff --git a/modules/file/file.module b/modules/file/file.module\nindex 1e98f11bd7..eea58470fa 100644\n--- a/modules/file/file.module\n+++ b/modules/file/file.module\n@@ -239,6 +239,9 @@ function file_ajax_upload() {\n $form_parents = func_get_args();\n $form_build_id = (string) array_pop($form_parents);\n \n+ // Sanitize form parents before using them.\n+ $form_parents = array_filter($form_parents, 'element_child');\n+\n if (empty($_POST['form_build_id']) || $form_build_id != $_POST['form_build_id']) {\n // Invalid request.\n drupal_set_message(t('An unrecoverable error occurred. The uploaded file likely exceeded the maximum file size (@size) that this server supports.', array('@size' => format_size(file_upload_max_size()))), 'error');\n-- \n2.15.1 (Apple Git-101)\n\n" }, { "path": "aegir/patches/7-core/SA-CORE-2018-006-D7.patch", "content": "From ee301cf5ebff3534b59fcece583b3a0e4f094f15 Mon Sep 17 00:00:00 2001\nFrom: Lee Rowlands \nDate: Thu, 18 Oct 2018 08:40:19 +1000\nSubject: [PATCH] SA-CORE-2018-006 by alexpott, attilatilman, bkosborne, catch,\n bonus, Wim Leers, Sam152, Berdir, Damien Tournoud, Dave Reid, Kova101,\n David_Rothstein, dawehner, dsnopek, samuel.mortenson, stefan.r, tedbow, xjm,\n timmillwood, pwolanin, njbooher, dyates, effulgentsia, klausi, mlhess,\n larowlan\n\n---\n includes/common.inc | 5 ++++-\n modules/path/path.test | 30 +++++++++++++++++++++++++++++-\n modules/system/system.mail.inc | 34 +++++++++++++++++++++++++++++++++-\n 3 files changed, 66 insertions(+), 3 deletions(-)\n\ndiff --git a/includes/common.inc b/includes/common.inc\nindex f61d1eb0f2..a79a2f42ac 100644\n--- a/includes/common.inc\n+++ b/includes/common.inc\n@@ -2311,7 +2311,10 @@ function url($path = NULL, array $options = array()) {\n $language = isset($options['language']) && isset($options['language']->language) ? $options['language']->language : '';\n $alias = drupal_get_path_alias($original_path, $language);\n if ($alias != $original_path) {\n- $path = $alias;\n+ // Strip leading slashes from internal path aliases to prevent them\n+ // becoming external URLs without protocol. /example.com should not be\n+ // turned into //example.com.\n+ $path = ltrim($alias, '/');\n }\n }\n \ndiff --git a/modules/path/path.test b/modules/path/path.test\nindex edecff5cbb..f6131ce62b 100644\n--- a/modules/path/path.test\n+++ b/modules/path/path.test\n@@ -21,7 +21,7 @@ class PathTestCase extends DrupalWebTestCase {\n parent::setUp('path');\n \n // Create test user and login.\n- $web_user = $this->drupalCreateUser(array('create page content', 'edit own page content', 'administer url aliases', 'create url aliases'));\n+ $web_user = $this->drupalCreateUser(array('create page content', 'edit own page content', 'administer url aliases', 'create url aliases', 'access content overview'));\n $this->drupalLogin($web_user);\n }\n \n@@ -160,6 +160,34 @@ class PathTestCase extends DrupalWebTestCase {\n $this->drupalGet($edit['path[alias]']);\n $this->assertNoText($node1->title, 'Alias was successfully deleted.');\n $this->assertResponse(404);\n+\n+ // Create third test node.\n+ $node3 = $this->drupalCreateNode();\n+\n+ // Create an invalid alias with a leading slash and verify that the slash\n+ // is removed when the link is generated. This ensures that URL aliases\n+ // cannot be used to inject external URLs.\n+ // @todo The user interface should either display an error message or\n+ // automatically trim these invalid aliases, rather than allowing them to\n+ // be silently created, at which point the functional aspects of this\n+ // test will need to be moved elsewhere and switch to using a\n+ // programmatically-created alias instead.\n+ $alias = $this->randomName(8);\n+ $edit = array('path[alias]' => '/' . $alias);\n+ $this->drupalPost('node/' . $node3->nid . '/edit', $edit, t('Save'));\n+ $this->drupalGet('admin/content');\n+ // This checks the link href before clicking it, rather than using\n+ // DrupalWebTestCase::assertUrl() after clicking it, because the test\n+ // browser does not always preserve the correct number of slashes in the\n+ // URL when it visits internal links; using DrupalWebTestCase::assertUrl()\n+ // would actually make the test pass unconditionally on the testbot (or\n+ // anywhere else where Drupal is installed in a subdirectory).\n+ $link_xpath = $this->xpath('//a[normalize-space(text())=:label]', array(':label' => $node3->title));\n+ $link_href = (string) $link_xpath[0]['href'];\n+ $link_prefix = base_path() . (variable_get('clean_url', 0) ? '' : '?q=');\n+ $this->assertEqual($link_href, $link_prefix . $alias);\n+ $this->clickLink($node3->title);\n+ $this->assertResponse(404);\n }\n \n /**\ndiff --git a/modules/system/system.mail.inc b/modules/system/system.mail.inc\nindex 443e574001..9a17f55f6f 100644\n--- a/modules/system/system.mail.inc\n+++ b/modules/system/system.mail.inc\n@@ -70,7 +70,9 @@ class DefaultMailSystem implements MailSystemInterface {\n // hosts. The return value of this method will still indicate whether mail\n // was sent successfully.\n if (!isset($_SERVER['WINDIR']) && strpos($_SERVER['SERVER_SOFTWARE'], 'Win32') === FALSE) {\n- if (isset($message['Return-Path']) && !ini_get('safe_mode')) {\n+ // We validate the return path, unless it is equal to the site mail, which\n+ // we assume to be safe.\n+ if (isset($message['Return-Path']) && !ini_get('safe_mode') && (variable_get('site_mail', ini_get('sendmail_from')) === $message['Return-Path'] || self::_isShellSafe($message['Return-Path']))) {\n // On most non-Windows systems, the \"-f\" option to the sendmail command\n // is used to set the Return-Path. There is no space between -f and\n // the value of the return path.\n@@ -109,6 +111,36 @@ class DefaultMailSystem implements MailSystemInterface {\n }\n return $mail_result;\n }\n+\n+ /**\n+ * Disallows potentially unsafe shell characters.\n+ *\n+ * Functionally similar to PHPMailer::isShellSafe() which resulted from\n+ * CVE-2016-10045. Note that escapeshellarg and escapeshellcmd are inadequate\n+ * for this purpose.\n+ *\n+ * @param string $string\n+ * The string to be validated.\n+ *\n+ * @return bool\n+ * True if the string is shell-safe.\n+ *\n+ * @see https://github.com/PHPMailer/PHPMailer/issues/924\n+ * @see https://github.com/PHPMailer/PHPMailer/blob/v5.2.21/class.phpmailer.php#L1430\n+ *\n+ * @todo Rename to ::isShellSafe() and/or discuss whether this is the correct\n+ * location for this helper.\n+ */\n+ protected static function _isShellSafe($string) {\n+ if (escapeshellcmd($string) !== $string || !in_array(escapeshellarg($string), array(\"'$string'\", \"\\\"$string\\\"\"))) {\n+ return FALSE;\n+ }\n+ if (preg_match('/[^a-zA-Z0-9@_\\-.]/', $string) !== 0) {\n+ return FALSE;\n+ }\n+ return TRUE;\n+ }\n+\n }\n \n /**\n-- \n2.14.1\n\n" }, { "path": "aegir/patches/7-core/drupal-2656548-21-php7.patch", "content": "diff --git a/includes/common.inc b/includes/common.inc\nindex c6303ef..0d7e27a 100644\n--- a/includes/common.inc\n+++ b/includes/common.inc\n@@ -3025,6 +3025,7 @@ function drupal_add_html_head_link($attributes, $header = FALSE) {\n */\n function drupal_add_css($data = NULL, $options = NULL) {\n $css = &drupal_static(__FUNCTION__, array());\n+ $count = &drupal_static(__FUNCTION__ . '_count', 0);\n \n // Construct the options, taking the defaults into consideration.\n if (isset($options)) {\n@@ -3060,7 +3061,7 @@ function drupal_add_css($data = NULL, $options = NULL) {\n }\n \n // Always add a tiny value to the weight, to conserve the insertion order.\n- $options['weight'] += count($css) / 1000;\n+ $options['weight'] += $count / 1000;\n \n // Add the data to the CSS array depending on the type.\n switch ($options['type']) {\n@@ -3068,11 +3069,13 @@ function drupal_add_css($data = NULL, $options = NULL) {\n // For inline stylesheets, we don't want to use the $data as the array\n // key as $data could be a very long string of CSS.\n $css[] = $options;\n+ $count++;\n break;\n default:\n // Local and external files must keep their name as the associative key\n // so the same CSS file is not be added twice.\n $css[$data] = $options;\n+ $count++;\n }\n }\n \ndiff --git a/includes/session.inc b/includes/session.inc\nindex 84d1983..efaf839 100644\n--- a/includes/session.inc\n+++ b/includes/session.inc\n@@ -425,7 +425,7 @@ function _drupal_session_destroy($sid) {\n \n // Nothing to do if we are not allowed to change the session.\n if (!drupal_save_session()) {\n- return;\n+ return TRUE;\n }\n \n // Delete session data.\n@@ -446,6 +446,8 @@ function _drupal_session_destroy($sid) {\n elseif (variable_get('https', FALSE)) {\n _drupal_session_delete_cookie('S' . session_name(), TRUE);\n }\n+\n+ return TRUE;\n }\n \n /**\ndiff --git a/modules/filter/filter.test b/modules/filter/filter.test\nindex d558fa3..b0a2a3f 100644\n--- a/modules/filter/filter.test\n+++ b/modules/filter/filter.test\n@@ -1120,8 +1120,12 @@ class FilterUnitTestCase extends DrupalUnitTestCase {\n $f = filter_xss(\"\", array('img'));\n $this->assertNoNormalized($f, 'cript', 'HTML scheme clearing evasion -- embedded nulls.');\n \n- $f = filter_xss('', array('img'));\n- $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- spaces and metacharacters before scheme.');\n+ // @fixme This dataset currently fails under 5.4 because of\n+ // https://www.drupal.org/node/1210798. Restore after its fixed.\n+ if (version_compare(PHP_VERSION, '5.4.0', '<')) {\n+ $f = filter_xss('', array('img'));\n+ $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- spaces and metacharacters before scheme.');\n+ }\n \n $f = filter_xss('', array('img'));\n $this->assertNoNormalized($f, 'vbscript', 'HTML scheme clearing evasion -- another scheme.');\ndiff --git a/modules/image/image.module b/modules/image/image.module\nindex dab8836..2122e05 100644\n--- a/modules/image/image.module\n+++ b/modules/image/image.module\n@@ -1413,3 +1413,21 @@ function image_filter_keyword($value, $current_pixels, $new_pixels) {\n function _image_effect_definitions_sort($a, $b) {\n return strcasecmp($a['name'], $b['name']);\n }\n+\n+/**\n+ * Converts a 24 bit RGB or 32 bit ARGB value to an RGBA array.\n+ *\n+ * @param int $argb\n+ * The color code to convert.\n+ *\n+ * @return array\n+ * An array containing the values for 'red', 'green', 'blue', 'alpha'.\n+ */\n+function _image_dec_to_rgba($argb) {\n+ return array(\n+ 'red' => $argb >> 16 & 0xFF,\n+ 'green' => $argb >> 8 & 0xFF,\n+ 'blue' => $argb & 0xFF,\n+ 'alpha' => $argb >> 24 & 0xFF,\n+ );\n+}\ndiff --git a/modules/openid/openid.test b/modules/openid/openid.test\nindex 5f7493a..d0708e0 100644\n--- a/modules/openid/openid.test\n+++ b/modules/openid/openid.test\n@@ -680,11 +680,11 @@ class OpenIDTestCase extends DrupalWebTestCase {\n * Test _openid_dh_XXX_to_XXX() functions.\n */\n function testConversion() {\n- $this->assertEqual(_openid_dh_long_to_base64('12345678901234567890123456789012345678901234567890'), 'CHJ/Y2mq+DyhUCZ0evjH8ZbOPwrS', '_openid_dh_long_to_base64() returned expected result.');\n- $this->assertEqual(_openid_dh_base64_to_long('BsH/g8Nrpn2dtBSdu/sr1y8hxwyx'), '09876543210987654321098765432109876543210987654321', '_openid_dh_base64_to_long() returned expected result.');\n+ $this->assertIdentical(_openid_dh_long_to_base64('12345678901234567890123456789012345678901234567890'), 'CHJ/Y2mq+DyhUCZ0evjH8ZbOPwrS', '_openid_dh_long_to_base64() returned expected result.');\n+ $this->assertIdentical(_openid_dh_base64_to_long('BsH/g8Nrpn2dtBSdu/sr1y8hxwyx'), '9876543210987654321098765432109876543210987654321', '_openid_dh_base64_to_long() returned expected result.');\n \n- $this->assertEqual(_openid_dh_long_to_binary('12345678901234567890123456789012345678901234567890'), \"\\x08r\\x7fci\\xaa\\xf8<\\xa1P&tz\\xf8\\xc7\\xf1\\x96\\xce?\\x0a\\xd2\", '_openid_dh_long_to_binary() returned expected result.');\n- $this->assertEqual(_openid_dh_binary_to_long(\"\\x06\\xc1\\xff\\x83\\xc3k\\xa6}\\x9d\\xb4\\x14\\x9d\\xbb\\xfb+\\xd7/!\\xc7\\x0c\\xb1\"), '09876543210987654321098765432109876543210987654321', '_openid_dh_binary_to_long() returned expected result.');\n+ $this->assertIdentical(_openid_dh_long_to_binary('12345678901234567890123456789012345678901234567890'), \"\\x08r\\x7fci\\xaa\\xf8<\\xa1P&tz\\xf8\\xc7\\xf1\\x96\\xce?\\x0a\\xd2\", '_openid_dh_long_to_binary() returned expected result.');\n+ $this->assertIdentical(_openid_dh_binary_to_long(\"\\x06\\xc1\\xff\\x83\\xc3k\\xa6}\\x9d\\xb4\\x14\\x9d\\xbb\\xfb+\\xd7/!\\xc7\\x0c\\xb1\"), '9876543210987654321098765432109876543210987654321', '_openid_dh_binary_to_long() returned expected result.');\n }\n \n /**\ndiff --git a/modules/rdf/rdf.test b/modules/rdf/rdf.test\nindex 22c41f1..7168d83 100644\n--- a/modules/rdf/rdf.test\n+++ b/modules/rdf/rdf.test\n@@ -304,7 +304,7 @@ class RdfMappingDefinitionTestCase extends TaxonomyWebTestCase {\n $blog_title = $this->xpath(\"//div[@about='$url']/span[@property='dc:title' and @content='$node->title']\");\n $blog_meta = $this->xpath(\"//div[(@about='$url') and (@typeof='sioct:Weblog')]//span[contains(@property, 'dc:date') and contains(@property, 'dc:created') and @datatype='xsd:dateTime' and @content='$isoDate']\");\n $this->assertTrue(!empty($blog_title), 'Property dc:title is present in meta tag.');\n- $this->assertTrue(!empty($blog_meta), 'RDF type is present on post. Properties dc:date and dc:created are present on post date.');\n+ // $this->assertTrue(!empty($blog_meta), 'RDF type is present on post. Properties dc:date and dc:created are present on post date.');\n }\n \n /**\ndiff --git a/modules/simpletest/drupal_web_test_case.php b/modules/simpletest/drupal_web_test_case.php\nindex aed66fa..a0ad946 100644\n--- a/modules/simpletest/drupal_web_test_case.php\n+++ b/modules/simpletest/drupal_web_test_case.php\n@@ -2760,7 +2760,7 @@ class DrupalWebTestCase extends DrupalTestCase {\n $path = substr($path, $length);\n }\n // Ensure that we have an absolute path.\n- if ($path[0] !== '/') {\n+ if ($path === '' || $path[0] !== '/') {\n $path = '/' . $path;\n }\n // Finally, prepend the $base_url.\ndiff --git a/modules/simpletest/tests/image.test b/modules/simpletest/tests/image.test\nindex 8497022..f742cda 100644\n--- a/modules/simpletest/tests/image.test\n+++ b/modules/simpletest/tests/image.test\n@@ -419,7 +419,20 @@ class ImageToolkitGdTestCase extends DrupalWebTestCase {\n $correct_dimensions_object = TRUE;\n $correct_colors = TRUE;\n \n- // Check the real dimensions of the image first.\n+ // PHP 5.5 GD bug: https://bugs.php.net/bug.php?id=65148. PHP 5.5 GD\n+ // rotates differently then it did in PHP 5.4 resulting in different\n+ // dimensions then what math teaches us. For the test images, the\n+ // dimensions will be 1 pixel smaller in both dimensions (though other\n+ // tests have shown a difference of 0 to 3 pixels in both dimensions.\n+ // @todo: if and when the PHP bug gets solved, add an upper limit\n+ // version check.\n+ // @todo: in [#1551686] the dimension calculations for rotation are\n+ // reworked. That issue should also check if these tests can be made\n+ // more robust.\n+ if (version_compare(PHP_VERSION, '5.5', '>=') && $values['function'] === 'rotate' && $values['arguments'][0] % 90 != 0) {\n+ $values['height']--;\n+ $values['width']--;\n+ }\n if (imagesy($image->resource) != $values['height'] || imagesx($image->resource) != $values['width']) {\n $correct_dimensions_real = FALSE;\n }\ndiff --git a/modules/simpletest/tests/upgrade/drupal-6.filled.database.php b/modules/simpletest/tests/upgrade/drupal-6.filled.database.php\nindex a916281..5d7ce06 100644\n--- a/modules/simpletest/tests/upgrade/drupal-6.filled.database.php\n+++ b/modules/simpletest/tests/upgrade/drupal-6.filled.database.php\n@@ -19919,7 +19919,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '1',\n 'name' => 'vocabulary 1 (i=0)',\n 'description' => 'description of vocabulary 1 (i=0)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 1 (i=0)',\n 'relations' => '1',\n 'hierarchy' => '0',\n 'multiple' => '0',\n@@ -19932,7 +19932,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '2',\n 'name' => 'vocabulary 2 (i=1)',\n 'description' => 'description of vocabulary 2 (i=1)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 2 (i=1)',\n 'relations' => '1',\n 'hierarchy' => '1',\n 'multiple' => '1',\n@@ -19945,7 +19945,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '3',\n 'name' => 'vocabulary 3 (i=2)',\n 'description' => 'description of vocabulary 3 (i=2)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 3 (i=2)',\n 'relations' => '1',\n 'hierarchy' => '2',\n 'multiple' => '0',\n@@ -19958,7 +19958,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '4',\n 'name' => 'vocabulary 4 (i=3)',\n 'description' => 'description of vocabulary 4 (i=3)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 4 (i=3)',\n 'relations' => '1',\n 'hierarchy' => '0',\n 'multiple' => '1',\n@@ -19971,7 +19971,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '5',\n 'name' => 'vocabulary 5 (i=4)',\n 'description' => 'description of vocabulary 5 (i=4)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 5 (i=4)',\n 'relations' => '1',\n 'hierarchy' => '1',\n 'multiple' => '0',\n@@ -19984,7 +19984,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '6',\n 'name' => 'vocabulary 6 (i=5)',\n 'description' => 'description of vocabulary 6 (i=5)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 6 (i=5)',\n 'relations' => '1',\n 'hierarchy' => '2',\n 'multiple' => '1',\n@@ -19997,7 +19997,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '7',\n 'name' => 'vocabulary 7 (i=6)',\n 'description' => 'description of vocabulary 7 (i=6)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 7 (i=6)',\n 'relations' => '1',\n 'hierarchy' => '0',\n 'multiple' => '0',\n@@ -20010,7 +20010,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '8',\n 'name' => 'vocabulary 8 (i=7)',\n 'description' => 'description of vocabulary 8 (i=7)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 8 (i=7)',\n 'relations' => '1',\n 'hierarchy' => '1',\n 'multiple' => '1',\n@@ -20023,7 +20023,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '9',\n 'name' => 'vocabulary 9 (i=8)',\n 'description' => 'description of vocabulary 9 (i=8)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 8 (i=8)',\n 'relations' => '1',\n 'hierarchy' => '2',\n 'multiple' => '0',\n@@ -20036,7 +20036,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '10',\n 'name' => 'vocabulary 10 (i=9)',\n 'description' => 'description of vocabulary 10 (i=9)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 10 (i=9)',\n 'relations' => '1',\n 'hierarchy' => '0',\n 'multiple' => '1',\n@@ -20049,7 +20049,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '11',\n 'name' => 'vocabulary 11 (i=10)',\n 'description' => 'description of vocabulary 11 (i=10)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 11 (i=10)',\n 'relations' => '1',\n 'hierarchy' => '1',\n 'multiple' => '0',\n@@ -20062,7 +20062,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '12',\n 'name' => 'vocabulary 12 (i=11)',\n 'description' => 'description of vocabulary 12 (i=11)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 12 (i=11)',\n 'relations' => '1',\n 'hierarchy' => '2',\n 'multiple' => '1',\n@@ -20075,7 +20075,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '13',\n 'name' => 'vocabulary 13 (i=12)',\n 'description' => 'description of vocabulary 13 (i=12)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 13 (i=12)',\n 'relations' => '1',\n 'hierarchy' => '0',\n 'multiple' => '0',\n@@ -20088,7 +20088,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '14',\n 'name' => 'vocabulary 14 (i=13)',\n 'description' => 'description of vocabulary 14 (i=13)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 14 (i=13)',\n 'relations' => '1',\n 'hierarchy' => '1',\n 'multiple' => '1',\n@@ -20101,7 +20101,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '15',\n 'name' => 'vocabulary 15 (i=14)',\n 'description' => 'description of vocabulary 15 (i=14)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 15 (i=14)',\n 'relations' => '1',\n 'hierarchy' => '2',\n 'multiple' => '0',\n@@ -20114,7 +20114,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '16',\n 'name' => 'vocabulary 16 (i=15)',\n 'description' => 'description of vocabulary 16 (i=15)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 16 (i=15)',\n 'relations' => '1',\n 'hierarchy' => '0',\n 'multiple' => '1',\n@@ -20127,7 +20127,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '17',\n 'name' => 'vocabulary 17 (i=16)',\n 'description' => 'description of vocabulary 17 (i=16)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 17 (i=16)',\n 'relations' => '1',\n 'hierarchy' => '1',\n 'multiple' => '0',\n@@ -20140,7 +20140,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '18',\n 'name' => 'vocabulary 18 (i=17)',\n 'description' => 'description of vocabulary 18 (i=17)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 18 (i=17)',\n 'relations' => '1',\n 'hierarchy' => '2',\n 'multiple' => '1',\n@@ -20153,7 +20153,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '19',\n 'name' => 'vocabulary 19 (i=18)',\n 'description' => 'description of vocabulary 19 (i=18)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 19 (i=18)',\n 'relations' => '1',\n 'hierarchy' => '0',\n 'multiple' => '0',\n@@ -20166,7 +20166,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '20',\n 'name' => 'vocabulary 20 (i=19)',\n 'description' => 'description of vocabulary 20 (i=19)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 20 (i=19)',\n 'relations' => '1',\n 'hierarchy' => '1',\n 'multiple' => '1',\n@@ -20179,7 +20179,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '21',\n 'name' => 'vocabulary 21 (i=20)',\n 'description' => 'description of vocabulary 21 (i=20)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 21 (i=20)',\n 'relations' => '1',\n 'hierarchy' => '2',\n 'multiple' => '0',\n@@ -20192,7 +20192,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '22',\n 'name' => 'vocabulary 22 (i=21)',\n 'description' => 'description of vocabulary 22 (i=21)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 22 (i=21)',\n 'relations' => '1',\n 'hierarchy' => '0',\n 'multiple' => '1',\n@@ -20205,7 +20205,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '23',\n 'name' => 'vocabulary 23 (i=22)',\n 'description' => 'description of vocabulary 23 (i=22)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 23 (i=22)',\n 'relations' => '1',\n 'hierarchy' => '1',\n 'multiple' => '0',\n@@ -20218,7 +20218,7 @@ db_insert('vocabulary')->fields(array(\n 'vid' => '24',\n 'name' => 'vocabulary 24 (i=23)',\n 'description' => 'description of vocabulary 24 (i=23)',\n- 'help' => '',\n+ 'help' => 'help for vocabulary 24 (i=23)',\n 'relations' => '1',\n 'hierarchy' => '2',\n 'multiple' => '1',\ndiff --git a/modules/simpletest/tests/upgrade/upgrade.taxonomy.test b/modules/simpletest/tests/upgrade/upgrade.taxonomy.test\nindex 58a4d5c..51402ed 100644\n--- a/modules/simpletest/tests/upgrade/upgrade.taxonomy.test\n+++ b/modules/simpletest/tests/upgrade/upgrade.taxonomy.test\n@@ -74,9 +74,10 @@ class UpgradePathTaxonomyTestCase extends UpgradePathTestCase {\n $this->assertEqual($voc_keys, $inst_keys, 'Node type page has instances for every vocabulary.');\n \n // Ensure instance variables are getting through.\n- foreach ($instances as $instance) {\n- $this->assertTrue(isset($instance['required']), 'The required setting was preserved during the upgrade path.');\n- $this->assertTrue($instance['description'], 'The description was preserved during the upgrade path');\n+ foreach (array_unique($instances) as $instance) {\n+ $field_instance = field_info_instance('node', $instance, 'page');\n+ $this->assertTrue(isset($field_instance['required']), 'The required setting was preserved during the upgrade path.');\n+ $this->assertTrue($field_instance['description'], 'The description was preserved during the upgrade path');\n }\n \n // Node type 'story' was not explicitly in $vocabulary->nodes but\ndiff --git a/modules/system/image.gd.inc b/modules/system/image.gd.inc\nindex 913b0de..28ab3f0 100644\n--- a/modules/system/image.gd.inc\n+++ b/modules/system/image.gd.inc\n@@ -98,10 +98,10 @@ function image_gd_resize(stdClass $image, $width, $height) {\n * $image->info['height'] values will be modified by this call.\n * @param $degrees\n * The number of (clockwise) degrees to rotate the image.\n- * @param $background\n- * An hexadecimal integer specifying the background color to use for the\n- * uncovered area of the image after the rotation. E.g. 0x000000 for black,\n- * 0xff00ff for magenta, and 0xffffff for white. For images that support\n+ * @param int $background\n+ * An 24 bit or 32 bit ARGB value specifying the background color to use for\n+ * the uncovered area of the image after the rotation. E.g. 0 for black,\n+ * 16711935 for fuchsia, and 16777215 for white. For images that support\n * transparency, this will default to transparent. Otherwise it will\n * be white.\n * @return\n@@ -116,38 +116,52 @@ function image_gd_rotate(stdClass $image, $degrees, $background = NULL) {\n return FALSE;\n }\n \n- $width = $image->info['width'];\n- $height = $image->info['height'];\n+ // PHP 5.5 GD bug: https://bugs.php.net/bug.php?id=65148: To prevent buggy\n+ // behavior on negative multiples of 90 degrees we convert any negative\n+ // angle to a positive one between 0 and 360 degrees.\n+ $degrees -= floor($degrees / 360) * 360;\n \n- // Convert the hexadecimal background value to a color index value.\n if (isset($background)) {\n- $rgb = array();\n- for ($i = 16; $i >= 0; $i -= 8) {\n- $rgb[] = (($background >> $i) & 0xFF);\n- }\n- $background = imagecolorallocatealpha($image->resource, $rgb[0], $rgb[1], $rgb[2], 0);\n+ $background = _image_dec_to_rgba($background);\n+ $background['alpha'] /= 2;\n }\n- // Set the background color as transparent if $background is NULL.\n else {\n- // Get the current transparent color.\n- $background = imagecolortransparent($image->resource);\n-\n- // If no transparent colors, use white.\n- if ($background == 0) {\n- $background = imagecolorallocatealpha($image->resource, 255, 255, 255, 0);\n- }\n+ // Background color is not specified: use transparent white as background.\n+ $background = array('red' => 255, 'green' => 255, 'blue' => 255, 'alpha' => 127);\n }\n \n+ // Store the color index for the background as that is what GD uses.\n+ $background_idx = imagecolorallocatealpha($image->resource, $background['red'], $background['green'], $background['blue'], $background['alpha']);\n+\n // Images are assigned a new color palette when rotating, removing any\n // transparency flags. For GIF images, keep a record of the transparent color.\n if ($image->info['extension'] == 'gif') {\n- $transparent_index = imagecolortransparent($image->resource);\n- if ($transparent_index != 0) {\n- $transparent_gif_color = imagecolorsforindex($image->resource, $transparent_index);\n+ // GIF does not work with a transparency channel, but can define 1 color\n+ // in its palette to act as transparent.\n+\n+ // Get the current transparent color, if any.\n+ $gif_transparent_id = imagecolortransparent($image->resource);\n+ if ($gif_transparent_id !== -1) {\n+ // The gif already has a transparent color set: remember it to set it on\n+ // the rotated image as well.\n+ $transparent_gif_color = imagecolorsforindex($image->resource, $gif_transparent_id);\n+\n+ if ($background['alpha'] >= 127) {\n+ // We want a transparent background: use the color already set to act\n+ // as transparent, as background.\n+ $background_idx = $gif_transparent_id;\n+ }\n+ }\n+ else {\n+ // The gif does not currently have a transparent color set.\n+ if ($background['alpha'] >= 127) {\n+ // But as the background is transparent, it should get one.\n+ $transparent_gif_color = $background;\n+ }\n }\n }\n \n- $image->resource = imagerotate($image->resource, 360 - $degrees, $background);\n+ $image->resource = imagerotate($image->resource, 360 - $degrees, $background_idx);\n \n // GIFs need to reassign the transparent color after performing the rotate.\n if (isset($transparent_gif_color)) {\ndiff --git a/modules/taxonomy/taxonomy.install b/modules/taxonomy/taxonomy.install\nindex ebd0084..60a9b5d 100644\n--- a/modules/taxonomy/taxonomy.install\n+++ b/modules/taxonomy/taxonomy.install\n@@ -492,6 +492,7 @@ function taxonomy_update_7004() {\n 'bundle' => $bundle->type,\n 'settings' => array(),\n 'description' => 'Debris left over after upgrade from Drupal 6',\n+ 'required' => FALSE,\n 'widget' => array(\n 'type' => 'taxonomy_autocomplete',\n 'module' => 'taxonomy',\n@@ -557,7 +558,7 @@ function taxonomy_update_7005(&$sandbox) {\n // of term references stored so far for the current revision, which\n // provides the delta value for each term reference data insert. The\n // deltas are reset for each new revision.\n- \n+\n $conditions = array(\n 'type' => 'taxonomy_term_reference',\n 'deleted' => 0,\ndiff --git a/modules/tracker/tracker.test b/modules/tracker/tracker.test\nindex 8a48ea8..e472978 100644\n--- a/modules/tracker/tracker.test\n+++ b/modules/tracker/tracker.test\n@@ -151,7 +151,6 @@ class TrackerTest extends DrupalWebTestCase {\n \n $node = $this->drupalCreateNode(array(\n 'comment' => 2,\n- 'title' => array(LANGUAGE_NONE => array(array('value' => $this->randomName(8)))),\n ));\n \n // Add a comment to the page.\ndiff --git a/modules/trigger/trigger.test b/modules/trigger/trigger.test\nindex 9e5f114..09169b7 100644\n--- a/modules/trigger/trigger.test\n+++ b/modules/trigger/trigger.test\n@@ -85,7 +85,7 @@ class TriggerContentTestCase extends TriggerWebTestCase {\n $this->assertRaw(t('!post %title has been created.', array('!post' => 'Basic page', '%title' => $edit[\"title\"])), 'Make sure the Basic page has actually been created');\n // Action should have been fired.\n $loaded_node = $this->drupalGetNodeByTitle($edit[\"title\"]);\n- $this->assertTrue($loaded_node->$info['property'] == $info['expected'], format_string('Make sure the @action action fired.', array('@action' => $info['name'])));\n+ $this->assertTrue($loaded_node->{$info['property']} == $info['expected'], format_string('Make sure the @action action fired.', array('@action' => $info['name'])));\n // Leave action assigned for next test\n \n // There should be an error when the action is assigned to the trigger\n" }, { "path": "aegir/patches/7-core/patch_commit_b8a8a84ea9b3.patch", "content": "diff --git a/modules/file/file.install b/modules/file/file.install\nindex 47ee4fd0014b3f29c87da274968a1d969d61224a..33334b84aecab28299516554bffbf196c063ac93 100644\n--- a/modules/file/file.install\n+++ b/modules/file/file.install\n@@ -53,10 +53,29 @@ function file_requirements($phase) {\n \n // Check the server's ability to indicate upload progress.\n if ($phase == 'runtime') {\n- $implementation = file_progress_implementation();\n- $apache = strpos($_SERVER['SERVER_SOFTWARE'], 'Apache') !== FALSE;\n- $fastcgi = strpos($_SERVER['SERVER_SOFTWARE'], 'mod_fastcgi') !== FALSE || strpos($_SERVER[\"SERVER_SOFTWARE\"], 'mod_fcgi') !== FALSE;\n $description = NULL;\n+\n+ // Test the web server identity.\n+ if (isset($_SERVER['SERVER_SOFTWARE']) && preg_match(\"/(?:ApacheSolaris|Nginx)/i\", $_SERVER['SERVER_SOFTWARE'])) {\n+ $is_nginx = TRUE;\n+ }\n+ else {\n+ $is_nginx = FALSE;\n+ }\n+\n+ if ($is_nginx) {\n+ // It is running on BOA with PECL uploadprogress installed and Nginx\n+ // so let's Make-Drupal-Happy-With-Fake-Apache-Identity.\n+ $apache = TRUE;\n+ $implementation = 'uploadprogress';\n+ $fastcgi = FALSE;\n+ }\n+ else {\n+ $implementation = file_progress_implementation();\n+ $apache = strpos($_SERVER['SERVER_SOFTWARE'], 'Apache') !== FALSE;\n+ $fastcgi = strpos($_SERVER['SERVER_SOFTWARE'], 'mod_fastcgi') !== FALSE || strpos($_SERVER[\"SERVER_SOFTWARE\"], 'mod_fcgi') !== FALSE;\n+ }\n+\n if (!$apache) {\n $value = t('Not enabled');\n $description = t('Your server is not capable of displaying file upload progress. File upload progress requires an Apache server running PHP with mod_php.');\ndiff --git a/modules/system/system.install b/modules/system/system.install\nindex 54092316522e332ca53bd6f3c6340dd8b9fcef57..fcce12f08ad14ef3bd407800a99a8be7dfea7813 100644\n--- a/modules/system/system.install\n+++ b/modules/system/system.install\n@@ -264,14 +264,17 @@ function system_requirements($phase) {\n \n // Test the web server identity.\n if (isset($_SERVER['SERVER_SOFTWARE']) && preg_match(\"/(?:ApacheSolaris|Nginx)/i\", $_SERVER['SERVER_SOFTWARE'])) {\n- $is_nginx = TRUE; // Skip this on BOA since .htaccess is never used in Nginx.\n+ // Skip this on BOA and Nginx since .htaccess is never used in Nginx.\n+ $is_nginx = TRUE;\n }\n elseif (!isset($_SERVER['SERVER_SOFTWARE'])) {\n- $is_nginx = TRUE; // Skip this on BOA since .htaccess is never used in Nginx.\n+ // Skip this in Aegir backend where SERVER_SOFTWARE is not set, since .htaccess is never used in Nginx.\n+ $is_nginx = TRUE;\n }\n else {\n $is_nginx = FALSE;\n }\n+\n // Test the contents of the .htaccess files.\n if ($phase == 'runtime' && !$is_nginx) {\n // Try to write the .htaccess files first, to prevent false alarms in case\n" }, { "path": "aegir/patches/8-core/0001-Symlink-core-support-test.patch", "content": "From fd51a9cbcb28a8b540e8f225d38735cece29ccf2 Mon Sep 17 00:00:00 2001\nFrom: Barracuda Team \nDate: Mon, 28 Mar 2016 17:12:22 +0200\nSubject: [PATCH] Symlink core support test\n\n---\n core/authorize.php | 2 +-\n core/includes/file.inc | 48 ++++++++++++++++++++++------------\n core/includes/install.core.inc | 2 +-\n core/install.php | 2 +-\n core/lib/Drupal/Core/DrupalKernel.php | 7 ++++-\n core/modules/statistics/statistics.php | 4 +--\n core/rebuild.php | 2 +-\n 7 files changed, 43 insertions(+), 24 deletions(-)\n\ndiff --git a/core/authorize.php b/core/authorize.php\nindex fe374fa..32b0ecc 100644\n--- a/core/authorize.php\n+++ b/core/authorize.php\n@@ -28,7 +28,7 @@\n use Drupal\\Core\\Site\\Settings;\n \n // Change the directory to the Drupal root.\n-chdir('..');\n+chdir(dirname(dirname($_SERVER['SCRIPT_FILENAME'])));\n \n $autoloader = require_once 'autoload.php';\n \ndiff --git a/core/includes/file.inc b/core/includes/file.inc\nindex b9c217b..9a4eea2 100644\n--- a/core/includes/file.inc\n+++ b/core/includes/file.inc\n@@ -1134,28 +1134,42 @@ function file_directory_temp() {\n * A string containing the path to the temporary directory.\n */\n function file_directory_os_temp() {\n- $directories = array();\n+ static $this_temp_dir;\n \n- // Has PHP been set with an upload_tmp_dir?\n- if (ini_get('upload_tmp_dir')) {\n- $directories[] = ini_get('upload_tmp_dir');\n+ if (preg_match(\"/^\\/home/\", getenv('HOME')) || preg_match(\"/^\\/data\\/disk/\", getenv('HOME')) || preg_match(\"/^\\/var\\/aegir/\", getenv('HOME'))) {\n+ $this_temp_dir = getenv('HOME') . \"/.tmp\";\n }\n-\n- // Operating system specific dirs.\n- if (substr(PHP_OS, 0, 3) == 'WIN') {\n- $directories[] = 'c:\\\\windows\\\\temp';\n- $directories[] = 'c:\\\\winnt\\\\temp';\n- }\n- else {\n- $directories[] = '/tmp';\n+ if (!is_dir($this_temp_dir)) {\n+ $this_temp_dir = FALSE;\n }\n- // PHP may be able to find an alternative tmp directory.\n- $directories[] = sys_get_temp_dir();\n \n- foreach ($directories as $directory) {\n- if (is_dir($directory) && is_writable($directory)) {\n- return $directory;\n+ if (!isset($this_temp_dir)) {\n+ $directories = array();\n+\n+ // Has PHP been set with an upload_tmp_dir?\n+ if (ini_get('upload_tmp_dir')) {\n+ $directories[] = ini_get('upload_tmp_dir');\n+ }\n+\n+ // Operating system specific dirs.\n+ if (substr(PHP_OS, 0, 3) == 'WIN') {\n+ $directories[] = 'c:\\\\windows\\\\temp';\n+ $directories[] = 'c:\\\\winnt\\\\temp';\n }\n+ else {\n+ $directories[] = '/tmp';\n+ }\n+ // PHP may be able to find an alternative tmp directory.\n+ $directories[] = sys_get_temp_dir();\n+\n+ foreach ($directories as $directory) {\n+ if (is_dir($directory) && is_writable($directory)) {\n+ return $directory;\n+ }\n+ }\n+ }\n+ else {\n+ return $this_temp_dir;\n }\n return FALSE;\n }\ndiff --git a/core/includes/install.core.inc b/core/includes/install.core.inc\nindex 7b66911..38ef83a 100644\n--- a/core/includes/install.core.inc\n+++ b/core/includes/install.core.inc\n@@ -319,7 +319,7 @@ function install_begin_request($class_loader, &$install_state) {\n }\n \n $site_path = DrupalKernel::findSitePath($request, FALSE);\n- Settings::initialize(dirname(dirname(__DIR__)), $site_path, $class_loader);\n+ Settings::initialize(getcwd(), $site_path, $class_loader);\n \n // Ensure that procedural dependencies are loaded as early as possible,\n // since the error/exception handlers depend on them.\ndiff --git a/core/install.php b/core/install.php\nindex 50deb38..148afe5 100644\n--- a/core/install.php\n+++ b/core/install.php\n@@ -6,7 +6,7 @@\n */\n \n // Change the directory to the Drupal root.\n-chdir('..');\n+chdir(dirname(dirname($_SERVER['SCRIPT_FILENAME'])));\n // Store the Drupal root path.\n $root_path = realpath('');\n \ndiff --git a/core/lib/Drupal/Core/DrupalKernel.php b/core/lib/Drupal/Core/DrupalKernel.php\nindex 1fa3474..a033b5b 100644\n--- a/core/lib/Drupal/Core/DrupalKernel.php\n+++ b/core/lib/Drupal/Core/DrupalKernel.php\n@@ -884,7 +884,12 @@ public static function bootEnvironment() {\n }\n \n // Include our bootstrap file.\n- $core_root = dirname(dirname(dirname(__DIR__)));\n+ if (is_link(getcwd() . '/core')) {\n+ $core_root = getcwd() . '/core';\n+ }\n+ else {\n+ $core_root = dirname(dirname(dirname(__DIR__)));\n+ }\n require_once $core_root . '/includes/bootstrap.inc';\n \n // Enforce E_STRICT, but allow users to set levels not part of E_STRICT.\ndiff --git a/core/modules/statistics/statistics.php b/core/modules/statistics/statistics.php\nindex fe1b9fd..9054b29 100644\n--- a/core/modules/statistics/statistics.php\n+++ b/core/modules/statistics/statistics.php\n@@ -8,9 +8,9 @@\n use Drupal\\Core\\DrupalKernel;\n use Symfony\\Component\\HttpFoundation\\Request;\n \n-chdir('../../..');\n+chdir(dirname(dirname(dirname(dirname($_SERVER['SCRIPT_FILENAME'])))));\n \n-$autoloader = require_once 'autoload.php';\n+$autoloader = require_once getcwd() . '/vendor/autoload.php';\n \n $kernel = DrupalKernel::createFromRequest(Request::createFromGlobals(), $autoloader, 'prod');\n $kernel->boot();\ndiff --git a/core/rebuild.php b/core/rebuild.php\nindex ccd4976..5545c3f 100644\n--- a/core/rebuild.php\n+++ b/core/rebuild.php\n@@ -18,7 +18,7 @@\n use Symfony\\Component\\HttpFoundation\\Response;\n \n // Change the directory to the Drupal root.\n-chdir('..');\n+chdir(dirname(dirname($_SERVER['SCRIPT_FILENAME'])));\n \n $autoloader = require_once __DIR__ . '/../autoload.php';\n require_once __DIR__ . '/includes/utility.inc';\n-- \n2.2.1\n\n" }, { "path": "aegir/patches/8-core/SA-CORE-2018-002-D8.patch", "content": "From 5ac8738fa69df34a0635f0907d661b509ff9a28f Mon Sep 17 00:00:00 2001\nFrom: Lee Rowlands \nDate: Tue, 27 Mar 2018 19:58:42 +1000\nSubject: [PATCH] SA-CORE-2018-002 by Jasu_M, samuel.mortenson,\n David_Rothstein, xjm, mlhess, larowlan, pwolanin, alexpott, dsnopek, Pere\n Orga, cashwilliams, dawehner, tim.plunkett, drumm\n\n---\n core/lib/Drupal/Core/DrupalKernel.php | 7 ++\n core/lib/Drupal/Core/Security/RequestSanitizer.php | 99 ++++++++++++++++++++++\n 2 files changed, 106 insertions(+)\n create mode 100644 core/lib/Drupal/Core/Security/RequestSanitizer.php\n\ndiff --git a/core/lib/Drupal/Core/DrupalKernel.php b/core/lib/Drupal/Core/DrupalKernel.php\nindex 37ed0e97a6..fec1be9ad3 100644\n--- a/core/lib/Drupal/Core/DrupalKernel.php\n+++ b/core/lib/Drupal/Core/DrupalKernel.php\n@@ -20,6 +20,7 @@\n use Drupal\\Core\\Http\\TrustedHostsRequestFactory;\n use Drupal\\Core\\Installer\\InstallerRedirectTrait;\n use Drupal\\Core\\Language\\Language;\n+use Drupal\\Core\\Security\\RequestSanitizer;\n use Drupal\\Core\\Site\\Settings;\n use Drupal\\Core\\Test\\TestDatabase;\n use Symfony\\Cmf\\Component\\Routing\\RouteObjectInterface;\n@@ -542,6 +543,12 @@ public function loadLegacyIncludes() {\n * {@inheritdoc}\n */\n public function preHandle(Request $request) {\n+ // Sanitize the request.\n+ $request = RequestSanitizer::sanitize(\n+ $request,\n+ (array) Settings::get(RequestSanitizer::SANITIZE_WHITELIST, []),\n+ (bool) Settings::get(RequestSanitizer::SANITIZE_LOG, FALSE)\n+ );\n \n $this->loadLegacyIncludes();\n \ndiff --git a/core/lib/Drupal/Core/Security/RequestSanitizer.php b/core/lib/Drupal/Core/Security/RequestSanitizer.php\nnew file mode 100644\nindex 0000000000..8ba17b95cf\n--- /dev/null\n+++ b/core/lib/Drupal/Core/Security/RequestSanitizer.php\n@@ -0,0 +1,99 @@\n+attributes->get(self::SANITIZED, FALSE)) {\n+ // Process query string parameters.\n+ $get_sanitized_keys = [];\n+ $request->query->replace(static::stripDangerousValues($request->query->all(), $whitelist, $get_sanitized_keys));\n+ if ($log_sanitized_keys && !empty($get_sanitized_keys)) {\n+ trigger_error(sprintf('Potentially unsafe keys removed from query string parameters (GET): %s', implode(', ', $get_sanitized_keys)));\n+ }\n+\n+ // Request body parameters.\n+ $post_sanitized_keys = [];\n+ $request->request->replace(static::stripDangerousValues($request->request->all(), $whitelist, $post_sanitized_keys));\n+ if ($log_sanitized_keys && !empty($post_sanitized_keys)) {\n+ trigger_error(sprintf('Potentially unsafe keys removed from request body parameters (POST): %s', implode(', ', $post_sanitized_keys)));\n+ }\n+\n+ // Cookie parameters.\n+ $cookie_sanitized_keys = [];\n+ $request->cookies->replace(static::stripDangerousValues($request->cookies->all(), $whitelist, $cookie_sanitized_keys));\n+ if ($log_sanitized_keys && !empty($cookie_sanitized_keys)) {\n+ trigger_error(sprintf('Potentially unsafe keys removed from cookie parameters: %s', implode(', ', $cookie_sanitized_keys)));\n+ }\n+\n+ if (!empty($get_sanitized_keys) || !empty($post_sanitized_keys) || !empty($cookie_sanitized_keys)) {\n+ $request->overrideGlobals();\n+ }\n+ $request->attributes->set(self::SANITIZED, TRUE);\n+ }\n+ return $request;\n+ }\n+\n+ /**\n+ * Strips dangerous keys from $input.\n+ *\n+ * @param mixed $input\n+ * The input to sanitize.\n+ * @param string[] $whitelist\n+ * An array of keys to whitelist as safe.\n+ * @param string[] $sanitized_keys\n+ * An array of keys that have been removed.\n+ *\n+ * @return mixed\n+ * The sanitized input.\n+ */\n+ protected static function stripDangerousValues($input, array $whitelist, array &$sanitized_keys) {\n+ if (is_array($input)) {\n+ foreach ($input as $key => $value) {\n+ if ($key !== '' && $key[0] === '#' && !in_array($key, $whitelist, TRUE)) {\n+ unset($input[$key]);\n+ $sanitized_keys[] = $key;\n+ }\n+ else {\n+ $input[$key] = static::stripDangerousValues($input[$key], $whitelist, $sanitized_keys);\n+ }\n+ }\n+ }\n+ return $input;\n+ }\n+\n+}\n-- \n2.14.3 (Apple Git-98)\n\n" }, { "path": "aegir/patches/8-core/SA-CORE-2018-004-D8.patch", "content": "From bb6d396609600d1169da29456ba3db59abae4b7e Mon Sep 17 00:00:00 2001\nFrom: xjm \nDate: Wed, 25 Apr 2018 10:39:01 -0500\nSubject: [PATCH] SA-CORE-2018-004 by David_Rothstein, alexpott, larowlan,\n Heine, Pere Orga, tim.plunkett, mlhess, xjm, Jasu_M, drumm, cashwilliams,\n quicksketch, dawehner, pwolanin, samuel.mortenson\n\n---\n core/lib/Drupal/Core/Security/RequestSanitizer.php | 98 +++++++++++++++++-----\n core/modules/file/src/Element/ManagedFile.php | 4 +\n 2 files changed, 82 insertions(+), 20 deletions(-)\n\ndiff --git a/core/lib/Drupal/Core/Security/RequestSanitizer.php b/core/lib/Drupal/Core/Security/RequestSanitizer.php\nindex 8ba17b95cf..44815f68cd 100644\n--- a/core/lib/Drupal/Core/Security/RequestSanitizer.php\n+++ b/core/lib/Drupal/Core/Security/RequestSanitizer.php\n@@ -2,6 +2,8 @@\n \n namespace Drupal\\Core\\Security;\n \n+use Drupal\\Component\\Utility\\UrlHelper;\n+use Symfony\\Component\\HttpFoundation\\ParameterBag;\n use Symfony\\Component\\HttpFoundation\\Request;\n \n /**\n@@ -39,33 +41,89 @@ class RequestSanitizer {\n */\n public static function sanitize(Request $request, $whitelist, $log_sanitized_keys = FALSE) {\n if (!$request->attributes->get(self::SANITIZED, FALSE)) {\n- // Process query string parameters.\n- $get_sanitized_keys = [];\n- $request->query->replace(static::stripDangerousValues($request->query->all(), $whitelist, $get_sanitized_keys));\n- if ($log_sanitized_keys && !empty($get_sanitized_keys)) {\n- trigger_error(sprintf('Potentially unsafe keys removed from query string parameters (GET): %s', implode(', ', $get_sanitized_keys)));\n+ $update_globals = FALSE;\n+ $bags = [\n+ 'query' => 'Potentially unsafe keys removed from query string parameters (GET): %s',\n+ 'request' => 'Potentially unsafe keys removed from request body parameters (POST): %s',\n+ 'cookies' => 'Potentially unsafe keys removed from cookie parameters: %s',\n+ ];\n+ foreach ($bags as $bag => $message) {\n+ if (static::processParameterBag($request->$bag, $whitelist, $log_sanitized_keys, $bag, $message)) {\n+ $update_globals = TRUE;\n+ }\n }\n-\n- // Request body parameters.\n- $post_sanitized_keys = [];\n- $request->request->replace(static::stripDangerousValues($request->request->all(), $whitelist, $post_sanitized_keys));\n- if ($log_sanitized_keys && !empty($post_sanitized_keys)) {\n- trigger_error(sprintf('Potentially unsafe keys removed from request body parameters (POST): %s', implode(', ', $post_sanitized_keys)));\n+ if ($update_globals) {\n+ $request->overrideGlobals();\n }\n+ $request->attributes->set(self::SANITIZED, TRUE);\n+ }\n+ return $request;\n+ }\n \n- // Cookie parameters.\n- $cookie_sanitized_keys = [];\n- $request->cookies->replace(static::stripDangerousValues($request->cookies->all(), $whitelist, $cookie_sanitized_keys));\n- if ($log_sanitized_keys && !empty($cookie_sanitized_keys)) {\n- trigger_error(sprintf('Potentially unsafe keys removed from cookie parameters: %s', implode(', ', $cookie_sanitized_keys)));\n+ /**\n+ * Processes a request parameter bag.\n+ *\n+ * @param \\Symfony\\Component\\HttpFoundation\\ParameterBag $bag\n+ * The parameter bag to process.\n+ * @param string[] $whitelist\n+ * An array of keys to whitelist as safe.\n+ * @param bool $log_sanitized_keys\n+ * Set to TRUE to log keys that are sanitized.\n+ * @param string $bag_name\n+ * The request parameter bag name. Either 'query', 'request' or 'cookies'.\n+ * @param string $message\n+ * The message to log if the parameter bag contains keys that are removed.\n+ * If the message contains %s that is replaced by a list of removed keys.\n+ *\n+ * @return bool\n+ * TRUE if the parameter bag has been sanitized, FALSE if not.\n+ */\n+ protected static function processParameterBag(ParameterBag $bag, $whitelist, $log_sanitized_keys, $bag_name, $message) {\n+ $sanitized = FALSE;\n+ $sanitized_keys = [];\n+ $bag->replace(static::stripDangerousValues($bag->all(), $whitelist, $sanitized_keys));\n+ if (!empty($sanitized_keys)) {\n+ $sanitized = TRUE;\n+ if ($log_sanitized_keys) {\n+ trigger_error(sprintf($message, implode(', ', $sanitized_keys)));\n }\n+ }\n \n- if (!empty($get_sanitized_keys) || !empty($post_sanitized_keys) || !empty($cookie_sanitized_keys)) {\n- $request->overrideGlobals();\n+ if ($bag->has('destination')) {\n+ $destination_dangerous_keys = static::checkDestination($bag->get('destination'), $whitelist);\n+ if (!empty($destination_dangerous_keys)) {\n+ // The destination is removed rather than sanitized because the URL\n+ // generator service is not available and this method is called very\n+ // early in the bootstrap.\n+ $bag->remove('destination');\n+ $sanitized = TRUE;\n+ if ($log_sanitized_keys) {\n+ trigger_error(sprintf('Potentially unsafe destination removed from %s parameter bag because it contained the following keys: %s', $bag_name, implode(', ', $destination_dangerous_keys)));\n+ }\n }\n- $request->attributes->set(self::SANITIZED, TRUE);\n }\n- return $request;\n+ return $sanitized;\n+ }\n+\n+ /**\n+ * Checks a destination string to see if it is dangerous.\n+ *\n+ * @param string $destination\n+ * The destination string to check.\n+ * @param array $whitelist\n+ * An array of keys to whitelist as safe.\n+ *\n+ * @return array\n+ * The dangerous keys found in the destination parameter.\n+ */\n+ protected static function checkDestination($destination, array $whitelist) {\n+ $dangerous_keys = [];\n+ $parts = UrlHelper::parse($destination);\n+ // If there is a query string, check its query parameters.\n+ if (!empty($parts['query'])) {\n+ static::stripDangerousValues($parts['query'], $whitelist, $dangerous_keys);\n+ }\n+ return $dangerous_keys;\n }\n \n /**\ndiff --git a/core/modules/file/src/Element/ManagedFile.php b/core/modules/file/src/Element/ManagedFile.php\nindex ca4e887a1b..6f01ee552e 100644\n--- a/core/modules/file/src/Element/ManagedFile.php\n+++ b/core/modules/file/src/Element/ManagedFile.php\n@@ -8,6 +8,7 @@\n use Drupal\\Core\\Ajax\\AjaxResponse;\n use Drupal\\Core\\Ajax\\ReplaceCommand;\n use Drupal\\Core\\Form\\FormStateInterface;\n+use Drupal\\Core\\Render\\Element;\n use Drupal\\Core\\Render\\Element\\FormElement;\n use Drupal\\Core\\Site\\Settings;\n use Drupal\\Core\\Url;\n@@ -175,6 +176,9 @@ public static function uploadAjaxCallback(&$form, FormStateInterface &$form_stat\n \n $form_parents = explode('/', $request->query->get('element_parents'));\n \n+ // Sanitize form parents before using them.\n+ $form_parents = array_filter($form_parents, [Element::class, 'child']);\n+\n // Retrieve the element to be rendered.\n $form = NestedArray::getValue($form, $form_parents);\n \n-- \n2.15.1 (Apple Git-101)\n\n" }, { "path": "aegir/patches/8-core/SA-CORE-2018-006-D8.patch", "content": "From c8f0c39ca488cc29ed575b61c0acf45845d8efed Mon Sep 17 00:00:00 2001\nFrom: Lee Rowlands \nDate: Thu, 18 Oct 2018 08:19:50 +1000\nSubject: [PATCH] SA-CORE-2018-006 by alexpott, attilatilman, bkosborne, catch,\n bonus, Wim Leers, Sam152, Berdir, Damien Tournoud, Dave Reid, Kova101,\n David_Rothstein, dawehner, dsnopek, samuel.mortenson, stefan.r, tedbow, xjm,\n timmillwood, pwolanin, njbooher, dyates, effulgentsia, klausi, mlhess,\n larowlan\n\n---\n core/lib/Drupal/Component/Utility/UrlHelper.php | 10 ++\n .../EventSubscriber/RedirectResponseSubscriber.php | 32 -----\n core/lib/Drupal/Core/Mail/Plugin/Mail/PhpMail.php | 48 ++++++-\n .../Core/PathProcessor/PathProcessorAlias.php | 9 ++\n core/lib/Drupal/Core/Routing/UrlGenerator.php | 5 +\n core/lib/Drupal/Core/Security/RequestSanitizer.php | 13 +-\n .../src/Functional/Views/DisplayBlockTest.php | 10 +-\n .../Constraint/ModerationStateConstraint.php | 1 +\n .../ModerationStateConstraintValidator.php | 90 ++++++++++---\n .../src/StateTransitionValidation.php | 10 ++\n .../src/StateTransitionValidationInterface.php | 19 +++\n .../src/Functional/ModerationStateNodeTest.php | 23 +---\n .../src/Kernel/EntityStateChangeValidationTest.php | 107 ++++++++++++++++\n core/modules/contextual/contextual.module | 8 +-\n core/modules/contextual/contextual.post_update.php | 14 ++\n core/modules/contextual/js/contextual.es6.js | 21 +--\n core/modules/contextual/js/contextual.js | 20 ++-\n .../contextual/src/ContextualController.php | 12 +-\n .../src/Element/ContextualLinksPlaceholder.php | 9 +-\n .../Functional/ContextualDynamicContextTest.php | 91 +++++++++++--\n .../src/Tests/Views/NodeContextualLinksTest.php | 118 -----------------\n .../src/Functional}/NodeRevisionsTest.php | 22 +---\n .../src/Functional}/NodeTypeTest.php | 25 ++--\n .../src/Functional}/PagePreviewTest.php | 17 ++-\n .../Functional/Views/NodeContextualLinksTest.php | 47 +++++++\n .../FunctionalJavascript/ContextualLinksTest.php | 117 +++++++++++++++++\n .../path/tests/src/Functional/PathAliasTest.php | 31 ++++-\n .../system/src/Tests/Routing/RouterTest.php | 7 +\n .../Tests/Component/Utility/UrlHelperTest.php | 4 +\n .../RedirectResponseSubscriberTest.php | 71 -----------\n .../Drupal/Tests/Core/Mail/MailManagerTest.php | 9 ++\n .../Tests/Core/Security/RequestSanitizerTest.php | 141 +++++++++++++++++++++\n 32 files changed, 829 insertions(+), 332 deletions(-)\n create mode 100644 core/modules/contextual/contextual.post_update.php\n delete mode 100644 core/modules/node/src/Tests/Views/NodeContextualLinksTest.php\n rename core/modules/node/{src/Tests => tests/src/Functional}/NodeRevisionsTest.php (92%)\n rename core/modules/node/{src/Tests => tests/src/Functional}/NodeTypeTest.php (94%)\n rename core/modules/node/{src/Tests => tests/src/Functional}/PagePreviewTest.php (97%)\n create mode 100644 core/modules/node/tests/src/Functional/Views/NodeContextualLinksTest.php\n create mode 100644 core/modules/node/tests/src/FunctionalJavascript/ContextualLinksTest.php\n\ndiff --git a/core/lib/Drupal/Component/Utility/UrlHelper.php b/core/lib/Drupal/Component/Utility/UrlHelper.php\nindex 1d133c9d6b..9e2365c1ae 100644\n--- a/core/lib/Drupal/Component/Utility/UrlHelper.php\n+++ b/core/lib/Drupal/Component/Utility/UrlHelper.php\n@@ -248,6 +248,16 @@ public static function isExternal($path) {\n * Exception thrown when a either $url or $bath_url are not fully qualified.\n */\n public static function externalIsLocal($url, $base_url) {\n+ // Some browsers treat \\ as / so normalize to forward slashes.\n+ $url = str_replace('\\\\', '/', $url);\n+\n+ // Leading control characters may be ignored or mishandled by browsers, so\n+ // assume such a path may lead to an non-local location. The \\p{C} character\n+ // class matches all UTF-8 control, unassigned, and private characters.\n+ if (preg_match('/^\\p{C}/u', $url) !== 0) {\n+ return FALSE;\n+ }\n+\n $url_parts = parse_url($url);\n $base_parts = parse_url($base_url);\n \ndiff --git a/core/lib/Drupal/Core/EventSubscriber/RedirectResponseSubscriber.php b/core/lib/Drupal/Core/EventSubscriber/RedirectResponseSubscriber.php\nindex 8397bdef4e..67a4aae422 100644\n--- a/core/lib/Drupal/Core/EventSubscriber/RedirectResponseSubscriber.php\n+++ b/core/lib/Drupal/Core/EventSubscriber/RedirectResponseSubscriber.php\n@@ -8,7 +8,6 @@\n use Drupal\\Core\\Routing\\RequestContext;\n use Drupal\\Core\\Utility\\UnroutedUrlAssemblerInterface;\n use Symfony\\Component\\HttpFoundation\\Response;\n-use Symfony\\Component\\HttpKernel\\Event\\GetResponseEvent;\n use Symfony\\Component\\HttpKernel\\KernelEvents;\n use Symfony\\Component\\HttpKernel\\Event\\FilterResponseEvent;\n use Symfony\\Component\\HttpFoundation\\RedirectResponse;\n@@ -129,36 +128,6 @@ protected function getDestinationAsAbsoluteUrl($destination, $scheme_and_host) {\n return $destination;\n }\n \n- /**\n- * Sanitize the destination parameter to prevent open redirect attacks.\n- *\n- * @param \\Symfony\\Component\\HttpKernel\\Event\\GetResponseEvent $event\n- * The Event to process.\n- */\n- public function sanitizeDestination(GetResponseEvent $event) {\n- $request = $event->getRequest();\n- // Sanitize the destination parameter (which is often used for redirects) to\n- // prevent open redirect attacks leading to other domains. Sanitize both\n- // $_GET['destination'] and $_REQUEST['destination'] to protect code that\n- // relies on either, but do not sanitize $_POST to avoid interfering with\n- // unrelated form submissions. The sanitization happens here because\n- // url_is_external() requires the variable system to be available.\n- $query_info = $request->query;\n- $request_info = $request->request;\n- if ($query_info->has('destination') || $request_info->has('destination')) {\n- // If the destination is an external URL, remove it.\n- if ($query_info->has('destination') && UrlHelper::isExternal($query_info->get('destination'))) {\n- $query_info->remove('destination');\n- $request_info->remove('destination');\n- }\n- // If there's still something in $_REQUEST['destination'] that didn't come\n- // from $_GET, check it too.\n- if ($request_info->has('destination') && (!$query_info->has('destination') || $request_info->get('destination') != $query_info->get('destination')) && UrlHelper::isExternal($request_info->get('destination'))) {\n- $request_info->remove('destination');\n- }\n- }\n- }\n-\n /**\n * Registers the methods in this class that should be listeners.\n *\n@@ -167,7 +136,6 @@ public function sanitizeDestination(GetResponseEvent $event) {\n */\n public static function getSubscribedEvents() {\n $events[KernelEvents::RESPONSE][] = ['checkRedirectUrl'];\n- $events[KernelEvents::REQUEST][] = ['sanitizeDestination', 100];\n return $events;\n }\n \ndiff --git a/core/lib/Drupal/Core/Mail/Plugin/Mail/PhpMail.php b/core/lib/Drupal/Core/Mail/Plugin/Mail/PhpMail.php\nindex e5361492b5..27e5c76e5d 100644\n--- a/core/lib/Drupal/Core/Mail/Plugin/Mail/PhpMail.php\n+++ b/core/lib/Drupal/Core/Mail/Plugin/Mail/PhpMail.php\n@@ -18,6 +18,20 @@\n */\n class PhpMail implements MailInterface {\n \n+ /**\n+ * The configuration factory.\n+ *\n+ * @var \\Drupal\\Core\\Config\\ConfigFactoryInterface\n+ */\n+ protected $configFactory;\n+\n+ /**\n+ * PhpMail constructor.\n+ */\n+ public function __construct() {\n+ $this->configFactory = \\Drupal::configFactory();\n+ }\n+\n /**\n * Concatenates and wraps the email body for plain-text mails.\n *\n@@ -86,7 +100,10 @@ public function mail(array $message) {\n // On most non-Windows systems, the \"-f\" option to the sendmail command\n // is used to set the Return-Path. There is no space between -f and\n // the value of the return path.\n- $additional_headers = isset($message['Return-Path']) ? '-f' . $message['Return-Path'] : '';\n+ // We validate the return path, unless it is equal to the site mail, which\n+ // we assume to be safe.\n+ $site_mail = $this->configFactory->get('system.site')->get('mail');\n+ $additional_headers = isset($message['Return-Path']) && ($site_mail === $message['Return-Path'] || static::_isShellSafe($message['Return-Path'])) ? '-f' . $message['Return-Path'] : '';\n $mail_result = @mail(\n $message['to'],\n $mail_subject,\n@@ -112,4 +129,33 @@ public function mail(array $message) {\n return $mail_result;\n }\n \n+ /**\n+ * Disallows potentially unsafe shell characters.\n+ *\n+ * Functionally similar to PHPMailer::isShellSafe() which resulted from\n+ * CVE-2016-10045. Note that escapeshellarg and escapeshellcmd are inadequate\n+ * for this purpose.\n+ *\n+ * @param string $string\n+ * The string to be validated.\n+ *\n+ * @return bool\n+ * True if the string is shell-safe.\n+ *\n+ * @see https://github.com/PHPMailer/PHPMailer/issues/924\n+ * @see https://github.com/PHPMailer/PHPMailer/blob/v5.2.21/class.phpmailer.php#L1430\n+ *\n+ * @todo Rename to ::isShellSafe() and/or discuss whether this is the correct\n+ * location for this helper.\n+ */\n+ protected static function _isShellSafe($string) {\n+ if (escapeshellcmd($string) !== $string || !in_array(escapeshellarg($string), [\"'$string'\", \"\\\"$string\\\"\"])) {\n+ return FALSE;\n+ }\n+ if (preg_match('/[^a-zA-Z0-9@_\\-.]/', $string) !== 0) {\n+ return FALSE;\n+ }\n+ return TRUE;\n+ }\n+\n }\ndiff --git a/core/lib/Drupal/Core/PathProcessor/PathProcessorAlias.php b/core/lib/Drupal/Core/PathProcessor/PathProcessorAlias.php\nindex b85737f3cf..d0690fee20 100644\n--- a/core/lib/Drupal/Core/PathProcessor/PathProcessorAlias.php\n+++ b/core/lib/Drupal/Core/PathProcessor/PathProcessorAlias.php\n@@ -43,6 +43,15 @@ public function processOutbound($path, &$options = [], Request $request = NULL,\n if (empty($options['alias'])) {\n $langcode = isset($options['language']) ? $options['language']->getId() : NULL;\n $path = $this->aliasManager->getAliasByPath($path, $langcode);\n+ // Ensure the resulting path has at most one leading slash, to prevent it\n+ // becoming an external URL without a protocol like //example.com. This\n+ // is done in \\Drupal\\Core\\Routing\\UrlGenerator::generateFromRoute()\n+ // also, to protect against this problem in arbitrary path processors,\n+ // but it is duplicated here to protect any other URL generation code\n+ // that might call this method separately.\n+ if (strpos($path, '//') === 0) {\n+ $path = '/' . ltrim($path, '/');\n+ }\n }\n return $path;\n }\ndiff --git a/core/lib/Drupal/Core/Routing/UrlGenerator.php b/core/lib/Drupal/Core/Routing/UrlGenerator.php\nindex 3b5c8d256b..853a5f7b4e 100644\n--- a/core/lib/Drupal/Core/Routing/UrlGenerator.php\n+++ b/core/lib/Drupal/Core/Routing/UrlGenerator.php\n@@ -297,6 +297,11 @@ public function generateFromRoute($name, $parameters = [], $options = [], $colle\n if ($options['path_processing']) {\n $path = $this->processPath($path, $options, $generated_url);\n }\n+ // Ensure the resulting path has at most one leading slash, to prevent it\n+ // becoming an external URL without a protocol like //example.com.\n+ if (strpos($path, '//') === 0) {\n+ $path = '/' . ltrim($path, '/');\n+ }\n // The contexts base URL is already encoded\n // (see Symfony\\Component\\HttpFoundation\\Request).\n $path = str_replace($this->decodedChars[0], $this->decodedChars[1], rawurlencode($path));\ndiff --git a/core/lib/Drupal/Core/Security/RequestSanitizer.php b/core/lib/Drupal/Core/Security/RequestSanitizer.php\nindex 3f48f3d59c..e1626ed383 100644\n--- a/core/lib/Drupal/Core/Security/RequestSanitizer.php\n+++ b/core/lib/Drupal/Core/Security/RequestSanitizer.php\n@@ -90,7 +90,8 @@ protected static function processParameterBag(ParameterBag $bag, $whitelist, $lo\n }\n \n if ($bag->has('destination')) {\n- $destination_dangerous_keys = static::checkDestination($bag->get('destination'), $whitelist);\n+ $destination = $bag->get('destination');\n+ $destination_dangerous_keys = static::checkDestination($destination, $whitelist);\n if (!empty($destination_dangerous_keys)) {\n // The destination is removed rather than sanitized because the URL\n // generator service is not available and this method is called very\n@@ -101,6 +102,16 @@ protected static function processParameterBag(ParameterBag $bag, $whitelist, $lo\n trigger_error(sprintf('Potentially unsafe destination removed from %s parameter bag because it contained the following keys: %s', $bag_name, implode(', ', $destination_dangerous_keys)));\n }\n }\n+ // Sanitize the destination parameter (which is often used for redirects)\n+ // to prevent open redirect attacks leading to other domains.\n+ if (UrlHelper::isExternal($destination)) {\n+ // The destination is removed because it is an external URL.\n+ $bag->remove('destination');\n+ $sanitized = TRUE;\n+ if ($log_sanitized_keys) {\n+ trigger_error(sprintf('Potentially unsafe destination removed from %s parameter bag because it points to an external URL.', $bag_name));\n+ }\n+ }\n }\n return $sanitized;\n }\ndiff --git a/core/modules/block/tests/src/Functional/Views/DisplayBlockTest.php b/core/modules/block/tests/src/Functional/Views/DisplayBlockTest.php\nindex 0a18d7fa0f..cdb1998241 100644\n--- a/core/modules/block/tests/src/Functional/Views/DisplayBlockTest.php\n+++ b/core/modules/block/tests/src/Functional/Views/DisplayBlockTest.php\n@@ -3,6 +3,8 @@\n namespace Drupal\\Tests\\block\\Functional\\Views;\n \n use Drupal\\Component\\Serialization\\Json;\n+use Drupal\\Component\\Utility\\Crypt;\n+use Drupal\\Core\\Site\\Settings;\n use Drupal\\Core\\Url;\n use Drupal\\Tests\\block\\Functional\\AssertBlockAppearsTrait;\n use Drupal\\Tests\\system\\Functional\\Cache\\AssertPageCacheContextsAndTagsTrait;\n@@ -360,14 +362,16 @@ public function testBlockContextualLinks() {\n $this->drupalGet('test-page');\n \n $id = 'block:block=' . $block->id() . ':langcode=en|entity.view.edit_form:view=test_view_block:location=block&name=test_view_block&display_id=block_1&langcode=en';\n+ $id_token = Crypt::hmacBase64($id, Settings::getHashSalt() . $this->container->get('private_key')->get());\n $cached_id = 'block:block=' . $cached_block->id() . ':langcode=en|entity.view.edit_form:view=test_view_block:location=block&name=test_view_block&display_id=block_1&langcode=en';\n+ $cached_id_token = Crypt::hmacBase64($cached_id, Settings::getHashSalt() . $this->container->get('private_key')->get());\n // @see \\Drupal\\contextual\\Tests\\ContextualDynamicContextTest:assertContextualLinkPlaceHolder()\n- $this->assertRaw(' $id]) . '>
', format_string('Contextual link placeholder with id @id exists.', ['@id' => $id]));\n- $this->assertRaw(' $cached_id]) . '>
', format_string('Contextual link placeholder with id @id exists.', ['@id' => $cached_id]));\n+ $this->assertRaw(' $id, 'data-contextual-token' => $id_token]) . '>', format_string('Contextual link placeholder with id @id exists.', ['@id' => $id]));\n+ $this->assertRaw(' $cached_id, 'data-contextual-token' => $cached_id_token]) . '>', format_string('Contextual link placeholder with id @id exists.', ['@id' => $cached_id]));\n \n // Get server-rendered contextual links.\n // @see \\Drupal\\contextual\\Tests\\ContextualDynamicContextTest:renderContextualLinks()\n- $post = ['ids[0]' => $id, 'ids[1]' => $cached_id];\n+ $post = ['ids[0]' => $id, 'ids[1]' => $cached_id, 'tokens[0]' => $id_token, 'tokens[1]' => $cached_id_token];\n $url = 'contextual/render?_format=json,destination=test-page';\n $this->getSession()->getDriver()->getClient()->request('POST', $url, $post);\n $this->assertResponse(200);\ndiff --git a/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraint.php b/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraint.php\nindex 7f7c756b6b..4fcde36059 100644\n--- a/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraint.php\n+++ b/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraint.php\n@@ -16,5 +16,6 @@ class ModerationStateConstraint extends Constraint {\n \n public $message = 'Invalid state transition from %from to %to';\n public $invalidStateMessage = 'State %state does not exist on %workflow workflow';\n+ public $invalidTransitionAccess = 'You do not have access to transition from %original_state to %new_state';\n \n }\ndiff --git a/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraintValidator.php b/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraintValidator.php\nindex 65fc2a0c50..c3b9c815fe 100644\n--- a/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraintValidator.php\n+++ b/core/modules/content_moderation/src/Plugin/Validation/Constraint/ModerationStateConstraintValidator.php\n@@ -2,10 +2,13 @@\n \n namespace Drupal\\content_moderation\\Plugin\\Validation\\Constraint;\n \n+use Drupal\\content_moderation\\StateTransitionValidationInterface;\n use Drupal\\Core\\DependencyInjection\\ContainerInjectionInterface;\n+use Drupal\\Core\\Entity\\ContentEntityInterface;\n use Drupal\\Core\\Entity\\EntityInterface;\n use Drupal\\Core\\Entity\\EntityTypeManagerInterface;\n use Drupal\\content_moderation\\ModerationInformationInterface;\n+use Drupal\\Core\\Session\\AccountInterface;\n use Symfony\\Component\\DependencyInjection\\ContainerInterface;\n use Symfony\\Component\\Validator\\Constraint;\n use Symfony\\Component\\Validator\\ConstraintValidator;\n@@ -29,6 +32,20 @@ class ModerationStateConstraintValidator extends ConstraintValidator implements\n */\n protected $moderationInformation;\n \n+ /**\n+ * The current user.\n+ *\n+ * @var \\Drupal\\Core\\Session\\AccountInterface\n+ */\n+ protected $currentUser;\n+\n+ /**\n+ * The state transition validation service.\n+ *\n+ * @var \\Drupal\\content_moderation\\StateTransitionValidationInterface\n+ */\n+ protected $stateTransitionValidation;\n+\n /**\n * Creates a new ModerationStateConstraintValidator instance.\n *\n@@ -36,10 +53,16 @@ class ModerationStateConstraintValidator extends ConstraintValidator implements\n * The entity type manager.\n * @param \\Drupal\\content_moderation\\ModerationInformationInterface $moderation_information\n * The moderation information.\n+ * @param \\Drupal\\Core\\Session\\AccountInterface $current_user\n+ * The current user.\n+ * @param \\Drupal\\content_moderation\\StateTransitionValidationInterface $state_transition_validation\n+ * The state transition validation service.\n */\n- public function __construct(EntityTypeManagerInterface $entity_type_manager, ModerationInformationInterface $moderation_information) {\n+ public function __construct(EntityTypeManagerInterface $entity_type_manager, ModerationInformationInterface $moderation_information, AccountInterface $current_user, StateTransitionValidationInterface $state_transition_validation) {\n $this->entityTypeManager = $entity_type_manager;\n $this->moderationInformation = $moderation_information;\n+ $this->currentUser = $current_user;\n+ $this->stateTransitionValidation = $state_transition_validation;\n }\n \n /**\n@@ -48,7 +71,9 @@ public function __construct(EntityTypeManagerInterface $entity_type_manager, Mod\n public static function create(ContainerInterface $container) {\n return new static(\n $container->get('entity_type.manager'),\n- $container->get('content_moderation.moderation_information')\n+ $container->get('content_moderation.moderation_information'),\n+ $container->get('current_user'),\n+ $container->get('content_moderation.state_transition_validation')\n );\n }\n \n@@ -76,32 +101,59 @@ public function validate($value, Constraint $constraint) {\n return;\n }\n \n+ $new_state = $workflow->getTypePlugin()->getState($entity->moderation_state->value);\n+ $original_state = $this->getOriginalOrInitialState($entity);\n+\n // If a new state is being set and there is an existing state, validate\n // there is a valid transition between them.\n+ if (!$original_state->canTransitionTo($new_state->id())) {\n+ $this->context->addViolation($constraint->message, [\n+ '%from' => $original_state->label(),\n+ '%to' => $new_state->label(),\n+ ]);\n+ }\n+ else {\n+ // If we're sure the transition exists, make sure the user has permission\n+ // to use it.\n+ if (!$this->stateTransitionValidation->isTransitionValid($workflow, $original_state, $new_state, $this->currentUser)) {\n+ $this->context->addViolation($constraint->invalidTransitionAccess, [\n+ '%original_state' => $original_state->label(),\n+ '%new_state' => $new_state->label(),\n+ ]);\n+ }\n+ }\n+ }\n+\n+ /**\n+ * Gets the original or initial state of the given entity.\n+ *\n+ * When a state is being validated, the original state is used to validate\n+ * that a valid transition exists for target state and the user has access\n+ * to the transition between those two states. If the entity has been\n+ * moderated before, we can load the original unmodified revision and\n+ * translation for this state.\n+ *\n+ * If the entity is new we need to load the initial state from the workflow.\n+ * Even if a value was assigned to the moderation_state field, the initial\n+ * state is used to compute an appropriate transition for the purposes of\n+ * validation.\n+ *\n+ * @return \\Drupal\\workflows\\StateInterface\n+ * The original or default moderation state.\n+ */\n+ protected function getOriginalOrInitialState(ContentEntityInterface $entity) {\n+ $state = NULL;\n+ $workflow_type = $this->moderationInformation->getWorkflowForEntity($entity)->getTypePlugin();\n if (!$entity->isNew() && !$this->isFirstTimeModeration($entity)) {\n $original_entity = $this->entityTypeManager->getStorage($entity->getEntityTypeId())->loadRevision($entity->getLoadedRevisionId());\n if (!$entity->isDefaultTranslation() && $original_entity->hasTranslation($entity->language()->getId())) {\n $original_entity = $original_entity->getTranslation($entity->language()->getId());\n }\n-\n- // If the state of the original entity doesn't exist on the workflow,\n- // we cannot do any further validation of transitions, because none will\n- // be setup for a state that doesn't exist. Instead allow any state to\n- // take its place.\n- if (!$workflow->getTypePlugin()->hasState($original_entity->moderation_state->value)) {\n- return;\n- }\n-\n- $new_state = $workflow->getTypePlugin()->getState($entity->moderation_state->value);\n- $original_state = $workflow->getTypePlugin()->getState($original_entity->moderation_state->value);\n-\n- if (!$original_state->canTransitionTo($new_state->id())) {\n- $this->context->addViolation($constraint->message, [\n- '%from' => $original_state->label(),\n- '%to' => $new_state->label(),\n- ]);\n+ if ($workflow_type->hasState($original_entity->moderation_state->value)) {\n+ $state = $workflow_type->getState($original_entity->moderation_state->value);\n }\n }\n+ return $state ?: $workflow_type->getInitialState($entity);\n }\n \n /**\ndiff --git a/core/modules/content_moderation/src/StateTransitionValidation.php b/core/modules/content_moderation/src/StateTransitionValidation.php\nindex 01b2ad8458..35d657e550 100644\n--- a/core/modules/content_moderation/src/StateTransitionValidation.php\n+++ b/core/modules/content_moderation/src/StateTransitionValidation.php\n@@ -4,7 +4,9 @@\n \n use Drupal\\Core\\Entity\\ContentEntityInterface;\n use Drupal\\Core\\Session\\AccountInterface;\n+use Drupal\\workflows\\StateInterface;\n use Drupal\\workflows\\Transition;\n+use Drupal\\workflows\\WorkflowInterface;\n \n /**\n * Validates whether a certain state transition is allowed.\n@@ -47,4 +49,12 @@ public function getValidTransitions(ContentEntityInterface $entity, AccountInter\n });\n }\n \n+ /**\n+ * {@inheritdoc}\n+ */\n+ public function isTransitionValid(WorkflowInterface $workflow, StateInterface $original_state, StateInterface $new_state, AccountInterface $user) {\n+ $transition = $workflow->getTypePlugin()->getTransitionFromStateToState($original_state->id(), $new_state->id());\n+ return $user->hasPermission('use ' . $workflow->id() . ' transition ' . $transition->id());\n+ }\n+\n }\ndiff --git a/core/modules/content_moderation/src/StateTransitionValidationInterface.php b/core/modules/content_moderation/src/StateTransitionValidationInterface.php\nindex 1acbf052fd..c793fe53e2 100644\n--- a/core/modules/content_moderation/src/StateTransitionValidationInterface.php\n+++ b/core/modules/content_moderation/src/StateTransitionValidationInterface.php\n@@ -4,6 +4,8 @@\n \n use Drupal\\Core\\Entity\\ContentEntityInterface;\n use Drupal\\Core\\Session\\AccountInterface;\n+use Drupal\\workflows\\StateInterface;\n+use Drupal\\workflows\\WorkflowInterface;\n \n /**\n * Validates whether a certain state transition is allowed.\n@@ -23,4 +25,21 @@\n */\n public function getValidTransitions(ContentEntityInterface $entity, AccountInterface $user);\n \n+ /**\n+ * Checks if a transition between two states if valid for the given user.\n+ *\n+ * @param \\Drupal\\workflows\\WorkflowInterface $workflow\n+ * The workflow entity.\n+ * @param \\Drupal\\workflows\\StateInterface $original_state\n+ * The original workflow state.\n+ * @param \\Drupal\\workflows\\StateInterface $new_state\n+ * The new workflow state.\n+ * @param \\Drupal\\Core\\Session\\AccountInterface $user\n+ * The user to validate.\n+ *\n+ * @return bool\n+ * Returns TRUE if transition is valid, otherwise FALSE.\n+ */\n+ public function isTransitionValid(WorkflowInterface $workflow, StateInterface $original_state, StateInterface $new_state, AccountInterface $user);\n+\n }\ndiff --git a/core/modules/content_moderation/tests/src/Functional/ModerationStateNodeTest.php b/core/modules/content_moderation/tests/src/Functional/ModerationStateNodeTest.php\nindex 11deaa72c0..5fd168d0bb 100644\n--- a/core/modules/content_moderation/tests/src/Functional/ModerationStateNodeTest.php\n+++ b/core/modules/content_moderation/tests/src/Functional/ModerationStateNodeTest.php\n@@ -158,32 +158,15 @@ public function testNoContentModerationPermissions() {\n ]);\n $this->drupalLogin($limited_user);\n \n- // Check the user can add content, but can't see the moderation state\n- // select.\n+ // Check the user can see the content entity form, but can't see the\n+ // moderation state select or save the entity form.\n $this->drupalGet('node/add/moderated_content');\n $session_assert->statusCodeEquals(200);\n $session_assert->fieldNotExists('moderation_state[0][state]');\n $this->drupalPostForm(NULL, [\n 'title[0][value]' => 'moderated content',\n ], 'Save');\n-\n- // Manually move the content to archived because the user doesn't have\n- // permission to do this.\n- $node = $this->getNodeByTitle('moderated content');\n- $node->moderation_state->value = 'archived';\n- $node->save();\n-\n- // Check the user can see the current state but not the select.\n- $this->drupalGet('node/' . $node->id() . '/edit');\n- $session_assert->statusCodeEquals(200);\n- $session_assert->pageTextContains('Archived');\n- $session_assert->fieldNotExists('moderation_state[0][state]');\n- $this->drupalPostForm(NULL, [], 'Save');\n-\n- // When saving they should still be on the edit form, and see the validation\n- // error message.\n- $session_assert->pageTextContains('Edit Moderated content moderated content');\n- $session_assert->pageTextContains('Invalid state transition from Archived to Archived');\n+ $session_assert->pageTextContains('You do not have access to transition from Draft to Draft');\n }\n \n }\ndiff --git a/core/modules/content_moderation/tests/src/Kernel/EntityStateChangeValidationTest.php b/core/modules/content_moderation/tests/src/Kernel/EntityStateChangeValidationTest.php\nindex dc1e7f6917..df90bf63c8 100644\n--- a/core/modules/content_moderation/tests/src/Kernel/EntityStateChangeValidationTest.php\n+++ b/core/modules/content_moderation/tests/src/Kernel/EntityStateChangeValidationTest.php\n@@ -7,6 +7,7 @@\n use Drupal\\node\\Entity\\Node;\n use Drupal\\node\\Entity\\NodeType;\n use Drupal\\Tests\\content_moderation\\Traits\\ContentModerationTestTrait;\n+use Drupal\\Tests\\user\\Traits\\UserCreationTrait;\n \n /**\n * @coversDefaultClass \\Drupal\\content_moderation\\Plugin\\Validation\\Constraint\\ModerationStateConstraintValidator\n@@ -15,6 +16,7 @@\n class EntityStateChangeValidationTest extends KernelTestBase {\n \n use ContentModerationTestTrait;\n+ use UserCreationTrait;\n \n /**\n * {@inheritdoc}\n@@ -29,6 +31,13 @@ class EntityStateChangeValidationTest extends KernelTestBase {\n 'workflows',\n ];\n \n+ /**\n+ * An admin user.\n+ *\n+ * @var \\Drupal\\Core\\Session\\AccountInterface\n+ */\n+ protected $adminUser;\n+\n /**\n * {@inheritdoc}\n */\n@@ -40,6 +49,9 @@ protected function setUp() {\n $this->installEntitySchema('user');\n $this->installEntitySchema('content_moderation_state');\n $this->installConfig('content_moderation');\n+ $this->installSchema('system', ['sequences']);\n+\n+ $this->adminUser = $this->createUser(array_keys($this->container->get('user.permissions')->getPermissions()));\n }\n \n /**\n@@ -48,6 +60,8 @@ protected function setUp() {\n * @covers ::validate\n */\n public function testValidTransition() {\n+ $this->setCurrentUser($this->adminUser);\n+\n $node_type = NodeType::create([\n 'type' => 'example',\n ]);\n@@ -76,6 +90,8 @@ public function testValidTransition() {\n * @covers ::validate\n */\n public function testInvalidTransition() {\n+ $this->setCurrentUser($this->adminUser);\n+\n $node_type = NodeType::create([\n 'type' => 'example',\n ]);\n@@ -125,6 +141,7 @@ public function testInvalidState() {\n * Test validation with content that has no initial state or an invalid state.\n */\n public function testInvalidStateWithoutExisting() {\n+ $this->setCurrentUser($this->adminUser);\n // Create content without moderation enabled for the content type.\n $node_type = NodeType::create([\n 'type' => 'example',\n@@ -156,15 +173,24 @@ public function testInvalidStateWithoutExisting() {\n // validating.\n $workflow->getTypePlugin()->deleteState('deleted_state');\n $workflow->save();\n+\n+ // When there is an invalid state, the content will revert to \"draft\". This\n+ // will allow a draft to draft transition.\n $node->moderation_state->value = 'draft';\n $violations = $node->validate();\n $this->assertCount(0, $violations);\n+ // This will disallow a draft to archived transition.\n+ $node->moderation_state->value = 'archived';\n+ $violations = $node->validate();\n+ $this->assertCount(1, $violations);\n }\n \n /**\n * Test state transition validation with multiple languages.\n */\n public function testInvalidStateMultilingual() {\n+ $this->setCurrentUser($this->adminUser);\n+\n ConfigurableLanguage::createFromLangcode('fr')->save();\n $node_type = NodeType::create([\n 'type' => 'example',\n@@ -220,6 +246,8 @@ public function testInvalidStateMultilingual() {\n * Tests that content without prior moderation information can be moderated.\n */\n public function testExistingContentWithNoModeration() {\n+ $this->setCurrentUser($this->adminUser);\n+\n $node_type = NodeType::create([\n 'type' => 'example',\n ]);\n@@ -254,6 +282,8 @@ public function testExistingContentWithNoModeration() {\n * Tests that content without prior moderation information can be translated.\n */\n public function testExistingMultilingualContentWithNoModeration() {\n+ $this->setCurrentUser($this->adminUser);\n+\n // Enable French.\n ConfigurableLanguage::createFromLangcode('fr')->save();\n \n@@ -293,4 +323,81 @@ public function testExistingMultilingualContentWithNoModeration() {\n $node_fr->save();\n }\n \n+ /**\n+ * @dataProvider transitionAccessValidationTestCases\n+ */\n+ public function testTransitionAccessValidation($permissions, $target_state, $messages) {\n+ $node_type = NodeType::create([\n+ 'type' => 'example',\n+ ]);\n+ $node_type->save();\n+ $workflow = $this->createEditorialWorkflow();\n+ $workflow->getTypePlugin()->addState('foo', 'Foo');\n+ $workflow->getTypePlugin()->addTransition('draft_to_foo', 'Draft to foo', ['draft'], 'foo');\n+ $workflow->getTypePlugin()->addTransition('foo_to_foo', 'Foo to foo', ['foo'], 'foo');\n+ $workflow->getTypePlugin()->addEntityTypeAndBundle('node', 'example');\n+ $workflow->save();\n+\n+ $this->setCurrentUser($this->createUser($permissions));\n+\n+ $node = Node::create([\n+ 'type' => 'example',\n+ 'title' => 'Test content',\n+ 'moderation_state' => $target_state,\n+ ]);\n+ $this->assertTrue($node->isNew());\n+ $violations = $node->validate();\n+ $this->assertCount(count($messages), $violations);\n+ foreach ($messages as $i => $message) {\n+ $this->assertEquals($message, $violations->get($i)->getMessage());\n+ }\n+ }\n+\n+ /**\n+ * Test cases for ::testTransitionAccessValidation.\n+ */\n+ public function transitionAccessValidationTestCases() {\n+ return [\n+ 'Invalid transition, no permissions validated' => [\n+ [],\n+ 'archived',\n+ ['Invalid state transition from Draft to Archived'],\n+ ],\n+ 'Valid transition, missing permission' => [\n+ [],\n+ 'published',\n+ ['You do not have access to transition from Draft to Published'],\n+ ],\n+ 'Valid transition, granted published permission' => [\n+ ['use editorial transition publish'],\n+ 'published',\n+ [],\n+ ],\n+ 'Valid transition, granted draft permission' => [\n+ ['use editorial transition create_new_draft'],\n+ 'draft',\n+ [],\n+ ],\n+ 'Valid transition, incorrect permission granted' => [\n+ ['use editorial transition create_new_draft'],\n+ 'published',\n+ ['You do not have access to transition from Draft to Published'],\n+ ],\n+ // Test with an additional state and set of transitions, since the\n+ // \"published\" transition can start from either \"draft\" or \"published\", it\n+ // does not capture bugs that fail to correctly distinguish the initial\n+ // workflow state from the set state of a new entity.\n+ 'Valid transition, granted foo permission' => [\n+ ['use editorial transition draft_to_foo'],\n+ 'foo',\n+ [],\n+ ],\n+ 'Valid transition, incorrect foo permission granted' => [\n+ ['use editorial transition foo_to_foo'],\n+ 'foo',\n+ ['You do not have access to transition from Draft to Foo'],\n+ ],\n+ ];\n+ }\n+\n }\ndiff --git a/core/modules/contextual/contextual.module b/core/modules/contextual/contextual.module\nindex b9d61b76d2..8b9fc36fd7 100644\n--- a/core/modules/contextual/contextual.module\n+++ b/core/modules/contextual/contextual.module\n@@ -191,13 +191,19 @@ function _contextual_links_to_id($contextual_links) {\n /**\n * Unserializes the result of _contextual_links_to_id().\n *\n- * @see _contextual_links_to_id\n+ * Note that $id is user input. Before calling this method the ID should be\n+ * checked against the token stored in the 'data-contextual-token' attribute\n+ * which is passed via the 'tokens' request parameter to\n+ * \\Drupal\\contextual\\ContextualController::render().\n *\n * @param string $id\n * A serialized representation of a #contextual_links property value array.\n *\n * @return array\n * The value for a #contextual_links property.\n+ *\n+ * @see _contextual_links_to_id()\n+ * @see \\Drupal\\contextual\\ContextualController::render()\n */\n function _contextual_id_to_links($id) {\n $contextual_links = [];\ndiff --git a/core/modules/contextual/contextual.post_update.php b/core/modules/contextual/contextual.post_update.php\nnew file mode 100644\nindex 0000000000..8decad05f0\n--- /dev/null\n+++ b/core/modules/contextual/contextual.post_update.php\n@@ -0,0 +1,14 @@\n+ {\n- const html = storage.getItem(`Drupal.contextual.${contextualID}`);\n+ const uncachedIDs = [];\n+ const uncachedTokens = [];\n+ ids.forEach(contextualID => {\n+ const html = storage.getItem(`Drupal.contextual.${contextualID.id}`);\n if (html && html.length) {\n // Initialize after the current execution cycle, to make the AJAX\n // request for retrieving the uncached contextual links as soon as\n@@ -182,13 +186,14 @@\n // Drupal.contextual.collection.\n window.setTimeout(() => {\n initContextual(\n- $context.find(`[data-contextual-id=\"${contextualID}\"]`),\n+ $context.find(`[data-contextual-id=\"${contextualID.id}\"]`),\n html,\n );\n });\n- return false;\n+ return;\n }\n- return true;\n+ uncachedIDs.push(contextualID.id);\n+ uncachedTokens.push(contextualID.token);\n });\n \n // Perform an AJAX request to let the server render the contextual links\n@@ -197,7 +202,7 @@\n $.ajax({\n url: Drupal.url('contextual/render'),\n type: 'POST',\n- data: { 'ids[]': uncachedIDs },\n+ data: { 'ids[]': uncachedIDs, 'tokens[]': uncachedTokens },\n dataType: 'json',\n success(results) {\n _.each(results, (html, contextualID) => {\ndiff --git a/core/modules/contextual/js/contextual.js b/core/modules/contextual/js/contextual.js\nindex 049233b4e1..d51eba21a9 100644\n--- a/core/modules/contextual/js/contextual.js\n+++ b/core/modules/contextual/js/contextual.js\n@@ -95,25 +95,31 @@\n \n var ids = [];\n $placeholders.each(function () {\n- ids.push($(this).attr('data-contextual-id'));\n+ ids.push({\n+ id: $(this).attr('data-contextual-id'),\n+ token: $(this).attr('data-contextual-token')\n+ });\n });\n \n- var uncachedIDs = _.filter(ids, function (contextualID) {\n- var html = storage.getItem('Drupal.contextual.' + contextualID);\n+ var uncachedIDs = [];\n+ var uncachedTokens = [];\n+ ids.forEach(function (contextualID) {\n+ var html = storage.getItem('Drupal.contextual.' + contextualID.id);\n if (html && html.length) {\n window.setTimeout(function () {\n- initContextual($context.find('[data-contextual-id=\"' + contextualID + '\"]'), html);\n+ initContextual($context.find('[data-contextual-id=\"' + contextualID.id + '\"]'), html);\n });\n- return false;\n+ return;\n }\n- return true;\n+ uncachedIDs.push(contextualID.id);\n+ uncachedTokens.push(contextualID.token);\n });\n \n if (uncachedIDs.length > 0) {\n $.ajax({\n url: Drupal.url('contextual/render'),\n type: 'POST',\n- data: { 'ids[]': uncachedIDs },\n+ data: { 'ids[]': uncachedIDs, 'tokens[]': uncachedTokens },\n dataType: 'json',\n success: function success(results) {\n _.each(results, function (html, contextualID) {\ndiff --git a/core/modules/contextual/src/ContextualController.php b/core/modules/contextual/src/ContextualController.php\nindex 58e42ecd6b..d05c6a8527 100644\n--- a/core/modules/contextual/src/ContextualController.php\n+++ b/core/modules/contextual/src/ContextualController.php\n@@ -2,8 +2,10 @@\n \n namespace Drupal\\contextual;\n \n+use Drupal\\Component\\Utility\\Crypt;\n use Drupal\\Core\\DependencyInjection\\ContainerInjectionInterface;\n use Drupal\\Core\\Render\\RendererInterface;\n+use Drupal\\Core\\Site\\Settings;\n use Symfony\\Component\\DependencyInjection\\ContainerInterface;\n use Symfony\\Component\\HttpFoundation\\JsonResponse;\n use Symfony\\Component\\HttpFoundation\\Request;\n@@ -63,8 +65,16 @@ public function render(Request $request) {\n throw new BadRequestHttpException(t('No contextual ids specified.'));\n }\n \n+ $tokens = $request->request->get('tokens');\n+ if (!isset($tokens)) {\n+ throw new BadRequestHttpException(t('No contextual ID tokens specified.'));\n+ }\n+\n $rendered = [];\n- foreach ($ids as $id) {\n+ foreach ($ids as $key => $id) {\n+ if (!isset($tokens[$key]) || !Crypt::hashEquals($tokens[$key], Crypt::hmacBase64($id, Settings::getHashSalt() . \\Drupal::service('private_key')->get()))) {\n+ throw new BadRequestHttpException('Invalid contextual ID specified.');\n+ }\n $element = [\n '#type' => 'contextual_links',\n '#contextual_links' => _contextual_id_to_links($id),\ndiff --git a/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php b/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php\nindex 97afde9a24..5e993941a6 100644\n--- a/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php\n+++ b/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php\n@@ -2,6 +2,8 @@\n \n namespace Drupal\\contextual\\Element;\n \n+use Drupal\\Component\\Utility\\Crypt;\n+use Drupal\\Core\\Site\\Settings;\n use Drupal\\Core\\Template\\Attribute;\n use Drupal\\Core\\Render\\Element\\RenderElement;\n use Drupal\\Component\\Render\\FormattableMarkup;\n@@ -43,7 +45,12 @@ public function getInfo() {\n * @see _contextual_links_to_id()\n */\n public static function preRenderPlaceholder(array $element) {\n- $element['#markup'] = new FormattableMarkup('', ['@attributes' => new Attribute(['data-contextual-id' => $element['#id']])]);\n+ $token = Crypt::hmacBase64($element['#id'], Settings::getHashSalt() . \\Drupal::service('private_key')->get());\n+ $attribute = new Attribute([\n+ 'data-contextual-id' => $element['#id'],\n+ 'data-contextual-token' => $token,\n+ ]);\n+ $element['#markup'] = new FormattableMarkup('', ['@attributes' => $attribute]);\n \n return $element;\n }\ndiff --git a/core/modules/contextual/tests/src/Functional/ContextualDynamicContextTest.php b/core/modules/contextual/tests/src/Functional/ContextualDynamicContextTest.php\nindex 340b60821f..74a6d504e8 100644\n--- a/core/modules/contextual/tests/src/Functional/ContextualDynamicContextTest.php\n+++ b/core/modules/contextual/tests/src/Functional/ContextualDynamicContextTest.php\n@@ -3,9 +3,10 @@\n namespace Drupal\\Tests\\contextual\\Functional;\n \n use Drupal\\Component\\Serialization\\Json;\n+use Drupal\\Component\\Utility\\Crypt;\n+use Drupal\\Core\\Site\\Settings;\n use Drupal\\Core\\Url;\n use Drupal\\language\\Entity\\ConfigurableLanguage;\n-use Drupal\\Core\\Template\\Attribute;\n use Drupal\\Tests\\BrowserTestBase;\n \n /**\n@@ -140,17 +141,76 @@ public function testDifferentPermissions() {\n $this->assertRaw('
  • Edit menu - contextual
    • ');\n }\n \n+ /**\n+ * Tests the contextual placeholder content is protected by a token.\n+ */\n+ public function testTokenProtection() {\n+ $this->drupalLogin($this->editorUser);\n+\n+ // Create a node that will have a contextual link.\n+ $node1 = $this->drupalCreateNode(['type' => 'article', 'promote' => 1]);\n+\n+ // Now, on the front page, all article nodes should have contextual links\n+ // placeholders, as should the view that contains them.\n+ $id = 'node:node=' . $node1->id() . ':changed=' . $node1->getChangedTime() . '&langcode=en';\n+\n+ // Editor user: can access contextual links and can edit articles.\n+ $this->drupalGet('node');\n+ $this->assertContextualLinkPlaceHolder($id);\n+\n+ $http_client = $this->getHttpClient();\n+ $url = Url::fromRoute('contextual.render', [], [\n+ 'query' => [\n+ '_format' => 'json',\n+ 'destination' => 'node',\n+ ],\n+ ])->setAbsolute()->toString();\n+\n+ $response = $http_client->request('POST', $url, [\n+ 'cookies' => $this->getSessionCookies(),\n+ 'form_params' => ['ids' => [$id], 'tokens' => []],\n+ 'http_errors' => FALSE,\n+ ]);\n+ $this->assertEquals('400', $response->getStatusCode());\n+ $this->assertContains('No contextual ID tokens specified.', (string) $response->getBody());\n+\n+ $response = $http_client->request('POST', $url, [\n+ 'cookies' => $this->getSessionCookies(),\n+ 'form_params' => ['ids' => [$id], 'tokens' => ['wrong_token']],\n+ 'http_errors' => FALSE,\n+ ]);\n+ $this->assertEquals('400', $response->getStatusCode());\n+ $this->assertContains('Invalid contextual ID specified.', (string) $response->getBody());\n+\n+ $response = $http_client->request('POST', $url, [\n+ 'cookies' => $this->getSessionCookies(),\n+ 'form_params' => ['ids' => [$id], 'tokens' => ['wrong_key' => $this->createContextualIdToken($id)]],\n+ 'http_errors' => FALSE,\n+ ]);\n+ $this->assertEquals('400', $response->getStatusCode());\n+ $this->assertContains('Invalid contextual ID specified.', (string) $response->getBody());\n+\n+ $response = $http_client->request('POST', $url, [\n+ 'cookies' => $this->getSessionCookies(),\n+ 'form_params' => ['ids' => [$id], 'tokens' => [$this->createContextualIdToken($id)]],\n+ 'http_errors' => FALSE,\n+ ]);\n+ $this->assertEquals('200', $response->getStatusCode());\n+ }\n+\n /**\n * Asserts that a contextual link placeholder with the given id exists.\n *\n * @param string $id\n * A contextual link id.\n- *\n- * @return bool\n- * The result of the assertion.\n */\n protected function assertContextualLinkPlaceHolder($id) {\n- return $this->assertRaw(' $id]) . '>', format_string('Contextual link placeholder with id @id exists.', ['@id' => $id]));\n+ $this->assertSession()->elementAttributeContains(\n+ 'css',\n+ 'div[data-contextual-id=\"' . $id . '\"]',\n+ 'data-contextual-token',\n+ $this->createContextualIdToken($id)\n+ );\n }\n \n /**\n@@ -158,12 +218,9 @@ protected function assertContextualLinkPlaceHolder($id) {\n *\n * @param string $id\n * A contextual link id.\n- *\n- * @return bool\n- * The result of the assertion.\n */\n protected function assertNoContextualLinkPlaceHolder($id) {\n- return $this->assertNoRaw(' $id]) . '>', format_string('Contextual link placeholder with id @id does not exist.', ['@id' => $id]));\n+ $this->assertSession()->elementNotExists('css', 'div[data-contextual-id=\"' . $id . '\"]');\n }\n \n /**\n@@ -178,6 +235,7 @@ protected function assertNoContextualLinkPlaceHolder($id) {\n * The response object.\n */\n protected function renderContextualLinks($ids, $current_path) {\n+ $tokens = array_map([$this, 'createContextualIdToken'], $ids);\n $http_client = $this->getHttpClient();\n $url = Url::fromRoute('contextual.render', [], [\n 'query' => [\n@@ -188,9 +246,22 @@ protected function renderContextualLinks($ids, $current_path) {\n \n return $http_client->request('POST', $this->buildUrl($url), [\n 'cookies' => $this->getSessionCookies(),\n- 'form_params' => ['ids' => $ids],\n+ 'form_params' => ['ids' => $ids, 'tokens' => $tokens],\n 'http_errors' => FALSE,\n ]);\n }\n \n+ /**\n+ * Creates a contextual ID token.\n+ *\n+ * @param string $id\n+ * The contextual ID to create a token for.\n+ *\n+ * @return string\n+ * The contextual ID token.\n+ */\n+ protected function createContextualIdToken($id) {\n+ return Crypt::hmacBase64($id, Settings::getHashSalt() . $this->container->get('private_key')->get());\n+ }\n+\n }\ndiff --git a/core/modules/node/src/Tests/Views/NodeContextualLinksTest.php b/core/modules/node/src/Tests/Views/NodeContextualLinksTest.php\ndeleted file mode 100644\nindex dc23d0ce55..0000000000\n--- a/core/modules/node/src/Tests/Views/NodeContextualLinksTest.php\n+++ /dev/null\n@@ -1,118 +0,0 @@\n-drupalCreateContentType(['type' => 'page']);\n- $this->drupalCreateNode(['promote' => 1]);\n- $this->drupalGet('node');\n-\n- $user = $this->drupalCreateUser(['administer nodes', 'access contextual links']);\n- $this->drupalLogin($user);\n-\n- $response = $this->renderContextualLinks(['node:node=1:'], 'node');\n- $this->assertResponse(200);\n- $json = Json::decode($response);\n- $this->setRawContent($json['node:node=1:']);\n-\n- // @todo Add these back when the functionality for making Views displays\n- // appear in contextual links is working again.\n- // $this->assertLinkByHref('node/1/contextual-links', 0, 'The contextual link to the view was found.');\n- // $this->assertLink('Test contextual link', 0, 'The contextual link to the view was found.');\n- }\n-\n- /**\n- * Get server-rendered contextual links for the given contextual link ids.\n- *\n- * Copied from \\Drupal\\contextual\\Tests\\ContextualDynamicContextTest::renderContextualLinks().\n- *\n- * @param array $ids\n- * An array of contextual link ids.\n- * @param string $current_path\n- * The Drupal path for the page for which the contextual links are rendered.\n- *\n- * @return string\n- * The response body.\n- */\n- protected function renderContextualLinks($ids, $current_path) {\n- // Build POST values.\n- $post = [];\n- for ($i = 0; $i < count($ids); $i++) {\n- $post['ids[' . $i . ']'] = $ids[$i];\n- }\n-\n- // Serialize POST values.\n- foreach ($post as $key => $value) {\n- // Encode according to application/x-www-form-urlencoded\n- // Both names and values needs to be urlencoded, according to\n- // http://www.w3.org/TR/html4/interact/forms.html#h-17.13.4.1\n- $post[$key] = urlencode($key) . '=' . urlencode($value);\n- }\n- $post = implode('&', $post);\n-\n- // Perform HTTP request.\n- return $this->curlExec([\n- CURLOPT_URL => \\Drupal::url('contextual.render', [], ['absolute' => TRUE, 'query' => ['destination' => $current_path]]),\n- CURLOPT_POST => TRUE,\n- CURLOPT_POSTFIELDS => $post,\n- CURLOPT_HTTPHEADER => [\n- 'Accept: application/json',\n- 'Content-Type: application/x-www-form-urlencoded',\n- ],\n- ]);\n- }\n-\n- /**\n- * Tests if the node page works if Contextual Links is disabled.\n- *\n- * All views have Contextual links enabled by default, even with the\n- * Contextual links module disabled. This tests if no calls are done to the\n- * Contextual links module by views when it is disabled.\n- *\n- * @see https://www.drupal.org/node/2379811\n- */\n- public function testPageWithDisabledContextualModule() {\n- \\Drupal::service('module_installer')->uninstall(['contextual']);\n- \\Drupal::service('module_installer')->install(['views_ui']);\n-\n- // Ensure that contextual links don't get called for admin users.\n- $admin_user = User::load(1);\n- $admin_user->setPassword('new_password');\n- $admin_user->pass_raw = 'new_password';\n- $admin_user->save();\n-\n- $this->drupalCreateContentType(['type' => 'page']);\n- $this->drupalCreateNode(['promote' => 1]);\n-\n- $this->drupalLogin($admin_user);\n- $this->drupalGet('node');\n- }\n-\n-}\ndiff --git a/core/modules/node/src/Tests/NodeRevisionsTest.php b/core/modules/node/tests/src/Functional/NodeRevisionsTest.php\nsimilarity index 92%\nrename from core/modules/node/src/Tests/NodeRevisionsTest.php\nrename to core/modules/node/tests/src/Functional/NodeRevisionsTest.php\nindex fdc929a84c..6b16ce8bdc 100644\n--- a/core/modules/node/src/Tests/NodeRevisionsTest.php\n+++ b/core/modules/node/tests/src/Functional/NodeRevisionsTest.php\n@@ -1,6 +1,6 @@\n assertTrue($node->isDefaultRevision(), 'Third node revision is the default one.');\n \n- // Confirm that the \"Edit\" and \"Delete\" contextual links appear for the\n- // default revision.\n- $ids = ['node:node=' . $node->id() . ':changed=' . $node->getChangedTime()];\n- $json = $this->renderContextualLinks($ids, 'node/' . $node->id());\n- $this->verbose($json[$ids[0]]);\n-\n- $expected = '
  • id() . '/edit\">Edit
    • ';\n- $this->assertTrue(strstr($json[$ids[0]], $expected), 'The \"Edit\" contextual link is shown for the default revision.');\n- $expected = '
  • id() . '/delete\">Delete
    • ';\n- $this->assertTrue(strstr($json[$ids[0]], $expected), 'The \"Delete\" contextual link is shown for the default revision.');\n-\n // Confirm that revisions revert properly.\n $this->drupalPostForm(\"node/\" . $node->id() . \"/revisions/\" . $nodes[1]->getRevisionid() . \"/revert\", [], t('Revert'));\n $this->assertRaw(t('@type %title has been reverted to the revision from %revision-date.', [\n@@ -188,15 +177,6 @@ public function testRevisions() {\n $node = node_revision_load($node->getRevisionId());\n $this->assertFalse($node->isDefaultRevision(), 'Third node revision is not the default one.');\n \n- // Confirm that \"Edit\" and \"Delete\" contextual links don't appear for\n- // non-default revision.\n- $ids = ['node_revision::node=' . $node->id() . '&node_revision=' . $node->getRevisionId() . ':'];\n- $json = $this->renderContextualLinks($ids, 'node/' . $node->id() . '/revisions/' . $node->getRevisionId() . '/view');\n- $this->verbose($json[$ids[0]]);\n-\n- $this->assertFalse(strstr($json[$ids[0]], '
  • '), 'The \"Edit\" contextual link is not shown for a non-default revision.');\n- $this->assertFalse(strstr($json[$ids[0]], '
  • '), 'The \"Delete\" contextual link is not shown for a non-default revision.');\n-\n // Confirm revisions delete properly.\n $this->drupalPostForm(\"node/\" . $node->id() . \"/revisions/\" . $nodes[1]->getRevisionId() . \"/delete\", [], t('Delete'));\n $this->assertRaw(t('Revision from %revision-date of @type %title has been deleted.', [\ndiff --git a/core/modules/node/src/Tests/NodeTypeTest.php b/core/modules/node/tests/src/Functional/NodeTypeTest.php\nsimilarity index 94%\nrename from core/modules/node/src/Tests/NodeTypeTest.php\nrename to core/modules/node/tests/src/Functional/NodeTypeTest.php\nindex 9938bb0ab5..84c549e8d5 100644\n--- a/core/modules/node/src/Tests/NodeTypeTest.php\n+++ b/core/modules/node/tests/src/Functional/NodeTypeTest.php\n@@ -1,11 +1,12 @@\n assertSession();\n $this->drupalPlaceBlock('system_breadcrumb_block');\n $web_user = $this->drupalCreateUser(['bypass node access', 'administer content types', 'administer node fields']);\n $this->drupalLogin($web_user);\n@@ -96,8 +99,8 @@ public function testNodeTypeEditing() {\n \n // Verify that title and body fields are displayed.\n $this->drupalGet('node/add/page');\n- $this->assertRaw('Title', 'Title field was found.');\n- $this->assertRaw('Body', 'Body field was found.');\n+ $assert->pageTextContains('Title');\n+ $assert->pageTextContains('Body');\n \n // Rename the title field.\n $edit = [\n@@ -106,8 +109,8 @@ public function testNodeTypeEditing() {\n $this->drupalPostForm('admin/structure/types/manage/page', $edit, t('Save content type'));\n \n $this->drupalGet('node/add/page');\n- $this->assertRaw('Foo', 'New title label was displayed.');\n- $this->assertNoRaw('Title', 'Old title label was not displayed.');\n+ $assert->pageTextContains('Foo');\n+ $assert->pageTextNotContains('Title');\n \n // Change the name and the description.\n $edit = [\n@@ -117,11 +120,11 @@ public function testNodeTypeEditing() {\n $this->drupalPostForm('admin/structure/types/manage/page', $edit, t('Save content type'));\n \n $this->drupalGet('node/add');\n- $this->assertRaw('Bar', 'New name was displayed.');\n- $this->assertRaw('Lorem ipsum', 'New description was displayed.');\n+ $assert->pageTextContains('Bar');\n+ $assert->pageTextContains('Lorem ipsum');\n $this->clickLink('Bar');\n- $this->assertRaw('Foo', 'Title field was found.');\n- $this->assertRaw('Body', 'Body field was found.');\n+ $assert->pageTextContains('Foo');\n+ $assert->pageTextContains('Body');\n \n // Change the name through the API\n /** @var \\Drupal\\node\\NodeTypeInterface $node_type */\n@@ -146,7 +149,7 @@ public function testNodeTypeEditing() {\n ]);\n // Check that the body field doesn't exist.\n $this->drupalGet('node/add/page');\n- $this->assertNoRaw('Body', 'Body field was not found.');\n+ $assert->pageTextNotContains('Body');\n }\n \n /**\ndiff --git a/core/modules/node/src/Tests/PagePreviewTest.php b/core/modules/node/tests/src/Functional/PagePreviewTest.php\nsimilarity index 97%\nrename from core/modules/node/src/Tests/PagePreviewTest.php\nrename to core/modules/node/tests/src/Functional/PagePreviewTest.php\nindex 2bc9cd3ce1..70305349d4 100644\n--- a/core/modules/node/src/Tests/PagePreviewTest.php\n+++ b/core/modules/node/tests/src/Functional/PagePreviewTest.php\n@@ -1,6 +1,6 @@\n drupalPostForm(NULL, ['field_image[0][alt]' => 'Picture of llamas'], t('Preview'));\n \n // Check that the preview is displaying the title, body and term.\n- $this->assertTitle(t('@title | Drupal', ['@title' => $edit[$title_key]]), 'Basic page title is preview.');\n+ $expected_title = $edit[$title_key] . ' | Drupal';\n+ $this->assertSession()->titleEquals($expected_title);\n $this->assertEscaped($edit[$title_key], 'Title displayed and escaped.');\n $this->assertText($edit[$body_key], 'Body displayed.');\n $this->assertText($edit[$term_key], 'Term displayed.');\n@@ -210,13 +215,13 @@ public function testPagePreview() {\n $this->assertFieldByName($body_key, $edit[$body_key], 'Body field displayed.');\n $this->assertFieldByName($term_key, $edit[$term_key], 'Term field displayed.');\n $this->assertFieldByName('field_image[0][alt]', 'Picture of llamas');\n- $this->drupalPostAjaxForm(NULL, [], ['field_test_multi_add_more' => t('Add another item')], NULL, [], [], 'node-page-form');\n+ $this->getSession()->getPage()->pressButton('Add another item');\n $this->assertFieldByName('field_test_multi[0][value]');\n $this->assertFieldByName('field_test_multi[1][value]');\n \n // Return to page preview to check everything is as expected.\n $this->drupalPostForm(NULL, [], t('Preview'));\n- $this->assertTitle(t('@title | Drupal', ['@title' => $edit[$title_key]]), 'Basic page title is preview.');\n+ $this->assertSession()->titleEquals($expected_title);\n $this->assertEscaped($edit[$title_key], 'Title displayed and escaped.');\n $this->assertText($edit[$body_key], 'Body displayed.');\n $this->assertText($edit[$term_key], 'Term displayed.');\n@@ -353,8 +358,8 @@ public function testPagePreview() {\n $this->assertText('Basic page ' . $title . ' has been created.');\n $node = $this->drupalGetNodeByTitle($title);\n $this->drupalGet('node/' . $node->id() . '/edit');\n- $this->drupalPostAjaxForm(NULL, [], ['field_test_multi_add_more' => t('Add another item')]);\n- $this->drupalPostAjaxForm(NULL, [], ['field_test_multi_add_more' => t('Add another item')]);\n+ $this->getSession()->getPage()->pressButton('Add another item');\n+ $this->getSession()->getPage()->pressButton('Add another item');\n $edit = [\n 'field_test_multi[1][value]' => $example_text_2,\n 'field_test_multi[2][value]' => $example_text_3,\ndiff --git a/core/modules/node/tests/src/Functional/Views/NodeContextualLinksTest.php b/core/modules/node/tests/src/Functional/Views/NodeContextualLinksTest.php\nnew file mode 100644\nindex 0000000000..73ccfef758\n--- /dev/null\n+++ b/core/modules/node/tests/src/Functional/Views/NodeContextualLinksTest.php\n@@ -0,0 +1,47 @@\n+uninstall(['contextual']);\n+ \\Drupal::service('module_installer')->install(['views_ui']);\n+\n+ // Ensure that contextual links don't get called for admin users.\n+ $admin_user = User::load(1);\n+ $admin_user->setPassword('new_password');\n+ $admin_user->passRaw = 'new_password';\n+ $admin_user->save();\n+\n+ $this->drupalCreateContentType(['type' => 'page']);\n+ $this->drupalCreateNode(['promote' => 1]);\n+\n+ $this->drupalLogin($admin_user);\n+ $this->drupalGet('node');\n+ }\n+\n+}\ndiff --git a/core/modules/node/tests/src/FunctionalJavascript/ContextualLinksTest.php b/core/modules/node/tests/src/FunctionalJavascript/ContextualLinksTest.php\nnew file mode 100644\nindex 0000000000..98051262ec\n--- /dev/null\n+++ b/core/modules/node/tests/src/FunctionalJavascript/ContextualLinksTest.php\n@@ -0,0 +1,117 @@\n+drupalCreateContentType([\n+ 'type' => 'page',\n+ 'name' => 'Basic page',\n+ 'display_submitted' => FALSE,\n+ ]);\n+\n+ // Create initial node.\n+ $node = $this->drupalCreateNode();\n+\n+ $nodes = [];\n+\n+ // Get original node.\n+ $nodes[] = clone $node;\n+\n+ // Create two revisions.\n+ $revision_count = 2;\n+ for ($i = 0; $i < $revision_count; $i++) {\n+\n+ // Create revision with a random title and body and update variables.\n+ $node->title = $this->randomMachineName();\n+ $node->body = [\n+ 'value' => $this->randomMachineName(32),\n+ 'format' => filter_default_format(),\n+ ];\n+ $node->setNewRevision();\n+\n+ $node->save();\n+\n+ // Make sure we get revision information.\n+ $node = Node::load($node->id());\n+ $nodes[] = clone $node;\n+ }\n+\n+ $this->nodes = $nodes;\n+\n+ $this->drupalLogin($this->createUser(\n+ [\n+ 'view page revisions',\n+ 'revert page revisions',\n+ 'delete page revisions',\n+ 'edit any page content',\n+ 'delete any page content',\n+ 'access contextual links',\n+ 'administer content types',\n+ ]\n+ ));\n+ }\n+\n+ /**\n+ * Tests the contextual links on revisions.\n+ */\n+ public function testRevisionContextualLinks() {\n+ // Confirm that the \"Edit\" and \"Delete\" contextual links appear for the\n+ // default revision.\n+ $this->drupalGet('node/' . $this->nodes[0]->id());\n+ $page = $this->getSession()->getPage();\n+ $page->waitFor(10, function () use ($page) {\n+ return $page->find('css', \"main .contextual\");\n+ });\n+\n+ $this->toggleContextualTriggerVisibility('main');\n+ $page->find('css', 'main .contextual button')->press();\n+ $links = $page->findAll('css', \"main .contextual-links li a\");\n+\n+ $this->assertEquals('Edit', $links[0]->getText());\n+ $this->assertEquals('Delete', $links[1]->getText());\n+\n+ // Confirm that \"Edit\" and \"Delete\" contextual links don't appear for\n+ // non-default revision.\n+ $this->drupalGet(\"node/\" . $this->nodes[0]->id() . \"/revisions/\" . $this->nodes[1]->getRevisionId() . \"/view\");\n+ $this->assertSession()->pageTextContains($this->nodes[1]->getTitle());\n+ $page->waitFor(10, function () use ($page) {\n+ return $page->find('css', \"main .contextual\");\n+ });\n+\n+ $this->toggleContextualTriggerVisibility('main');\n+ $contextual_button = $page->find('css', 'main .contextual button');\n+ $this->assertEmpty(0, $contextual_button);\n+ }\n+\n+}\ndiff --git a/core/modules/path/tests/src/Functional/PathAliasTest.php b/core/modules/path/tests/src/Functional/PathAliasTest.php\nindex b8ac5968db..19115cd27b 100644\n--- a/core/modules/path/tests/src/Functional/PathAliasTest.php\n+++ b/core/modules/path/tests/src/Functional/PathAliasTest.php\n@@ -4,6 +4,7 @@\n \n use Drupal\\Core\\Cache\\Cache;\n use Drupal\\Core\\Database\\Database;\n+use Drupal\\Core\\Url;\n \n /**\n * Add, edit, delete, and change alias and verify its consistency in the\n@@ -24,7 +25,7 @@ protected function setUp() {\n parent::setUp();\n \n // Create test user and log in.\n- $web_user = $this->drupalCreateUser(['create page content', 'edit own page content', 'administer url aliases', 'create url aliases']);\n+ $web_user = $this->drupalCreateUser(['create page content', 'edit own page content', 'administer url aliases', 'create url aliases', 'access content overview']);\n $this->drupalLogin($web_user);\n }\n \n@@ -327,6 +328,34 @@ public function testNodeAlias() {\n $node5->delete();\n $path_alias = \\Drupal::service('path.alias_storage')->lookupPathAlias('/node/' . $node5->id(), $node5->language()->getId());\n $this->assertFalse($path_alias, 'Alias was successfully deleted when the referenced node was deleted.');\n+\n+ // Create sixth test node.\n+ $node6 = $this->drupalCreateNode();\n+\n+ // Create an invalid alias with two leading slashes and verify that the\n+ // extra slash is removed when the link is generated. This ensures that URL\n+ // aliases cannot be used to inject external URLs.\n+ // @todo The user interface should either display an error message or\n+ // automatically trim these invalid aliases, rather than allowing them to\n+ // be silently created, at which point the functional aspects of this\n+ // test will need to be moved elsewhere and switch to using a\n+ // programmatically-created alias instead.\n+ $alias = $this->randomMachineName(8);\n+ $edit = ['path[0][alias]' => '//' . $alias];\n+ $this->drupalPostForm($node6->toUrl('edit-form'), $edit, t('Save'));\n+ $this->drupalGet(Url::fromRoute('system.admin_content'));\n+ // This checks the link href before clicking it, rather than using\n+ // \\Drupal\\Tests\\BrowserTestBase::assertSession()->addressEquals() after\n+ // clicking it, because the test browser does not always preserve the\n+ // correct number of slashes in the URL when it visits internal links;\n+ // using \\Drupal\\Tests\\BrowserTestBase::assertSession()->addressEquals()\n+ // would actually make the test pass unconditionally on the testbot (or\n+ // anywhere else where Drupal is installed in a subdirectory).\n+ $link_xpath = $this->xpath('//a[normalize-space(text())=:label]', [':label' => $node6->getTitle()]);\n+ $link_href = $link_xpath[0]->getAttribute('href');\n+ $this->assertEquals($link_href, base_path() . $alias);\n+ $this->clickLink($node6->getTitle());\n+ $this->assertResponse(404);\n }\n \n /**\ndiff --git a/core/modules/system/src/Tests/Routing/RouterTest.php b/core/modules/system/src/Tests/Routing/RouterTest.php\nindex 83a9c55b39..8d7c43e86a 100644\n--- a/core/modules/system/src/Tests/Routing/RouterTest.php\n+++ b/core/modules/system/src/Tests/Routing/RouterTest.php\n@@ -320,6 +320,13 @@ public function testLeadingSlashes() {\n $this->drupalGet($url);\n $this->assertEqual(1, $this->redirectCount, $url . \" redirected to \" . $this->url);\n $this->assertUrl($request->getUriForPath('/router_test/test1') . '?qs=test');\n+\n+ // Ensure that external URLs in destination query params are not redirected\n+ // to.\n+ $url = $request->getUriForPath('/////////////////////////////////////////////////router_test/test1') . '?qs=test&destination=http://www.example.com%5c@drupal8alt.test';\n+ $this->drupalGet($url);\n+ $this->assertEqual(1, $this->redirectCount, $url . \" redirected to \" . $this->url);\n+ $this->assertUrl($request->getUriForPath('/router_test/test1') . '?qs=test');\n }\n \n }\ndiff --git a/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php b/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php\nindex d185219c9a..beaa472c26 100644\n--- a/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php\n+++ b/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php\n@@ -563,6 +563,10 @@ public function providerTestExternalIsLocal() {\n ['http://example.com/foo', 'http://example.com/bar', FALSE],\n ['http://example.com', 'http://example.com/bar', FALSE],\n ['http://example.com/bar', 'http://example.com/bar/', FALSE],\n+ // Ensure \\ is normalised to / since some browsers do that.\n+ ['http://www.example.ca\\@example.com', 'http://example.com', FALSE],\n+ // Some browsers ignore or strip leading control characters.\n+ [\"\\x00//www.example.ca\", 'http://example.com', FALSE],\n ];\n }\n \ndiff --git a/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php b/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php\nindex 8659a6f126..85b3da313c 100644\n--- a/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php\n+++ b/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php\n@@ -11,7 +11,6 @@\n use Symfony\\Component\\HttpFoundation\\RedirectResponse;\n use Symfony\\Component\\HttpFoundation\\Request;\n use Symfony\\Component\\HttpKernel\\Event\\FilterResponseEvent;\n-use Symfony\\Component\\HttpKernel\\Event\\GetResponseEvent;\n use Symfony\\Component\\HttpKernel\\HttpKernelInterface;\n use Symfony\\Component\\HttpKernel\\KernelEvents;\n \n@@ -192,74 +191,4 @@ public function providerTestDestinationRedirectWithInvalidUrl() {\n return $data;\n }\n \n- /**\n- * Tests that $_GET only contain internal URLs.\n- *\n- * @covers ::sanitizeDestination\n- *\n- * @dataProvider providerTestSanitizeDestination\n- *\n- * @see \\Drupal\\Component\\Utility\\UrlHelper::isExternal\n- */\n- public function testSanitizeDestinationForGet($input, $output) {\n- $request = new Request();\n- $request->query->set('destination', $input);\n-\n- $listener = new RedirectResponseSubscriber($this->urlAssembler, $this->requestContext);\n- $kernel = $this->getMock('Symfony\\Component\\HttpKernel\\HttpKernelInterface');\n- $event = new GetResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST);\n-\n- $dispatcher = new EventDispatcher();\n- $dispatcher->addListener(KernelEvents::REQUEST, [$listener, 'sanitizeDestination'], 100);\n- $dispatcher->dispatch(KernelEvents::REQUEST, $event);\n-\n- $this->assertEquals($output, $request->query->get('destination'));\n- }\n-\n- /**\n- * Tests that $_REQUEST['destination'] only contain internal URLs.\n- *\n- * @covers ::sanitizeDestination\n- *\n- * @dataProvider providerTestSanitizeDestination\n- *\n- * @see \\Drupal\\Component\\Utility\\UrlHelper::isExternal\n- */\n- public function testSanitizeDestinationForPost($input, $output) {\n- $request = new Request();\n- $request->request->set('destination', $input);\n-\n- $listener = new RedirectResponseSubscriber($this->urlAssembler, $this->requestContext);\n- $kernel = $this->getMock('Symfony\\Component\\HttpKernel\\HttpKernelInterface');\n- $event = new GetResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST);\n-\n- $dispatcher = new EventDispatcher();\n- $dispatcher->addListener(KernelEvents::REQUEST, [$listener, 'sanitizeDestination'], 100);\n- $dispatcher->dispatch(KernelEvents::REQUEST, $event);\n-\n- $this->assertEquals($output, $request->request->get('destination'));\n- }\n-\n- /**\n- * Data provider for testSanitizeDestination().\n- */\n- public function providerTestSanitizeDestination() {\n- $data = [];\n- // Standard internal example node path is present in the 'destination'\n- // parameter.\n- $data[] = ['node', 'node'];\n- // Internal path with one leading slash is allowed.\n- $data[] = ['/example.com', '/example.com'];\n- // External URL without scheme is not allowed.\n- $data[] = ['//example.com/test', ''];\n- // Internal URL using a colon is allowed.\n- $data[] = ['example:test', 'example:test'];\n- // External URL is not allowed.\n- $data[] = ['http://example.com', ''];\n- // Javascript URL is allowed because it is treated as an internal URL.\n- $data[] = ['javascript:alert(0)', 'javascript:alert(0)'];\n-\n- return $data;\n- }\n-\n }\ndiff --git a/core/tests/Drupal/Tests/Core/Mail/MailManagerTest.php b/core/tests/Drupal/Tests/Core/Mail/MailManagerTest.php\nindex ea523028a8..de2e3d943f 100644\n--- a/core/tests/Drupal/Tests/Core/Mail/MailManagerTest.php\n+++ b/core/tests/Drupal/Tests/Core/Mail/MailManagerTest.php\n@@ -7,6 +7,7 @@\n \n namespace Drupal\\Tests\\Core\\Mail;\n \n+use Drupal\\Core\\DependencyInjection\\ContainerBuilder;\n use Drupal\\Core\\Render\\RenderContext;\n use Drupal\\Core\\Render\\RendererInterface;\n use Drupal\\Tests\\UnitTestCase;\n@@ -103,6 +104,9 @@ protected function setUpMailManager($interface = []) {\n 'system.mail' => [\n 'interface' => $interface,\n ],\n+ 'system.site' => [\n+ 'mail' => 'test@example.com',\n+ ],\n ]);\n $logger_factory = $this->getMock('\\Drupal\\Core\\Logger\\LoggerChannelFactoryInterface');\n $string_translation = $this->getStringTranslationStub();\n@@ -110,6 +114,11 @@ protected function setUpMailManager($interface = []) {\n // Construct the manager object and override its discovery.\n $this->mailManager = new TestMailManager(new \\ArrayObject(), $this->cache, $this->moduleHandler, $this->configFactory, $logger_factory, $string_translation, $this->renderer);\n $this->mailManager->setDiscovery($this->discovery);\n+\n+ // @see \\Drupal\\Core\\Plugin\\Factory\\ContainerFactory::createInstance()\n+ $container = new ContainerBuilder();\n+ $container->set('config.factory', $this->configFactory);\n+ \\Drupal::setContainer($container);\n }\n \n /**\ndiff --git a/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php b/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php\nindex 53147f3b7d..e828de086e 100644\n--- a/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php\n+++ b/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php\n@@ -197,6 +197,147 @@ public function providerTestRequestSanitization() {\n return $tests;\n }\n \n+ /**\n+ * Tests acceptable destinations are not removed from GET requests.\n+ *\n+ * @param string $destination\n+ * The destination string to test.\n+ *\n+ * @dataProvider providerTestAcceptableDestinations\n+ */\n+ public function testAcceptableDestinationGet($destination) {\n+ // Set up a GET request.\n+ $request = $this->createRequestForTesting(['destination' => $destination]);\n+\n+ $request = RequestSanitizer::sanitize($request, [], TRUE);\n+\n+ $this->assertSame($destination, $request->query->get('destination', NULL));\n+ $this->assertNull($request->request->get('destination', NULL));\n+ $this->assertSame($destination, $_GET['destination']);\n+ $this->assertSame($destination, $_REQUEST['destination']);\n+ $this->assertArrayNotHasKey('destination', $_POST);\n+ $this->assertEquals([], $this->errors);\n+ }\n+\n+ /**\n+ * Tests unacceptable destinations are removed from GET requests.\n+ *\n+ * @param string $destination\n+ * The destination string to test.\n+ *\n+ * @dataProvider providerTestSanitizedDestinations\n+ */\n+ public function testSanitizedDestinationGet($destination) {\n+ // Set up a GET request.\n+ $request = $this->createRequestForTesting(['destination' => $destination]);\n+\n+ $request = RequestSanitizer::sanitize($request, [], TRUE);\n+\n+ $this->assertNull($request->request->get('destination', NULL));\n+ $this->assertNull($request->query->get('destination', NULL));\n+ $this->assertArrayNotHasKey('destination', $_POST);\n+ $this->assertArrayNotHasKey('destination', $_REQUEST);\n+ $this->assertArrayNotHasKey('destination', $_GET);\n+ $this->assertError('Potentially unsafe destination removed from query parameter bag because it points to an external URL.', E_USER_NOTICE);\n+ }\n+\n+ /**\n+ * Tests acceptable destinations are not removed from POST requests.\n+ *\n+ * @param string $destination\n+ * The destination string to test.\n+ *\n+ * @dataProvider providerTestAcceptableDestinations\n+ */\n+ public function testAcceptableDestinationPost($destination) {\n+ // Set up a POST request.\n+ $request = $this->createRequestForTesting([], ['destination' => $destination]);\n+\n+ $request = RequestSanitizer::sanitize($request, [], TRUE);\n+\n+ $this->assertSame($destination, $request->request->get('destination', NULL));\n+ $this->assertNull($request->query->get('destination', NULL));\n+ $this->assertSame($destination, $_POST['destination']);\n+ $this->assertSame($destination, $_REQUEST['destination']);\n+ $this->assertArrayNotHasKey('destination', $_GET);\n+ $this->assertEquals([], $this->errors);\n+ }\n+\n+ /**\n+ * Tests unacceptable destinations are removed from GET requests.\n+ *\n+ * @param string $destination\n+ * The destination string to test.\n+ *\n+ * @dataProvider providerTestSanitizedDestinations\n+ */\n+ public function testSanitizedDestinationPost($destination) {\n+ // Set up a POST request.\n+ $request = $this->createRequestForTesting([], ['destination' => $destination]);\n+\n+ $request = RequestSanitizer::sanitize($request, [], TRUE);\n+\n+ $this->assertNull($request->request->get('destination', NULL));\n+ $this->assertNull($request->query->get('destination', NULL));\n+ $this->assertArrayNotHasKey('destination', $_POST);\n+ $this->assertArrayNotHasKey('destination', $_REQUEST);\n+ $this->assertArrayNotHasKey('destination', $_GET);\n+ $this->assertError('Potentially unsafe destination removed from request parameter bag because it points to an external URL.', E_USER_NOTICE);\n+ }\n+\n+ /**\n+ * Creates a request and sets PHP globals for testing.\n+ *\n+ * @param array $query\n+ * (optional) The GET parameters.\n+ * @param array $request\n+ * (optional) The POST parameters.\n+ *\n+ * @return \\Symfony\\Component\\HttpFoundation\\Request\n+ * The request object.\n+ */\n+ protected function createRequestForTesting(array $query = [], array $request = []) {\n+ $request = new Request($query, $request);\n+\n+ // Set up globals.\n+ $_GET = $request->query->all();\n+ $_POST = $request->request->all();\n+ $_COOKIE = $request->cookies->all();\n+ $_REQUEST = array_merge($request->query->all(), $request->request->all());\n+ $request->server->set('QUERY_STRING', http_build_query($request->query->all()));\n+ $_SERVER['QUERY_STRING'] = $request->server->get('QUERY_STRING');\n+ return $request;\n+ }\n+\n+ /**\n+ * Data provider for testing acceptable destinations.\n+ */\n+ public function providerTestAcceptableDestinations() {\n+ $data = [];\n+ // Standard internal example node path is present in the 'destination'\n+ // parameter.\n+ $data[] = ['node'];\n+ // Internal path with one leading slash is allowed.\n+ $data[] = ['/example.com'];\n+ // Internal URL using a colon is allowed.\n+ $data[] = ['example:test'];\n+ // Javascript URL is allowed because it is treated as an internal URL.\n+ $data[] = ['javascript:alert(0)'];\n+ return $data;\n+ }\n+\n+ /**\n+ * Data provider for testing sanitized destinations.\n+ */\n+ public function providerTestSanitizedDestinations() {\n+ $data = [];\n+ // External URL without scheme is not allowed.\n+ $data[] = ['//example.com/test'];\n+ // External URL is not allowed.\n+ $data[] = ['http://example.com'];\n+ return $data;\n+ }\n+\n /**\n * Catches and logs errors to $this->errors.\n *\n-- \n2.14.1\n\n" }, { "path": "aegir/patches/992540-3-reset_flood_limit_on_password_reset-drush.patch", "content": "diff --git modules/user/user.pages.inc modules/user/user.pages.inc\nindex 697a82d..797e3d1 100644\n--- modules/user/user.pages.inc\n+++ modules/user/user.pages.inc\n@@ -135,6 +135,16 @@ function user_pass_reset($form, &$form_state, $uid, $timestamp, $hashed_pass, $a\n // Let the user's password be changed without the current password check.\n $token = drupal_hash_base64(drupal_random_bytes(55));\n $_SESSION['pass_reset_' . $user->uid] = $token;\n+ //clear out flood event for user trying to log in too many times\n+ if (variable_get('user_failed_login_identifier_uid_only', FALSE)) {\n+ $identifier = $account->uid;\n+ }\n+ else {\n+ $identifier = $account->uid . '-' . ip_address();\n+ }\n+ flood_clear_event('failed_login_attempt_user', $identifier);\n+ //also clear out the ip attempts for that user\n+ flood_clear_event('failed_login_attempt_ip');\n drupal_goto('user/' . $user->uid . '/edit', array('query' => array('pass-reset-token' => $token)));\n }\n else {\n@@ -319,6 +329,15 @@ function user_profile_form_submit($form, &$form_state) {\n // Remove the password reset tag since a new password was saved.\n unset($_SESSION['pass_reset_'. $account->uid]);\n }\n+\n+ // Clear the flood table. Since we don't know the IP address for this user\n+ // we can't use flood_clear_event because we need to use the LIKE operator.\n+ $identifier = $account->uid .'-%';\n+ db_delete('flood')\n+ ->condition('event', 'failed_login_attempt_user')\n+ ->condition('identifier', $identifier, 'LIKE')\n+ ->execute();\n+\n // Clear the page cache because pages can contain usernames and/or profile information:\n cache_clear_all();\n \ndiff --git modules/user/user.test modules/user/user.test\nindex 6ecbfac..5c13145 100644\n--- modules/user/user.test\n+++ modules/user/user.test\n@@ -396,6 +396,67 @@ class UserLoginTestCase extends DrupalWebTestCase {\n }\n \n /**\n+ * Test that flood events are removed after an account has been updated.\n+ */\n+ function testUpdatedUserFloodControl() {\n+ // Set a high global limit out so that it is not relevant in the test.\n+ variable_set('user_failed_login_ip_limit', 4000);\n+ // Set the per-user login limit.\n+ variable_set('user_failed_login_user_limit', 3);\n+\n+ $user1 = $this->drupalCreateUser(array('administer users'));\n+ $user2 = $this->drupalCreateUser(array());\n+ $user2->pass_raw .= 'incorrect';\n+\n+ // Try 3 failed logins.\n+ for ($i = 0; $i < 3; $i++) {\n+ $this->assertFailedLogin($user2);\n+ }\n+\n+ // The next login trial should result in an user-based flood error message.\n+ $this->assertFailedLogin($user2, 'user');\n+\n+ // Update the account and assert the user can login again.\n+ $this->drupalLogin($user1);\n+ $user2->pass_raw = 'goodpass';\n+ $edit = array(\n+ 'pass[pass1]' => $user2->pass_raw,\n+ 'pass[pass2]' => $user2->pass_raw,\n+ );\n+ $this->drupalPost('user/' . $user2->uid . '/edit', $edit, t('Save'));\n+ $this->drupalLogout();\n+ $this->drupalLogin($user2);\n+ }\n+\n+ /**\n+ * Test that flood events are removed after password reset.\n+ */\n+ function testResetPasswordFloodControl() {\n+ // Set a high global limit out so that it is not relevant in the test.\n+ variable_set('user_failed_login_ip_limit', 4000);\n+ // Set the per-user login limit.\n+ variable_set('user_failed_login_user_limit', 3);\n+\n+ $user1 = $this->drupalCreateUser();\n+ $correct = $user1->pass_raw;\n+ $user1->pass_raw .= 'incorrect';\n+\n+ // Try 3 failed logins.\n+ for ($i = 0; $i < 3; $i++) {\n+ $this->assertFailedLogin($user1);\n+ }\n+\n+ // The next login trial should result in an user-based flood error message.\n+ $this->assertFailedLogin($user1, 'user');\n+\n+ // Request new password, logout and login.\n+ $this->drupalPost(user_pass_reset_url($user1), array(), t('Log in'));\n+ $this->drupalLogout();\n+ $user1->pass_raw = $correct;\n+ $this->drupalLogin($user1);\n+ }\n+\n+ /**\n * Test that user password is re-hashed upon login after changing $count_log2.\n */\n function testPasswordRehashOnLogin() {\n" }, { "path": "aegir/patches/MailManagerReplacement.php.patch", "content": "--- src/MailManagerReplacement.php.org\t2024-01-25 12:04:50.463753755 +0100\n+++ src/MailManagerReplacement.php\t2024-01-25 12:02:53.223548904 +0100\n@@ -86,17 +86,19 @@\n \n // Create an email from the array.\n $builder = $this->emailBuilderManager->createInstanceFromMessage($message);\n- $email = $builder->fromArray($this->emailFactory, $message);\n+ if ($builder) {\n+ $email = $builder->fromArray($this->emailFactory, $message);\n \n- if ($send) {\n- $message['result'] = $email->send();\n- }\n- else {\n- // We set 'result' to NULL, because FALSE indicates an error in sending.\n- $message['result'] = NULL;\n- }\n+ if ($send) {\n+ $message['result'] = $email->send();\n+ }\n+ else {\n+ // We set 'result' to NULL, because FALSE indicates an error in sending.\n+ $message['result'] = NULL;\n+ }\n \n- $this->legacyHelper->emailToArray($email, $message);\n+ $this->legacyHelper->emailToArray($email, $message);\n+ }\n return $message;\n }\n \n" }, { "path": "aegir/patches/PHP-5.6.31-OpenSSL-1.1.0-compatibility-20170801.patch", "content": "diff -rupN php-5.6.31.orig/ext/openssl/openssl.c php-5.6.31/ext/openssl/openssl.c\n--- php-5.6.31.orig/ext/openssl/openssl.c\t2017-07-06 00:25:00.000000000 +0200\n+++ php-5.6.31/ext/openssl/openssl.c\t2017-08-01 10:55:28.108819344 +0200\n@@ -42,6 +42,12 @@\n \n /* OpenSSL includes */\n #include \n+#if OPENSSL_VERSION_NUMBER >= 0x10002000L\n+#include \n+#include \n+#include \n+#include \n+#endif\n #include \n #include \n #include \n@@ -531,6 +537,133 @@ zend_module_entry openssl_module_entry =\n ZEND_GET_MODULE(openssl)\n #endif\n \n+/* {{{ OpenSSL compatibility functions and macros */\n+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)\n+#define EVP_PKEY_get0_RSA(_pkey) _pkey->pkey.rsa\n+#define EVP_PKEY_get0_DH(_pkey) _pkey->pkey.dh\n+#define EVP_PKEY_get0_DSA(_pkey) _pkey->pkey.dsa\n+#define EVP_PKEY_get0_EC_KEY(_pkey) _pkey->pkey.ec\n+\n+static int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d)\n+{\n+\tr->n = n;\n+\tr->e = e;\n+\tr->d = d;\n+\n+\treturn 1;\n+}\n+\n+static int RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q)\n+{\n+\tr->p = p;\n+\tr->q = q;\n+\n+\treturn 1;\n+}\n+\n+static int RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp)\n+{\n+\tr->dmp1 = dmp1;\n+\tr->dmq1 = dmq1;\n+\tr->iqmp = iqmp;\n+\n+\treturn 1;\n+}\n+\n+static void RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e, const BIGNUM **d)\n+{\n+\t*n = r->n;\n+\t*e = r->e;\n+\t*d = r->d;\n+}\n+\n+static void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q)\n+{\n+\t*p = r->p;\n+\t*q = r->q;\n+}\n+\n+static void RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1, const BIGNUM **iqmp)\n+{\n+\t*dmp1 = r->dmp1;\n+\t*dmq1 = r->dmq1;\n+\t*iqmp = r->iqmp;\n+}\n+\n+static void DH_get0_pqg(const DH *dh, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g)\n+{\n+\t*p = dh->p;\n+\t*q = dh->q;\n+\t*g = dh->g;\n+}\n+\n+static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)\n+{\n+\tdh->p = p;\n+\tdh->q = q;\n+\tdh->g = g;\n+\n+\treturn 1;\n+}\n+\n+static void DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key)\n+{\n+\t*pub_key = dh->pub_key;\n+\t*priv_key = dh->priv_key;\n+}\n+\n+static int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key)\n+{\n+\tdh->pub_key = pub_key;\n+\tdh->priv_key = priv_key;\n+\n+\treturn 1;\n+}\n+\n+static void DSA_get0_pqg(const DSA *d, const BIGNUM **p, const BIGNUM **q, const BIGNUM **g)\n+{\n+\t*p = d->p;\n+\t*q = d->q;\n+\t*g = d->g;\n+}\n+\n+int DSA_set0_pqg(DSA *d, BIGNUM *p, BIGNUM *q, BIGNUM *g)\n+{\n+\td->p = p;\n+\td->q = q;\n+\td->g = g;\n+\n+\treturn 1;\n+}\n+\n+static void DSA_get0_key(const DSA *d, const BIGNUM **pub_key, const BIGNUM **priv_key)\n+{\n+\t*pub_key = d->pub_key;\n+\t*priv_key = d->priv_key;\n+}\n+\n+int DSA_set0_key(DSA *d, BIGNUM *pub_key, BIGNUM *priv_key)\n+{\n+\td->pub_key = pub_key;\n+\td->priv_key = priv_key;\n+\n+\treturn 1;\n+}\n+\n+#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined (LIBRESSL_VERSION_NUMBER)\n+#define EVP_PKEY_id(_pkey) _pkey->type\n+#define EVP_PKEY_base_id(_key) EVP_PKEY_type(_key->type)\n+\n+static int X509_get_signature_nid(const X509 *x)\n+{\n+\treturn OBJ_obj2nid(x->sig_alg->algorithm);\n+}\n+\n+#endif\n+\n+#endif\n+/* }}} */\n+\n static int le_key;\n static int le_x509;\n static int le_csr;\n@@ -825,7 +958,7 @@ static int add_oid_section(struct php_x5\n \t}\n \tfor (i = 0; i < sk_CONF_VALUE_num(sktmp); i++) {\n \t\tcnf = sk_CONF_VALUE_value(sktmp, i);\n-\t\tif (OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) {\n+\t\tif (OBJ_sn2nid(cnf->name) == NID_undef && OBJ_ln2nid(cnf->name) == NID_undef && OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) {\n \t\t\tphp_error_docref(NULL TSRMLS_CC, E_WARNING, \"problem creating object %s=%s\", cnf->name, cnf->value);\n \t\t\treturn FAILURE;\n \t\t}\n@@ -967,7 +1100,7 @@ static void php_openssl_dispose_config(s\n }\n /* }}} */\n \n-#ifdef PHP_WIN32\n+#if defined(PHP_WIN32) || (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER))\n #define PHP_OPENSSL_RAND_ADD_TIME() ((void) 0)\n #else\n #define PHP_OPENSSL_RAND_ADD_TIME() php_openssl_rand_add_timeval()\n@@ -1053,9 +1186,11 @@ static EVP_MD * php_openssl_get_evp_md_f\n \t\t\tmdtype = (EVP_MD *) EVP_md2();\n \t\t\tbreak;\n #endif\n+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)\n \t\tcase OPENSSL_ALGO_DSS1:\n \t\t\tmdtype = (EVP_MD *) EVP_dss1();\n \t\t\tbreak;\n+#endif\n #if OPENSSL_VERSION_NUMBER >= 0x0090708fL\n \t\tcase OPENSSL_ALGO_SHA224:\n \t\t\tmdtype = (EVP_MD *) EVP_sha224();\n@@ -1146,6 +1281,12 @@ PHP_MINIT_FUNCTION(openssl)\n \tOpenSSL_add_all_digests();\n \tOpenSSL_add_all_algorithms();\n \n+#if !defined(OPENSSL_NO_AES) && defined(EVP_CIPH_CCM_MODE) && OPENSSL_VERSION_NUMBER < 0x100020000\n+\tEVP_add_cipher(EVP_aes_128_ccm());\n+\tEVP_add_cipher(EVP_aes_192_ccm());\n+\tEVP_add_cipher(EVP_aes_256_ccm());\n+#endif\n+\n \tSSL_load_error_strings();\n \n \t/* register a resource id number with OpenSSL so that we can map SSL -> stream structures in\n@@ -1173,7 +1314,9 @@ PHP_MINIT_FUNCTION(openssl)\n #ifdef HAVE_OPENSSL_MD2_H\n \tREGISTER_LONG_CONSTANT(\"OPENSSL_ALGO_MD2\", OPENSSL_ALGO_MD2, CONST_CS|CONST_PERSISTENT);\n #endif\n+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)\n \tREGISTER_LONG_CONSTANT(\"OPENSSL_ALGO_DSS1\", OPENSSL_ALGO_DSS1, CONST_CS|CONST_PERSISTENT);\n+#endif\n #if OPENSSL_VERSION_NUMBER >= 0x0090708fL\n \tREGISTER_LONG_CONSTANT(\"OPENSSL_ALGO_SHA224\", OPENSSL_ALGO_SHA224, CONST_CS|CONST_PERSISTENT);\n \tREGISTER_LONG_CONSTANT(\"OPENSSL_ALGO_SHA256\", OPENSSL_ALGO_SHA256, CONST_CS|CONST_PERSISTENT);\n@@ -1251,7 +1394,9 @@ PHP_MINIT_FUNCTION(openssl)\n \t}\n \n \tphp_stream_xport_register(\"ssl\", php_openssl_ssl_socket_factory TSRMLS_CC);\n+#ifndef OPENSSL_NO_SSL3\n \tphp_stream_xport_register(\"sslv3\", php_openssl_ssl_socket_factory TSRMLS_CC);\n+#endif\n #ifndef OPENSSL_NO_SSL2\n \tphp_stream_xport_register(\"sslv2\", php_openssl_ssl_socket_factory TSRMLS_CC);\n #endif\n@@ -1308,7 +1453,9 @@ PHP_MSHUTDOWN_FUNCTION(openssl)\n #ifndef OPENSSL_NO_SSL2\n \tphp_stream_xport_unregister(\"sslv2\" TSRMLS_CC);\n #endif\n+#ifndef OPENSSL_NO_SSL3\n \tphp_stream_xport_unregister(\"sslv3\" TSRMLS_CC);\n+#endif\n \tphp_stream_xport_unregister(\"tls\" TSRMLS_CC);\n \tphp_stream_xport_unregister(\"tlsv1.0\" TSRMLS_CC);\n #if OPENSSL_VERSION_NUMBER >= 0x10001001L\n@@ -1893,6 +2040,7 @@ static int openssl_x509v3_subjectAltName\n {\n \tGENERAL_NAMES *names;\n \tconst X509V3_EXT_METHOD *method = NULL;\n+\tASN1_OCTET_STRING *extension_data;\n \tlong i, length, num;\n \tconst unsigned char *p;\n \n@@ -1901,8 +2049,9 @@ static int openssl_x509v3_subjectAltName\n \t\treturn -1;\n \t}\n \n-\tp = extension->value->data;\n-\tlength = extension->value->length;\n+\textension_data = X509_EXTENSION_get_data(extension);\n+\tp = extension_data->data;\n+\tlength = extension_data->length;\n \tif (method->it) {\n \t\tnames = (GENERAL_NAMES*)(ASN1_item_d2i(NULL, &p, length,\n \t\t\t\t\t\t ASN1_ITEM_ptr(method->it)));\n@@ -1965,6 +2114,8 @@ PHP_FUNCTION(openssl_x509_parse)\n \tchar * tmpstr;\n \tzval * subitem;\n \tX509_EXTENSION *extension;\n+\tX509_NAME *subject_name;\n+\tchar *cert_name;\n \tchar *extname;\n \tBIO *bio_out;\n \tBUF_MEM *bio_buf;\n@@ -1979,10 +2130,10 @@ PHP_FUNCTION(openssl_x509_parse)\n \t}\n \tarray_init(return_value);\n \n-\tif (cert->name) {\n-\t\tadd_assoc_string(return_value, \"name\", cert->name, 1);\n-\t}\n-/*\tadd_assoc_bool(return_value, \"valid\", cert->valid); */\n+\tsubject_name = X509_get_subject_name(cert);\n+\tcert_name = X509_NAME_oneline(subject_name, NULL, 0);\n+\tadd_assoc_string(return_value, \"name\", cert_name, 1);\n+\tOPENSSL_free(cert_name);\n \n \tadd_assoc_name_entry(return_value, \"subject\", \t\tX509_get_subject_name(cert), useshortnames TSRMLS_CC);\n \t/* hash as used in CA directories to lookup cert by subject name */\n@@ -2008,7 +2159,7 @@ PHP_FUNCTION(openssl_x509_parse)\n \t\tadd_assoc_string(return_value, \"alias\", tmpstr, 1);\n \t}\n \n-\tsig_nid = OBJ_obj2nid((cert)->sig_alg->algorithm);\n+\tsig_nid = X509_get_signature_nid(cert);\n \tadd_assoc_string(return_value, \"signatureTypeSN\", (char*)OBJ_nid2sn(sig_nid), 1);\n \tadd_assoc_string(return_value, \"signatureTypeLN\", (char*)OBJ_nid2ln(sig_nid), 1);\n \tadd_assoc_long(return_value, \"signatureTypeNID\", sig_nid);\n@@ -3217,7 +3368,21 @@ PHP_FUNCTION(openssl_csr_get_public_key)\n \t\tRETURN_FALSE;\n \t}\n \n-\ttpubkey=X509_REQ_get_pubkey(csr);\n+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)\n+\t/* Due to changes in OpenSSL 1.1 related to locking when decoding CSR,\n+\t * the pub key is not changed after assigning. It means if we pass\n+\t * a private key, it will be returned including the private part.\n+\t * If we duplicate it, then we get just the public part which is\n+\t * the same behavior as for OpenSSL 1.0 */\n+\tcsr = X509_REQ_dup(csr);\n+#endif\n+\t/* Retrieve the public key from the CSR */\n+\ttpubkey = X509_REQ_get_pubkey(csr);\n+\n+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)\n+\t/* We need to free the CSR as it was duplicated */\n+\tX509_REQ_free(csr);\n+#endif\n \tRETVAL_RESOURCE(zend_list_insert(tpubkey, le_key TSRMLS_CC));\n \treturn;\n }\n@@ -3482,13 +3647,20 @@ static int php_openssl_is_private_key(EV\n {\n \tassert(pkey != NULL);\n \n-\tswitch (pkey->type) {\n+\tswitch (EVP_PKEY_id(pkey)) {\n #ifndef NO_RSA\n \t\tcase EVP_PKEY_RSA:\n \t\tcase EVP_PKEY_RSA2:\n-\t\t\tassert(pkey->pkey.rsa != NULL);\n-\t\t\tif (pkey->pkey.rsa != NULL && (NULL == pkey->pkey.rsa->p || NULL == pkey->pkey.rsa->q)) {\n-\t\t\t\treturn 0;\n+\t\t\t{\n+\t\t\t\tRSA *rsa = EVP_PKEY_get0_RSA(pkey);\n+\t\t\t\tif (rsa != NULL) {\n+\t\t\t\t\tconst BIGNUM *p, *q;\n+\n+\t\t\t\t\tRSA_get0_factors(rsa, &p, &q);\n+\t\t\t\t\t if (p == NULL || q == NULL) {\n+\t\t\t\t\t\treturn 0;\n+\t\t\t\t\t }\n+\t\t\t\t}\n \t\t\t}\n \t\t\tbreak;\n #endif\n@@ -3498,28 +3670,51 @@ static int php_openssl_is_private_key(EV\n \t\tcase EVP_PKEY_DSA2:\n \t\tcase EVP_PKEY_DSA3:\n \t\tcase EVP_PKEY_DSA4:\n-\t\t\tassert(pkey->pkey.dsa != NULL);\n-\n-\t\t\tif (NULL == pkey->pkey.dsa->p || NULL == pkey->pkey.dsa->q || NULL == pkey->pkey.dsa->priv_key){ \n-\t\t\t\treturn 0;\n+\t\t\t{\n+\t\t\t\tDSA *dsa = EVP_PKEY_get0_DSA(pkey);\n+\t\t\t\tif (dsa != NULL) {\n+\t\t\t\t\tconst BIGNUM *p, *q, *g, *pub_key, *priv_key;\n+\n+\t\t\t\t\tDSA_get0_pqg(dsa, &p, &q, &g);\n+\t\t\t\t\tif (p == NULL || q == NULL) {\n+\t\t\t\t\t\treturn 0;\n+\t\t\t\t\t}\n+ \n+\t\t\t\t\tDSA_get0_key(dsa, &pub_key, &priv_key);\n+\t\t\t\t\tif (priv_key == NULL) {\n+\t\t\t\t\t\treturn 0;\n+\t\t\t\t\t}\n+\t\t\t\t}\n \t\t\t}\n \t\t\tbreak;\n #endif\n #ifndef NO_DH\n \t\tcase EVP_PKEY_DH:\n-\t\t\tassert(pkey->pkey.dh != NULL);\n-\n-\t\t\tif (NULL == pkey->pkey.dh->p || NULL == pkey->pkey.dh->priv_key) {\n-\t\t\t\treturn 0;\n+\t\t\t{\n+\t\t\t\tDH *dh = EVP_PKEY_get0_DH(pkey);\n+\t\t\t\tif (dh != NULL) {\n+\t\t\t\t\tconst BIGNUM *p, *q, *g, *pub_key, *priv_key;\n+\n+\t\t\t\t\tDH_get0_pqg(dh, &p, &q, &g);\n+\t\t\t\t\tif (p == NULL) {\n+\t\t\t\t\t\treturn 0;\n+\t\t\t\t\t}\n+ \n+\t\t\t\t\tDH_get0_key(dh, &pub_key, &priv_key);\n+\t\t\t\t\tif (priv_key == NULL) {\n+\t\t\t\t\t\treturn 0;\n+\t\t\t\t\t}\n+\t\t\t\t}\n \t\t\t}\n \t\t\tbreak;\n #endif\n #ifdef HAVE_EVP_PKEY_EC\n \t\tcase EVP_PKEY_EC:\n-\t\t\tassert(pkey->pkey.ec != NULL);\n-\n-\t\t\tif ( NULL == EC_KEY_get0_private_key(pkey->pkey.ec)) {\n-\t\t\t\treturn 0;\n+\t\t\t{\n+\t\t\t\tEC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);\n+\t\t\t\tif (ec != NULL && NULL == EC_KEY_get0_private_key(ec)) {\n+\t\t\t\t\treturn 0;\n+\t\t\t\t}\n \t\t\t}\n \t\t\tbreak;\n #endif\n@@ -3531,34 +3726,80 @@ static int php_openssl_is_private_key(EV\n }\n /* }}} */\n \n-#define OPENSSL_PKEY_GET_BN(_type, _name) do {\t\t\t\t\t\t\t\\\n-\t\tif (pkey->pkey._type->_name != NULL) {\t\t\t\t\t\t\t\\\n-\t\t\tint len = BN_num_bytes(pkey->pkey._type->_name);\t\t\t\\\n-\t\t\tchar *str = emalloc(len + 1);\t\t\t\t\t\t\t\t\\\n-\t\t\tBN_bn2bin(pkey->pkey._type->_name, (unsigned char*)str);\t\\\n-\t\t\tstr[len] = 0; \t\\\n-\t\t\tadd_assoc_stringl(_type, #_name, str, len, 0);\t\t\t\t\\\n-\t\t}\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\\\n-\t} while (0)\n-\n-#define OPENSSL_PKEY_SET_BN(_ht, _type, _name) do {\t\t\t\t\t\t\\\n-\t\tzval **bn;\t\t\t\t\t\t\t\t\t\t\t\t\t\t\\\n-\t\tif (zend_hash_find(_ht, #_name, sizeof(#_name),\t(void**)&bn) == SUCCESS && \\\n-\t\t\t\tZ_TYPE_PP(bn) == IS_STRING) {\t\t\t\t\t\t\t\\\n-\t\t\t_type->_name = BN_bin2bn(\t\t\t\t\t\t\t\t\t\\\n-\t\t\t\t(unsigned char*)Z_STRVAL_PP(bn),\t\t\t\t\t\t\\\n-\t \t\t\tZ_STRLEN_PP(bn), NULL);\t\t\t\t\t\t\t\t\t\\\n-\t } \\\n+#define OPENSSL_GET_BN(_array, _bn, _name) do { \\\n+\t\tif (_bn != NULL) { \\\n+\t\t\tint len = BN_num_bytes(_bn); \\\n+\t\t\tchar *str = emalloc(len + 1); \\\n+\t\t\tBN_bn2bin(_bn, (unsigned char*)str); \\\n+\t\t\tstr[len] = 0; \\\n+\t\t\tadd_assoc_stringl(_array, #_name, str, len, 0); \\\n+\t\t} \\\n \t} while (0);\n \n+#define OPENSSL_PKEY_GET_BN(_type, _name) OPENSSL_GET_BN(_type, _name, _name)\n+\n+#define OPENSSL_PKEY_SET_BN(_data, _name) do { \\\n+\t\tzval **bn; \\\n+\t\tif (zend_hash_find(Z_ARRVAL_P(_data), #_name, sizeof(#_name),(void**)&bn) == SUCCESS && \\\n+\t\t\t\tZ_TYPE_PP(bn) == IS_STRING) { \\\n+\t\t\t_name = BN_bin2bn( \\\n+\t\t\t\t(unsigned char*)Z_STRVAL_PP(bn), \\\n+\t\t\t\tZ_STRLEN_PP(bn), NULL); \\\n+\t\t} else { \\\n+\t\t\t_name = NULL; \\\n+\t\t} \\\n+ \t} while (0);\n+\n+/* {{{ php_openssl_pkey_init_rsa */\n+zend_bool php_openssl_pkey_init_and_assign_rsa(EVP_PKEY *pkey, RSA *rsa, zval *data)\n+{\n+\tBIGNUM *n, *e, *d, *p, *q, *dmp1, *dmq1, *iqmp;\n+\n+\tOPENSSL_PKEY_SET_BN(data, n);\n+\tOPENSSL_PKEY_SET_BN(data, e);\n+\tOPENSSL_PKEY_SET_BN(data, d);\n+\tif (!n || !d || !RSA_set0_key(rsa, n, e, d)) {\n+\t\treturn 0;\n+\t}\n+\n+\tOPENSSL_PKEY_SET_BN(data, p);\n+\tOPENSSL_PKEY_SET_BN(data, q);\n+\tif ((p || q) && !RSA_set0_factors(rsa, p, q)) {\n+\t\treturn 0;\n+\t}\n+\n+\tOPENSSL_PKEY_SET_BN(data, dmp1);\n+\tOPENSSL_PKEY_SET_BN(data, dmq1);\n+\tOPENSSL_PKEY_SET_BN(data, iqmp);\n+\tif ((dmp1 || dmq1 || iqmp) && !RSA_set0_crt_params(rsa, dmp1, dmq1, iqmp)) {\n+\t\treturn 0;\n+\t}\n+\n+\tif (!EVP_PKEY_assign_RSA(pkey, rsa)) {\n+\t\treturn 0;\n+\t}\n+\n+\treturn 1;\n+}\n+/* }}} */\n+\n /* {{{ php_openssl_pkey_init_dsa */\n-zend_bool php_openssl_pkey_init_dsa(DSA *dsa)\n+zend_bool php_openssl_pkey_init_dsa(DSA *dsa, zval *data)\n {\n-\tif (!dsa->p || !dsa->q || !dsa->g) {\n+\tBIGNUM *p, *q, *g, *priv_key, *pub_key;\n+\tconst BIGNUM *priv_key_const, *pub_key_const;\n+\n+\tOPENSSL_PKEY_SET_BN(data, p);\n+\tOPENSSL_PKEY_SET_BN(data, q);\n+\tOPENSSL_PKEY_SET_BN(data, g);\n+\tif (!p || !q || !g || !DSA_set0_pqg(dsa, p, q, g)) {\n \t\treturn 0;\n \t}\n-\tif (dsa->priv_key || dsa->pub_key) {\n-\t\treturn 1;\n+\n+\tOPENSSL_PKEY_SET_BN(data, pub_key);\n+\tOPENSSL_PKEY_SET_BN(data, priv_key);\n+\tif (pub_key) {\n+\t\treturn DSA_set0_key(dsa, pub_key, priv_key);\n \t}\n \tPHP_OPENSSL_RAND_ADD_TIME();\n \tif (!DSA_generate_key(dsa)) {\n@@ -3566,7 +3807,8 @@ zend_bool php_openssl_pkey_init_dsa(DSA\n \t}\n \t/* if BN_mod_exp return -1, then DSA_generate_key succeed for failed key\n \t * so we need to double check that public key is created */\n-\tif (!dsa->pub_key || BN_is_zero(dsa->pub_key)) {\n+\tDSA_get0_key(dsa, &pub_key_const, &priv_key_const);\n+\tif (!pub_key_const || BN_is_zero(pub_key_const)) {\n \t\treturn 0;\n \t}\n \t/* all good */\n@@ -3574,14 +3816,66 @@ zend_bool php_openssl_pkey_init_dsa(DSA\n }\n /* }}} */\n \n+/* {{{ php_openssl_dh_pub_from_priv */\n+static BIGNUM *php_openssl_dh_pub_from_priv(BIGNUM *priv_key, BIGNUM *g, BIGNUM *p)\n+{\n+\tBIGNUM *pub_key, *priv_key_const_time;\n+\tBN_CTX *ctx;\n+\n+\tpub_key = BN_new();\n+\tif (pub_key == NULL) {\n+\t\treturn NULL;\n+\t}\n+\n+\tpriv_key_const_time = BN_new();\n+\tif (priv_key_const_time == NULL) {\n+\t\tBN_free(pub_key);\n+\t\treturn NULL;\n+\t}\n+\tctx = BN_CTX_new();\n+\tif (ctx == NULL) {\n+\t\tBN_free(pub_key);\n+\t\tBN_free(priv_key_const_time);\n+\t\treturn NULL;\n+\t}\n+\n+\tBN_with_flags(priv_key_const_time, priv_key, BN_FLG_CONSTTIME);\n+\n+\tif (!BN_mod_exp_mont(pub_key, g, priv_key_const_time, p, ctx, NULL)) {\n+\t\tBN_free(pub_key);\n+\t\tpub_key = NULL;\n+\t}\n+\n+\tBN_free(priv_key_const_time);\n+\tBN_CTX_free(ctx);\n+\n+\treturn pub_key;\n+}\n+/* }}} */\n+\n /* {{{ php_openssl_pkey_init_dh */\n-zend_bool php_openssl_pkey_init_dh(DH *dh)\n+zend_bool php_openssl_pkey_init_dh(DH *dh, zval *data)\n {\n-\tif (!dh->p || !dh->g) {\n+\tBIGNUM *p, *q, *g, *priv_key, *pub_key;\n+\n+\tOPENSSL_PKEY_SET_BN(data, p);\n+\tOPENSSL_PKEY_SET_BN(data, q);\n+\tOPENSSL_PKEY_SET_BN(data, g);\n+\tif (!p || !g || !DH_set0_pqg(dh, p, q, g)) {\n \t\treturn 0;\n \t}\n-\tif (dh->pub_key) {\n-\t\treturn 1;\n+\n+\tOPENSSL_PKEY_SET_BN(data, priv_key);\n+\tOPENSSL_PKEY_SET_BN(data, pub_key);\n+\tif (pub_key) {\n+\t\treturn DH_set0_key(dh, pub_key, priv_key);\n+\t}\n+\tif (priv_key) {\n+\t\tpub_key = php_openssl_dh_pub_from_priv(priv_key, g, p);\n+\t\tif (pub_key == NULL) {\n+\t\t\treturn 0;\n+\t\t}\n+\t\treturn DH_set0_key(dh, pub_key, priv_key);\n \t}\n \tPHP_OPENSSL_RAND_ADD_TIME();\n \tif (!DH_generate_key(dh)) {\n@@ -3614,18 +3908,8 @@ PHP_FUNCTION(openssl_pkey_new)\n \t\t if (pkey) {\n \t\t\t\tRSA *rsa = RSA_new();\n \t\t\t\tif (rsa) {\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, n);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, e);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, d);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, p);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, q);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, dmp1);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, dmq1);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, iqmp);\n-\t\t\t\t\tif (rsa->n && rsa->d) {\n-\t\t\t\t\t\tif (EVP_PKEY_assign_RSA(pkey, rsa)) {\n-\t\t\t\t\t\t\tRETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));\n-\t\t\t\t\t\t}\n+\t\t\t\t\tif (php_openssl_pkey_init_and_assign_rsa(pkey, rsa, *data)) {\n+\t\t\t\t\t\tRETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));\n \t\t\t\t\t}\n \t\t\t\t\tRSA_free(rsa);\n \t\t\t\t}\n@@ -3638,12 +3922,7 @@ PHP_FUNCTION(openssl_pkey_new)\n \t\t if (pkey) {\n \t\t\t\tDSA *dsa = DSA_new();\n \t\t\t\tif (dsa) {\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, p);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, q);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, g);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, priv_key);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, pub_key);\n-\t\t\t\t\tif (php_openssl_pkey_init_dsa(dsa)) {\n+\t\t\t\t\tif (php_openssl_pkey_init_dsa(dsa, *data)) {\n \t\t\t\t\t\tif (EVP_PKEY_assign_DSA(pkey, dsa)) {\n \t\t\t\t\t\t\tRETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));\n \t\t\t\t\t\t}\n@@ -3659,11 +3938,7 @@ PHP_FUNCTION(openssl_pkey_new)\n \t\t if (pkey) {\n \t\t\t\tDH *dh = DH_new();\n \t\t\t\tif (dh) {\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, p);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, g);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, priv_key);\n-\t\t\t\t\tOPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, pub_key);\n-\t\t\t\t\tif (php_openssl_pkey_init_dh(dh)) {\n+\t\t\t\t\tif (php_openssl_pkey_init_dh(dh, *data)) {\n \t\t\t\t\t\tif (EVP_PKEY_assign_DH(pkey, dh)) {\n \t\t\t\t\t\t\tRETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));\n \t\t\t\t\t\t}\n@@ -3738,10 +4013,10 @@ PHP_FUNCTION(openssl_pkey_export_to_file\n \t\t\tcipher = NULL;\n \t\t}\n \n-\t\tswitch (EVP_PKEY_type(key->type)) {\n+\t\tswitch (EVP_PKEY_base_id(key)) {\n #ifdef HAVE_EVP_PKEY_EC\n \t\t\tcase EVP_PKEY_EC:\n-\t\t\t\tpem_write = PEM_write_bio_ECPrivateKey(bio_out, EVP_PKEY_get1_EC_KEY(key), cipher, (unsigned char *)passphrase, passphrase_len, NULL, NULL);\n+\t\t\t\tpem_write = PEM_write_bio_ECPrivateKey(bio_out, EVP_PKEY_get0_EC_KEY(key), cipher, (unsigned char *)passphrase, passphrase_len, NULL, NULL);\n \t\t\t\tbreak;\n #endif\n \t\t\tdefault:\n@@ -3807,7 +4082,7 @@ PHP_FUNCTION(openssl_pkey_export)\n \t\t\tcipher = NULL;\n \t\t}\n \n-\t\tswitch (EVP_PKEY_type(key->type)) {\n+\t\tswitch (EVP_PKEY_base_id(key)) {\n #ifdef HAVE_EVP_PKEY_EC\n \t\t\tcase EVP_PKEY_EC:\n \t\t\t\tpem_write = PEM_write_bio_ECPrivateKey(bio_out, EVP_PKEY_get1_EC_KEY(key), cipher, (unsigned char *)passphrase, passphrase_len, NULL, NULL);\n@@ -3928,25 +4203,33 @@ PHP_FUNCTION(openssl_pkey_get_details)\n \t/*TODO: Use the real values once the openssl constants are used \n \t * See the enum at the top of this file\n \t */\n-\tswitch (EVP_PKEY_type(pkey->type)) {\n+\tswitch (EVP_PKEY_base_id(pkey)) {\n \t\tcase EVP_PKEY_RSA:\n \t\tcase EVP_PKEY_RSA2:\n-\t\t\tktype = OPENSSL_KEYTYPE_RSA;\n-\n-\t\t\tif (pkey->pkey.rsa != NULL) {\n-\t\t\t\tzval *rsa;\n-\n-\t\t\t\tALLOC_INIT_ZVAL(rsa);\n-\t\t\t\tarray_init(rsa);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(rsa, n);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(rsa, e);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(rsa, d);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(rsa, p);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(rsa, q);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(rsa, dmp1);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(rsa, dmq1);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(rsa, iqmp);\n-\t\t\t\tadd_assoc_zval(return_value, \"rsa\", rsa);\n+\t\t\t{\n+\t\t\t\tRSA *rsa = EVP_PKEY_get0_RSA(pkey);\n+\t\t\t\tktype = OPENSSL_KEYTYPE_RSA;\n+\n+\t\t\t\tif (rsa != NULL) {\n+\t\t\t\t\tzval *z_rsa;\n+\t\t\t\t\tconst BIGNUM *n, *e, *d, *p, *q, *dmp1, *dmq1, *iqmp;\n+\n+\t\t\t\t\tRSA_get0_key(rsa, &n, &e, &d);\n+\t\t\t\t\tRSA_get0_factors(rsa, &p, &q);\n+\t\t\t\t\tRSA_get0_crt_params(rsa, &dmp1, &dmq1, &iqmp);\n+\n+\t\t\t\t\tALLOC_INIT_ZVAL(z_rsa);\n+\t\t\t\t\tarray_init(z_rsa);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_rsa, n);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_rsa, e);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_rsa, d);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_rsa, p);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_rsa, q);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_rsa, dmp1);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_rsa, dmq1);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_rsa, iqmp);\n+\t\t\t\t\tadd_assoc_zval(return_value, \"rsa\", z_rsa);\n+\t\t\t\t}\n \t\t\t}\n \n \t\t\tbreak;\t\n@@ -3954,42 +4237,55 @@ PHP_FUNCTION(openssl_pkey_get_details)\n \t\tcase EVP_PKEY_DSA2:\n \t\tcase EVP_PKEY_DSA3:\n \t\tcase EVP_PKEY_DSA4:\n-\t\t\tktype = OPENSSL_KEYTYPE_DSA;\n-\n-\t\t\tif (pkey->pkey.dsa != NULL) {\n-\t\t\t\tzval *dsa;\n-\n-\t\t\t\tALLOC_INIT_ZVAL(dsa);\n-\t\t\t\tarray_init(dsa);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(dsa, p);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(dsa, q);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(dsa, g);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(dsa, priv_key);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(dsa, pub_key);\n-\t\t\t\tadd_assoc_zval(return_value, \"dsa\", dsa);\n+\t\t\t{\n+\t\t\t\tDSA *dsa = EVP_PKEY_get0_DSA(pkey);\n+\t\t\t\tktype = OPENSSL_KEYTYPE_DSA;\n+\n+\t\t\t\tif (dsa != NULL) {\n+\t\t\t\t\tzval *z_dsa;\n+\t\t\t\t\tconst BIGNUM *p, *q, *g, *priv_key, *pub_key;\n+\n+\t\t\t\t\tDSA_get0_pqg(dsa, &p, &q, &g);\n+\t\t\t\t\tDSA_get0_key(dsa, &pub_key, &priv_key);\n+\n+\t\t\t\t\tALLOC_INIT_ZVAL(z_dsa);\n+\t\t\t\t\tarray_init(z_dsa);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_dsa, p);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_dsa, q);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_dsa, g);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_dsa, priv_key);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_dsa, pub_key);\n+\t\t\t\t\tadd_assoc_zval(return_value, \"dsa\", z_dsa);\n+\t\t\t\t}\n \t\t\t}\n \t\t\tbreak;\n \t\tcase EVP_PKEY_DH:\n-\t\t\t\n-\t\t\tktype = OPENSSL_KEYTYPE_DH;\n-\n-\t\t\tif (pkey->pkey.dh != NULL) {\n-\t\t\t\tzval *dh;\n-\n-\t\t\t\tALLOC_INIT_ZVAL(dh);\n-\t\t\t\tarray_init(dh);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(dh, p);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(dh, g);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(dh, priv_key);\n-\t\t\t\tOPENSSL_PKEY_GET_BN(dh, pub_key);\n-\t\t\t\tadd_assoc_zval(return_value, \"dh\", dh);\n+\t\t\t{\n+\t\t\t\tDH *dh = EVP_PKEY_get0_DH(pkey);\n+\t\t\t\tktype = OPENSSL_KEYTYPE_DH;\n+\n+\t\t\t\tif (dh != NULL) {\n+\t\t\t\t\tzval *z_dh;\n+\t\t\t\t\tconst BIGNUM *p, *q, *g, *priv_key, *pub_key;\n+\n+\t\t\t\t\tDH_get0_pqg(dh, &p, &q, &g);\n+\t\t\t\t\tDH_get0_key(dh, &pub_key, &priv_key);\n+\n+\t\t\t\t\tALLOC_INIT_ZVAL(z_dh);\n+\t\t\t\t\tarray_init(z_dh);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_dh, p);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_dh, g);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_dh, priv_key);\n+\t\t\t\t\tOPENSSL_PKEY_GET_BN(z_dh, pub_key);\n+\t\t\t\t\tadd_assoc_zval(return_value, \"dh\", z_dh);\n+\t\t\t\t}\n \t\t\t}\n \n \t\t\tbreak;\n #ifdef HAVE_EVP_PKEY_EC\n \t\tcase EVP_PKEY_EC:\n \t\t\tktype = OPENSSL_KEYTYPE_EC;\n-\t\t\tif (pkey->pkey.ec != NULL) {\n+\t\t\tif (EVP_PKEY_get0_EC_KEY(pkey) != NULL) {\n \t\t\t\tzval *ec;\n \t\t\t\tconst EC_GROUP *ec_group;\n \t\t\t\tint nid;\n@@ -4546,13 +4842,13 @@ PHP_FUNCTION(openssl_private_encrypt)\n \tcryptedlen = EVP_PKEY_size(pkey);\n \tcryptedbuf = emalloc(cryptedlen + 1);\n \n-\tswitch (pkey->type) {\n+\tswitch (EVP_PKEY_id(pkey)) {\n \t\tcase EVP_PKEY_RSA:\n \t\tcase EVP_PKEY_RSA2:\n \t\t\tsuccessful = (RSA_private_encrypt(data_len, \n \t\t\t\t\t\t(unsigned char *)data, \n \t\t\t\t\t\tcryptedbuf, \n-\t\t\t\t\t\tpkey->pkey.rsa, \n+\t\t\t\t\t\tEVP_PKEY_get0_RSA(pkey), \n \t\t\t\t\t\tpadding) == cryptedlen);\n \t\t\tbreak;\n \t\tdefault:\n@@ -4604,13 +4900,13 @@ PHP_FUNCTION(openssl_private_decrypt)\n \tcryptedlen = EVP_PKEY_size(pkey);\n \tcrypttemp = emalloc(cryptedlen + 1);\n \n-\tswitch (pkey->type) {\n+\tswitch (EVP_PKEY_id(pkey)) {\n \t\tcase EVP_PKEY_RSA:\n \t\tcase EVP_PKEY_RSA2:\n \t\t\tcryptedlen = RSA_private_decrypt(data_len, \n \t\t\t\t\t(unsigned char *)data, \n \t\t\t\t\tcrypttemp, \n-\t\t\t\t\tpkey->pkey.rsa, \n+\t\t\t\t\tEVP_PKEY_get0_RSA(pkey), \n \t\t\t\t\tpadding);\n \t\t\tif (cryptedlen != -1) {\n \t\t\t\tcryptedbuf = emalloc(cryptedlen + 1);\n@@ -4669,13 +4965,13 @@ PHP_FUNCTION(openssl_public_encrypt)\n \tcryptedlen = EVP_PKEY_size(pkey);\n \tcryptedbuf = emalloc(cryptedlen + 1);\n \n-\tswitch (pkey->type) {\n+\tswitch (EVP_PKEY_id(pkey)) {\n \t\tcase EVP_PKEY_RSA:\n \t\tcase EVP_PKEY_RSA2:\n \t\t\tsuccessful = (RSA_public_encrypt(data_len, \n \t\t\t\t\t\t(unsigned char *)data, \n \t\t\t\t\t\tcryptedbuf, \n-\t\t\t\t\t\tpkey->pkey.rsa, \n+\t\t\t\t\t\tEVP_PKEY_get0_RSA(pkey), \n \t\t\t\t\t\tpadding) == cryptedlen);\n \t\t\tbreak;\n \t\tdefault:\n@@ -4728,13 +5024,13 @@ PHP_FUNCTION(openssl_public_decrypt)\n \tcryptedlen = EVP_PKEY_size(pkey);\n \tcrypttemp = emalloc(cryptedlen + 1);\n \n-\tswitch (pkey->type) {\n+\tswitch (EVP_PKEY_id(pkey)) {\n \t\tcase EVP_PKEY_RSA:\n \t\tcase EVP_PKEY_RSA2:\n \t\t\tcryptedlen = RSA_public_decrypt(data_len, \n \t\t\t\t\t(unsigned char *)data, \n \t\t\t\t\tcrypttemp, \n-\t\t\t\t\tpkey->pkey.rsa, \n+\t\t\t\t\tEVP_PKEY_get0_RSA(pkey), \n \t\t\t\t\tpadding);\n \t\t\tif (cryptedlen != -1) {\n \t\t\t\tcryptedbuf = emalloc(cryptedlen + 1);\n@@ -4798,7 +5094,7 @@ PHP_FUNCTION(openssl_sign)\n \tlong keyresource = -1;\n \tchar * data;\n \tint data_len;\n-\tEVP_MD_CTX md_ctx;\n+\tEVP_MD_CTX *md_ctx;\n \tzval *method = NULL;\n \tlong signature_algo = OPENSSL_ALGO_SHA1;\n \tconst EVP_MD *mdtype;\n@@ -4831,9 +5127,10 @@ PHP_FUNCTION(openssl_sign)\n \tsiglen = EVP_PKEY_size(pkey);\n \tsigbuf = emalloc(siglen + 1);\n \n-\tEVP_SignInit(&md_ctx, mdtype);\n-\tEVP_SignUpdate(&md_ctx, data, data_len);\n-\tif (EVP_SignFinal (&md_ctx, sigbuf,(unsigned int *)&siglen, pkey)) {\n+\tmd_ctx = EVP_MD_CTX_create();\n+\tEVP_SignInit(md_ctx, mdtype);\n+\tEVP_SignUpdate(md_ctx, data, data_len);\n+\tif (EVP_SignFinal (md_ctx, sigbuf,(unsigned int *)&siglen, pkey)) {\n \t\tzval_dtor(signature);\n \t\tsigbuf[siglen] = '\\0';\n \t\tZVAL_STRINGL(signature, (char *)sigbuf, siglen, 0);\n@@ -4842,7 +5139,7 @@ PHP_FUNCTION(openssl_sign)\n \t\tefree(sigbuf);\n \t\tRETVAL_FALSE;\n \t}\n-\tEVP_MD_CTX_cleanup(&md_ctx);\n+\tEVP_MD_CTX_destroy(md_ctx);\n \tif (keyresource == -1) {\n \t\tEVP_PKEY_free(pkey);\n \t}\n@@ -4856,7 +5153,7 @@ PHP_FUNCTION(openssl_verify)\n \tzval **key;\n \tEVP_PKEY *pkey;\n \tint err;\n-\tEVP_MD_CTX md_ctx;\n+\tEVP_MD_CTX *md_ctx;\n \tconst EVP_MD *mdtype;\n \tlong keyresource = -1;\n \tchar * data;\tint data_len;\n@@ -4890,10 +5187,11 @@ PHP_FUNCTION(openssl_verify)\n \t\tRETURN_FALSE;\n \t}\n \n-\tEVP_VerifyInit (&md_ctx, mdtype);\n-\tEVP_VerifyUpdate (&md_ctx, data, data_len);\n-\terr = EVP_VerifyFinal (&md_ctx, (unsigned char *)signature, signature_len, pkey);\n-\tEVP_MD_CTX_cleanup(&md_ctx);\n+\tmd_ctx = EVP_MD_CTX_create();\n+\tEVP_VerifyInit (md_ctx, mdtype);\n+\tEVP_VerifyUpdate (md_ctx, data, data_len);\n+\terr = EVP_VerifyFinal (md_ctx, (unsigned char *)signature, signature_len, pkey);\n+\tEVP_MD_CTX_destroy(md_ctx);\n \n \tif (keyresource == -1) {\n \t\tEVP_PKEY_free(pkey);\n@@ -4917,7 +5215,7 @@ PHP_FUNCTION(openssl_seal)\n \tchar *method =NULL;\n \tint method_len = 0;\n \tconst EVP_CIPHER *cipher;\n-\tEVP_CIPHER_CTX ctx;\n+\tEVP_CIPHER_CTX *ctx;\n \n \tif (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, \"szza/|s\", &data, &data_len, &sealdata, &ekeys, &pubkeys, &method, &method_len) == FAILURE) {\n \t\treturn;\n@@ -4950,6 +5248,7 @@ PHP_FUNCTION(openssl_seal)\n \tmemset(eks, 0, sizeof(*eks) * nkeys);\n \tkey_resources = safe_emalloc(nkeys, sizeof(long), 0);\n \tmemset(key_resources, 0, sizeof(*key_resources) * nkeys);\n+\tmemset(pkeys, 0, sizeof(*pkeys) * nkeys);\n \n \t/* get the public keys we are using to seal this data */\n \tzend_hash_internal_pointer_reset_ex(pubkeysht, &pos);\n@@ -4967,27 +5266,28 @@ PHP_FUNCTION(openssl_seal)\n \t\ti++;\n \t}\n \n-\tif (!EVP_EncryptInit(&ctx,cipher,NULL,NULL)) {\n+\tctx = EVP_CIPHER_CTX_new();\n+\tif (ctx == NULL || !EVP_EncryptInit(ctx,cipher,NULL,NULL)) {\n \t\tRETVAL_FALSE;\n-\t\tEVP_CIPHER_CTX_cleanup(&ctx);\n+\t\tEVP_CIPHER_CTX_free(ctx);\n \t\tgoto clean_exit;\n \t}\n \n #if 0\n \t/* Need this if allow ciphers that require initialization vector */\n-\tivlen = EVP_CIPHER_CTX_iv_length(&ctx);\n+\tivlen = EVP_CIPHER_CTX_iv_length(ctx);\n \tiv = ivlen ? emalloc(ivlen + 1) : NULL;\n #endif\n \t/* allocate one byte extra to make room for \\0 */\n-\tbuf = emalloc(data_len + EVP_CIPHER_CTX_block_size(&ctx));\n-\tEVP_CIPHER_CTX_cleanup(&ctx);\n+\tbuf = emalloc(data_len + EVP_CIPHER_CTX_block_size(ctx));\n+\tEVP_CIPHER_CTX_cleanup(ctx);\n \n-\tif (EVP_SealInit(&ctx, cipher, eks, eksl, NULL, pkeys, nkeys) <= 0 ||\n-\t\t\t!EVP_SealUpdate(&ctx, buf, &len1, (unsigned char *)data, data_len) ||\n-\t\t\t!EVP_SealFinal(&ctx, buf + len1, &len2)) {\n+\tif (EVP_SealInit(ctx, cipher, eks, eksl, NULL, pkeys, nkeys) <= 0 ||\n+\t\t\t!EVP_SealUpdate(ctx, buf, &len1, (unsigned char *)data, data_len) ||\n+\t\t\t!EVP_SealFinal(ctx, buf + len1, &len2)) {\n \t\tRETVAL_FALSE;\n \t\tefree(buf);\n-\t\tEVP_CIPHER_CTX_cleanup(&ctx);\n+\t\tEVP_CIPHER_CTX_free(ctx);\n \t\tgoto clean_exit;\n \t}\n \n@@ -5018,7 +5318,7 @@ PHP_FUNCTION(openssl_seal)\n \t\tefree(buf);\n \t}\n \tRETVAL_LONG(len1 + len2);\n-\tEVP_CIPHER_CTX_cleanup(&ctx);\n+\tEVP_CIPHER_CTX_free(ctx);\n \n clean_exit:\n \tfor (i=0; i keylen) {\n-\t\tEVP_CIPHER_CTX_set_key_length(&cipher_ctx, password_len);\n+\t\tEVP_CIPHER_CTX_set_key_length(cipher_ctx, password_len);\n \t}\n-\tEVP_EncryptInit_ex(&cipher_ctx, NULL, NULL, key, (unsigned char *)iv);\n+\tEVP_EncryptInit_ex(cipher_ctx, NULL, NULL, key, (unsigned char *)iv);\n \tif (options & OPENSSL_ZERO_PADDING) {\n-\t\tEVP_CIPHER_CTX_set_padding(&cipher_ctx, 0);\n+\t\tEVP_CIPHER_CTX_set_padding(cipher_ctx, 0);\n \t}\n \tif (data_len > 0) {\n-\t\tEVP_EncryptUpdate(&cipher_ctx, outbuf, &i, (unsigned char *)data, data_len);\n+\t\tEVP_EncryptUpdate(cipher_ctx, outbuf, &i, (unsigned char *)data, data_len);\n \t}\n \toutlen = i;\n-\tif (EVP_EncryptFinal(&cipher_ctx, (unsigned char *)outbuf + i, &i)) {\n+\tif (EVP_EncryptFinal(cipher_ctx, (unsigned char *)outbuf + i, &i)) {\n \t\toutlen += i;\n \t\tif (options & OPENSSL_RAW_DATA) {\n \t\t\toutbuf[outlen] = '\\0';\n@@ -5301,7 +5610,8 @@ PHP_FUNCTION(openssl_encrypt)\n \tif (free_iv) {\n \t\tefree(iv);\n \t}\n-\tEVP_CIPHER_CTX_cleanup(&cipher_ctx);\n+\tEVP_CIPHER_CTX_cleanup(cipher_ctx);\n+\tEVP_CIPHER_CTX_free(cipher_ctx);\n }\n /* }}} */\n \n@@ -5313,7 +5623,7 @@ PHP_FUNCTION(openssl_decrypt)\n \tchar *data, *method, *password, *iv = \"\";\n \tint data_len, method_len, password_len, iv_len = 0;\n \tconst EVP_CIPHER *cipher_type;\n-\tEVP_CIPHER_CTX cipher_ctx;\n+\tEVP_CIPHER_CTX *cipher_ctx;\n \tint i, outlen, keylen;\n \tunsigned char *outbuf, *key;\n \tint base64_str_len;\n@@ -5359,17 +5669,23 @@ PHP_FUNCTION(openssl_decrypt)\n \toutlen = data_len + EVP_CIPHER_block_size(cipher_type);\n \toutbuf = emalloc(outlen + 1);\n \n-\tEVP_DecryptInit(&cipher_ctx, cipher_type, NULL, NULL);\n+\tcipher_ctx = EVP_CIPHER_CTX_new();\n+\tif (!cipher_ctx) {\n+\t\tphp_error_docref(NULL TSRMLS_CC, E_WARNING, \"Failed to create cipher context\");\n+\t\tRETURN_FALSE;\n+\t}\n+\n+\tEVP_DecryptInit(cipher_ctx, cipher_type, NULL, NULL);\n \tif (password_len > keylen) {\n-\t\tEVP_CIPHER_CTX_set_key_length(&cipher_ctx, password_len);\n+\t\tEVP_CIPHER_CTX_set_key_length(cipher_ctx, password_len);\n \t}\n-\tEVP_DecryptInit_ex(&cipher_ctx, NULL, NULL, key, (unsigned char *)iv);\n+\tEVP_DecryptInit_ex(cipher_ctx, NULL, NULL, key, (unsigned char *)iv);\n \tif (options & OPENSSL_ZERO_PADDING) {\n-\t\tEVP_CIPHER_CTX_set_padding(&cipher_ctx, 0);\n+\t\tEVP_CIPHER_CTX_set_padding(cipher_ctx, 0);\n \t}\n-\tEVP_DecryptUpdate(&cipher_ctx, outbuf, &i, (unsigned char *)data, data_len);\n+\tEVP_DecryptUpdate(cipher_ctx, outbuf, &i, (unsigned char *)data, data_len);\n \toutlen = i;\n-\tif (EVP_DecryptFinal(&cipher_ctx, (unsigned char *)outbuf + i, &i)) {\n+\tif (EVP_DecryptFinal(cipher_ctx, (unsigned char *)outbuf + i, &i)) {\n \t\toutlen += i;\n \t\toutbuf[outlen] = '\\0';\n \t\tRETVAL_STRINGL((char *)outbuf, outlen, 0);\n@@ -5386,7 +5702,8 @@ PHP_FUNCTION(openssl_decrypt)\n \tif (base64_str) {\n \t\tefree(base64_str);\n \t}\n- \tEVP_CIPHER_CTX_cleanup(&cipher_ctx);\n+ \tEVP_CIPHER_CTX_cleanup(cipher_ctx);\n+ \tEVP_CIPHER_CTX_free(cipher_ctx);\n }\n /* }}} */\n \n@@ -5424,6 +5741,7 @@ PHP_FUNCTION(openssl_dh_compute_key)\n \tzval *key;\n \tchar *pub_str;\n \tint pub_len;\n+\tDH *dh;\n \tEVP_PKEY *pkey;\n \tBIGNUM *pub;\n \tchar *data;\n@@ -5433,14 +5751,21 @@ PHP_FUNCTION(openssl_dh_compute_key)\n \t\treturn;\n \t}\n \tZEND_FETCH_RESOURCE(pkey, EVP_PKEY *, &key, -1, \"OpenSSL key\", le_key);\n-\tif (!pkey || EVP_PKEY_type(pkey->type) != EVP_PKEY_DH || !pkey->pkey.dh) {\n+\tif (pkey == NULL) {\n+\t\tRETURN_FALSE;\n+\t}\n+\tif (EVP_PKEY_base_id(pkey) != EVP_PKEY_DH) {\n+\t\tRETURN_FALSE;\n+\t}\n+\tdh = EVP_PKEY_get0_DH(pkey);\n+\tif (dh == NULL) {\n \t\tRETURN_FALSE;\n \t}\n \n \tpub = BN_bin2bn((unsigned char*)pub_str, pub_len, NULL);\n \n-\tdata = emalloc(DH_size(pkey->pkey.dh) + 1);\n-\tlen = DH_compute_key((unsigned char*)data, pub, pkey->pkey.dh);\n+\tdata = emalloc(DH_size(dh) + 1);\n+\tlen = DH_compute_key((unsigned char*)data, pub, dh);\n \n \tif (len >= 0) {\n \t\tdata[len] = 0;\ndiff -rupN php-5.6.31.orig/ext/openssl/tests/bug41033.phpt php-5.6.31/ext/openssl/tests/bug41033.phpt\n--- php-5.6.31.orig/ext/openssl/tests/bug41033.phpt\t2017-07-06 00:25:00.000000000 +0200\n+++ php-5.6.31/ext/openssl/tests/bug41033.phpt\t2017-08-01 10:49:25.008823468 +0200\n@@ -13,11 +13,11 @@ $pub = 'file://' . dirname(__FILE__) . '\n \n $prkeyid = openssl_get_privatekey($prv, \"1234\");\n $ct = \"Hello I am some text!\";\n-openssl_sign($ct, $signature, $prkeyid, OPENSSL_ALGO_DSS1);\n+openssl_sign($ct, $signature, $prkeyid, OPENSSL_VERSION_NUMBER < 0x10100000 ? OPENSSL_ALGO_DSS1 : OPENSSL_ALGO_SHA1);\n echo \"Signature: \".base64_encode($signature) . \"\\n\";\n \n $pukeyid = openssl_get_publickey($pub);\n-$valid = openssl_verify($ct, $signature, $pukeyid, OPENSSL_ALGO_DSS1);\n+$valid = openssl_verify($ct, $signature, $pukeyid, OPENSSL_VERSION_NUMBER < 0x10100000 ? OPENSSL_ALGO_DSS1 : OPENSSL_ALGO_SHA1);\n echo \"Signature validity: \" . $valid . \"\\n\";\n \n \ndiff -rupN php-5.6.31.orig/ext/openssl/tests/bug66501.phpt php-5.6.31/ext/openssl/tests/bug66501.phpt\n--- php-5.6.31.orig/ext/openssl/tests/bug66501.phpt\t2017-07-06 00:25:00.000000000 +0200\n+++ php-5.6.31/ext/openssl/tests/bug66501.phpt\t2017-08-01 10:49:25.008823468 +0200\n@@ -16,7 +16,7 @@ AwEHoUQDQgAEPq4hbIWHvB51rdWr8ejrjWo4qVNW\n sqOTOnMoezkbSmVVMuwz9flvnqHGmQvmug==\r\n -----END EC PRIVATE KEY-----';\r\n $key = openssl_pkey_get_private($pkey);\r\n-$res = openssl_sign($data ='alpha', $sign, $key, 'ecdsa-with-SHA1');\r\n+$res = openssl_sign($data ='alpha', $sign, $key, OPENSSL_VERSION_NUMBER < 0x10100000 ? 'ecdsa-with-SHA1' : 'SHA1');\r\n var_dump($res);\r\n --EXPECTF--\r\n bool(true)\r\ndiff -rupN php-5.6.31.orig/ext/openssl/tests/openssl_error_string_basic.phpt php-5.6.31/ext/openssl/tests/openssl_error_string_basic.phpt\n--- php-5.6.31.orig/ext/openssl/tests/openssl_error_string_basic.phpt\t2017-07-06 00:25:00.000000000 +0200\n+++ php-5.6.31/ext/openssl/tests/openssl_error_string_basic.phpt\t2017-08-01 10:49:25.008823468 +0200\n@@ -105,7 +105,7 @@ expect_openssl_errors('openssl_private_d\n // public encrypt and decrypt with failed padding check and padding\n @openssl_public_encrypt(\"data\", $crypted, $public_key_file, 1000);\n @openssl_public_decrypt(\"data\", $crypted, $public_key_file);\n-expect_openssl_errors('openssl_private_(en|de)crypt padding', ['0906D06C', '04068076', '0407006A', '04067072']);\n+expect_openssl_errors('openssl_private_(en|de)crypt padding', OPENSSL_VERSION_NUMBER < 0x10100000 ? ['0906D06C', '04068076', '0407006A', '04067072'] : ['0906D06C', '04068076', '04067072']);\n \n // X509\n echo \"X509 errors\\n\";\ndiff -rupN php-5.6.31.orig/ext/openssl/tests/sni_server.phpt php-5.6.31/ext/openssl/tests/sni_server.phpt\n--- php-5.6.31.orig/ext/openssl/tests/sni_server.phpt\t2017-07-06 00:25:00.000000000 +0200\n+++ php-5.6.31/ext/openssl/tests/sni_server.phpt\t2017-08-01 10:49:25.012823468 +0200\n@@ -27,6 +27,9 @@ CODE;\n $clientCode = <<<'CODE'\n $flags = STREAM_CLIENT_CONNECT;\n $ctxArr = [\n+ 'verify_peer' => false,\n+ 'verify_peer_name' => false,\n+ 'allow_self_signed' => true,\n 'cafile' => __DIR__ . '/sni_server_ca.pem',\n 'capture_peer_cert' => true\n ];\ndiff -rupN php-5.6.31.orig/ext/openssl/xp_ssl.c php-5.6.31/ext/openssl/xp_ssl.c\n--- php-5.6.31.orig/ext/openssl/xp_ssl.c\t2017-07-06 00:25:00.000000000 +0200\n+++ php-5.6.31/ext/openssl/xp_ssl.c\t2017-08-01 10:49:25.012823468 +0200\n@@ -935,7 +935,7 @@ static int set_local_cert(SSL_CTX *ctx,\n static const SSL_METHOD *php_select_crypto_method(long method_value, int is_client TSRMLS_DC) /* {{{ */\n {\n \tif (method_value == STREAM_CRYPTO_METHOD_SSLv2) {\n-#ifndef OPENSSL_NO_SSL2\n+#if !defined(OPENSSL_NO_SSL2) && OPENSSL_VERSION_NUMBER < 0x10100000L\n \t\treturn is_client ? SSLv2_client_method() : SSLv2_server_method();\n #else\n \t\tphp_error_docref(NULL TSRMLS_CC, E_WARNING,\n@@ -1588,12 +1588,26 @@ int php_openssl_setup_crypto(php_stream\n }\n /* }}} */\n \n+#define PHP_SSL_MAX_VERSION_LEN 32\n+\n+static char *php_ssl_cipher_get_version(const SSL_CIPHER *c, char *buffer, size_t max_len) /* {{{ */\n+{\n+\tconst char *version = SSL_CIPHER_get_version(c);\n+\tstrncpy(buffer, version, max_len);\n+\tif (max_len <= strlen(version)) {\n+\t\tbuffer[max_len - 1] = 0;\n+\t}\n+\treturn buffer;\n+}\n+/* }}} */\n+\n static zval *capture_session_meta(SSL *ssl_handle) /* {{{ */\n {\n \tzval *meta_arr;\n \tchar *proto_str;\n \tlong proto = SSL_version(ssl_handle);\n \tconst SSL_CIPHER *cipher = SSL_get_current_cipher(ssl_handle);\n+\tchar version_str[PHP_SSL_MAX_VERSION_LEN];\n \n \tswitch (proto) {\n #if OPENSSL_VERSION_NUMBER >= 0x10001001L\n@@ -1611,7 +1625,7 @@ static zval *capture_session_meta(SSL *s\n \tadd_assoc_string(meta_arr, \"protocol\", proto_str, 1);\n \tadd_assoc_string(meta_arr, \"cipher_name\", (char *) SSL_CIPHER_get_name(cipher), 1);\n \tadd_assoc_long(meta_arr, \"cipher_bits\", SSL_CIPHER_get_bits(cipher, NULL));\n-\tadd_assoc_string(meta_arr, \"cipher_version\", SSL_CIPHER_get_version(cipher), 1);\n+\tadd_assoc_string(meta_arr, \"cipher_version\", php_ssl_cipher_get_version(cipher, version_str, PHP_SSL_MAX_VERSION_LEN), 1);\n \n \treturn meta_arr;\n }\ndiff -rupN php-5.6.31.orig/ext/phar/util.c php-5.6.31/ext/phar/util.c\n--- php-5.6.31.orig/ext/phar/util.c\t2017-07-06 00:25:00.000000000 +0200\n+++ php-5.6.31/ext/phar/util.c\t2017-08-01 10:49:25.020823468 +0200\n@@ -1531,7 +1531,7 @@ int phar_verify_signature(php_stream *fp\n \t\t\tBIO *in;\n \t\t\tEVP_PKEY *key;\n \t\t\tEVP_MD *mdtype = (EVP_MD *) EVP_sha1();\n-\t\t\tEVP_MD_CTX md_ctx;\n+\t\t\tEVP_MD_CTX *md_ctx;\n #else\n \t\t\tint tempsig;\n #endif\n@@ -1608,7 +1608,8 @@ int phar_verify_signature(php_stream *fp\n \t\t\t\treturn FAILURE;\n \t\t\t}\n \n-\t\t\tEVP_VerifyInit(&md_ctx, mdtype);\n+\t\t\tmd_ctx = EVP_MD_CTX_create();\n+\t\t\tEVP_VerifyInit(md_ctx, mdtype);\n \t\t\tread_len = end_of_phar;\n \n \t\t\tif (read_len > sizeof(buf)) {\n@@ -1620,7 +1621,7 @@ int phar_verify_signature(php_stream *fp\n \t\t\tphp_stream_seek(fp, 0, SEEK_SET);\n \n \t\t\twhile (read_size && (len = php_stream_read(fp, (char*)buf, read_size)) > 0) {\n-\t\t\t\tEVP_VerifyUpdate (&md_ctx, buf, len);\n+\t\t\t\tEVP_VerifyUpdate (md_ctx, buf, len);\n \t\t\t\tread_len -= (off_t)len;\n \n \t\t\t\tif (read_len < read_size) {\n@@ -1628,9 +1629,9 @@ int phar_verify_signature(php_stream *fp\n \t\t\t\t}\n \t\t\t}\n \n-\t\t\tif (EVP_VerifyFinal(&md_ctx, (unsigned char *)sig, sig_len, key) != 1) {\n+\t\t\tif (EVP_VerifyFinal(md_ctx, (unsigned char *)sig, sig_len, key) != 1) {\n \t\t\t\t/* 1: signature verified, 0: signature does not match, -1: failed signature operation */\n-\t\t\t\tEVP_MD_CTX_cleanup(&md_ctx);\n+\t\t\t\tEVP_MD_CTX_destroy(md_ctx);\n \n \t\t\t\tif (error) {\n \t\t\t\t\tspprintf(error, 0, \"broken openssl signature\");\n@@ -1639,7 +1640,7 @@ int phar_verify_signature(php_stream *fp\n \t\t\t\treturn FAILURE;\n \t\t\t}\n \n-\t\t\tEVP_MD_CTX_cleanup(&md_ctx);\n+\t\t\tEVP_MD_CTX_destroy(md_ctx);\n #endif\n \n \t\t\t*signature_len = phar_hex_str((const char*)sig, sig_len, signature TSRMLS_CC);\n" }, { "path": "aegir/patches/activity.patch", "content": "diff -urp a/activity.install b/activity.install\n--- a/activity.install\t2010-06-30 21:04:18.000000000 +0000\n+++ b/activity.install\t2010-10-15 21:41:11.000000000 +0000\n@@ -5,7 +5,7 @@ function activity_install() {\n drupal_install_schema('activity');\n // Set Trigger's weight to 2 so that it will fire AFTER pathauto. This makes\n // pathauto alias' work.\n- if (activity_bad_trigger_weight()) {\n+ if (activity_bad_trigger_weight() && isset($_SERVER['HTTP_USER_AGENT'])) {\n drupal_set_message(t('In order for proper Pathauto behavior with Activity module, the Trigger module\\'s weight needs to be fixed up. !clickhere', array('!clickhere' => l(t('Click here to fix Trigger\\'s weight'), 'admin/activity/weight', array('query' => drupal_get_destination())))), 'error');\n }\n }\n@@ -214,4 +214,4 @@ function activity_update_6201() {\n $ret = array();\n db_change_field($ret, 'activity_messages', 'amid', 'amid', array('type' => 'serial', 'unsigned' => TRUE, 'not null' => TRUE));\n return $ret;\n-}\n\\ No newline at end of file\n+}\n" }, { "path": "aegir/patches/apps_msg.patch", "content": "diff -urp a/apps.profile.inc b/apps.profile.inc\n--- a/apps.profile.inc\t2012-10-14 06:42:00.000000000 -0400\n+++ b/apps.profile.inc\t2012-10-14 06:42:48.000000000 -0400\n@@ -177,7 +177,7 @@ function apps_profile_download_batch_fin\n 'title' => t('Downloading updates failed:'),\n 'items' => $results['errors'],\n );\n- drupal_set_message(theme('item_list', $error_list), 'error');\n+ //drupal_set_message(theme('item_list', $error_list), 'error');\n }\n elseif ($success) {\n drupal_set_message(t('Updates downloaded successfully.'));\n" }, { "path": "aegir/patches/bug62886.patch", "content": "diff --git a/sapi/fpm/fpm/fpm.c b/sapi/fpm/fpm/fpm.c\nindex dab415d..2f42175 100644\n--- a/sapi/fpm/fpm/fpm.c\n+++ b/sapi/fpm/fpm/fpm.c\n@@ -39,7 +39,7 @@ struct fpm_globals_s fpm_globals = {\n \t.test_successful = 0,\n \t.heartbeat = 0,\n \t.run_as_root = 0,\n-\t.send_config_signal = 0,\n+\t.send_config_pipe = {0, 0},\n };\n \n int fpm_init(int argc, char **argv, char *config, char *prefix, char *pid, int test_conf, int run_as_root) /* {{{ */\ndiff --git a/sapi/fpm/fpm/fpm.h b/sapi/fpm/fpm/fpm.h\nindex 7a2903d..c576876 100644\n--- a/sapi/fpm/fpm/fpm.h\n+++ b/sapi/fpm/fpm/fpm.h\n@@ -55,7 +55,7 @@ struct fpm_globals_s {\n \tint test_successful;\n \tint heartbeat;\n \tint run_as_root;\n-\tint send_config_signal;\n+\tint send_config_pipe[2];\n };\n \n extern struct fpm_globals_s fpm_globals;\ndiff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c\nindex b058d7a..7d53927 100644\n--- a/sapi/fpm/fpm/fpm_main.c\n+++ b/sapi/fpm/fpm/fpm_main.c\n@@ -1804,16 +1804,18 @@ consult the installation file that came with this distribution, or visit \\n\\\n \n \tif (0 > fpm_init(argc, argv, fpm_config ? fpm_config : CGIG(fpm_config), fpm_prefix, fpm_pid, test_conf, php_allow_to_run_as_root)) {\n \n-\t\tif (fpm_globals.send_config_signal) {\n-\t\t\tzlog(ZLOG_DEBUG, \"Sending SIGUSR2 (error) to parent %d\", getppid());\n-\t\t\tkill(getppid(), SIGUSR2);\n+\t\tif (fpm_globals.send_config_pipe[1]) {\n+\t\t\tint writeval = 0;\n+\t\t\tzlog(ZLOG_DEBUG, \"Sending \\\"0\\\" (error) to parent via fd=%d\", fpm_globals.send_config_pipe[1]);\n+\t\t\twrite(fpm_globals.send_config_pipe[1], &writeval, sizeof(writeval));\n \t\t}\n \t\treturn FPM_EXIT_CONFIG;\n \t}\n \n-\tif (fpm_globals.send_config_signal) {\n-\t\tzlog(ZLOG_DEBUG, \"Sending SIGUSR1 (OK) to parent %d\", getppid());\n-\t\tkill(getppid(), SIGUSR1);\n+\tif (fpm_globals.send_config_pipe[1]) {\n+\t\tint writeval = 1;\n+\t\tzlog(ZLOG_DEBUG, \"Sending \\\"1\\\" (OK) to parent via fd=%d\", fpm_globals.send_config_pipe[1]);\n+\t\twrite(fpm_globals.send_config_pipe[1], &writeval, sizeof(writeval));\n \t}\n \tfpm_is_running = 1;\n \ndiff --git a/sapi/fpm/fpm/fpm_signals.c b/sapi/fpm/fpm/fpm_signals.c\nindex 656269f..8993a86 100644\n--- a/sapi/fpm/fpm/fpm_signals.c\n+++ b/sapi/fpm/fpm/fpm_signals.c\n@@ -249,15 +249,3 @@ int fpm_signals_get_fd() /* {{{ */\n }\n /* }}} */\n \n-void fpm_signals_sighandler_exit_ok(pid_t pid) /* {{{ */\n-{\n-\texit(FPM_EXIT_OK);\n-}\n-/* }}} */\n-\n-void fpm_signals_sighandler_exit_config(pid_t pid) /* {{{ */\n-{\n-\texit(FPM_EXIT_CONFIG);\n-}\n-/* }}} */\n-\ndiff --git a/sapi/fpm/fpm/fpm_signals.h b/sapi/fpm/fpm/fpm_signals.h\nindex 13484cb..eb80fae 100644\n--- a/sapi/fpm/fpm/fpm_signals.h\n+++ b/sapi/fpm/fpm/fpm_signals.h\n@@ -11,9 +11,6 @@ int fpm_signals_init_main();\n int fpm_signals_init_child();\n int fpm_signals_get_fd();\n \n-void fpm_signals_sighandler_exit_ok(pid_t pid);\n-void fpm_signals_sighandler_exit_config(pid_t pid);\n-\n extern const char *fpm_signal_names[NSIG + 1];\n \n #endif\ndiff --git a/sapi/fpm/fpm/fpm_unix.c b/sapi/fpm/fpm/fpm_unix.c\nindex 5c5e37c..443f606 100644\n--- a/sapi/fpm/fpm/fpm_unix.c\n+++ b/sapi/fpm/fpm/fpm_unix.c\n@@ -262,36 +262,19 @@ int fpm_unix_init_main() /* {{{ */\n \t\t * The parent process has then to wait for the master\n \t\t * process to initialize to return a consistent exit\n \t\t * value. For this pupose, the master process will\n-\t\t * send USR1 if everything went well and USR2\n-\t\t * otherwise.\n+\t\t * send \\\"1\\\" into the pipe if everything went well \n+\t\t * and \\\"0\\\" otherwise.\n \t\t */\n \n-\t\tstruct sigaction act;\n-\t\tstruct sigaction oldact_usr1;\n-\t\tstruct sigaction oldact_usr2;\n-\t\tstruct timeval tv;\n \n-\t\t/*\n-\t\t * set sigaction for USR1 before fork\n-\t\t * save old sigaction to restore it after\n-\t\t * fork in the child process (the master process)\n-\t\t */\n-\t\tmemset(&act, 0, sizeof(act));\n-\t\tmemset(&act, 0, sizeof(oldact_usr1));\n-\t\tact.sa_handler = fpm_signals_sighandler_exit_ok;\n-\t\tsigfillset(&act.sa_mask);\n-\t\tsigaction(SIGUSR1, &act, &oldact_usr1);\n+\t\tstruct timeval tv;\n+\t\tfd_set rfds;\n+\t\tint ret;\n \n-\t\t/*\n-\t\t * set sigaction for USR2 before fork\n-\t\t * save old sigaction to restore it after\n-\t\t * fork in the child process (the master process)\n-\t\t */\n-\t\tmemset(&act, 0, sizeof(act));\n-\t\tmemset(&act, 0, sizeof(oldact_usr2));\n-\t\tact.sa_handler = fpm_signals_sighandler_exit_config;\n-\t\tsigfillset(&act.sa_mask);\n-\t\tsigaction(SIGUSR2, &act, &oldact_usr2);\n+\t\tif (pipe(fpm_globals.send_config_pipe) == -1) {\n+\t\t\tzlog(ZLOG_SYSERROR, \"failed to create pipe\");\n+\t\t\treturn -1;\n+\t\t}\n \n \t\t/* then fork */\n \t\tpid_t pid = fork();\n@@ -302,24 +285,54 @@ int fpm_unix_init_main() /* {{{ */\n \t\t\t\treturn -1;\n \n \t\t\tcase 0 : /* children */\n-\t\t\t\t/* restore USR1 and USR2 sigaction */\n-\t\t\t\tsigaction(SIGUSR1, &oldact_usr1, NULL);\n-\t\t\t\tsigaction(SIGUSR2, &oldact_usr2, NULL);\n-\t\t\t\tfpm_globals.send_config_signal = 1;\n+\t\t\t\tclose(fpm_globals.send_config_pipe[0]); /* close the read side of the pipe */\n \t\t\t\tbreak;\n \n \t\t\tdefault : /* parent */\n-\t\t\t\tfpm_cleanups_run(FPM_CLEANUP_PARENT_EXIT);\n+\t\t\t\tclose(fpm_globals.send_config_pipe[1]); /* close the write side of the pipe */\n \n \t\t\t\t/*\n \t\t\t\t * wait for 10s before exiting with error\n-\t\t\t\t * the child is supposed to send USR1 or USR2 to tell the parent\n+\t\t\t\t * the child is supposed to send 1 or 0 into the pipe to tell the parent\n \t\t\t\t * how it goes for it\n \t\t\t\t */\n+\t\t\t\tFD_ZERO(&rfds);\n+\t\t\t\tFD_SET(fpm_globals.send_config_pipe[0], &rfds);\n+\n \t\t\t\ttv.tv_sec = 10;\n \t\t\t\ttv.tv_usec = 0;\n-\t\t\t\tzlog(ZLOG_DEBUG, \"The calling process is waiting for the master process to ping\");\n-\t\t\t\tselect(0, NULL, NULL, NULL, &tv);\n+\n+\t\t\t\tzlog(ZLOG_DEBUG, \"The calling process is waiting for the master process to ping via fd=%d\", fpm_globals.send_config_pipe[0]);\n+\t\t\t\tret = select(fpm_globals.send_config_pipe[0] + 1, &rfds, NULL, NULL, &tv);\n+\t\t\t\tif (ret == -1) {\n+\t\t\t\t\tzlog(ZLOG_SYSERROR, \"failed to select\");\n+\t\t\t\t\texit(FPM_EXIT_SOFTWARE);\n+\t\t\t\t}\n+\t\t\t\tif (ret) { /* data available */\n+\t\t\t\t\tint readval;\n+\t\t\t\t\tret = read(fpm_globals.send_config_pipe[0], &readval, sizeof(readval));\n+\t\t\t\t\tif (ret == -1) {\n+\t\t\t\t\t\tzlog(ZLOG_SYSERROR, \"failed to read from pipe\");\n+\t\t\t\t\t\texit(FPM_EXIT_SOFTWARE);\n+\t\t\t\t\t}\n+\n+\t\t\t\t\tif (ret == 0) {\n+\t\t\t\t\t\tzlog(ZLOG_ERROR, \"no data have been read from pipe\");\n+\t\t\t\t\t\texit(FPM_EXIT_SOFTWARE);\n+\t\t\t\t\t} else {\n+\t\t\t\t\t\tif (readval == 1) {\n+\t\t\t\t\t\t\tzlog(ZLOG_DEBUG, \"I received a valid acknoledge from the master process, I can exit without error\");\n+\t\t\t\t\t\t\tfpm_cleanups_run(FPM_CLEANUP_PARENT_EXIT);\n+\t\t\t\t\t\t\texit(FPM_EXIT_OK);\n+\t\t\t\t\t\t} else {\n+\t\t\t\t\t\t\tzlog(ZLOG_ERROR, \"The master process returned an error !\");\n+\t\t\t\t\t\t\texit(FPM_EXIT_SOFTWARE);\n+\t\t\t\t\t\t}\n+\t\t\t\t\t}\n+\t\t\t\t} else { /* no date sent ! */\n+\t\t\t\t\tzlog(ZLOG_ERROR, \"the master process didn't send back its status (via the pipe to the calling process)\");\n+\t\t\t\t exit(FPM_EXIT_SOFTWARE);\n+\t\t\t\t}\n \t\t\t\texit(FPM_EXIT_SOFTWARE);\n \t\t}\n \t}\n" }, { "path": "aegir/patches/civicrm.drush.inc.patch.txt", "content": "diff -burp a/civicrm/drupal/drush/civicrm.drush.inc b/civicrm/drupal/drush/civicrm.drush.inc\n--- a/civicrm/drupal/drush/civicrm.drush.inc\t2014-09-18 11:46:17.000000000 +0000\n+++ b/civicrm/drupal/drush/civicrm.drush.inc\t2015-02-04 16:13:25.000000000 +0000\n@@ -257,6 +257,20 @@ function civicrm_drush_command() {\n * Implementation of drush_hook_COMMAND_validate for command 'civicrm-install'\n */\n function drush_civicrm_install_validate() {\n+\n+ switch (substr(drush_core_version(), 0, 1)) {\n+ case '7':\n+ $sql = drush_get_class('Drush\\Sql\\Sql', array(), array(drush_drupal_major_version()));\n+ $db_spec = $sql->get_db_spec();\n+ break;\n+ case '6':\n+ case '5':\n+ $db_spec = _drush_sql_get_db_spec();\n+ break;\n+ default:\n+ drush_set_error('DRUSH_UNSUPPORTED_VERSION', dt('Drush !version is not supported'));\n+ }\n+\n // TODO: Replace these with required options (Drush 5).\n // Get the drupal credentials in case civi specific db info is not passed.\n if (drush_get_option('db-url', FALSE)) {\n@@ -445,7 +459,19 @@ function _civicrm_generate_settings_file\n }\n\n $baseUrl = !$baseUrl ? ($GLOBALS['base_url']) : ($protocol . '://' . $baseUrl);\n+\n+ switch (substr(drush_core_version(), 0, 1)) {\n+ case '7':\n+ $sql = drush_get_class('Drush\\Sql\\Sql', array(), array(drush_drupal_major_version()));\n+ $db_spec = $sql->get_db_spec();\n+ break;\n+ case '6':\n+ case '5':\n $db_spec = _drush_sql_get_db_spec();\n+ break;\n+ default:\n+ drush_set_error('DRUSH_UNSUPPORTED_VERSION', dt('Drush !version is not supported'));\n+ }\n\n // Check version: since 4.1, Drupal6 must be used for the UF in D6\n // The file civicrm-version.php appeared around 4.0, so it is safe to assume\n@@ -961,7 +987,19 @@ function drush_civicrm_restore() {\n $restore_backup_dir = rtrim($restore_backup_dir, '/');\n\n // get confirmation from user -\n+ switch (substr(drush_core_version(), 0, 1)) {\n+ case '7':\n+ $sql = drush_get_class('Drush\\Sql\\Sql', array(), array(drush_drupal_major_version()));\n+ $db_spec = $sql->get_db_spec();\n+ break;\n+ case '6':\n+ case '5':\n $db_spec = _drush_sql_get_db_spec();\n+ break;\n+ default:\n+ drush_set_error('DRUSH_UNSUPPORTED_VERSION', dt('Drush !version is not supported'));\n+ }\n+\n drush_print(dt(\"\\nProcess involves :\"));\n drush_print(dt(\"1. Restoring '\\$restore-dir/civicrm' directory to '!toDir'.\", array('!toDir' => $civicrm_root_base)));\n drush_print(dt(\"2. Dropping and creating '!db' database.\", array('!db' => $db_spec['database'])));\n" }, { "path": "aegir/patches/civicrm_engage.install", "content": " array(\n 'label' => 'Media Contact',\n 'parent_id' => 1,\n 'is_active' => 1,\n 'name' => 'Media_Contact',\n ),\n 'Funder_Contact' => array(\n 'label' => 'Funder Contact',\n 'parent_id' => 1,\n 'is_active' => 1,\n 'name' => 'Funder_Contact',\n ),\n 'Elected_Official' => array(\n 'label' => 'Elected Official',\n 'parent_id' => 1,\n 'is_active' => 1,\n 'name' => 'Elected_Official',\n ),\n 'Media_Outlet' => array(\n 'label' => 'Media Outlet',\n 'parent_id' => 3,\n 'is_active' => 1,\n 'name' => 'Media_Outlet',\n ),\n 'Foundation' => array(\n 'label' => 'Foundation',\n 'parent_id' => 3,\n 'is_active' => 1,\n 'name' => 'Foundation',\n ),\n );\n require_once (\"CRM/Contact/BAO/ContactType.php\");\n $existing_types = CRM_Contact_BAO_ContactType::subTypeInfo();\n while (list($k) = each($existing_types)) {\n if (array_key_exists($k, $create)) {\n drupal_set_message(t(\"Not creating @type, already exists.\", array(\"@type\" => $k)));\n unset($create[$k]);\n }\n }\n $contact_type = new CRM_Contact_BAO_ContactType();\n while (list($k, $v) = each($create)) {\n drupal_set_message(t(\"Creating %c\", array('%c' => $k)));\n $contact_type->add($v);\n }\n}\n\n/**\n * Street parsing is required for walk lists because it needs to\n * sort by even/odd address numbers so, when canvassing a street\n * in which even addresses are on one side and odd on the other, you\n * can divide the task between two people with two different lists.\n */\nfunction civcrm_engage_enable_street_address_parsing() {\n include_once 'CRM/Core/BAO/Setting.php';\n $address_options = CRM_Core_BAO_Setting::valueOptions(CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME,\n 'address_options',\n TRUE, NULL, TRUE\n );\n $address_options['street_address_parsing'] = 1;\n CRM_Core_BAO_Setting::setValueOption(CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME,\n 'address_options',\n $address_options\n );\n}\n\n/**\n * Check Phone Number for auto complete. This setting doubles for batch\n * update, and when making a phone list in CiviCampaign you really need\n * to have the phone number included.\n */\nfunction civcrm_engage_set_autocomplete_options() {\n include_once 'CRM/Core/BAO/Setting.php';\n $contact_autocomplete_options = CRM_Core_BAO_Setting::valueOptions(\n CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME,\n 'contact_autocomplete_options',\n TRUE, NULL, TRUE\n );\n $contact_autocomplete_options['phone'] = 1;\n CRM_Core_BAO_Setting::setValueOption(\n CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME,\n 'contact_autocomplete_options',\n $contact_autocomplete_options\n );\n}\n\nfunction civicrm_engage_load_configuration() {\n drupal_set_message(\"Loading default civicrm_engage configuration.\");\n // we need to build the path to the CustomGroupDate.xml file\n // shipped in the civicrm_engage directory. civicrm_engage could\n // be installed outside of the civicrm root, so we can't rely on\n // that contstant.\n\n // instead... start with the drupal root\n $root = getcwd();\n // and then added the relative path to the module\n $civi_engage_path = drupal_get_path('module', 'civicrm_engage');\n $xml_file = $root . '/' . $civi_engage_path . '/CustomGroupData.xml';\n require_once 'CRM/Utils/Migrate/Import.php';\n $import = new CRM_Utils_Migrate_Import();\n\n $import->run($xml_file);\n}\n\n" }, { "path": "aegir/patches/commerce_kickstart.patch", "content": "diff --git a/profiles/commerce_kickstart/modules/commerce_kickstart/commerce_kickstart_slideshow/commerce_kickstart_slideshow.module b/profiles/commerce_kickstart/modules/commerce_kickstart/commerce_kickstart_slideshow/commerce_kickstart_slideshow.module\nindex ce7bbed..6e4af5a 100644\n--- a/profiles/commerce_kickstart/modules/commerce_kickstart/commerce_kickstart_slideshow/commerce_kickstart_slideshow.module\n+++ b/profiles/commerce_kickstart/modules/commerce_kickstart/commerce_kickstart_slideshow/commerce_kickstart_slideshow.module\n@@ -15,7 +15,7 @@ function commerce_kickstart_slideshow_library() {\n 'website' => 'http://bxslider.com/',\n 'version' => '4.0',\n 'js' => array(\n- libraries_get_path('jquery.bxslider') . '/jquery.bxslider.min.js' => array(),\n+ libraries_get_path('jquery.bxslider') . '/dist/jquery.bxslider.min.js' => array(),\n ),\n );\n return $libraries;\n" }, { "path": "aegir/patches/commons-1045778-fix-aegir-installs.patch", "content": "diff --git a/drupal_commons.profile b/drupal_commons.profile\nindex 48f7a16..57b5089 100644\n--- a/drupal_commons.profile\n+++ b/drupal_commons.profile\n@@ -68,7 +68,7 @@ function drupal_commons_profile_modules() {\n * language-specific profiles.\n */\n function drupal_commons_profile_details() {\n- $logo = '\"Drupal';\n+ $logo = '\"Drupal';\n $description = st('Select this profile to install the Drupal Commons distribution for powering your community website. Drupal Commons provides provides blogging, discussions, user profiles, and other useful community features for both private communities (e.g. an Intranet), or public communities (e.g. a customer community).');\n $description .= '
    ' . $logo;\n\n" }, { "path": "aegir/patches/commons-1060250-aegir-infinite-loop.patch", "content": "diff --git a/drupal_commons.profile b/drupal_commons.profile\nindex 57b5089..ae0ffbd 100644\n--- a/drupal_commons.profile\n+++ b/drupal_commons.profile\n@@ -116,7 +116,33 @@ function drupal_commons_profile_tasks(&$task, $url) {\n\n // Provide a form to choose features\n if ($task == 'configure-commons') {\n- $output = drupal_get_form('drupal_commons_features_form', $url);\n+ if (defined('DRUSH_BASE_PATH')) {\n+ // Set some sane defaults\n+ $features = array(\n+ 'commons_core',\n+ 'commons_home',\n+ 'commons_blog',\n+ 'commons_discussion',\n+ 'commons_document',\n+ 'commons_wiki',\n+ 'commons_poll',\n+ 'commons_event',\n+ 'commons_dashboard',\n+ 'commons_notifications',\n+ 'commons_reputation',\n+ 'commons_group_aggregator',\n+ 'commons_admin',\n+ 'commons_seo'\n+ );\n+ variable_set('commons_selected_features', $features);\n+\n+ // Initiate the next installation step\n+ $task = 'install-commons';\n+ variable_set('install_task', $task);\n+ }\n+ else {\n+ $output = drupal_get_form('drupal_commons_features_form', $url);\n+ }\n }\n\n // Installation batch process\n" }, { "path": "aegir/patches/commons_chicken_egg.patch", "content": "diff -urp a/commons.install b/commons.install\n--- a/commons.install\t2014-08-08 15:45:53.000000000 -0400\n+++ b/commons.install\t2014-08-08 15:38:43.000000000 -0400\n@@ -474,7 +474,8 @@ function commons_add_user_avatar($accoun\n if ($account->uid) {\n $picture_directory = file_default_scheme() . '://' . variable_get('user_picture_path', 'pictures');\n if(file_prepare_directory($picture_directory, FILE_CREATE_DIRECTORY)){\n- $picture_result = drupal_http_request($base_url . '/profiles/commons/images/avatars/avatar-' . commons_normalize_name($account->name) . '.png');\n+ $tmp_url = 'http://127.0.0.1:8888';\n+ $picture_result = drupal_http_request($tmp_url . '/profiles/commons/images/avatars/avatar-' . commons_normalize_name($account->name) . '.png');\n $picture_path = file_stream_wrapper_uri_normalize($picture_directory . '/picture-' . $account->uid . '-' . REQUEST_TIME . '.jpg');\n $picture_file = file_save_data($picture_result->data, $picture_path, FILE_EXISTS_REPLACE);\n\n" }, { "path": "aegir/patches/disable_SSLv2_for_openssl_1_0_0.patch", "content": "--- a/ext/openssl/xp_ssl.c\n+++ b/ext/openssl/xp_ssl.c\n@@ -328,10 +328,12 @@ static inline int php_openssl_setup_cryp\n \t\t\tsslsock->is_client = 1;\n \t\t\tmethod = SSLv23_client_method();\n \t\t\tbreak;\n+#ifndef OPENSSL_NO_SSL2\n \t\tcase STREAM_CRYPTO_METHOD_SSLv2_CLIENT:\n \t\t\tsslsock->is_client = 1;\n \t\t\tmethod = SSLv2_client_method();\n \t\t\tbreak;\n+#endif\n \t\tcase STREAM_CRYPTO_METHOD_SSLv3_CLIENT:\n \t\t\tsslsock->is_client = 1;\n \t\t\tmethod = SSLv3_client_method();\n@@ -348,10 +350,12 @@ static inline int php_openssl_setup_cryp\n \t\t\tsslsock->is_client = 0;\n \t\t\tmethod = SSLv3_server_method();\n \t\t\tbreak;\n+#ifndef OPENSSL_NO_SSL2\n \t\tcase STREAM_CRYPTO_METHOD_SSLv2_SERVER:\n \t\t\tsslsock->is_client = 0;\n \t\t\tmethod = SSLv2_server_method();\n \t\t\tbreak;\n+#endif\n \t\tcase STREAM_CRYPTO_METHOD_TLS_SERVER:\n \t\t\tsslsock->is_client = 0;\n \t\t\tmethod = TLSv1_server_method();\n@@ -629,9 +633,11 @@ static inline int php_openssl_tcp_sockop\n \t\t\t\tcase STREAM_CRYPTO_METHOD_SSLv23_CLIENT:\n \t\t\t\t\tsock->method = STREAM_CRYPTO_METHOD_SSLv23_SERVER;\n \t\t\t\t\tbreak;\n+#ifndef OPENSSL_NO_SSL2\n \t\t\t\tcase STREAM_CRYPTO_METHOD_SSLv2_CLIENT:\n \t\t\t\t\tsock->method = STREAM_CRYPTO_METHOD_SSLv2_SERVER;\n \t\t\t\t\tbreak;\n+#endif\n \t\t\t\tcase STREAM_CRYPTO_METHOD_SSLv3_CLIENT:\n \t\t\t\t\tsock->method = STREAM_CRYPTO_METHOD_SSLv3_SERVER;\n \t\t\t\t\tbreak;\n@@ -911,9 +917,11 @@ php_stream *php_openssl_ssl_socket_facto\n \tif (strncmp(proto, \"ssl\", protolen) == 0) {\n \t\tsslsock->enable_on_connect = 1;\n \t\tsslsock->method = STREAM_CRYPTO_METHOD_SSLv23_CLIENT;\n+#ifndef OPENSSL_NO_SSL2\n \t} else if (strncmp(proto, \"sslv2\", protolen) == 0) {\n \t\tsslsock->enable_on_connect = 1;\n \t\tsslsock->method = STREAM_CRYPTO_METHOD_SSLv2_CLIENT;\n+#endif\n \t} else if (strncmp(proto, \"sslv3\", protolen) == 0) {\n \t\tsslsock->enable_on_connect = 1;\n \t\tsslsock->method = STREAM_CRYPTO_METHOD_SSLv3_CLIENT;\n" }, { "path": "aegir/patches/drupal-eleven-aegir-console-02.patch", "content": "diff -urp a/console/Output/Output.php b/console/Output/Output.php\n--- a/console/Output/Output.php\t2025-05-24 11:34:04.000000000 +0100\n+++ b/console/Output/Output.php\t2025-07-15 22:16:24.471373174 +0100\n@@ -140,5 +140,5 @@ abstract class Output implements OutputI\n /**\n * Writes a message to the output.\n */\n- abstract protected function doWrite(string $message, bool $newline): void;\n+ abstract protected function doWrite($message, $newline);\n }\n\n" }, { "path": "aegir/patches/drupal-eleven-aegir-core-01.patch", "content": "diff -urp a/core/lib/Drupal/Core/Logger/LoggerChannel.php b/core/lib/Drupal/Core/Logger/LoggerChannel.php\n--- a/core/lib/Drupal/Core/Logger/LoggerChannel.php\t2025-06-26 14:56:54.000000000 +0100\n+++ b/core/lib/Drupal/Core/Logger/LoggerChannel.php\t2025-07-17 23:40:15.830594172 +0100\n@@ -91,7 +91,7 @@ class LoggerChannel implements LoggerCha\n /**\n * {@inheritdoc}\n */\n- public function log($level, string|\\Stringable $message, array $context = []): void {\n+ public function log($level, $message, array $context = []) {\n if ($this->callDepth == self::MAX_CALL_DEPTH) {\n return;\n }\ndiff -urp a/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php b/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php\n--- a/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php\t2025-06-26 14:56:54.000000000 +0100\n+++ b/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php\t2025-07-17 23:40:15.830594172 +0100\n@@ -17,62 +17,62 @@ trait RfcLoggerTrait {\n /**\n * {@inheritdoc}\n */\n- public function emergency(string|\\Stringable $message, array $context = []): void {\n+ public function emergency($message, array $context = []) {\n $this->log(RfcLogLevel::EMERGENCY, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function alert(string|\\Stringable $message, array $context = []): void {\n+ public function alert($message, array $context = []) {\n $this->log(RfcLogLevel::ALERT, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function critical(string|\\Stringable $message, array $context = []): void {\n+ public function critical($message, array $context = []) {\n $this->log(RfcLogLevel::CRITICAL, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function error(string|\\Stringable $message, array $context = []): void {\n+ public function error($message, array $context = []) {\n $this->log(RfcLogLevel::ERROR, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function warning(string|\\Stringable $message, array $context = []): void {\n+ public function warning($message, array $context = []) {\n $this->log(RfcLogLevel::WARNING, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function notice(string|\\Stringable $message, array $context = []): void {\n+ public function notice($message, array $context = []) {\n $this->log(RfcLogLevel::NOTICE, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function info(string|\\Stringable $message, array $context = []): void {\n+ public function info($message, array $context = []) {\n $this->log(RfcLogLevel::INFO, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function debug(string|\\Stringable $message, array $context = []): void {\n+ public function debug($message, array $context = []) {\n $this->log(RfcLogLevel::DEBUG, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- abstract public function log($level, string|\\Stringable $message, array $context = []): void;\n+ abstract public function log($level, $message, array $context = []);\n\n }\ndiff -urp a/core/modules/dblog/src/Logger/DbLog.php b/core/modules/dblog/src/Logger/DbLog.php\n--- a/core/modules/dblog/src/Logger/DbLog.php\t2025-06-26 14:56:54.000000000 +0100\n+++ b/core/modules/dblog/src/Logger/DbLog.php\t2025-07-17 23:57:11.122594172 +0100\n@@ -52,7 +52,7 @@ class DbLog implements LoggerInterface {\n /**\n * {@inheritdoc}\n */\n- public function log($level, string|\\Stringable $message, array $context = []): void {\n+ public function log($level, $message, array $context = []) {\n // Remove backtrace and exception since they may contain an unserializable\n // variable.\n unset($context['backtrace'], $context['exception']);\ndiff -urp a/core/modules/syslog/src/Logger/SysLog.php b/core/modules/syslog/src/Logger/SysLog.php\n--- a/core/modules/syslog/src/Logger/SysLog.php\t2025-06-26 14:56:54.000000000 +0100\n+++ b/core/modules/syslog/src/Logger/SysLog.php\t2025-07-17 23:40:15.842594172 +0100\n@@ -67,7 +67,7 @@ class SysLog implements LoggerInterface\n /**\n * {@inheritdoc}\n */\n- public function log($level, string|\\Stringable $message, array $context = []): void {\n+ public function log($level, $message, array $context = []) {\n global $base_url;\n\n $format = $this->config->get('format');\n" }, { "path": "aegir/patches/drupal-eleven-aegir-validator-03.patch", "content": "diff -urp a/core/modules/package_manager/src/Validator/DiskSpaceValidator.php b/core/modules/package_manager/src/Validator/DiskSpaceValidator.php\n--- a/core/modules/package_manager/src/Validator/DiskSpaceValidator.php\t2025-06-26 14:56:54.000000000 +0100\n+++ b/core/modules/package_manager/src/Validator/DiskSpaceValidator.php\t2025-07-28 00:56:23.271822366 +0100\n@@ -40,7 +40,7 @@ class DiskSpaceValidator implements Even\n * If the amount of free space could not be determined.\n */\n protected function freeSpace(string $path): float {\n- $free_space = disk_free_space($path);\n+ $free_space = function_exists('disk_free_space') ? disk_free_space($path) : 9999999999; // assume plenty of space\n if ($free_space === FALSE) {\n throw new \\RuntimeException(\"Cannot get disk information for $path.\");\n }\n" }, { "path": "aegir/patches/drupal-ten-aegir-console-02.patch", "content": "diff -urp a/console/Output/Output.php b/console/Output/Output.php\n--- a/console/Output/Output.php\t2025-05-07 08:05:04.000000000 +0100\n+++ b/console/Output/Output.php\t2025-07-24 03:21:09.032482294 +0100\n@@ -151,5 +151,5 @@ abstract class Output implements OutputI\n *\n * @return void\n */\n- abstract protected function doWrite(string $message, bool $newline);\n+ abstract protected function doWrite($message, $newline);\n }\n" }, { "path": "aegir/patches/drupal-ten-aegir-core-01.patch", "content": "diff -urp a/core/lib/Drupal/Core/Logger/LoggerChannel.php b/core/lib/Drupal/Core/Logger/LoggerChannel.php\n--- a/core/lib/Drupal/Core/Logger/LoggerChannel.php\t2023-12-23 03:12:54.060219719 +0100\n+++ b/core/lib/Drupal/Core/Logger/LoggerChannel.php\t2023-12-23 03:12:39.896219719 +0100\n@@ -91,7 +91,7 @@ class LoggerChannel implements LoggerCha\n /**\n * {@inheritdoc}\n */\n- public function log($level, string|\\Stringable $message, array $context = []): void {\n+ public function log($level, $message, array $context = []) {\n if ($this->callDepth == self::MAX_CALL_DEPTH) {\n return;\n }\ndiff -urp a/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php b/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php\n--- a/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php\t2023-12-23 03:12:54.060219719 +0100\n+++ b/core/lib/Drupal/Core/Logger/RfcLoggerTrait.php\t2023-12-23 03:12:39.896219719 +0100\n@@ -17,62 +17,62 @@ trait RfcLoggerTrait {\n /**\n * {@inheritdoc}\n */\n- public function emergency(string|\\Stringable $message, array $context = []): void {\n+ public function emergency($message, array $context = []) {\n $this->log(RfcLogLevel::EMERGENCY, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function alert(string|\\Stringable $message, array $context = []): void {\n+ public function alert($message, array $context = []) {\n $this->log(RfcLogLevel::ALERT, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function critical(string|\\Stringable $message, array $context = []): void {\n+ public function critical($message, array $context = []) {\n $this->log(RfcLogLevel::CRITICAL, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function error(string|\\Stringable $message, array $context = []): void {\n+ public function error($message, array $context = []) {\n $this->log(RfcLogLevel::ERROR, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function warning(string|\\Stringable $message, array $context = []): void {\n+ public function warning($message, array $context = []) {\n $this->log(RfcLogLevel::WARNING, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function notice(string|\\Stringable $message, array $context = []): void {\n+ public function notice($message, array $context = []) {\n $this->log(RfcLogLevel::NOTICE, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function info(string|\\Stringable $message, array $context = []): void {\n+ public function info($message, array $context = []) {\n $this->log(RfcLogLevel::INFO, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- public function debug(string|\\Stringable $message, array $context = []): void {\n+ public function debug($message, array $context = []) {\n $this->log(RfcLogLevel::DEBUG, $message, $context);\n }\n\n /**\n * {@inheritdoc}\n */\n- abstract public function log($level, string|\\Stringable $message, array $context = []): void;\n+ abstract public function log($level, $message, array $context = []);\n\n }\ndiff -urp a/core/modules/dblog/src/Logger/DbLog.php b/core/modules/dblog/src/Logger/DbLog.php\n--- a/core/modules/dblog/src/Logger/DbLog.php\t2023-12-23 03:12:54.060219719 +0100\n+++ b/core/modules/dblog/src/Logger/DbLog.php\t2023-12-23 03:12:39.896219719 +0100\n@@ -52,7 +52,7 @@ class DbLog implements LoggerInterface {\n /**\n * {@inheritdoc}\n */\n- public function log($level, string|\\Stringable $message, array $context = []): void {\n+ public function log($level, $message, array $context = []) {\n // Remove backtrace and exception since they may contain an unserializable variable.\n unset($context['backtrace'], $context['exception']);\n\ndiff -urp a/core/modules/syslog/src/Logger/SysLog.php b/core/modules/syslog/src/Logger/SysLog.php\n--- a/core/modules/syslog/src/Logger/SysLog.php\t2023-12-06 10:22:56.000000000 +0100\n+++ b/core/modules/syslog/src/Logger/SysLog.php\t2023-12-23 03:10:01.744219719 +0100\n@@ -65,7 +65,7 @@ class SysLog implements LoggerInterface\n /**\n * {@inheritdoc}\n */\n- public function log($level, string|\\Stringable $message, array $context = []): void {\n+ public function log($level, $message, array $context = []) {\n global $base_url;\n\n $format = $this->config->get('format');\n" }, { "path": "aegir/patches/drush-remote_make_files.patch", "content": "Index: drush_make.utilities.inc\n===================================================================\nRCS file: /cvs/drupal-contrib/contributions/modules/drush_make/Attic/drush_make.utilities.inc,v\nretrieving revision 1.1.2.55\ndiff -u -p -r1.1.2.55 drush_make.utilities.inc\n--- drush_make.utilities.inc\t12 Nov 2010 08:19:52 -0000\t1.1.2.55\n+++ drush_make.utilities.inc\t23 Nov 2010 13:02:49 -0000\n@@ -454,7 +454,7 @@ function drush_make_get_data($data_sourc\n }\n // Remote file.\n else {\n- $file = _drush_make_download_file(array('url' => $datasource));\n+ $file = _drush_make_download_file(array('url' => $data_source));\n $data = file_get_contents($file);\n drush_op('unlink', $file);\n }\n" }, { "path": "aegir/patches/drush_make-drush-4.x-fix-do7-compatibility.patch", "content": "diff --git a/drush_make.drush.inc b/drush_make.drush.inc\nindex c8a9b42..f6c541f 100644\n--- a/drush_make.drush.inc\n+++ b/drush_make.drush.inc\n@@ -310,10 +310,22 @@ function drush_make_update_xml_download($project) {\n // Make an array of releases.\n foreach ($project['release_history']->releases->release as $release) {\n $version = (string) $release->version_major;\n+ // Work around drupal.org D7 upgrade inconsistently including version_patch\n+ // see https://drupal.org/node/2140621.\n+ if (empty($release->version_patch)) {\n+ $release->version_patch = 0;\n+ }\n // there should be version_patch attribute for every stable release\n // so checking whether the attribute exists should be enough\n if (isset($release->version_patch) && ((string) $release->version_extra) != 'dev') {\n- $version .= '.' . (string) $release->version_patch;\n+ // Set point version accounting for drupal.org D7 upgrade\n+ // As of the drupal.org D7 upgrade version_minor replaces version_patch.\n+ if (isset($release->version_minor) ) {\n+ $version .= '.' . (string) $release->version_minor;\n+ }\n+ else {\n+ $version .= '.' . (string) $release->version_patch;\n+ }\n }\n // if version_patch attribute does not exist, then it should be a dev release\n // and the version string should be in format MAJOR_VERSION.x-dev\n" }, { "path": "aegir/patches/drush_make.drush.inc.patch", "content": "Index: drush_make.drush.inc\n===================================================================\nRCS file: /cvs/drupal-contrib/contributions/modules/drush_make/Attic/drush_make.drush.inc,v\nretrieving revision 1.11.2.74\ndiff -u -p -r1.11.2.74 drush_make.drush.inc\n--- drush_make.drush.inc\t10 Oct 2010 18:04:07 -0000\t1.11.2.74\n+++ drush_make.drush.inc\t24 Oct 2010 02:27:15 -0000\n@@ -225,8 +225,8 @@ function drush_make_updatexml($project) \n $term_map = array(\n 'Modules' => 'module',\n 'Themes' => 'theme',\n- 'Drupal project' => 'core',\n- 'Installation profiles' => 'profile',\n+ 'Drupal Project' => 'core',\n+ 'Installation Profiles' => 'profile',\n 'Translations' => 'translation'\n );\n // Iterate through all terms related to this project.\n" }, { "path": "aegir/patches/features-1265168-19-roles.patch", "content": "diff --git a/includes/features.user.inc b/includes/features.user.inc\nindex c76455d..bf6d6ff 100644\n--- a/includes/features.user.inc\n+++ b/includes/features.user.inc\n@@ -122,7 +122,11 @@ function user_permission_features_rebuild($module) {\n \n $roles = _user_features_get_roles();\n $permissions_by_role = _user_features_get_permissions(FALSE);\n+ $modules = user_permission_get_modules();\n foreach ($defaults as $permission) {\n+ if (empty($modules[$permission['name']])) {\n+ continue;\n+ }\n $perm = $permission['name'];\n foreach ($roles as $role) {\n if (in_array($role, $permission['roles'])) {\n" }, { "path": "aegir/patches/field_info_collate_fields-1400256-25.patch", "content": "diff --git a/modules/field/field.info.inc b/modules/field/field.info.inc\nindex 9e7ab93..30c7cb1 100644\n--- a/modules/field/field.info.inc\n+++ b/modules/field/field.info.inc\n@@ -183,10 +183,13 @@ function _field_info_collate_types($reset = FALSE) {\n */\n function _field_info_collate_fields($reset = FALSE) {\n static $info;\n+ static $rebuilding = FALSE;\n \n if ($reset) {\n- $info = NULL;\n- cache_clear_all('field_info_fields', 'cache_field');\n+ if(!$rebuilding) {\n+ $info = NULL;\n+ cache_clear_all('field_info_fields', 'cache_field');\n+ }\n return;\n }\n \n@@ -195,6 +198,7 @@ function _field_info_collate_fields($reset = FALSE) {\n $info = $cached->data;\n }\n else {\n+ $rebuilding = TRUE;\n $definitions = array(\n 'field_ids' => field_read_fields(array(), array('include_deleted' => 1)),\n 'instances' => field_read_instances(),\n@@ -244,6 +248,7 @@ function _field_info_collate_fields($reset = FALSE) {\n }\n \n cache_set('field_info_fields', $info, 'cache_field');\n+ $rebuilding = FALSE;\n }\n }\n \n" }, { "path": "aegir/patches/fpm_main.c.patch", "content": "--- a/fpm_main.c\t2013-12-10 14:04:57.000000000 -0500\n+++ b/fpm_main.c\t2013-12-22 16:55:03.000000000 -0500\n@@ -164,6 +164,7 @@ typedef struct _php_cgi_globals_struct {\n \tzend_bool rfc2616_headers;\n \tzend_bool nph;\n \tzend_bool fix_pathinfo;\n+\tchar *fix_chrootpath;\n \tzend_bool force_redirect;\n \tzend_bool discard_path;\n \tzend_bool fcgi_logging;\n@@ -1058,6 +1059,27 @@ static void init_request_info(TSRMLS_D)\n \tchar *ini;\n \tint apache_was_here = 0;\n\n+\tif (CGIG(fix_chrootpath)) {\n+\t\tsize_t chroot_len = strlen(CGIG(fix_chrootpath));\n+\t\t/* remove trail slash */\n+\t\twhile (chroot_len > 0 && CGIG(fix_chrootpath)[chroot_len-1] == '/') {\n+\t\t\tchroot_len--;\n+\t\t}\n+\t\tif (chroot_len > 0) {\n+\t\t\tchar *env_document_root = sapi_cgibin_getenv(\"DOCUMENT_ROOT\", sizeof(\"DOCUMENT_ROOT\") - 1 TSRMLS_CC);\n+\n+\t\t\tif (strncmp(env_path_translated, CGIG(fix_chrootpath), chroot_len) == 0) {\n+\t\t\t\tenv_path_translated += chroot_len;\n+\t\t\t\tenv_path_translated = _sapi_cgibin_putenv(\"PATH_TRANSLATED\", env_path_translated TSRMLS_CC);\n+\t\t\t}\n+\n+\t\t\tif (strncmp(env_document_root, CGIG(fix_chrootpath), chroot_len) == 0) {\n+\t\t\t\tenv_document_root += chroot_len;\n+\t\t\t\tenv_document_root = _sapi_cgibin_putenv(\"DOCUMENT_ROOT\", env_document_root TSRMLS_CC);\n+\t\t\t}\n+\t\t}\n+\t}\n+\n \t/* some broken servers do not have script_filename or argv0\n \t * an example, IIS configured in some ways. then they do more\n \t * broken stuff and set path_translated to the cgi script location */\n@@ -1446,6 +1468,7 @@ PHP_INI_BEGIN()\n \tSTD_PHP_INI_ENTRY(\"cgi.force_redirect\", \"1\", PHP_INI_SYSTEM, OnUpdateBool, force_redirect, php_cgi_globals_struct, php_cgi_globals)\n \tSTD_PHP_INI_ENTRY(\"cgi.redirect_status_env\", NULL, PHP_INI_SYSTEM, OnUpdateString, redirect_status_env, php_cgi_globals_struct, php_cgi_globals)\n \tSTD_PHP_INI_ENTRY(\"cgi.fix_pathinfo\", \"1\", PHP_INI_SYSTEM, OnUpdateBool, fix_pathinfo, php_cgi_globals_struct, php_cgi_globals)\n+\tSTD_PHP_INI_ENTRY(\"cgi.fix_chrootpath\", NULL, PHP_INI_SYSTEM, OnUpdateString, fix_chrootpath, php_cgi_globals_struct, php_cgi_globals)\n \tSTD_PHP_INI_ENTRY(\"cgi.discard_path\", \"0\", PHP_INI_SYSTEM, OnUpdateBool, discard_path, php_cgi_globals_struct, php_cgi_globals)\n \tSTD_PHP_INI_ENTRY(\"fastcgi.logging\", \"1\", PHP_INI_SYSTEM, OnUpdateBool, fcgi_logging, php_cgi_globals_struct, php_cgi_globals)\n \tSTD_PHP_INI_ENTRY(\"fastcgi.error_header\", NULL, PHP_INI_SYSTEM, OnUpdateString, error_header, php_cgi_globals_struct, php_cgi_globals)\n@@ -1461,6 +1484,7 @@ static void php_cgi_globals_ctor(php_cgi\n \tphp_cgi_globals->force_redirect = 1;\n \tphp_cgi_globals->redirect_status_env = NULL;\n \tphp_cgi_globals->fix_pathinfo = 1;\n+\tphp_cgi_globals->fix_chrootpath = NULL;\n \tphp_cgi_globals->discard_path = 0;\n \tphp_cgi_globals->fcgi_logging = 1;\n \tzend_hash_init(&php_cgi_globals->user_config_cache, 0, NULL, (dtor_func_t) user_config_cache_entry_dtor, 1);\n" }, { "path": "aegir/patches/freetype.patch", "content": "diff -u -r php-7.2.5/ext/gd/config.m4 php-7.2.5-freetype/ext/gd/config.m4\n--- php-7.2.5/ext/gd/config.m4\t2018-04-24 17:09:54.000000000 +0200\n+++ php-7.2.5-freetype/ext/gd/config.m4\t2018-05-09 14:49:03.647108948 +0200\n@@ -186,6 +186,9 @@\n AC_DEFUN([PHP_GD_FREETYPE2],[\n if test \"$PHP_FREETYPE_DIR\" != \"no\"; then\n\n+ AC_PATH_PROG(PKG_CONFIG, pkg-config, no)\n+\n+ AC_MSG_CHECKING([for freetype])\n for i in $PHP_FREETYPE_DIR /usr/local /usr; do\n if test -f \"$i/bin/freetype-config\"; then\n FREETYPE2_DIR=$i\n@@ -194,13 +197,20 @@\n fi\n done\n\n- if test -z \"$FREETYPE2_DIR\"; then\n+ if test -n \"$FREETYPE2_CONFIG\"; then\n+ FREETYPE2_CFLAGS=`$FREETYPE2_CONFIG --cflags`\n+ FREETYPE2_LIBS=`$FREETYPE2_CONFIG --libs`\n+ AC_MSG_RESULT([found in $FREETYPE2_DIR])\n+ elif test \"$PKG_CONFIG\" != \"no\" && $PKG_CONFIG --exists freetype2; then\n+ FREETYPE2_DIR=pkg-config\n+ FREETYPE2_CFLAGS=`$PKG_CONFIG freetype2 --cflags`\n+ FREETYPE2_LIBS=`$PKG_CONFIG freetype2 --libs`\n+ AC_MSG_RESULT([found by pkg-config])\n+ else\n+ AC_MSG_RESULT([not found])\n AC_MSG_ERROR([freetype-config not found.])\n fi\n\n- FREETYPE2_CFLAGS=`$FREETYPE2_CONFIG --cflags`\n- FREETYPE2_LIBS=`$FREETYPE2_CONFIG --libs`\n-\n PHP_EVAL_INCLINE($FREETYPE2_CFLAGS)\n PHP_EVAL_LIBLINE($FREETYPE2_LIBS, GD_SHARED_LIBADD)\n AC_DEFINE(HAVE_LIBFREETYPE,1,[ ])\n" }, { "path": "aegir/patches/hosting_advanced_cron.patch", "content": "diff -urp a/hosting_advanced_cron/hosting_advanced_cron.module b/hosting_advanced_cron/hosting_advanced_cron.module\n--- a/hosting_advanced_cron/hosting_advanced_cron.module\t2012-05-27 13:12:12.000000000 +0100\n+++ b/hosting_advanced_cron/hosting_advanced_cron.module\t2012-05-27 15:09:14.000000000 +0100\n@@ -1,7 +1,7 @@\n nid);\n- if (variable_get('hosting_cron_use_backend', TRUE)) {\n- provision_backend_invoke($site_name, \"cron\");\n- }\n- else {\n- $cmd = sprintf(\"wget -O - -q %s > /dev/null\", escapeshellarg(_hosting_site_url($site) . '/cron.php'));\n- drush_shell_exec($cmd);\n- }\n+ if (!preg_match(\"/(?:dev\\.|devel\\.)/\", $site_name)) {\n+ if (variable_get('hosting_cron_use_backend', TRUE)) {\n+ provision_backend_invoke($site_name, \"cron\");\n+ }\n+ else {\n+ // Optionally add the cron_key querystring key if the site has one.\n+ $url =_hosting_site_url($site) . '/cron.php';\n+ if (!empty($site->cron_key)) {\n+ $url .= '?cron_key=' . rawurlencode($site->cron_key);\n+ }\n+ $cmd = sprintf(\"wget -O - -q %s > /dev/null\", escapeshellarg($url));\n+ drush_shell_exec($cmd);\n+ }\n+\n+ // We are updating the site table here directly to avoid a possible race condition,\n+ // with the task queue. There exists a chance that they might both try to save the\n+ // same node at the same time, and then an old record from the cron queue might\n+ // replace the newly updated record.\n+ db_query(\"UPDATE {hosting_site} SET last_cron=%d WHERE nid=%d\", time(), $site->nid);\n \n- // We are updating the site table here directly to avoid a possible race condition,\n- // with the task queue. There exists a chance that they might both try to save the\n- // same node at the same time, and then an old record from the cron queue might\n- // replace the newly updated record.\n- db_query(\"UPDATE {hosting_site} SET last_cron = %d WHERE nid = %d\", time(), $site->nid);\n+ // A small trick to avoid high load when still too many crons are started at once.\n+ sleep(5);\n+ }\n }\n }\n \n@@ -99,7 +109,7 @@ function hosting_advanced_cron_nodeapi(&\n if (!$result) {\n $result = array('cron_interval' => variable_get('hosting_advanced_cron_default_interval', 3600));\n }\n- \n+\n return $result;\n \n case 'delete':\n@@ -125,8 +135,8 @@ function hosting_advanced_cron_get_sites\n $cron_interval = $site->cron_interval ? $site->cron_interval : variable_get('hosting_advanced_cron_default_interval', 3600);\n \n // Run cron if it has never ran before for this site, or if the cron\n- // interval since last cron run has been exceeded. \n- if ($cron_interval != HOSTING_ADVANCED_CRON_SITE_DISABLED && (!$site->last_cron || ($site->last_cron + $site->cron_interval < time()))) {\n+ // interval since last cron run has been exceeded.\n+ if ($cron_interval != HOSTING_ADVANCED_CRON_SITE_DISABLED && (!$site->last_cron || ($site->last_cron + $cron_interval < time()))) {\n $sites[$site->nid] = node_load($site->nid);\n }\n }\n@@ -191,9 +201,9 @@ function hosting_advanced_cron_form_site\n function hosting_advanced_cron_interval_options() {\n $options = array(\n HOSTING_ADVANCED_CRON_SITE_DISABLED => t('Disabled'),\n- HOSTING_ADVANCED_CRON_SITE_DEFAULT => t('Default'),\n+ HOSTING_ADVANCED_CRON_SITE_DEFAULT => t('3h (default)'),\n );\n- $options += drupal_map_assoc(array(60, 300, 900, 1800, 3600, 21600, 86400), 'format_interval');\n+ $options += drupal_map_assoc(array(60, 180, 300, 600, 900, 1800, 3600, 10800, 21600, 43200, 86400), 'format_interval');\n \n return $options;\n }\n" }, { "path": "aegir/patches/hosting_cron.module", "content": " HOSTING_QUEUE_TYPE_BATCH,\n 'name' => t('Advanced Cron queue'),\n 'description' => t('Run advanced cron on hosted sites.'),\n 'total_items' => hosting_cron_hosting_site_count(),\n 'frequency' => strtotime(\"1 min\", 0),\n 'min_threads' => 6,\n 'max_threads' => 12,\n 'threshold' => 100,\n 'singular' => t('site'),\n 'plural' => t('sites'),\n );\n return $items;\n}\n\nfunction hosting_cron_hosting_site_count() {\n $sql = \"SELECT count(n.nid) FROM {node} n\n LEFT JOIN {hosting_site} hs ON n.nid = hs.nid\n LEFT JOIN {hosting_cron} hac ON n.nid = hac.nid\n WHERE n.type = :site AND hs.status = :status\n AND ((hac.cron_interval IS NOT NULL AND hac.cron_interval > 0)\n OR (hac.cron_interval IS NULL AND :cron_interval > 0))\";\n $result = db_query($sql, array(':site' => 'site', ':status' => HOSTING_SITE_ENABLED, ':cron_interval' => variable_get('hosting_cron_default_interval', ADV_CRON_DEFAULT)))->fetchField();\n return $result;\n}\n\n/**\n * Implements hook_permission().\n */\nfunction hosting_cron_permission() {\n return array(\n 'configure site cron interval' => array(\n 'title' => t('configure site cron interval'),\n ),\n );\n}\n\n/**\n * Queue callback (hosting__queue) for the advanced cron queue.\n *\n * This function is called by hosting_run_queue() whenever the \"Advanced Cron\"\n * queue is run.\n */\nfunction hosting_cron_queue($count = ADV_CRON_MAX_PLL) {\n if (is_readable($_SERVER['HOME'] . '/static/control/cron-proxy.info')) {\n $use_proxy_mode = TRUE;\n }\n else {\n $use_proxy_mode = FALSE;\n }\n // Get a list of sites for which to run cron.\n $sites = hosting_cron_get_sites($count);\n foreach ($sites as $site) {\n $site_name = hosting_context_name($site->nid);\n $this_name = ltrim($site_name, '@');\n $this_host = '-H \"Host: ' . $this_name . '\"';\n $this_cuid = '.cron.' . md5($this_name . '.' . $site->nid) . '.pid';\n $profile = node_load($site->profile);\n $platform = node_load($site->platform);\n if ($profile->short_name == 'hostmaster') {\n provision_backend_invoke($site_name, \"cron\");\n }\n elseif (variable_get('hosting_cron_use_backend', TRUE)) {\n provision_backend_invoke($site_name, \"elysia-cron\");\n sleep(3);\n provision_backend_invoke($site_name, \"cron\");\n }\n else {\n if (is_readable($_SERVER['HOME'] . '/.tmp')) {\n $this_tmp = $_SERVER['HOME'] . '/.tmp/';\n }\n else {\n $this_tmp = '/tmp/';\n }\n $result = db_query(\"SELECT p.publish_path FROM {hosting_platform} p LEFT JOIN {hosting_site} s ON p.nid=s.platform WHERE platform = :platform\", array(':platform' => $platform->nid));\n foreach ($result as $row) {\n $this_platform_root = $row->publish_path;\n }\n if (is_readable($this_platform_root . '/core') ||\n is_readable($this_platform_root . '/docroot/core') ||\n is_readable($this_platform_root . '/html/core') ||\n is_readable($this_platform_root . '/web/core')) {\n $url_own = 'https://' . $this_name . '/cron/';\n $url = 'https://127.0.0.1/cron/';\n // Optionally add the cron_key query string key if the site has one.\n if (!empty($site->cron_key)) {\n $url_own .= rawurlencode($site->cron_key);\n $url .= rawurlencode($site->cron_key);\n }\n }\n else {\n $url_own = 'https://' . $this_name . '/cron.php';\n $url = 'https://127.0.0.1/cron.php';\n // Optionally add the cron_key query string key if the site has one.\n if (!empty($site->cron_key)) {\n $url_own .= '?cron_key=' . rawurlencode($site->cron_key);\n $url .= '?cron_key=' . rawurlencode($site->cron_key);\n }\n }\n // Prepare the log file and command.\n $this_clog = $this_tmp . $this_cuid . '.log';\n // Add a date-stamped entry to the log.\n $date = date(\"Y-m-d H:i:s\");\n if (!empty($use_proxy_mode)) {\n $date = date(\"Y-m-d H:i:s\");\n file_put_contents($this_clog, \"\\n$date cURL command via IP request\\n\", FILE_APPEND);\n file_put_contents($this_clog, \"$date KEY $this_host KEY $url\\n\", FILE_APPEND);\n $second_cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $this_host . ' ' . $url;\n $second_output = [];\n $second_return_var = 0;\n exec($second_cmd, $second_output, $second_return_var);\n // Append curl response to the log.\n if (!empty($second_response)) {\n file_put_contents($this_clog, \"$date First IP Response:\\n\" . implode(\"\\n\", $second_output) . \"\\n\", FILE_APPEND);\n } else {\n file_put_contents($this_clog, \"$date First IP request returned empty OK response.\\n\", FILE_APPEND);\n }\n }\n else {\n file_put_contents($this_clog, \"\\n$date cURL command via DOMAIN request\\n\", FILE_APPEND);\n file_put_contents($this_clog, \"$date KEY $url_own\\n\", FILE_APPEND);\n $cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $url_own;\n $output = [];\n $return_var = 0;\n exec($cmd, $output, $return_var);\n $response = implode(\"\\n\", $output);\n if (!empty($response)) {\n $date = date(\"Y-m-d H:i:s\");\n file_put_contents($this_clog, \"$date NON-EMPTY-RESPONSE FOLLOWS\\n\", FILE_APPEND);\n file_put_contents($this_clog, $response . \"\\n\", FILE_APPEND);\n file_put_contents($this_clog, \"$date Another cURL command, this time via IP request\\n\", FILE_APPEND);\n file_put_contents($this_clog, \"$date KEY $this_host KEY $url\\n\", FILE_APPEND);\n $second_cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $this_host . ' ' . $url;\n $second_output = [];\n $second_return_var = 0;\n exec($second_cmd, $second_output, $second_return_var);\n if (!empty($second_response)) {\n file_put_contents($this_clog, \"$date Second IP Response:\\n\" . implode(\"\\n\", $second_output) . \"\\n\", FILE_APPEND);\n } else {\n file_put_contents($this_clog, \"$date Second IP request returned empty OK response.\\n\", FILE_APPEND);\n }\n }\n else {\n $date = date(\"Y-m-d H:i:s\");\n file_put_contents($this_clog, \"$date First DOMAIN request returned empty OK response.\\n\", FILE_APPEND);\n }\n }\n }\n db_update('hosting_site')\n ->fields(array(\n 'last_cron' => REQUEST_TIME,\n ))\n ->condition('nid', $site->nid)\n ->execute();\n // A small trick to avoid high load when still too many crons are started at once.\n unset($site_name, $this_name, $this_host, $this_cuid, $this_clog, $profile, $platform, $this_tmp, $this_platform_root, $url);\n sleep(3);\n }\n}\n\n/**\n * Implements hook_node_load().\n */\nfunction hosting_cron_node_load($nodes, $types) {\n foreach ($nodes as $nid => &$node) {\n if ($node->type == 'site') {\n\n $this_cron_interval = db_query(\"SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid\", array(':nid' => $node->nid))->fetchField();\n if ($this_cron_interval) {\n $this_cron_interval = array('cron_interval' => $this_cron_interval);\n }\n\n if (isset($node->cron_interval) && $node->cron_interval > -1) {\n $cron_interval_ok = TRUE;\n }\n else {\n if (isset($this_cron_interval) && $this_cron_interval > -1) {\n $node->cron_interval = $this_cron_interval;\n }\n }\n\n return $this_cron_interval;\n }\n }\n}\n\n/**\n * Implements hook_node_view().\n */\nfunction hosting_cron_node_view($node, $view_mode, $langcode) {\n if ($node->type == 'site') {\n if ($view_mode != 'teaser') {\n $this_cron_interval = db_query(\"SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid\", array(':nid' => $node->nid))->fetchField();\n if (!$node->cron_interval && $this_cron_interval) {\n $node->cron_interval = $this_cron_interval;\n }\n $cron_text = $this_cron_interval == ADV_CRON_TURNED_OFF ? t('Disabled') : t('Every !interval', array('!interval' => format_interval($this_cron_interval)));\n $cron_text .= '
    ' . t('(Last run: !interval)', array('!interval' => hosting_format_interval($node->last_cron)));\n $node->content['info']['last_cron'] = array(\n '#type' => 'item',\n '#title' => t('Cron'),\n '#weight' => 20,\n '#markup' => $cron_text,\n );\n }\n }\n}\n\n/**\n * Implements hook_node_delete().\n */\nfunction hosting_cron_node_delete($node) {\n if ($node->type == \"site\") {\n db_delete('hosting_cron')\n ->condition('nid', $node->nid)\n ->execute();\n }\n}\n\n/**\n * Implements hook_node_update().\n */\nfunction hosting_cron_node_update($node) {\n if ($node->type == \"site\") {\n $use_cron_interval = ADV_CRON_TURNED_OFF;\n $this_cron_interval = db_query(\"SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid\", array(':nid' => $node->nid))->fetchField();\n\n if ($node->cron_interval > -1) {\n $use_cron_interval = $node->cron_interval;\n }\n else {\n if ($this_cron_interval > -1) {\n $use_cron_interval = $this_cron_interval;\n }\n }\n\n if ($node->nid == 10) {\n if ($node->cron_interval == ADV_CRON_TURNED_OFF) {\n db_update('hosting_cron')\n ->fields(array('cron_interval' => '3600'))\n ->condition('nid', '10')\n ->execute();\n }\n }\n\n if ($this_cron_interval > -1) {\n $cron_interval_ok = TRUE;\n }\n else {\n db_insert('hosting_cron')\n ->fields(array(\n 'nid' => $node->nid,\n 'cron_interval' => $use_cron_interval,\n ))\n ->execute();\n }\n\n if ($use_cron_interval == ADV_CRON_TURNED_OFF) {\n db_update('hosting_cron')\n ->fields(array(\n 'cron_interval' => ADV_CRON_TURNED_OFF,\n ))\n ->condition('nid', $node->nid)\n ->execute();\n }\n elseif ($use_cron_interval > ADV_CRON_TURNED_OFF) {\n db_update('hosting_cron')\n ->fields(array(\n 'cron_interval' => $use_cron_interval,\n ))\n ->condition('nid', $node->nid)\n ->execute();\n }\n else {\n db_insert('hosting_cron')\n ->fields(array(\n 'nid' => $node->nid,\n 'cron_interval' => ADV_CRON_TURNED_OFF,\n ))\n ->execute();\n }\n }\n}\n\n/**\n * Implements hook_node_insert().\n */\nfunction hosting_cron_node_insert($node) {\n if ($node->type == 'site') {\n $use_cron_interval = ADV_CRON_TURNED_OFF;\n $this_cron_interval = db_query(\"SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid\", array(':nid' => $node->nid))->fetchField();\n\n if (isset($node->cron_interval) && $node->cron_interval > -1) {\n $use_cron_interval = $node->cron_interval;\n }\n else {\n if ($this_cron_interval > -1) {\n $use_cron_interval = $this_cron_interval;\n }\n }\n\n if ($node->nid == 10) {\n $use_cron_interval = '3600';\n }\n\n if ($use_cron_interval == ADV_CRON_TURNED_OFF) {\n db_insert('hosting_cron')\n ->fields(array(\n 'nid' => $node->nid,\n 'cron_interval' => ADV_CRON_TURNED_OFF,\n ))\n ->execute();\n }\n elseif ($use_cron_interval > ADV_CRON_TURNED_OFF) {\n db_insert('hosting_cron')\n ->fields(array(\n 'nid' => $node->nid,\n 'cron_interval' => $use_cron_interval,\n ))\n ->execute();\n }\n else {\n db_insert('hosting_cron')\n ->fields(array(\n 'nid' => $node->nid,\n 'cron_interval' => ADV_CRON_TURNED_OFF,\n ))\n ->execute();\n }\n }\n}\n\n/**\n * Retrieves a list of sites for which to run cron.\n */\nfunction hosting_cron_get_sites($count) {\n $result = db_query('SELECT n.nid, hs.last_cron, hac.cron_interval FROM {node} n LEFT JOIN {hosting_site} hs ON n.nid = hs.nid LEFT JOIN {hosting_cron} hac ON n.nid = hac.nid WHERE n.type = :site AND hs.status = :status ORDER BY hs.last_cron ASC, n.nid ASC', array(':site' => 'site', ':status' => HOSTING_SITE_ENABLED));\n $counter = 0;\n foreach ($result as $site) {\n if ($counter <= $count && $counter <= ADV_CRON_MAX_PLL) {\n //\n // Run cron if it has never ran before for this site,\n // but only if it has been enabled for this site.\n //\n // This shouldn't happen for any newly cloned site,\n // no matter if the cron is enabled on the source site or not,\n // to avoid running cron on the cloned copy without any prior control.\n //\n // Note that we can't use hosting_cron_default_interval here\n // if $site->cron_interval is empty / not set yet, so we have to ignore\n // the first cron run attempt by using ADV_CRON_TURNED_OFF by default\n // instead of hosting_cron_default_interval if we can't read\n // $site->cron_interval or it is empty for some reason. This means, however,\n // that we must store cron_interval also for sites using default value,\n // or the cron would never run on newly created/cloned site.\n //\n if (!$site->last_cron) {\n $this_cron_interval = db_query(\"SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid\", array(':nid' => $site->nid))->fetchField();\n if ($this_cron_interval != ADV_CRON_TURNED_OFF) {\n $sites[$site->nid] = node_load($site->nid);\n $counter++;\n }\n }\n else {\n //\n // Determine the cron interval. If not specified for this site,\n // use the default hosting_cron_default_interval or\n // ADV_CRON_DEFAULT.\n //\n $this_cron_interval = db_query(\"SELECT cron_interval FROM {hosting_cron} WHERE nid = :nid\", array(':nid' => $site->nid))->fetchField();\n //\n // Run cron if it has already ran before for this site,\n // and the cron is enabled on this site, but cron interval\n // since last cron run has been exceeded.\n //\n if ($this_cron_interval != ADV_CRON_TURNED_OFF) {\n if ($site->last_cron + $this_cron_interval < time()) {\n $sites[$site->nid] = node_load($site->nid);\n $counter++;\n }\n }\n }\n }\n }\n return $sites;\n}\n\n/**\n * Implements hook_form__alter().\n */\nfunction hosting_cron_form_hosting_settings_alter(&$form, $form_state) {\n $options = hosting_cron_interval_options();\n unset($options[0]);\n $form['hosting_cron_default_interval'] = array(\n '#type' => 'select',\n '#title' => t('Default cron interval'),\n '#options' => $options,\n '#description' => t('The cron interval to use for all sites unless overridden on the site node itself.'),\n '#default_value' => variable_get('hosting_cron_default_interval', ADV_CRON_DEFAULT),\n );\n $form['hosting_cron_use_backend'] = array(\n '#type' => 'radios',\n '#title' => t('Cron method'),\n '#description' => t('For running cron on a site. You can use the drush cron implementation or a traditional wget method.'),\n '#options' => array('Wget', 'Drush'),\n '#default_value' => variable_get('hosting_cron_use_backend', TRUE),\n );\n // Add some weight to the buttons to push them to the bottom of the form.\n $form['buttons']['#weight'] = 1000;\n}\n\n/**\n * Implements hook_form__alter().\n *\n * Alter the node form for a site to the cron interval setting.\n */\nfunction hosting_cron_form_site_node_form_alter(&$form, $form_state) {\n if (user_access('configure site cron interval')) {\n if (!empty($form['#node']) && isset($form['#node']->nid)) {\n if (empty($form['#node']->cron_interval)) {\n $default_value = ADV_CRON_TURNED_OFF;\n }\n else {\n $default_value = $form['#node']->cron_interval;\n }\n }\n else {\n $default_value = variable_get('hosting_cron_default_interval', ADV_CRON_DEFAULT);\n }\n $form['cron_interval'] = array(\n '#type' => 'select',\n '#title' => t('Cron interval'),\n '#options' => hosting_cron_interval_options(),\n '#description' => t('Cron will be automatically run for this site at the interval defined here.'),\n '#default_value' => $default_value,\n '#weight' => 3,\n );\n return $form;\n }\n}\n\n/**\n * Returns an array of options for the cron interval.\n *\n * @return\n * An associative array with the interval in seconds as key, and a\n * human-readable interval as value.\n */\nfunction hosting_cron_interval_options() {\n $options = array(\n ADV_CRON_TURNED_OFF => t('Disabled'),\n ADV_CRON_DEFAULT => t('1h (default)'),\n );\n $options += drupal_map_assoc(array(60, 180, 300, 600, 900, 1800, 3600, 10800, 21600, 43200, 86400, 604800), 'format_interval');\n return $options;\n}\n" }, { "path": "aegir/patches/hosting_cron_queue-reliability.patch", "content": "From dc226392e0480bb4ea6fe98ff2f65bbf1fd89e65 Mon Sep 17 00:00:00 2001\nFrom: BOA Dev Team \nDate: Mon, 9 Dec 2024 02:45:37 +0100\nSubject: [PATCH] Improve hosting_cron_queue reliability\n\n---\n cron/hosting_cron.module | 61 ++++++++++++++++++++++++++++++++++++----\n 1 file changed, 56 insertions(+), 5 deletions(-)\n\ndiff --git a/cron/hosting_cron.module b/cron/hosting_cron.module\nindex 122e5378..ec5347d9 100644\n--- a/cron/hosting_cron.module\n+++ b/cron/hosting_cron.module\n@@ -64,6 +64,12 @@ function hosting_cron_permission() {\n * queue is run.\n */\n function hosting_cron_queue($count = ADV_CRON_MAX_PLL) {\n+ if (is_readable($_SERVER['HOME'] . '/static/control/cron-proxy.info')) {\n+ $use_proxy_mode = TRUE;\n+ }\n+ else {\n+ $use_proxy_mode = FALSE;\n+ }\n // Get a list of sites for which to run cron.\n $sites = hosting_cron_get_sites($count);\n foreach ($sites as $site) {\n@@ -96,26 +102,70 @@ function hosting_cron_queue($count = ADV_CRON_MAX_PLL) {\n is_readable($this_platform_root . '/docroot/core') ||\n is_readable($this_platform_root . '/html/core') ||\n is_readable($this_platform_root . '/web/core')) {\n+ $url_own = 'https://' . $this_name . '/cron/';\n $url = 'https://127.0.0.1/cron/';\n // Optionally add the cron_key query string key if the site has one.\n if (!empty($site->cron_key)) {\n+ $url_own .= rawurlencode($site->cron_key);\n $url .= rawurlencode($site->cron_key);\n }\n }\n else {\n+ $url_own = 'https://' . $this_name . '/cron.php';\n $url = 'https://127.0.0.1/cron.php';\n // Optionally add the cron_key query string key if the site has one.\n if (!empty($site->cron_key)) {\n+ $url_own .= '?cron_key=' . rawurlencode($site->cron_key);\n $url .= '?cron_key=' . rawurlencode($site->cron_key);\n }\n }\n- if (is_readable($this_tmp . $this_cuid)) {\n- system('touch ' . $this_tmp . '.busy' . $this_cuid);\n+ // Prepare the log file and command.\n+ $this_clog = $this_tmp . $this_cuid . '.log';\n+ // Add a date-stamped entry to the log.\n+ $date = date(\"Y-m-d H:i:s\");\n+ if (!empty($use_proxy_mode)) {\n+ $date = date(\"Y-m-d H:i:s\");\n+ file_put_contents($this_clog, \"\\n$date cURL command via IP request\\n\", FILE_APPEND);\n+ file_put_contents($this_clog, \"$date KEY $this_host KEY $url\\n\", FILE_APPEND);\n+ $second_cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $this_host . ' ' . $url;\n+ $second_output = [];\n+ $second_return_var = 0;\n+ exec($second_cmd, $second_output, $second_return_var);\n+ // Append curl response to the log.\n+ if (!empty($second_response)) {\n+ file_put_contents($this_clog, \"$date First IP Response:\\n\" . implode(\"\\n\", $second_output) . \"\\n\", FILE_APPEND);\n+ } else {\n+ file_put_contents($this_clog, \"$date First IP request returned empty OK response.\\n\", FILE_APPEND);\n+ }\n }\n else {\n- system('touch ' . $this_tmp . $this_cuid);\n- system('curl -L --max-redirs 5 -k -s --retry 1 --retry-delay 10 --max-time 300 -A iCabProXy ' . $this_host . ' ' . $url . ' > /dev/null');\n- system('rm -f ' . $this_tmp . $this_cuid);\n+ file_put_contents($this_clog, \"\\n$date cURL command via DOMAIN request\\n\", FILE_APPEND);\n+ file_put_contents($this_clog, \"$date KEY $url_own\\n\", FILE_APPEND);\n+ $cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $url_own;\n+ $output = [];\n+ $return_var = 0;\n+ exec($cmd, $output, $return_var);\n+ $response = implode(\"\\n\", $output);\n+ if (!empty($response)) {\n+ $date = date(\"Y-m-d H:i:s\");\n+ file_put_contents($this_clog, \"$date NON-EMPTY-RESPONSE FOLLOWS\\n\", FILE_APPEND);\n+ file_put_contents($this_clog, $response . \"\\n\", FILE_APPEND);\n+ file_put_contents($this_clog, \"$date Another cURL command, this time via IP request\\n\", FILE_APPEND);\n+ file_put_contents($this_clog, \"$date KEY $this_host KEY $url\\n\", FILE_APPEND);\n+ $second_cmd = 'curl -L --max-redirs 5 -k -s --retry 3 --retry-delay 5 --max-time 600 -A iCabProXy ' . $this_host . ' ' . $url;\n+ $second_output = [];\n+ $second_return_var = 0;\n+ exec($second_cmd, $second_output, $second_return_var);\n+ if (!empty($second_response)) {\n+ file_put_contents($this_clog, \"$date Second IP Response:\\n\" . implode(\"\\n\", $second_output) . \"\\n\", FILE_APPEND);\n+ } else {\n+ file_put_contents($this_clog, \"$date Second IP request returned empty OK response.\\n\", FILE_APPEND);\n+ }\n+ }\n+ else {\n+ $date = date(\"Y-m-d H:i:s\");\n+ file_put_contents($this_clog, \"$date First DOMAIN request returned empty OK response.\\n\", FILE_APPEND);\n+ }\n }\n }\n db_update('hosting_site')\n@@ -125,6 +175,7 @@ function hosting_cron_queue($count = ADV_CRON_MAX_PLL) {\n ->condition('nid', $site->nid)\n ->execute();\n // A small trick to avoid high load when still too many crons are started at once.\n+ unset($site_name, $this_name, $this_host, $this_cuid, $this_clog, $profile, $platform, $this_tmp, $this_platform_root, $url);\n sleep(3);\n }\n }\n--\n2.45.1\n\n" }, { "path": "aegir/patches/hosting_le_vhost.drush.inc", "content": " NULL);\n}\n\n/*\n * Implementation of hook_provision_nginx_vhost_config()\n */\nfunction hosting_le_vhost_provision_nginx_vhost_config($uri, $data) {\n\n if (d()->type == 'site') {\n\n $aegir_root = d('@server_master')->aegir_root;\n $le_cert = d('@server_master')->aegir_root . \"/tools/le/certs\";\n $is_boa = FALSE;\n $is_boa_ctrl = \"/data/conf/global.inc\";\n\n if (provision_file()->exists($is_boa_ctrl)->status()) {\n $is_boa = TRUE;\n }\n\n $main_name = $real_name = substr(d()->name, 1);\n if ($real_name == 'hostmaster') {\n $real_name = $main_name = d()->uri;\n }\n\n if (d()->redirection) {\n $main_name = d()->redirection;\n if ($is_boa) {\n $cert_dir = $le_cert . \"/\" . $real_name;\n }\n else {\n $cert_dir = $le_cert . \"/\" . $main_name;\n }\n }\n else {\n $cert_dir = $le_cert . \"/\" . $main_name;\n }\n\n $chain_pem = $cert_dir . \"/chain.pem\";\n\n $lines = array();\n\n $lines[] = \"\";\n if (d()->ssl_enabled) {\n if (provision_file()->exists($chain_pem)->status()) {\n $lines[] = \" ssl_trusted_certificate $chain_pem;\";\n $lines[] = \"\";\n }\n }\n $lines[] = \" ###\";\n $lines[] = \" ### Allow access to letsencrypt.org ACME challenges directory.\";\n $lines[] = \" ###\";\n $lines[] = \" location ^~ /.well-known/acme-challenge {\";\n $lines[] = \" allow all;\";\n $lines[] = \" alias $aegir_root/tools/le/.acme-challenges;\";\n $lines[] = \" try_files \\$uri 404;\";\n $lines[] = \" auth_basic off;\";\n $lines[] = \" }\";\n $lines[] = \"\\n\";\n\n return implode(\"\\n\", $lines);\n }\n\n return '';\n}\n\n/*\n * Implementation of hook_provision_apache_vhost_config()\n */\nfunction hosting_le_vhost_provision_apache_vhost_config($uri, $data) {\n\n $aegir_root = d('@server_master')->aegir_root;\n\n if (d()->type == 'site') {\n\n $lines = array();\n\n $lines[] = \"\";\n $lines[] = \" Alias /.well-known/acme-challenge $aegir_root/tools/le/.acme-challenges\";\n $lines[] = \"\";\n $lines[] = \" # Allow access to letsencrypt.org ACME challenges directory.\";\n $lines[] = \" \";\n $lines[] = \" Order allow,deny\";\n $lines[] = \" Allow from all\";\n $lines[] = \" Require all granted\";\n $lines[] = \" Satisfy Any\";\n $lines[] = \" \";\n $lines[] = \"\\n\";\n\n return implode(\"\\n\", $lines);\n }\n\n return '';\n}\n" }, { "path": "aegir/patches/imagecache-1243258-5.patch", "content": "diff --git a/imagecache.module b/imagecache.module\nindex 55d48ce..36ace81 100644\n--- a/imagecache.module\n+++ b/imagecache.module\n@@ -442,7 +442,7 @@ function _imagecache_cache($presetname, $path) {\n }\n \n // umm yeah deliver it early if it is there. especially useful\n- // to prevent lock files from being created when delivering private files.\n+ // to prevent locks from being created when delivering private files.\n $dst = imagecache_create_path($preset['presetname'], $path);\n if (is_file($dst)) {\n imagecache_transfer($dst);\n@@ -458,34 +458,39 @@ function _imagecache_cache($presetname, $path) {\n exit;\n };\n \n- // Bail if the requested file isn't an image you can't request .php files\n+ // Bail if the requested file isn't an image. You can't request .php files\n // etc...\n- if (!getimagesize($src)) {\n+ if (!@getimagesize($src)) {\n watchdog('imagecache', '403: File is not an image %image ', array('%image' => $src), WATCHDOG_ERROR);\n header('HTTP/1.0 403 Forbidden');\n exit;\n }\n \n- $lockfile = file_directory_temp() .'/'. $preset['presetname'] . basename($src);\n- if (file_exists($lockfile)) {\n- watchdog('imagecache', 'ImageCache already generating: %dst, Lock file: %tmp.', array('%dst' => $dst, '%tmp' => $lockfile), WATCHDOG_NOTICE);\n- // 307 Temporary Redirect, to myself. Lets hope the image is done next time around.\n- header('Location: '. request_uri(), TRUE, 307);\n- exit;\n+ // Generate preset inside of a lock.\n+ $lockname = $preset['presetname'] . basename($src);\n+ $wait = FALSE;\n+ if (lock_acquire($lockname)) {\n+ imagecache_build_derivative($preset['actions'], $src, $dst);\n+ lock_release($lockname);\n+ }\n+ else {\n+ lock_wait($lockname);\n+ $wait = TRUE;\n }\n- touch($lockfile);\n- // register the shtdown function to clean up lock files. by the time shutdown\n- // functions are being called the cwd has changed from document root, to\n- // server root so absolute paths must be used for files in shutdown functions.\n- register_shutdown_function('file_delete', realpath($lockfile));\n \n- // check if deriv exists... (file was created between apaches request handler and reaching this code)\n- // otherwise try to create the derivative.\n- if (file_exists($dst) || imagecache_build_derivative($preset['actions'], $src, $dst)) {\n+ // Make sure derivative image exists before trying to send it.\n+ if (file_exists($dst)) {\n+ // exit gets called inside this function.\n imagecache_transfer($dst);\n }\n+\n // Generate an error if image could not generate.\n- watchdog('imagecache', 'Failed generating an image from %image using imagecache preset %preset.', array('%image' => $path, '%preset' => $preset['presetname']), WATCHDOG_ERROR);\n+ if ($wait) {\n+ watchdog('imagecache', 'Acquired lock, but failed in generating an image from %image using imagecache preset %preset.', array('%image' => $path, '%preset' => $preset['presetname']), WATCHDOG_ERROR);\n+ }\n+ else {\n+ watchdog('imagecache', 'Waited for the lock, but found no generated image from %image using imagecache preset %preset.', array('%image' => $path, '%preset' => $preset['presetname']), WATCHDOG_ERROR);\n+ }\n header(\"HTTP/1.0 500 Internal Server Error\");\n exit;\n }\n" }, { "path": "aegir/patches/imagefield_crop.patch", "content": "Index: imagefield_crop.module\n===================================================================\n--- imagefield_crop.module\t(revision 1120)\n+++ imagefield_crop.module\t(working copy)\n@@ -45,6 +45,8 @@\n * Delegated to filefield.\n */\n function imagefield_crop_widget_settings($op, $widget) {\n+ // make sure we have the functions as this may be called from update.php\n+ module_load_include('inc', 'imagefield_crop', 'imagefield_crop_widget');\n switch ($op) {\n case 'form':\n return imagefield_crop_widget_settings_form($widget);\n" }, { "path": "aegir/patches/julio_profile.patch", "content": "diff --git a/julio.profile b/julio.profile\nindex 340580d..8522810 100644\n--- a/julio.profile\n+++ b/julio.profile\n@@ -1,6 +1,8 @@\n ) is conditionally defined\n- to have different layout and size depending on the defined macros.\n- The correct macro is defined in my_config.h, which means it MUST be\n- included first (or at least before - so, practically,\n- before including any system headers).\n-\n- __GLIBC__ is defined in \n-*/\n-#ifdef __GLIBC__\n-#error MUST be included first!\n-#endif\n-\n #endif\n" }, { "path": "aegir/patches/mysql.provision.patch", "content": "diff --git mysql_service.inc mysql_service.inc\nindex 10dccaa..d3a3e10 100644\n--- mysql_service.inc\n+++ mysql_service.inc\n@@ -113,6 +113,13 @@ class provisionService_db_mysql extends provisionService_db_pdo {\n $cmd = sprintf('mysqldump --defaults-file=/dev/fd/3 --opt --skip-lock-tables --order-by-primary --default-character-set=utf8 -Q --hex-blob --single-transaction --quick -r%s/database.sql %s', escapeshellcmd(d()->site_path), escapeshellcmd(drush_get_option('db_name')));\n $success = $this->safe_shell_exec($cmd, drush_get_option('db_host'), urldecode(drush_get_option('db_user')), urldecode(drush_get_option('db_passwd')));\n \n+ $cmd = sprintf('sed \\'s|/\\*!50001 CREATE ALGORITHM=UNDEFINED \\*/|/\\*!50001 CREATE \\*/|g\\' %s/database.sql > %s/database_temp.sql', escapeshellcmd(d()->site_path), escapeshellcmd(d()->site_path));\n+ $success = $this->safe_shell_exec($cmd);\n+ $cmd = sprintf('sed \\'s|/\\*!50013 DEFINER=.*||g\\' %s/database_temp.sql > %s/database.sql', escapeshellcmd(d()->site_path), escapeshellcmd(d()->site_path));\n+ $success = $this->safe_shell_exec($cmd);\n+ $cmd = sprintf('rm %s/database_temp.sql', escapeshellcmd(d()->site_path));\n+ $success = $this->safe_shell_exec($cmd);\n+\n if (!$success && !drush_get_option('force', false)) {\n drush_set_error('PROVISION_BACKUP_FAILED', dt('Could not generate database backup from mysqldump. (error: %msg)', array('%msg' => $this->safe_shell_exec_output)));\n }\n" }, { "path": "aegir/patches/nik.patch", "content": "--- BARRACUDA.sh.txt\t2010-10-03 14:15:01.000000000 +1100\n+++ BARRACUDA-mod.sh.txt\t2010-10-03 15:55:49.000000000 +1100\n@@ -198,6 +198,14 @@ prompt_yes_no () {\n esac\n done \n }\n+\n+prompt_confirm_choice () {\n+\tread -p \"$1 [$2]:\" _CONFIRMED_ANSWER\n+\tif [ -z \"$_CONFIRMED_ANSWER\" ] ; then\n+\t\t_CONFIRMED_ANSWER=$2\n+\tfi\n+}\n+\n #\n # Stop on error\n # set -e ### disable this for debugging\n@@ -703,34 +711,40 @@ if [ ! -f \"/var/aegir/config/includes/ap\n cd /opt/tmp/$_BOA_REPO_NAME/aegir/helpers\n _MIRROR=`bash ffmirror.sh.txt < apt-list-ubuntu.txt`\n+\t\t_MIRROR=\"http://$_MIRROR/ubuntu/\"\n+\t\tprompt_confirm_choice \"Enter your own mirror to use or press enter to use the fastest found mirror \" $_MIRROR\n+\t\t_MIRROR=$_CONFIRMED_ANSWER\n msg \"$(date 2>&1) INFO: We will use $_THIS_OS mirror $_MIRROR\"\n cd /var/opt\n echo \"## MAIN REPOSITORIES\" > /etc/apt/sources.list\n- echo \"deb http://$_MIRROR/ubuntu/ $_REL_VERSION main restricted universe multiverse\" >> /etc/apt/sources.list\n- echo \"deb-src http://$_MIRROR/ubuntu/ $_REL_VERSION main restricted universe multiverse\" >> /etc/apt/sources.list\n+ echo \"deb $_MIRROR $_REL_VERSION main restricted universe multiverse\" >> /etc/apt/sources.list\n+ echo \"deb-src $_MIRROR $_REL_VERSION main restricted universe multiverse\" >> /etc/apt/sources.list\n echo \"\" >> /etc/apt/sources.list\n echo \"## MAJOR BUG FIX UPDATES produced after the final release\" >> /etc/apt/sources.list\n- echo \"deb http://$_MIRROR/ubuntu/ $_REL_VERSION-updates main restricted universe multiverse\" >> /etc/apt/sources.list\n- echo \"deb-src http://$_MIRROR/ubuntu/ $_REL_VERSION-updates main restricted universe multiverse\" >> /etc/apt/sources.list\n+ echo \"deb $_MIRROR $_REL_VERSION-updates main restricted universe multiverse\" >> /etc/apt/sources.list\n+ echo \"deb-src $_MIRROR $_REL_VERSION-updates main restricted universe multiverse\" >> /etc/apt/sources.list\n echo \"\" >> /etc/apt/sources.list\n echo \"## UBUNTU SECURITY UPDATES\" >> /etc/apt/sources.list\n echo \"deb http://security.ubuntu.com/ubuntu $_REL_VERSION-security main restricted universe multiverse\" >> /etc/apt/sources.list\n echo \"deb-src http://security.ubuntu.com/ubuntu $_REL_VERSION-security main restricted universe multiverse\" >> /etc/apt/sources.list\n echo \"\" >> /etc/apt/sources.list\n echo \"## BACKPORTS REPOSITORY\" >> /etc/apt/sources.list\n- echo \"deb http://$_MIRROR/ubuntu/ $_REL_VERSION-backports main restricted universe multiverse\" >> /etc/apt/sources.list\n- echo \"deb-src http://$_MIRROR/ubuntu/ $_REL_VERSION-backports main restricted universe multiverse\" >> /etc/apt/sources.list\n+ echo \"deb $_MIRROR $_REL_VERSION-backports main restricted universe multiverse\" >> /etc/apt/sources.list\n+ echo \"deb-src $_MIRROR $_REL_VERSION-backports main restricted universe multiverse\" >> /etc/apt/sources.list\n elif [ \"$_THIS_OS\" = \"Debian\" ] ; then\n msg \"$(date 2>&1) INFO: Now looking for the best/fastest $_THIS_OS mirror, this may take a while, please wait...\"\n cd /opt/tmp/$_BOA_REPO_NAME/aegir/helpers\n _MIRROR=`bash ffmirror.sh.txt < apt-list-debian.txt`\n+\t\t_MIRROR=\"http://$_MIRROR/debian/\"\n+\t\tprompt_confirm_choice \"Enter your own mirror to use or press enter to use the fastest found mirror \" $_MIRROR\n+\t\t_MIRROR=$_CONFIRMED_ANSWER\n msg \"$(date 2>&1) INFO: We will use $_THIS_OS mirror $_MIRROR\"\n cd /var/opt\n- echo \"deb http://$_MIRROR/debian/ $_REL_VERSION main contrib non-free\" > /etc/apt/sources.list\n- echo \"deb-src http://$_MIRROR/debian/ $_REL_VERSION main contrib non-free\" >> /etc/apt/sources.list\n+ echo \"deb $_MIRROR $_REL_VERSION main contrib non-free\" > /etc/apt/sources.list\n+ echo \"deb-src $_MIRROR $_REL_VERSION main contrib non-free\" >> /etc/apt/sources.list\n echo \"deb http://security.debian.org/ $_REL_VERSION/updates main contrib non-free\" >> /etc/apt/sources.list\n echo \"deb-src http://security.debian.org/ $_REL_VERSION/updates main contrib non-free\" >> /etc/apt/sources.list\n echo \"deb http://volatile.debian.org/debian-volatile $_REL_VERSION/volatile main contrib non-free\" >> /etc/apt/sources.list\n@@ -758,31 +772,31 @@ fi\n \n ###--------------------###\n msg \"$(date 2>&1) INFO: Run apt update, please wait...\"\n-runner \"apt-fast update\"\n+runner \"apt-fast update -y\"\n if [ \"$_THIS_OS\" = \"Ubuntu\" ] ; then\n runner \"apt-fast upgrade -y\"\n- runner \"apt-fast update\"\n- runner \"apt-fast clean\"\n- runner \"apt-fast dist-upgrade\"\n- runner \"apt-fast autoclean\"\n+ runner \"apt-fast update -y\"\n+ runner \"apt-fast clean -y\"\n+ runner \"apt-fast dist-upgrade -y\"\n+ runner \"apt-fast autoclean -y\"\n elif [ \"$_THIS_OS\" = \"Debian\" ] ; then\n runner \"apt-fast upgrade -y\"\n- runner \"apt-fast update\"\n- runner \"apt-fast clean\"\n- runner \"apt-fast dist-upgrade\"\n+ runner \"apt-fast update -y\"\n+ runner \"apt-fast clean -y\"\n+ runner \"apt-fast dist-upgrade -y\"\n runner \"aptitude full-upgrade -y\"\n- runner \"apt-fast autoclean\"\n+ runner \"apt-fast autoclean -y\"\n fi\n \n \n ###--------------------###\n msg \"$(date 2>&1) INFO: Run apt update again, please wait...\"\n-runner \"apt-fast update\"\n-runner \"apt-fast clean\"\n+runner \"apt-fast update -y\"\n+runner \"apt-fast clean -y\"\n if [ \"$_THIS_OS\" = \"Ubuntu\" ] ; then\n runner \"apt-fast upgrade -y\"\n- runner \"apt-fast dist-upgrade\"\n- runner \"apt-fast autoclean\"\n+ runner \"apt-fast dist-upgrade -y\"\n+ runner \"apt-fast autoclean -y\"\n elif [ \"$_THIS_OS\" = \"Debian\" ] ; then\n runner \"aptitude full-upgrade -y\"\n fi\n@@ -790,12 +804,12 @@ fi\n \n ###--------------------###\n msg \"$(date 2>&1) INFO: Run apt update again, please wait...\"\n-runner \"apt-fast update\"\n-runner \"apt-fast clean\"\n+runner \"apt-fast update -y\"\n+runner \"apt-fast clean -y\"\n if [ \"$_THIS_OS\" = \"Ubuntu\" ] ; then\n runner \"apt-fast upgrade -y\"\n- runner \"apt-fast dist-upgrade\"\n- runner \"apt-fast autoclean\"\n+ runner \"apt-fast dist-upgrade -y\"\n+ runner \"apt-fast autoclean -y\"\n elif [ \"$_THIS_OS\" = \"Debian\" ] ; then\n runner \"aptitude full-upgrade -y\"\n fi\n" }, { "path": "aegir/patches/object_conversion_menu_router_build-972536-1.patch", "content": "--- includes/menu.inc.orig\t2010-11-15 07:55:27.000000000 -0500\n+++ includes/menu.inc\t2010-11-15 13:38:36.000000000 -0500\n@@ -3367,7 +3367,7 @@ function _menu_router_build($callbacks) \n $sort[$path] = $number_parts;\n }\n }\n- array_multisort($sort, SORT_NUMERIC, $menu);\n+ array_multisort($sort, SORT_NUMERIC, $menu, SORT_STRING);\n // Apply inheritance rules.\n foreach ($menu as $path => $v) {\n $item = &$menu[$path];\n" }, { "path": "aegir/patches/octopus_video.patch", "content": "diff -urp a/octopus_video/modules/features/video_core/video_core.strongarm.inc b/octopus_video/modules/features/video_core/video_core.strongarm.inc\n--- a/octopus_video/modules/features/video_core/video_core.strongarm.inc\t2012-04-03 12:12:51.000000000 -0400\n+++ b/octopus_video/modules/features/video_core/video_core.strongarm.inc\t2012-04-04 21:26:51.000000000 -0400\n@@ -293,7 +293,7 @@ function video_core_strongarm() {\n $strongarm->disabled = FALSE; /* Edit this to true to make a default strongarm disabled initially */\n $strongarm->api_version = 1;\n $strongarm->name = 'videojs_directory';\n- $strongarm->value = 'profiles/octopus/libraries/video-js/video-js';\n+ $strongarm->value = 'profiles/octopus_video/libraries/video-js';\n $export['videojs_directory'] = $strongarm;\n\n $strongarm = new stdClass;\ndiff -urp a/octopus_video/octopus_video.info b/octopus_video/octopus_video.info\n--- a/octopus_video/octopus_video.info\t2012-04-03 12:12:51.000000000 -0400\n+++ b/octopus_video/octopus_video.info\t2012-04-04 22:52:53.000000000 -0400\n@@ -16,8 +16,8 @@ dependencies[] = statistics\n dependencies[] = syslog\n\n ; Contrib\n-dependencies[] = admin_menu\n-dependencies[] = admin_menu_toolbar\n+dependencies[] = zencoderapi\n+dependencies[] = toolbar\n dependencies[] = amazons3\n dependencies[] = awssdk\n dependencies[] = awssdk_ui\n@@ -68,4 +68,8 @@ dependencies[] = video_user\n\n ; custom\n dependencies[] = jwplayer\n-dependencies[] = octopus_helper\n\\ No newline at end of file\n+dependencies[] = octopus_helper\n+\n+version = \"1.0-alpha6\"\n+project = \"octopus_video\"\n+\ndiff -urp a/octopus_video/octopus_video.install b/octopus_video/octopus_video.install\n--- a/octopus_video/octopus_video.install\t2012-04-03 12:12:51.000000000 -0400\n+++ b/octopus_video/octopus_video.install\t2012-04-04 23:05:32.000000000 -0400\n@@ -5,9 +5,10 @@\n */\n function octopus_video_install() {\n // set themes\n- theme_enable(array('octopus_video'));\n+ theme_enable(array('octopus_video','rubik'));\n variable_set('theme_default', 'octopus_video');\n- variable_set('admin_theme', 'seven');\n+ variable_set('admin_theme', 'rubik');\n+ variable_set('node_admin_theme', '0');\n // Add text formats.\n $filtered_html_format = array(\n 'format' => 'filtered_html',\ndiff -urp a/octopus_video/themes/octopus_video/octopus_video.info b/octopus_video/themes/octopus_video/octopus_video.info\n--- a/octopus_video/themes/octopus_video/octopus_video.info\t2012-04-03 12:12:51.000000000 -0400\n+++ b/octopus_video/themes/octopus_video/octopus_video.info\t2012-04-04 21:24:25.000000000 -0400\n@@ -118,13 +118,13 @@ settings[alpha_css][omega-menu.css] = '0\n settings[alpha_css][omega-forms.css] = '0'\n\n settings[alpha_css][omega-visuals.css] = '0'\n\n settings[alpha_exclude][modules/comment/comment.css] = '0'\n\n-settings[alpha_exclude][profiles/octopus/modules/contrib/date/date_api/date.css] = '0'\n\n+settings[alpha_exclude][profiles/octopus_video/modules/contrib/date/date_api/date.css] = '0'\n\n settings[alpha_exclude][modules/field/theme/field.css] = '0'\n\n-settings[alpha_exclude][profiles/octopus/modules/contrib/logintoboggan/logintoboggan.css] = '0'\n\n+settings[alpha_exclude][profiles/octopus_video/modules/contrib/logintoboggan/logintoboggan.css] = '0'\n\n settings[alpha_exclude][modules/node/node.css] = '0'\n\n settings[alpha_exclude][modules/search/search.css] = '0'\n\n settings[alpha_exclude][modules/user/user.css] = '0'\n\n-settings[alpha_exclude][profiles/octopus/modules/contrib/views/css/views.css] = '0'\n\n+settings[alpha_exclude][profiles/octopus_video/modules/contrib/views/css/views.css] = '0'\n\n settings[alpha_exclude][misc/vertical-tabs.css] = '0'\n\n settings[alpha_exclude][modules/aggregator/aggregator.css] = '0'\n\n settings[alpha_exclude][modules/block/block.css] = '0'\n\n" }, { "path": "aegir/patches/og_update_6205_commons_fix.patch", "content": "diff -urp a/og.install b/og.install\n--- a/og.install 2012-01-18 23:55:27.000000000 +0000\n+++ b/og.install 2012-03-17 13:46:41.000000000 +0000\n@@ -447,12 +447,13 @@ function og_update_6204() {\n }\n\n /**\n- * Add an index on og_uid.uid.\n+ * Add an index on og_uid.uid. Already applied in drupal_commons.make\n */\n function og_update_6205() {\n- $ret = array();\n- db_add_index($ret, 'og_uid', 'uid', array('uid'));\n- return $ret;\n+ //$ret = array();\n+ //db_add_index($ret, 'og_uid', 'uid', array('uid'));\n+ //return $ret;\n+ return array();\n }\n\n // end updates //\n" }, { "path": "aegir/patches/openacademy-search-off.patch", "content": "diff -urp a/openacademy.info b/openacademy.info\n--- a/openacademy.info\t2012-07-20 21:37:28.000000000 +0000\n+++ b/openacademy.info\t2012-09-02 00:03:45.000000000 +0000\n@@ -69,13 +69,6 @@ dependencies[] = simplified_menu_admin\n dependencies[] = references_dialog \n dependencies[] = backports\n \n-; Panopoly - Contrib - Search \n-dependencies[] = search_api\n-dependencies[] = search_api_solr\n-dependencies[] = facetapi\n-dependencies[] = search_api_facetapi\n-dependencies[] = search_api_views\n-\n ; Panopoly - Contrib - Products\n dependencies[] = apps \n dependencies[] = features\ndiff -urp a/openacademy.profile b/openacademy.profile\n--- a/openacademy.profile\t2012-08-18 18:57:09.000000000 +0000\n+++ b/openacademy.profile\t2012-09-02 00:02:54.000000000 +0000\n@@ -30,7 +30,6 @@ function openacademy_install_tasks($inst\n 'panopoly_images',\n 'panopoly_magic',\n 'panopoly_pages',\n- 'panopoly_search',\n 'panopoly_theme',\n 'panopoly_users',\n 'panopoly_widgets',\n@@ -42,7 +41,6 @@ function openacademy_install_tasks($inst\n 'panopoly_images', \n 'panopoly_magic', \n 'panopoly_pages', \n- 'panopoly_search', \n 'panopoly_theme', \n 'panopoly_users', \n 'panopoly_widgets', \n" }, { "path": "aegir/patches/openacademy.patch", "content": "diff -urp a/openacademy/openacademy.info b/openacademy/openacademy.info\n--- a/openacademy/openacademy.info\t2012-05-31 14:51:19.000000000 -0400\n+++ b/openacademy/openacademy.info\t2012-06-03 12:35:45.000000000 -0400\n@@ -31,6 +31,8 @@ dependencies[] = views\n dependencies[] = views_content\n dependencies[] = views_ui\n dependencies[] = token\n+dependencies[] = ds\n+dependencies[] = ds_extras\n \n ; Panopoly - Contrib - Field UI and Content Types\n dependencies[] = tablefield\n@@ -70,13 +72,6 @@ dependencies[] = simplified_menu_admin\n dependencies[] = references_dialog \n dependencies[] = backports\n \n-; Panopoly - Contrib - Search \n-dependencies[] = search_api\n-dependencies[] = search_api_solr\n-dependencies[] = facetapi\n-dependencies[] = search_api_facetapi\n-dependencies[] = search_api_views\n-\n ; Panopoly - Contrib - Products\n dependencies[] = apps \n dependencies[] = features\n@@ -86,9 +81,6 @@ dependencies[] = defaultcontent\n dependencies[] = strongarm\n dependencies[] = libraries\n \n-; Panopoly - Contrib - Performance\n-dependencies[] = redis\n-\n ; Panopoly - Contrib - Development\n dependencies[] = devel\n dependencies[] = devel_generate\ndiff -urp a/openacademy/openacademy.profile b/openacademy/openacademy.profile\n--- a/openacademy/openacademy.profile\t2012-05-29 18:39:27.000000000 -0400\n+++ b/openacademy/openacademy.profile\t2012-06-03 12:38:48.000000000 -0400\n@@ -26,7 +26,6 @@ function openacademy_install_tasks($inst\n 'panopoly_images',\n 'panopoly_magic',\n 'panopoly_pages',\n- 'panopoly_search',\n 'panopoly_theme',\n 'panopoly_users',\n 'panopoly_widgets',\n@@ -38,7 +37,6 @@ function openacademy_install_tasks($inst\n 'panopoly_images', \n 'panopoly_magic', \n 'panopoly_pages', \n- 'panopoly_search', \n 'panopoly_theme', \n 'panopoly_users', \n 'panopoly_widgets', \n@@ -315,7 +313,12 @@ function openacademy_theme_form($form, &\n function openacademy_theme_form_submit($form, &$form_state) {\n \n // Enable and set the theme of choice\n- $theme = $form_state['input']['theme'];\n+ if (defined('DRUSH_BASE_PATH')) {\n+ $theme = \"openacademy_default\";\n+ }\n+ else {\n+ $theme = $form_state['input']['theme'];\n+ }\n theme_enable(array($theme));\n variable_set('theme_default', $theme);\n \n" }, { "path": "aegir/patches/openaid-tpl.patch", "content": "diff -urp a/openaid/themes/openaid/templates/page.tpl.php b/openaid/themes/openaid/templates/page.tpl.php\n--- a/openaid/themes/openaid/templates/page.tpl.php\t2012-04-12 00:48:17.000000000 +0000\n+++ b/openaid/themes/openaid/templates/page.tpl.php\t2012-04-12 23:00:59.000000000 +0000\n@@ -20,7 +20,7 @@\n \n \n \n- \n+ \n \n
    \n \n@@ -31,81 +31,81 @@\n\n
    \n
    \n-\n+\n \n
    \n \n
    \n- \n-\n+ \n+\n \n
    \n \n
    \n- \n-\n+ \n+\n
    \n-\n-
    \n-\n+\n+
    \n+\n \n
    \n \n
    \n- \n-\n+ \n+\n \n
    \n \n
    \n- \n-\n+ \n+\n \n
    \n \n
    \n- \n-\n+ \n+\n 0) { ?>\n-

    \n- \n-\n+

    \n+ \n+\n
    \n-\n+\n \n
    \n \n
    \n- \n-\n+ \n+\n \n-\n+\n
    \n
    \n-\n+\n \n
    \n \n
    \n- \n-\n+ \n+\n
    \n-\n+\n
    \n
    \n-\n+\n
    \n
    \n \n
    \n
    \n-\n+\n \n
    \n
    \n \n
    \n-
    \n- \n-\n+
    \n+ \n+\n
    \n" }, { "path": "aegir/patches/openenterprise.patch", "content": "diff -urp a/openenterprise.profile b/openenterprise.profile\n--- a/openenterprise.profile\t2011-02-11 15:47:05.000000000 +0000\n+++ b/openenterprise.profile\t2011-04-18 04:55:30.000000000 +0000\n@@ -11,9 +11,10 @@ define('OPENENTERPRISE_FILTERED_HTML', '\n * Implementation of hook_profile_details().\n */\n function openenterprise_profile_details() {\n+ $description = st('Open Enterprise by LevelTen Interactive.');\n return array(\n- 'name' => t('Open Enterprise'),\n- 'description' => t('Open Enterprise by LevelTen Interactive.'),\n+ 'name' => 'Open Enterprise',\n+ 'description' => $description,\n 'old_short_name' => 'enterprise_installer',\n );\n }\n@@ -657,4 +658,4 @@ function openenterprise_config_date_form\n \n variable_set('date_format_date_only', 'l, F j, Y');\n variable_set('date_format_time_only', 'g:i a');\n-}\n\\ No newline at end of file\n+}\n" }, { "path": "aegir/patches/openoutreach.patch", "content": "From b72102ef8f5fb913d2f197067d8c2cd7ee3e99ed Mon Sep 17 00:00:00 2001\nFrom: Nedjo Rogers\nDate: Wed, 04 Feb 2015 19:27:16 +0000\nSubject: Issue #2293949: fix drush install time errors by enabling file_entity earlier.\n\n---\ndiff --git a/openoutreach.info b/openoutreach.info\nindex ea5540c..1471c80 100644\n--- a/openoutreach.info\n+++ b/openoutreach.info\n@@ -14,7 +14,7 @@ dependencies[] = \"dashboard\"\n dependencies[] = \"dblog\"\n dependencies[] = \"features\"\n dependencies[] = \"field_ui\"\n-dependencies[] = \"file\"\n+dependencies[] = \"file_entity\"\n dependencies[] = \"help\"\n dependencies[] = \"image\"\n dependencies[] = \"libraries\"\n@@ -85,4 +85,4 @@ subprofiles[membership][features][debut_section] = TRUE\n subprofiles[membership][features][debut_seo] = TRUE\n subprofiles[membership][features][debut_social] = TRUE\n subprofiles[membership][features][debut_wysiwyg] = TRUE\n-subprofiles[membership][features][openoutreach_front_page] = TRUE\n\\ No newline at end of file\n+subprofiles[membership][features][openoutreach_front_page] = TRUE\n--\ncgit v0.9.2\n" }, { "path": "aegir/patches/openpublic.patch", "content": "diff -urp a/openpublic.profile b/openpublic.profile\n--- a/openpublic.profile\t2011-07-10 16:30:50.000000000 -0400\n+++ b/openpublic.profile\t2011-07-11 10:39:52.000000000 -0400\n@@ -13,7 +13,7 @@\n * called through custom invocation, so $form_state is not populated.\n */\n function openpublic_form_alter(&$form, $form_state, $form_id) {\n- if ($form_id == 'install_configure_form') {\n+ if ($form_id == 'install_configure_form' && !defined('DRUSH_BASE_PATH')) {\n $roles = array(DRUPAL_AUTHENTICATED_RID);\n $policy = _password_policy_load_active_policy($roles);\n \n" }, { "path": "aegir/patches/openscholar.profile.patch", "content": "diff -urp a/openscholar.profile b/openscholar.profile\n--- a/openscholar.profile\t2010-08-24 20:16:19.000000000 +0000\n+++ b/openscholar.profile\t2010-10-16 01:00:00.000000000 +0000\n@@ -35,16 +35,43 @@ function openscholar_profile_modules() {\n );\n }\n \n+\n+/**\n+ * Returns an array list of core contributed modules to be installed first.\n+ */\n+function _openscholar_core_modules_first() {\n+ $contrib_modules = array(\n+ //cck\n+ 'content',\n+ 'content_copy',\n+ 'diff',\n+ 'date_timezone',\n+ 'date_api',\n+ 'date',\n+ 'date_popup',\n+ 'filefield',\n+ 'fieldgroup',\n+ 'imagecache',\n+ 'imagecache_ui',\n+ 'imagefield',\n+ 'link',\n+ 'text',\n+ 'number',\n+ 'nodereference',\n+ 'nodereference_url',\n+ 'optionwidgets',\n+ );\n+ return $contrib_modules;\n+}\n+\n+\n /**\n * Returns an array list of core contributed modules.\n */\n function _openscholar_core_modules() {\n $contrib_modules = array(\n- // sites/all/contrib\n- 'activity',\n 'addthis',\n 'advanced_help',\n- 'calendar',\n 'litecal',\n 'context',\n 'context_contrib',\n@@ -83,7 +110,6 @@ function _openscholar_core_modules() {\n 'stringoverrides',\n 'strongarm',\n 'token',\n- 'trigger',\n 'transliteration',\n 'twitter_pull',\n 'ucreate',\n@@ -95,38 +121,17 @@ function _openscholar_core_modules() {\n 'views_attach',\n 'vertical_tabs',\n 'wysiwyg',\n- \n- //cck\n- 'content',\n- 'content_copy',\n- 'diff',\n- 'date_timezone',\n- 'date_api',\n- 'date',\n- 'date_popup',\n- 'filefield',\n- 'fieldgroup',\n- 'imagecache',\n- 'imagecache_ui',\n- 'imagefield',\n- 'imagefield_crop',\n- 'link',\n- 'text',\n- 'number',\n- 'nodereference',\n- 'nodereference_url',\n- 'optionwidgets',\n-\n 'install_profile_api',\n 'schema',\n- \n // Optional Development Resources\n- //'admin_menu',\n+ 'admin_menu',\n //'devel',\n //'devel_generate',\n- \n+ 'calendar',\n+ 'trigger',\n+ 'imagefield_crop',\n+ 'activity',\n );\n- \n return $contrib_modules;\n }\n \n@@ -190,8 +195,6 @@ function openscholar_profile_task_list()\n global $conf;\n $conf['site_name'] = 'OpenScholar';\n $conf['site_footer'] = 'OpenScholar by IQSS at Harvard University';\n- \n- \n $tasks = array(\n 'openscholar-configure' => st('openscholar configuration'),\n );\n@@ -206,11 +209,15 @@ function openscholar_profile_tasks(&$tas\n $output = '';\n \n if ($task == 'profile') {\n+\n+ $modules_first = _openscholar_core_modules_first();\n $modules = _openscholar_core_modules();\n $modules = array_merge($modules, _openscholar_scholar_modules());\n-\n $files = module_rebuild_cache();\n $operations = array();\n+ foreach ($modules_first as $module) {\n+ $operations[] = array('_install_module_batch', array($module, $files[$module]->info['name']));\n+ }\n foreach ($modules as $module) {\n $operations[] = array('_install_module_batch', array($module, $files[$module]->info['name']));\n }\n" }, { "path": "aegir/patches/openscholar_projects.profile.patch", "content": "diff -urp a/openscholar_projects.profile b/openscholar_projects.profile\n--- a/openscholar_projects.profile\t2010-08-18 15:16:43.000000000 +0000\n+++ b/openscholar_projects.profile\t2010-10-16 02:17:04.000000000 +0000\n@@ -35,16 +35,43 @@ function openscholar_projects_profile_mo\n );\n }\n \n+\n+/**\n+ * Returns an array list of core contributed modules to be installed first.\n+ */\n+function _openscholar_projects_core_modules_first() {\n+ $contrib_modules = array(\n+ //cck\n+ 'content',\n+ 'content_copy',\n+ 'diff',\n+ 'date_timezone',\n+ 'date_api',\n+ 'date',\n+ 'date_popup',\n+ 'filefield',\n+ 'fieldgroup',\n+ 'imagecache',\n+ 'imagecache_ui',\n+ 'imagefield',\n+ 'link',\n+ 'text',\n+ 'number',\n+ 'nodereference',\n+ 'nodereference_url',\n+ 'optionwidgets',\n+ );\n+ return $contrib_modules;\n+}\n+\n+\n /**\n * Returns an array list of core contributed modules.\n */\n function _openscholar_projects_core_modules() {\n $contrib_modules = array(\n- // sites/all/contrib\n- 'activity',\n 'addthis',\n 'advanced_help',\n- 'calendar',\n 'litecal',\n 'context',\n 'context_contrib',\n@@ -83,7 +110,6 @@ function _openscholar_projects_core_modu\n 'stringoverrides',\n 'strongarm',\n 'token',\n- 'trigger',\n 'transliteration',\n 'twitter_pull',\n 'ucreate',\n@@ -95,38 +121,17 @@ function _openscholar_projects_core_modu\n 'views_attach',\n 'vertical_tabs',\n 'wysiwyg',\n- \n- //cck\n- 'content',\n- 'content_copy',\n- 'diff',\n- 'date_timezone',\n- 'date_api',\n- 'date',\n- 'date_popup',\n- 'filefield',\n- 'fieldgroup',\n- 'imagecache',\n- 'imagecache_ui',\n- 'imagefield',\n- 'imagefield_crop',\n- 'link',\n- 'text',\n- 'number',\n- 'nodereference',\n- 'nodereference_url',\n- 'optionwidgets',\n-\n 'install_profile_api',\n 'schema',\n- \n // Optional Development Resources\n- //'admin_menu',\n+ 'admin_menu',\n //'devel',\n //'devel_generate',\n- \n+ 'calendar',\n+ 'trigger',\n+ 'imagefield_crop',\n+ 'activity',\n );\n- \n return $contrib_modules;\n }\n \n@@ -180,8 +185,6 @@ function _openscholar_projects_scholar_m\n 'scholar_reader',\n 'scholar_front',\n 'scholar_profiles',\n- \n-\n );\n }\n \n@@ -192,7 +195,6 @@ function openscholar_projects_profile_ta\n global $conf;\n $conf['site_name'] = 'OpenScholar';\n $conf['site_footer'] = 'OpenScholar by IQSS at Harvard University';\n- \n $tasks = array(\n 'scholar_projects-configure' => st('Projects configuration'),\n );\n@@ -207,11 +209,15 @@ function openscholar_projects_profile_ta\n $output = '';\n \n if ($task == 'profile') {\n+ \n+ $modules_first = _openscholar_projects_core_modules_first();\n $modules = _openscholar_projects_core_modules();\n $modules = array_merge($modules, _openscholar_projects_scholar_modules());\n-\n $files = module_rebuild_cache();\n $operations = array();\n+ foreach ($modules_first as $module) {\n+ $operations[] = array('_install_module_batch', array($module, $files[$module]->info['name']));\n+ }\n foreach ($modules as $module) {\n $operations[] = array('_install_module_batch', array($module, $files[$module]->info['name']));\n }\n" }, { "path": "aegir/patches/panopoly-search-off.patch", "content": "diff -urp a/panopoly.info b/panopoly.info\n--- a/panopoly.info\t2012-06-21 16:21:56.000000000 +0000\n+++ b/panopoly.info\t2012-08-27 09:08:43.000000000 +0000\n@@ -68,14 +68,6 @@ dependencies[] = simplified_menu_admin\n dependencies[] = references_dialog \n dependencies[] = backports\n \n-; Panopoly - Contrib - Search \n-dependencies[] = facetapi\n-dependencies[] = search_api\n-dependencies[] = search_api_solr\n-dependencies[] = search_api_facetapi\n-dependencies[] = search_api_views\n-dependencies[] = search_api_db\n-\n ; Panopoly - Contrib - Products\n dependencies[] = apps \n dependencies[] = features\ndiff -urp a/panopoly.profile b/panopoly.profile\n--- a/panopoly.profile\t2012-08-18 18:57:09.000000000 +0000\n+++ b/panopoly.profile\t2012-08-27 09:14:04.000000000 +0000\n@@ -31,7 +31,6 @@ function panopoly_install_tasks($install\n 'panopoly_images',\n 'panopoly_magic',\n 'panopoly_pages',\n- 'panopoly_search',\n 'panopoly_theme',\n 'panopoly_users',\n 'panopoly_widgets',\n@@ -43,7 +42,6 @@ function panopoly_install_tasks($install\n 'panopoly_images', \n 'panopoly_magic', \n 'panopoly_pages', \n- 'panopoly_search', \n 'panopoly_theme', \n 'panopoly_users', \n 'panopoly_widgets', \n" }, { "path": "aegir/patches/panopoly-search-redis.patch", "content": "diff -urp a/panopoly/panopoly.info b/panopoly/panopoly.info\n--- a/panopoly/panopoly.info\t2012-05-05 02:11:30.000000000 +0000\n+++ b/panopoly/panopoly.info\t2012-05-17 00:45:16.000000000 +0000\n@@ -70,13 +70,6 @@ dependencies[] = simplified_menu_admin\n dependencies[] = references_dialog \n dependencies[] = backports\n \n-; Contrib - Search \n-dependencies[] = search_api\n-dependencies[] = search_api_solr\n-dependencies[] = facetapi\n-dependencies[] = search_api_facetapi\n-dependencies[] = search_api_views\n-\n ; Contrib - Products\n dependencies[] = apps \n dependencies[] = features\n@@ -86,9 +79,6 @@ dependencies[] = defaultcontent\n dependencies[] = strongarm\n dependencies[] = libraries\n \n-; Contrib - Performance\n-dependencies[] = redis\n-\n ; Contrib - Development\n dependencies[] = devel\n dependencies[] = devel_generate\ndiff -urp a/panopoly/panopoly.profile b/panopoly/panopoly.profile\n--- a/panopoly/panopoly.profile\t2012-05-05 01:40:14.000000000 +0000\n+++ b/panopoly/panopoly.profile\t2012-05-17 00:45:30.000000000 +0000\n@@ -27,7 +27,6 @@ function panopoly_install_tasks($install\n 'panopoly_images',\n 'panopoly_magic',\n 'panopoly_pages',\n- 'panopoly_search',\n 'panopoly_theme',\n 'panopoly_users',\n 'panopoly_widgets',\n" }, { "path": "aegir/patches/patch_commit_6fabd31b0f81.patch", "content": "diff --git a/includes/file.inc b/includes/file.inc\nindex c5e5cf07d636d2454c3e158eda0e2c0f6f7297fa..57a4e4734a8a175c4ae8dd8894a281699529b95b 100644\n--- a/includes/file.inc\n+++ b/includes/file.inc\n@@ -476,6 +476,9 @@ function file_ensure_htaccess() {\n * The default is TRUE which indicates a private and protected directory.\n */\n function file_create_htaccess($directory, $private = TRUE) {\n+ // Skip this on BOA since .htaccess is never used in Nginx.\n+ return;\n+\n if (file_uri_scheme($directory)) {\n $directory = file_stream_wrapper_uri_normalize($directory);\n }\n" }, { "path": "aegir/patches/patch_commit_fa47bad85589.patch", "content": "diff --git a/Provision/Config/cdn.tpl.php b/Provision/Config/cdn.tpl.php\nindex a4ce098ea323d9855642ab4b17a54d93cb2d1d0f..00597f8795768bc43dea4fa0eae8afca75a22f67 100644\n--- a/Provision/Config/cdn.tpl.php\n+++ b/Provision/Config/cdn.tpl.php\n@@ -3,7 +3,16 @@ $ip_address = !empty($ip_address) ? $ip_address : '*';\n ?>\n server {\n limit_conn limreq 555; # like mod_evasive - this allows max 555 simultaneous connections from one IP address\n- listen ;\n+ip_addresses as $ip) {\n+ print \" listen {$ip}:{$http_port};\\n\";\n+ }\n+}\n+?>\n server_name cdn as $cdn_domain) : if (trim($cdn_domain)) : ?> ;\n root root}\"; ?>;\n\ndiff --git a/Provision/Config/cdn_disabled.tpl.php b/Provision/Config/cdn_disabled.tpl.php\nindex 396e309a3e746794759bb910edeb500bea38aa41..cee2eb0acaabb7304cd4cc9e61f5d81d4a1fd3bf 100644\n--- a/Provision/Config/cdn_disabled.tpl.php\n+++ b/Provision/Config/cdn_disabled.tpl.php\n@@ -2,10 +2,19 @@\n $ip_address = !empty($ip_address) ? $ip_address : '*';\n ?>\n server {\n- listen ;\n+ limit_conn limreq 555;\n+ip_addresses as $ip) {\n+ print \" listen {$ip}:{$http_port};\\n\";\n+ }\n+}\n+?>\n server_name cdn); ?>;\n root /var/www/nginx-default;\n index index.html index.htm;\n-\n ### Do not reveal Aegir front-end URL here.\n }\n" }, { "path": "aegir/patches/php-8.1-openssl3.patch", "content": "diff -Naur a/ext/openssl/openssl.c b/ext/openssl/openssl.c\n--- a/ext/openssl/openssl.c\t2021-07-20 19:08:50.000000000 +0300\n+++ b/ext/openssl/openssl.c\t2021-07-21 15:44:11.395257764 +0300\n@@ -1198,7 +1198,6 @@\n \tREGISTER_LONG_CONSTANT(\"OPENSSL_CMS_NOSIGS\", CMS_NOSIGS, CONST_CS|CONST_PERSISTENT);\n\n \tREGISTER_LONG_CONSTANT(\"OPENSSL_PKCS1_PADDING\", RSA_PKCS1_PADDING, CONST_CS|CONST_PERSISTENT);\n-\tREGISTER_LONG_CONSTANT(\"OPENSSL_SSLV23_PADDING\", RSA_SSLV23_PADDING, CONST_CS|CONST_PERSISTENT);\n \tREGISTER_LONG_CONSTANT(\"OPENSSL_NO_PADDING\", RSA_NO_PADDING, CONST_CS|CONST_PERSISTENT);\n \tREGISTER_LONG_CONSTANT(\"OPENSSL_PKCS1_OAEP_PADDING\", RSA_PKCS1_OAEP_PADDING, CONST_CS|CONST_PERSISTENT);\n\n" }, { "path": "aegir/patches/provision/patch_commit_e4abc685f9b4.patch", "content": "diff --git a/http/Provision/Config/Nginx/server.tpl.php b/http/Provision/Config/Nginx/server.tpl.php\nindex 1158df5756ca13516f8eb16c34ba16a2742c95ed..4ce8cebf9583c17a5d335f2e691bba9e5531169c 100644\n--- a/http/Provision/Config/Nginx/server.tpl.php\n+++ b/http/Provision/Config/Nginx/server.tpl.php\n@@ -16,7 +16,7 @@\n fastcgi_param DOCUMENT_ROOT $document_root;\n fastcgi_param SERVER_PROTOCOL $server_protocol;\n fastcgi_param GATEWAY_INTERFACE CGI/1.1;\n- fastcgi_param SERVER_SOFTWARE ApacheSolaris/$nginx_version;\n+ fastcgi_param SERVER_SOFTWARE ApacheSolarisNginx/$nginx_version;\n fastcgi_param REMOTE_ADDR $remote_addr;\n fastcgi_param REMOTE_PORT $remote_port;\n fastcgi_param SERVER_ADDR $server_addr;\ndiff --git a/http/Provision/Service/http/fastcgi_params.conf b/http/Provision/Service/http/fastcgi_params.conf\nindex 70d62e38d15a93c5ce3bb8502664290c7efd95a7..e1991a74580e1b11f6942506f71de9929c308abe 100644\n--- a/http/Provision/Service/http/fastcgi_params.conf\n+++ b/http/Provision/Service/http/fastcgi_params.conf\n@@ -12,7 +12,7 @@ fastcgi_param DOCUMENT_URI $document_uri;\n fastcgi_param DOCUMENT_ROOT $document_root;\n fastcgi_param SERVER_PROTOCOL $server_protocol;\n fastcgi_param GATEWAY_INTERFACE CGI/1.1;\n-fastcgi_param SERVER_SOFTWARE ApacheSolaris/$nginx_version;\n+fastcgi_param SERVER_SOFTWARE ApacheSolarisNginx/$nginx_version;\n fastcgi_param REMOTE_ADDR $remote_addr;\n fastcgi_param REMOTE_PORT $remote_port;\n fastcgi_param SERVER_ADDR $server_addr;\ndiff --git a/http/Provision/Service/http/fastcgi_ssl_params.conf b/http/Provision/Service/http/fastcgi_ssl_params.conf\nindex c24a765bcfe90216283d8177f9acead6bb749d46..2b7eedaf06eb12aa17017059c25f9a45555d6bcb 100644\n--- a/http/Provision/Service/http/fastcgi_ssl_params.conf\n+++ b/http/Provision/Service/http/fastcgi_ssl_params.conf\n@@ -12,7 +12,7 @@ fastcgi_param DOCUMENT_URI $document_uri;\n fastcgi_param DOCUMENT_ROOT $document_root;\n fastcgi_param SERVER_PROTOCOL $server_protocol;\n fastcgi_param GATEWAY_INTERFACE CGI/1.1;\n-fastcgi_param SERVER_SOFTWARE SSLApacheSolaris/$nginx_version;\n+fastcgi_param SERVER_SOFTWARE ApacheSolarisSSLNginx/$nginx_version;\n fastcgi_param REMOTE_ADDR $remote_addr;\n fastcgi_param REMOTE_PORT $remote_port;\n fastcgi_param SERVER_ADDR $server_addr;\n" }, { "path": "aegir/patches/provision_hosting_le.drush.inc", "content": "type == 'site') {\n $le_root = d('@server_master')->aegir_root . \"/tools/le\";\n $le_cert = d('@server_master')->aegir_root . \"/tools/le/certs\";\n $le_acme = d('@server_master')->aegir_root . \"/tools/le/.acme-challenges\";\n $le_ctrl = d('@server_master')->aegir_root . \"/tools/le/.ctrl\";\n $le_exec = d('@server_master')->aegir_root . \"/tools/le/dehydrated\";\n $le_conf = d('@server_master')->aegir_root . \"/tools/le/config.sh\";\n $le_cnfx = d('@server_master')->aegir_root . \"/tools/le/config\";\n $le_acct = d('@server_master')->aegir_root . \"/tools/le/accounts\";\n $le_hook = d('@server_master')->aegir_root . \"/tools/le/letsencrypt-sh-hooks.sh\";\n $cf_hook = d('@server_master')->aegir_root . \"/tools/le/hooks/cloudflare/hook.py\";\n\n $is_boa = FALSE;\n $is_boa_ctrl = \"/data/conf/global.inc\";\n\n if (provision_file()->exists($is_boa_ctrl)->status()) {\n $is_boa = TRUE;\n }\n\n $main_name = $real_name = substr(d()->name, 1);\n if ($real_name == 'hostmaster') {\n $real_name = $main_name = d()->uri;\n }\n\n if (d()->redirection) {\n drush_log('[hosting_le] This sitename redirection target is ' . d()->redirection, 'info');\n $main_name = d()->redirection;\n if ($is_boa) {\n $cert_dir = $le_cert . \"/\" . $real_name;\n }\n else {\n $cert_dir = $le_cert . \"/\" . $main_name;\n drush_log('[hosting_le] LE SSL certificate will be valid only for ' . d()->redirection, 'info');\n }\n }\n else {\n $cert_dir = $le_cert . \"/\" . $main_name;\n }\n\n drush_log('[hosting_le] This cert_dir is ' . $cert_dir, 'info');\n\n if ($is_boa) {\n drush_log('[hosting_le] This site main SSL name is ' . $real_name, 'info');\n drush_log('[hosting_le] BOA system detected, congrats!', 'info');\n }\n else {\n drush_log('[hosting_le] This site main SSL name is ' . $main_name, 'info');\n }\n\n $wildcard_ctrl = d('@server_master')->aegir_root . \"/static/control/wildcard-enable-\" . $main_name . \".info\";\n drush_log('[hosting_le] The optional wildcard flag is ' . $wildcard_ctrl, 'info');\n\n $legacy_tls_ctrl = d('@server_master')->aegir_root . \"/static/control/tls-legacy-enable-\" . $main_name . \".info\";\n drush_log('[hosting_le] The optional legacy TLSv1.1 flag is ' . $legacy_tls_ctrl, 'info');\n\n $no_san_ctrl = d('@server_master')->aegir_root . \"/static/control/ssl-no-san-\" . $main_name . \".info\";\n drush_log('[hosting_le] The optional no-SAN flag is ' . $no_san_ctrl, 'info');\n\n $yes_dev_ctrl = d('@server_master')->aegir_root . \"/static/control/ssl-yes-dev-\" . $main_name . \".info\";\n drush_log('[hosting_le] The optional enable-DEV flag is ' . $yes_dev_ctrl, 'info');\n\n $immutable = $le_ctrl . \"/dont-overwrite-\" . $main_name . \".pid\";\n drush_log('[hosting_le] The optional immutable flag is ' . $immutable, 'info');\n\n $demo_mode_ctrl = $le_ctrl . \"/ssl-demo-mode.pid\";\n drush_log('[hosting_le] The optional demo flag is ' . $demo_mode_ctrl, 'info');\n\n // https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864\n $forced_renewal_ctrl = $le_ctrl . \"/forced-renewal-02-\" . $main_name . \".pid\";\n\n $site_mode_demo_ctrl = $le_ctrl . \"/demo-\" . $main_name . \".pid\";\n $site_mode_live_ctrl = $le_ctrl . \"/live-\" . $main_name . \".pid\";\n\n $force_renew = FALSE;\n\n $on_remote_server = !provision_is_local_host(d()->platform->web_server->remote_host);\n }\n\n $is_wildcard = FALSE;\n if (provision_file()->exists($wildcard_ctrl)->status()) {\n if (provision_file()->exists($cf_hook)->status()) {\n if (provision_file()->exists($le_cnfx)->status()) {\n $is_wildcard = TRUE;\n $main_name = preg_replace('`^www\\.`', '', $main_name);\n $real_name = preg_replace('`^www\\.`', '', $real_name);\n }\n }\n }\n\n if (d()->type == 'site' &&\n !d()->ssl_enabled &&\n !provision_file()->exists($immutable)->status()) {\n if (file_exists($cert_dir)) {\n exec(\"/bin/bash \" . $le_exec . \" --cleanup\", $output_b);\n $acme_result_b = implode(' ', $output_b);\n drush_log('[hosting_le] ACME Cleanup Output: ' . $acme_result_b, 'info');\n\n exec(\"symlinks -dr \" . $cert_dir, $output_c);\n $acme_result_c = implode(' ', $output_c);\n drush_log('[hosting_le] ACME Cleanup Symlinks: ' . $acme_result_c, 'info');\n }\n }\n elseif (d()->type == 'site' &&\n d()->ssl_enabled) {\n\n provision_file()->create_dir($le_root, dt('[hosting_le] LE root'), 0711);\n provision_file()->create_dir($le_cert, dt('[hosting_le] LE certs'), 0700);\n provision_file()->create_dir($le_acme, dt('[hosting_le] LE challenges'), 0711);\n provision_file()->create_dir($le_ctrl, dt('[hosting_le] LE ctrl'), 0711);\n\n if (!provision_file()->exists($le_exec)->status()) {\n drush_log('[hosting_le] Please upload dehydrated to ' . $le_exec, 'warning');\n drush_log('[hosting_le] URL: https://raw.githubusercontent.com/omega8cc/dehydrated/master/dehydrated', 'warning');\n return FALSE;\n }\n\n if ($on_remote_server && !provision_file()->exists($le_hook)->status()) {\n drush_log('[hosting_le] Please copy letsencrypt-sh-hooks.sh to ' . $le_root, 'warning');\n return FALSE;\n }\n\n $enable_dev_ctrl = FALSE;\n if (provision_file()->exists($yes_dev_ctrl)->status()) {\n $enable_dev_ctrl = TRUE;\n drush_log('[hosting_le] SSL enable-DEV mode ctrl file detected for ' . $main_name, 'info');\n }\n\n if ($is_boa) {\n if (preg_match(\"/\\.(?:host8|boa|aegir|o8)\\.(?:biz|io|cc)$/\", $main_name) ||\n preg_match(\"/\\.(?:nodns)\\./\", $main_name)\n ) {\n drush_log('[hosting_le] Skipping LE setup for ' . $main_name, 'warning');\n return FALSE;\n }\n if (!$enable_dev_ctrl) {\n if (preg_match(\"/\\.(?:temp|tmp|temporary)\\./\", $main_name) ||\n preg_match(\"/\\.(?:test|testing)\\./\", $main_name) ||\n preg_match(\"/\\.(?:dev|devel)\\./\", $main_name)\n ) {\n drush_log('[hosting_le] Skipping LE setup for ' . $main_name, 'warning');\n return FALSE;\n }\n }\n }\n\n if (provision_file()->exists($demo_mode_ctrl)->status()) {\n if (!provision_file()->exists($le_conf)->status()) {\n\n $le_conf_lines = \"CA=\\\"https://acme-staging-v02.api.letsencrypt.org/directory\\\"\\n\";\n\n provision_file()->file_put_contents($le_conf, $le_conf_lines)\n ->succeed('[hosting_le] Created cnf ' . $le_conf)\n ->fail('[hosting_le] Could not create cnf ' . $le_conf);\n\n copy($le_conf, $le_cnfx);\n\n if (provision_file()->exists($le_acct)->status()) {\n drush_log('[hosting_le] Demo LE account will be created.', 'info');\n rename($le_acct, $le_acct . \"-live\");\n }\n\n drush_log('[hosting_le] New LE accounts require registration on ACMEv2.', 'info');\n drush_log('[hosting_le] Running --register --accept-terms as required by ACMEv2.', 'info');\n $le_register = \" --register --accept-terms\";\n exec(\"/bin/bash \" . $le_exec . $le_register . \" 2>&1\", $register_output);\n $acme_register = implode(' ', $register_output);\n drush_log(\"[hosting_le] ACMEv2 Demo Register Output: \" . $acme_register, 'info');\n $acme_register = \"\";\n }\n drush_log('[hosting_le] Demo LE mode active. No real LE certs will be generated.', 'info');\n $demo_mode = TRUE;\n }\n else {\n if (provision_file()->exists($le_conf)->status()) {\n unlink($le_conf);\n unlink($le_cnfx);\n if (provision_file()->exists($le_acct)->status()) {\n rename($le_acct, $le_acct . \"-demo\");\n }\n drush_log('[hosting_le] Live LE account will be registered.', 'info');\n drush_log('[hosting_le] New LE accounts require registration on ACMEv2.', 'info');\n drush_log('[hosting_le] Running --register --accept-terms as required by ACMEv2.', 'info');\n $le_register = \" --register --accept-terms\";\n exec(\"/bin/bash \" . $le_exec . $le_register . \" 2>&1\", $register_output);\n $acme_register = implode(' ', $register_output);\n drush_log(\"[hosting_le] ACMEv2 Live Register Output: \" . $acme_register, 'info');\n $acme_register = \"\";\n }\n drush_log('[hosting_le] Live LE mode active. Real LE certs will be generated.', 'info');\n $demo_mode = FALSE;\n }\n\n if ($demo_mode) {\n if (file_exists($site_mode_live_ctrl) || !file_exists($site_mode_demo_ctrl)) {\n unlink($site_mode_live_ctrl);\n $force_renew = TRUE;\n drush_log('[hosting_le] Forcing DEMO certificate renew for ' . $main_name, 'info');\n }\n if (!file_exists($site_mode_demo_ctrl)) {\n provision_file()->file_put_contents($site_mode_demo_ctrl, $main_name)\n ->succeed('[hosting_le] Created pid ' . $site_mode_demo_ctrl)\n ->fail('[hosting_le] Could not create pid ' . $site_mode_demo_ctrl);\n }\n }\n else {\n if (file_exists($site_mode_demo_ctrl) || !file_exists($site_mode_live_ctrl)) {\n @unlink($site_mode_demo_ctrl);\n $force_renew = TRUE;\n drush_log('[hosting_le] Forcing LIVE certificate renew for ' . $main_name, 'info');\n }\n if (!file_exists($site_mode_live_ctrl)) {\n provision_file()->file_put_contents($site_mode_live_ctrl, $main_name)\n ->succeed('[hosting_le] Created pid ' . $site_mode_live_ctrl)\n ->fail('[hosting_le] Could not create pid ' . $site_mode_live_ctrl);\n }\n }\n\n if (!file_exists($forced_renewal_ctrl)) {\n $force_renew = TRUE;\n provision_file()->file_put_contents($forced_renewal_ctrl, $main_name)\n ->succeed('[hosting_le] Created pid ' . $forced_renewal_ctrl)\n ->fail('[hosting_le] Could not create pid ' . $forced_renewal_ctrl);\n }\n\n // WIP: needed after certs deleted\n // $force_renew = TRUE;\n\n drush_log('[hosting_le] LE certificate for ' . $main_name, 'info');\n\n if (provision_file()->exists($no_san_ctrl)->status()) {\n $no_alt_names = TRUE;\n drush_log('[hosting_le] SSL no-SAN mode ctrl file detected for ' . $main_name, 'info');\n }\n else {\n $no_alt_names = FALSE;\n if ($is_boa) {\n if (!empty(d()->aliases)) {\n foreach (d()->aliases as $alias) {\n if ($is_wildcard) {\n if (!preg_match(\"/\\.(?:host8|boa|aegir|o8)\\.(?:biz|io|cc)$/\", $alias) &&\n !preg_match(\"/\\.(?:nodns)\\./\", $alias) &&\n !strpos($alias, $main_name)) {\n $alt_names .= ' --domain ' . str_replace('/', '.', $alias);\n }\n }\n else {\n if (!preg_match(\"/\\.(?:host8|boa|aegir|o8)\\.(?:biz|io|cc)$/\", $alias) &&\n !preg_match(\"/\\.(?:nodns)\\./\", $alias)) {\n $alt_names .= ' --domain ' . str_replace('/', '.', $alias);\n }\n }\n }\n }\n }\n else {\n if (!empty(d()->aliases)) {\n $alt_names = implode(' --domain ', str_replace('/', '.', d()->aliases));\n $alt_names = ' --domain ' . $alt_names;\n }\n }\n drush_log('[hosting_le] ALT names:' . $alt_names, 'info');\n }\n\n $web_server = d()->platform->web_server;\n // check if server is a pack\n if ($web_server->master_web_servers) {\n // use pack master\n $web_server = d(reset($web_server->master_web_servers));\n }\n $site_vhost = $web_server->http_vhostd_path . \"/\" . $real_name;\n\n if (provision_file()->exists($site_vhost)->status()) {\n $grep_output = '';\n $redirect_result = '';\n $http_service_type = $web_server->http_service_type;\n\n if ($http_service_type == 'nginx_ssl') {\n exec(\"/bin/grep \\\"alias redirection virtual host\\\" \" . $site_vhost, $grep_output);\n }\n elseif ($http_service_type == 'apache_ssl') {\n exec(\"/bin/grep \\\"Redirect all aliases\\\" \" . $site_vhost, $grep_output);\n }\n\n $redirect_result = implode(' ', $grep_output);\n drush_log('[hosting_le] Redirect check result for ' . $main_name . ' : ' . $redirect_result, 'info');\n\n if ($redirect_result && !$no_alt_names && !$is_boa) {\n drush_log(\"[hosting_le] Aliases redirection must be disabled if all aliases are expected to be listed as SAN names.\", 'info');\n drush_log(\"[hosting_le] The alternative is to disable SAN mode for this site with empty ctrl file: \" . $no_san_ctrl, 'info');\n drush_log('[hosting_le] Forcing no-SAN-mode for ' . $main_name, 'info');\n $no_alt_names = TRUE;\n }\n }\n else {\n drush_log(\"[hosting_le] The site's vhost must already exist, or the LE agent will not be able to proceed.\", 'warning');\n drush_log('[hosting_le] Path to vhost: ' . $site_vhost, 'info');\n drush_log('[hosting_le] Skipping LE setup for ' . $main_name, 'warning');\n return FALSE;\n }\n\n if (provision_file()->exists($immutable)->status() &&\n provision_file()->exists($cert_dir)->status()) {\n $needs_update = FALSE;\n drush_log(\"[hosting_le] Immutable protection mode detected for this domain: \" . $cert_dir, 'info');\n drush_log(\"[hosting_le] SSL Certificate for this domain already exists in: \" . $cert_dir, 'info');\n drush_log(\"[hosting_le] You can replace it with any other certificate since it will be left here as-is forever.\", 'info');\n drush_log(\"[hosting_le] To re-activate LE auto-renewals please delete this file: \" . $immutable, 'info');\n drush_log(\"[hosting_le] NOTE: On hosted Ægir service you need to contact your host support for further assistance.\", 'info');\n }\n else {\n drush_log(\"[hosting_le] To stop the LE Certificate auto-renewals please create an empty ctrl file.\", 'info');\n drush_log(\"[hosting_le] Path to use for this site specific empty ctrl file: \" . $immutable, 'info');\n drush_log(\"[hosting_le] You could then replace existing cert with any other cert since it will be left here as-is forever.\", 'info');\n drush_log(\"[hosting_le] NOTE: On hosted Ægir service you need to contact your host support for further assistance.\", 'info');\n $output = '';\n $le_options = \" --cron --ipv4\";\n $le_challenge = \" --domain \" . $real_name . \" --challenge dns-01 --hook \" . $cf_hook;\n if ($on_remote_server) {\n $le_options .= \" --hook \" . $le_hook;\n }\n if ($force_renew) {\n if ($no_alt_names || empty($alt_names)) {\n if ($is_wildcard) {\n $le_options .= \" --alias \" . $real_name . \" --domain *.\" . $real_name . $le_challenge;\n exec(\"/bin/bash \" . $le_exec . $le_options . \" --force 2>&1\", $output);\n }\n else {\n exec(\"/bin/bash \" . $le_exec . $le_options . \" --force --domain \" . $main_name . ' 2>&1', $output);\n }\n }\n else {\n if ($is_wildcard) {\n $le_options .= \" --alias \" . $real_name . \" --domain *.\" . $real_name . $alt_names . $le_challenge;\n exec(\"/bin/bash \" . $le_exec . $le_options . \" --force 2>&1\", $output);\n }\n else {\n exec(\"/bin/bash \" . $le_exec . $le_options . \" --force --domain \" . $real_name . $alt_names . ' 2>&1', $output);\n }\n }\n }\n else {\n if ($no_alt_names || empty($alt_names)) {\n if ($is_wildcard) {\n $le_options .= \" --alias \" . $real_name . \" --domain *.\" . $real_name . $le_challenge;\n exec(\"/bin/bash \" . $le_exec . $le_options . \" 2>&1\", $output);\n }\n else {\n exec(\"/bin/bash \" . $le_exec . $le_options . \" --domain \" . $main_name . ' 2>&1', $output);\n }\n }\n else {\n if ($is_wildcard) {\n $le_options .= \" --alias \" . $real_name . \" --domain *.\" . $real_name . $alt_names . $le_challenge;\n exec(\"/bin/bash \" . $le_exec . $le_options . \" 2>&1\", $output);\n }\n else {\n exec(\"/bin/bash \" . $le_exec . $le_options . \" --domain \" . $real_name . $alt_names . ' 2>&1', $output);\n }\n }\n }\n $acme_result = implode(' ', $output);\n drush_log(\"[hosting_le] ACME Output: \" . $acme_result, 'info');\n if (!provision_file()->exists($cert_dir)->status()) {\n $needs_update = FALSE;\n drush_log(\"[hosting_le] Hmm.. For some reason cert_dir doesn't exist: \" . $cert_dir, 'info');\n drush_log(\"[hosting_le] I couldn't generate LE cert during this Verify procedure.\", 'info');\n drush_log(\"[hosting_le] It's normal while running a series of Verify sub-tasks during Rename/Migrate.\", 'info');\n drush_log(\"[hosting_le] But if this happens during standalone Verify, maybe permissions are incorrect.\", 'info');\n drush_log(\"[hosting_le] Let's abort the procedure here. Bye.\", 'info');\n return FALSE;\n }\n else {\n if (preg_match(\"/unchanged.*Skipping/i\", $acme_result)) {\n $needs_update = FALSE;\n drush_log(\"[hosting_le] The existing LE Certificate is up to date in \" . $cert_dir, 'success');\n }\n elseif (preg_match(\"/Forcing.*renew/i\", $acme_result) &&\n preg_match(\"/Creating.*fullchain/i\", $acme_result)) {\n $needs_update = TRUE;\n drush_log(\"[hosting_le] The LE Certificate has been successfully updated in \" . $cert_dir, 'success');\n }\n elseif (preg_match(\"/Forcing.*renew/i\", $acme_result) &&\n !preg_match(\"/Creating.*fullchain/i\", $acme_result)) {\n $needs_update = FALSE;\n drush_log(\"[hosting_le] The LE Certificate attempted update looks incomplete in \" . $cert_dir, 'warning');\n drush_log(\"[hosting_le] Make sure that all aliases have valid DNS names pointing to your instance IP address.\", 'warning');\n if (!$is_boa) {\n drush_log(\"[hosting_le] Aliases redirection must be disabled, or the LE agent will not be able to proceed.\", 'warning');\n }\n drush_log(\"[hosting_le] The alternative is to disable SAN mode for this site with empty ctrl file: \" . $no_san_ctrl, 'warning');\n }\n elseif (preg_match(\"/Requesting.*challenge/i\", $acme_result) &&\n !preg_match(\"/Forcing.*renew/i\", $acme_result) &&\n !preg_match(\"/Creating.*fullchain/i\", $acme_result)) {\n $needs_update = FALSE;\n drush_log(\"[hosting_le] The LE Certificate attempted creation failed in \" . $cert_dir, 'warning');\n drush_log(\"[hosting_le] Make sure that all aliases have valid DNS names pointing to your instance IP address.\", 'warning');\n if (!$is_boa) {\n drush_log(\"[hosting_le] Aliases redirection must be disabled, or the LE agent will not be able to proceed.\", 'warning');\n }\n drush_log(\"[hosting_le] The alternative is to disable SAN mode for this site with empty ctrl file: \" . $no_san_ctrl, 'warning');\n }\n else {\n $needs_update = TRUE;\n drush_log(\"[hosting_le] The LE Certificate has been successfully [re]generated in \" . $cert_dir, 'success');\n }\n }\n }\n\n if ($needs_update && !provision_file()->exists($immutable)->status()) {\n\n exec(\"/bin/bash \" . $le_exec . \" --cleanup\", $output_clean);\n $acme_result_clean = implode(' ', $output_clean);\n drush_log('[hosting_le] ACME Cleanup Output: ' . $acme_result_clean, 'info');\n\n $ssl_symlinks[] = d('@server_master')->ssld_path . \"/\" . $real_name;\n $ssl_symlinks[] = $web_server->http_ssld_path . \"/\" . $real_name;\n\n foreach ($ssl_symlinks as $symlink) {\n if (provision_file()->exists($symlink)->status()) {\n drush_log('[hosting_le] File exists: ' . $symlink, 'info');\n\n if (!is_link($symlink)) {\n drush_log('[hosting_le] Moving original directory out of the way: ' . $symlink, 'info');\n\n // This will overwrite symlink.bak if necessary, so we don't end up\n // with dozens of backups of unused certificates.\n rename($symlink, $symlink . \".bak\");\n }\n else {\n drush_log('[hosting_le] SSL certificate already symlinked: ' . $symlink, 'success');\n continue;\n }\n }\n\n drush_log('[hosting_le] Creating symlink at ' . $symlink, 'info');\n\n if (symlink($cert_dir, $symlink)) {\n drush_log('[hosting_le] Symlinked cert directory to ' . $symlink, 'success');\n }\n else {\n drush_log('[hosting_le] Could not symlink cert directory to ' . $symlink, 'warning');\n }\n }\n\n drush_log('[hosting_le] Replacing openssl symlinks.', 'info');\n\n $filenames = array(\n 'openssl.crt' => 'cert.pem',\n 'openssl.csr' => 'cert.csr',\n 'openssl.key' => 'privkey.pem',\n 'openssl_chain.crt' => 'fullchain.pem',\n );\n\n $success = TRUE;\n foreach ($filenames as $original => $target) {\n // Remove current symlink or file (this would have been generated by\n // Ægir AFTER the original dir symlinking, meaning it's self-generated\n // and therefore unimportant.\n @unlink($cert_dir . \"/\" . $original);\n\n $success = ($success && symlink($cert_dir . \"/\" . $target, $cert_dir . \"/\" . $original));\n }\n\n if ($success) {\n drush_log('[hosting_le] Successfully replaced all symlinks.', 'success');\n }\n else {\n drush_log('[hosting_le] Could not replace one or more symlinks. Check ' . $certdir, 'warning');\n }\n\n $web_server->sync($le_cert . '/' . $real_name);\n $web_server->sync($web_server->http_ssld_path);\n\n $pid = $le_ctrl . \"/\" . $main_name . \".pid\";\n\n if (file_exists($cert_dir) && !file_exists($pid)) {\n provision_file()->file_put_contents($pid, $main_name)\n ->succeed('[hosting_le] Created pid ' . $pid)\n ->fail('[hosting_le] Could not create pid ' . $pid);\n // We will not run the secondary Verify if pid file doesn't exist,\n // to avoid verify-inside-verify loop which could overload the system.\n if (provision_file()->exists($pid)->status()) {\n drush_log('[hosting_le] Running Verify again to reload web server once openssl_chain.crt is present in the vhost', 'info');\n $local_uri_verify = '@' . $real_name;\n provision_backend_invoke($local_uri_verify, 'provision-verify');\n // We could run it via frontend but it is not needed currently.\n //provision_backend_invoke('@hostmaster', 'hosting-task', array($local_uri_verify, 'verify'), array('force' => TRUE));\n sleep(5); // A small trick to avoid high load and race conditions.\n }\n }\n\n drush_log('[hosting_le] Restarting webserver', 'info');\n $web_server->restart();\n }\n }\n}\n" }, { "path": "aegir/patches/remove_usr1_usr2_fpm_unix.patch", "content": "diff --git a/sapi/fpm/fpm/fpm_unix.c b/sapi/fpm/fpm/fpm_unix.c\nindex 5c5e37c..ed3b352 100644\n--- a/sapi/fpm/fpm/fpm_unix.c\n+++ b/sapi/fpm/fpm/fpm_unix.c\n@@ -271,28 +271,6 @@ int fpm_unix_init_main() /* {{{ */\n \t\tstruct sigaction oldact_usr2;\n \t\tstruct timeval tv;\n \n-\t\t/*\n-\t\t * set sigaction for USR1 before fork\n-\t\t * save old sigaction to restore it after\n-\t\t * fork in the child process (the master process)\n-\t\t */\n-\t\tmemset(&act, 0, sizeof(act));\n-\t\tmemset(&act, 0, sizeof(oldact_usr1));\n-\t\tact.sa_handler = fpm_signals_sighandler_exit_ok;\n-\t\tsigfillset(&act.sa_mask);\n-\t\tsigaction(SIGUSR1, &act, &oldact_usr1);\n-\n-\t\t/*\n-\t\t * set sigaction for USR2 before fork\n-\t\t * save old sigaction to restore it after\n-\t\t * fork in the child process (the master process)\n-\t\t */\n-\t\tmemset(&act, 0, sizeof(act));\n-\t\tmemset(&act, 0, sizeof(oldact_usr2));\n-\t\tact.sa_handler = fpm_signals_sighandler_exit_config;\n-\t\tsigfillset(&act.sa_mask);\n-\t\tsigaction(SIGUSR2, &act, &oldact_usr2);\n-\n \t\t/* then fork */\n \t\tpid_t pid = fork();\n \t\tswitch (pid) {\n@@ -311,15 +289,6 @@ int fpm_unix_init_main() /* {{{ */\n \t\t\tdefault : /* parent */\n \t\t\t\tfpm_cleanups_run(FPM_CLEANUP_PARENT_EXIT);\n \n-\t\t\t\t/*\n-\t\t\t\t * wait for 10s before exiting with error\n-\t\t\t\t * the child is supposed to send USR1 or USR2 to tell the parent\n-\t\t\t\t * how it goes for it\n-\t\t\t\t */\n-\t\t\t\ttv.tv_sec = 10;\n-\t\t\t\ttv.tv_usec = 0;\n-\t\t\t\tzlog(ZLOG_DEBUG, \"The calling process is waiting for the master process to ping\");\n-\t\t\t\tselect(0, NULL, NULL, NULL, &tv);\n \t\t\t\texit(FPM_EXIT_SOFTWARE);\n \t\t}\n \t}\n" }, { "path": "aegir/patches/restaurant_demo.patch", "content": "diff -urp a/texts.csv b/texts.csv\n--- a/texts.csv\t2014-08-25 11:19:44.000000000 +0000\n+++ b/texts.csv\t2014-08-25 12:22:37.000000000 +0000\n@@ -1,3 +1,3 @@\n \"Title\",\"Text\",\"Overrides\"\n-\"About Restaurant\",\"

    The Restaurant distribution is powered by Drupal and Panopoly.

    Download Restaurant

    Learn more · Try on Pantheon

    \",\"site_template_panel_context__new-7\"\n-\"How to book a table\",\"

    Step 1

    Fill in the reservation form with your contact information, the date of your reservation and the number of persons.

    Step 2

    Wait for our email that confirms that your reservation has been received.

    Step 3

    We will email you or call you back when your reservation has been confirmed.

    \",\"reservation__page_reservation_panel_context_2__new-2\"\n\\ No newline at end of file\n+\"About Restaurant\",\"

    The Restaurant distribution is powered by Drupal and Panopoly.

    Download Restaurant

    Learn more · Try on Aegir

    \",\"site_template_panel_context__new-7\"\n+\"How to book a table\",\"

    Step 1

    Fill in the reservation form with your contact information, the date of your reservation and the number of persons.

    Step 2

    Wait for our email that confirms that your reservation has been received.

    Step 3

    We will email you or call you back when your reservation has been confirmed.

    \",\"reservation__page_reservation_panel_context_2__new-2\"\n" }, { "path": "aegir/patches/singular.mft.patch", "content": "diff -urp singular/style.css singular/style.css\r\n--- singular/style.css 2011-03-10 20:28:50.000000000 +0100\r\n+++ singular/style.css 2011-03-10 20:28:44.000000000 +0100\r\n@@ -22,13 +22,13 @@ a {\r\n -moz-border-radius-bottomright:5px;\r\n -webkit-border-top-right-radius:5px;\r\n -webkit-border-bottom-right-radius:5px;\r\n+ border-top-right-radius:5px;\r\n+ border-bottom-right-radius:5px;\r\n\r\n font-size:13px;\r\n line-height:20px;\r\n-\r\n background:url(images/mask.png);\r\n color:#fff;\r\n-\r\n margin:100px 0px 0px;\r\n float:right;\r\n width:220px;\r\n@@ -36,9 +36,9 @@ a {\r\n\r\n #main {\r\n -moz-border-radius:10px;\r\n- -moz-border-radius:10px;\r\n- -webkit-border-radius:10px;\r\n -webkit-border-radius:10px;\r\n+ border-radius:10px;\r\n+\r\n background:url(images/mask.png);\r\n width:740px;\r\n }\r\n@@ -102,6 +102,8 @@ body.fluid #sidebar { width:20%; }\r\n #branding div.primary ul.links a {\r\n -moz-border-radius:10px;\r\n -webkit-border-radius:10px;\r\n+ border-radius:10px;\r\n+\r\n background:url(images/mask.png);\r\n padding:0px 15px;\r\n }\r\n@@ -123,6 +125,8 @@ body.fluid #sidebar { width:20%; }\r\n -moz-border-radius-topright:5px;\r\n -webkit-border-top-left-radius:5px;\r\n -webkit-border-top-right-radius:5px;\r\n+ border-top-left-radius:5px;\r\n+ border-top-right-radius:5px;\r\n\r\n color:#ccc;\r\n background:url(images/mask.png);\r\n@@ -195,6 +199,8 @@ div.left div.admin-panel { margin-right:\r\n -moz-border-radius-bottomright:5px;\r\n -webkit-border-bottom-left-radius:5px;\r\n -webkit-border-bottom-right-radius:5px;\r\n+ border-bottom-right-radius: 5px;\r\n+ border-bottom-left-radius: 5px;\r\n }\r\n\r\n #page #content div.block {\r\n@@ -212,6 +218,8 @@ div.left div.admin-panel { margin-right:\r\n #page #content div.block-content {\r\n -moz-border-radius:10px;\r\n -webkit-border-radius:10px;\r\n+ border-radius:10px;\r\n+\r\n background:#fff;\r\n padding:10px;\r\n }\r\n@@ -262,6 +270,7 @@ div.left div.admin-panel { margin-right:\r\n #growl div.messages {\r\n -moz-border-radius:5px;\r\n -webkit-border-radius:5px;\r\n+ border-radius:5px;\r\n\r\n margin:5px 0px;\r\n background:#eff;\r\n@@ -320,6 +329,8 @@ dl dd {\r\n -moz-border-radius-bottomleft:5px;\r\n -webkit-border-top-left-radius:5px;\r\n -webkit-border-bottom-left-radius:5px;\r\n+ border-top-left-radius: 5px;\r\n+ border-bottom-left-radius: 5px;\r\n }\r\n\r\n #sidebar div.block h2.block-title {\r\n@@ -390,6 +401,8 @@ div.node-links ul.links {\r\n margin:20px 0px 0px;\r\n -moz-border-radius:5px;\r\n -webkit-border-radius:5px;\r\n+ border-radius:5px;\r\n+\r\n background:#fff;\r\n float:right;\r\n }\r\n" }, { "path": "aegir/patches/singular.patch", "content": "diff -urp singular/style.css singular/style.css\n--- singular/style.css\t2009-08-12 21:41:25.000000000 +0200\n+++ singular/style.css\t2009-08-18 14:51:26.000000000 +0200\n@@ -20,6 +20,8 @@ a {\n #sidebar {\n -moz-border-radius-topright:5px;\n -moz-border-radius-bottomright:5px;\n+ -webkit-border-top-right-radius:5px;\n+ -webkit-border-bottom-right-radius:5px;\n\n font-size:13px;\n line-height:20px;\n@@ -35,6 +37,8 @@ a {\n #main {\n -moz-border-radius:10px;\n -moz-border-radius:10px;\n+ -webkit-border-radius:10px;\n+ -webkit-border-radius:10px;\n background:url(images/mask.png);\n width:740px;\n }\n@@ -187,9 +191,10 @@ div.left div.admin-panel { margin-right:\n background:#f8f8f8;\n border-top:1px solid #ddd;\n padding:19px 20px 20px;\n-\n -moz-border-radius-bottomleft:5px;\n -moz-border-radius-bottomright:5px;\n+ -webkit-border-bottom-left-radius:5px;\n+ -webkit-border-bottom-right-radius:5px;\n }\n\n #page #content div.block {\n@@ -206,6 +211,7 @@ div.left div.admin-panel { margin-right:\n\n #page #content div.block-content {\n -moz-border-radius:10px;\n+ -webkit-border-radius:10px;\n background:#fff;\n padding:10px;\n }\n@@ -383,6 +389,7 @@ div.node-submitted { margin:0px 0px 20px\n div.node-links ul.links {\n margin:20px 0px 0px;\n -moz-border-radius:5px;\n+ -webkit-border-radius:5px;\n background:#fff;\n float:right;\n }\n" }, { "path": "aegir/patches/skwashd.commons.patch", "content": "diff -aburN --exclude='CVS*' drupal_commons.orig/profiles/drupal_commons/drupal_commons.profile drupal_commons/profiles/drupal_commons/drupal_commons.profile\n--- drupal_commons.orig/profiles/drupal_commons/drupal_commons.profile\t2010-08-17 08:36:12.000000000 +1000\n+++ drupal_commons/profiles/drupal_commons/drupal_commons.profile\t2010-10-11 12:46:40.428489204 +1100\n@@ -177,6 +177,7 @@\n * modify the $task, otherwise discarded.\n */\n function drupal_commons_profile_tasks(&$task, $url) {\n+ drupal_commons_config_vars();\n drupal_commons_build_directories();\n drupal_commons_config_taxonomy();\n drupal_commons_config_profile();\n@@ -193,7 +194,6 @@\n drupal_commons_config_views();\n drupal_commons_config_theme();\n drupal_commons_config_images();\n- drupal_commons_config_vars();\n drupal_commons_cleanup();\n }\n\n" }, { "path": "aegir/patches/taxonomy-6.20.patch", "content": "From a88b4ae0ec60221b93cd5ed14ac67b1ff5719ddb Mon Sep 17 00:00:00 2001\nFrom: Thomas Skovgaard Gielfeldt \nDate: Sun, 22 May 2011 10:34:56 +0200\nSubject: [PATCH] Use Taxonomy Edge functionality.\n\n---\n modules/taxonomy/taxonomy.module | 6 ++++++\n 1 files changed, 6 insertions(+), 0 deletions(-)\n mode change 100644 => 100755 modules/taxonomy/taxonomy.module\n\ndiff --git a/modules/taxonomy/taxonomy.module b/modules/taxonomy/taxonomy.module\nindex 0141120..26a6845\n--- a/modules/taxonomy/taxonomy.module\n+++ b/modules/taxonomy/taxonomy.module\n@@ -835,6 +835,9 @@ function taxonomy_get_children($tid, $vid = 0, $key = 'tid') {\n * Results are statically cached.\n */\n function taxonomy_get_tree($vid, $parent = 0, $depth = -1, $max_depth = NULL) {\n+ if (function_exists('taxonomy_edge_taxonomy_get_tree')) {\n+ return taxonomy_edge_taxonomy_get_tree($vid, $parent, $depth, $max_depth);\n+ }\n static $children, $parents, $terms;\n\n $depth++;\n@@ -1130,6 +1133,9 @@ function theme_taxonomy_term_select($element) {\n * A resource identifier pointing to the query results.\n */\n function taxonomy_select_nodes($tids = array(), $operator = 'or', $depth = 0, $pager = TRUE, $order = 'n.sticky DESC, n.created DESC') {\n+ if (function_exists('taxonomy_edge_taxonomy_select_nodes')) {\n+ return taxonomy_edge_taxonomy_select_nodes($tids, $operator, $depth, $pager, $order);\n+ }\n if (count($tids) > 0) {\n // For each term ID, generate an array of descendant term IDs to the right depth.\n $descendant_tids = array();\n--\n1.7.4\n" }, { "path": "aegir/patches/taxonomy-6.26.patch", "content": "--- modules/taxonomy/taxonomy.module.orig\t2012-02-29 17:44:11.000000000 +0100\n+++ modules/taxonomy/taxonomy.module\t2012-03-14 18:46:54.000000000 +0100\n@@ -846,6 +846,9 @@\n * Results are statically cached.\n */\n function taxonomy_get_tree($vid, $parent = 0, $depth = -1, $max_depth = NULL) {\n+ if (function_exists('taxonomy_edge_get_tree')) {\n+ return taxonomy_edge_get_tree($vid, $parent, $depth, $max_depth);\n+ }\n static $children, $parents, $terms;\n \n // We cache trees, so it's not CPU-intensive to call get_tree() on a term\n@@ -1181,6 +1184,9 @@\n * A resource identifier pointing to the query results.\n */\n function taxonomy_select_nodes($tids = array(), $operator = 'or', $depth = 0, $pager = TRUE, $order = 'n.sticky DESC, n.created DESC') {\n+ if (function_exists('taxonomy_edge_select_nodes')) {\n+ return taxonomy_edge_select_nodes($tids, $operator, $depth, $pager, $order);\n+ }\n if (count($tids) > 0) {\n // For each term ID, generate an array of descendant term IDs to the right depth.\n $descendant_tids = array();\n" }, { "path": "aegir/patches/taxonomy-7.12.patch", "content": "--- modules/taxonomy/taxonomy.module.orig\t2012-02-01 23:03:14.000000000 +0100\n+++ modules/taxonomy/taxonomy.module\t2012-03-18 19:24:09.000000000 +0100\n@@ -968,6 +968,9 @@\n * depending on the $load_entities parameter.\n */\n function taxonomy_get_tree($vid, $parent = 0, $max_depth = NULL, $load_entities = FALSE) {\n+ if (module_exists('taxonomy_edge') && function_exists('taxonomy_edge_get_tree')) {\n+ return taxonomy_edge_get_tree($vid, $parent, $max_depth, $load_entities);\n+ }\n $children = &drupal_static(__FUNCTION__, array());\n $parents = &drupal_static(__FUNCTION__ . ':parents', array());\n $terms = &drupal_static(__FUNCTION__ . ':terms', array());\n" }, { "path": "aegir/patches/taxonomy-7.7.patch", "content": "From f2b5994fe2c2236fb763bdc811437e0fb595c7c5 Mon Sep 17 00:00:00 2001\nFrom: Thomas Skovgaard Gielfeldt \nDate: Sun, 21 Aug 2011 07:45:59 +0200\nSubject: [PATCH] Patch for Taxonomy Edge.\n\n---\n modules/taxonomy/taxonomy.module | 3 +++\n 1 files changed, 3 insertions(+), 0 deletions(-)\n\ndiff --git a/modules/taxonomy/taxonomy.module b/modules/taxonomy/taxonomy.module\nindex dc2847d..e3337de 100644\n--- a/modules/taxonomy/taxonomy.module\n+++ b/modules/taxonomy/taxonomy.module\n@@ -925,6 +925,9 @@ function taxonomy_get_children($tid, $vid = 0) {\n * depending on the $load_entities parameter.\n */\n function taxonomy_get_tree($vid, $parent = 0, $max_depth = NULL, $load_entities = FALSE) {\n+ if (function_exists('taxonomy_edge_get_tree')) {\n+ return taxonomy_edge_get_tree($vid, $parent, $max_depth, $load_entities);\n+ }\n $children = &drupal_static(__FUNCTION__, array());\n $parents = &drupal_static(__FUNCTION__ . ':parents', array());\n $terms = &drupal_static(__FUNCTION__ . ':terms', array());\n--\n1.7.5.1\n" }, { "path": "aegir/patches/ubercart-1167276-reroll.patch", "content": "diff --git a/uc_cart/uc_cart.module b/uc_cart/uc_cart.module\nindex a3cc27f..dd6722f 100644\n--- a/uc_cart/uc_cart.module\n+++ b/uc_cart/uc_cart.module\n@@ -374,12 +374,19 @@ function uc_cart_block($op = 'list', $delta = 0, $edit = array()) {\n case 'view':\n // 0 = Default shopping cart block.\n if ($delta == 0) {\n- $cachable = !$user->uid && variable_get('cache', CACHE_DISABLED) != CACHE_DISABLED;\n+ $cachable = TRUE;\n+ if (function_exists('drupal_page_is_cacheable')) {\n+ $cachable = drupal_page_is_cacheable();\n+ }\n+ else {\n+ $cachable = !$user->uid && variable_get('cache', CACHE_DISABLED) != CACHE_DISABLED;\n+ }\n+\n $product_count = count(uc_cart_get_contents());\n \n // Display nothing if the block is set to hide on empty and there are no\n // items in the cart.\n- if (!$cachable && variable_get('uc_cart_block_empty_hide', FALSE) && !$product_count) {\n+ if (variable_get('uc_cart_block_empty_hide', FALSE) && !$product_count) {\n return;\n }\n \n" }, { "path": "aegir/patches/user.drush.inc.patch", "content": "--- /dev/null\t2010-06-09 13:49:44.501193278 -0500\n+++ commands/user/user.drush.inc\t2010-06-24 14:18:14.000000000 -0500\n@@ -0,0 +1,548 @@\n+ 'drush_user_information',\n+ 'description' => 'Print information about the specified user(s).',\n+ 'aliases' => array('uinf'),\n+ 'examples' => array(\n+ 'drush user-information 2,3,someguy,somegal,billgates@microsoft.com' => \n+ 'Display information about any users with uids, names, or mail addresses matching the strings between commas.',\n+ ),\n+ 'arguments' => array(\n+ 'users' => 'A comma delimited list of uids, user names, or email addresses.',\n+ ),\n+ 'options' => array(\n+ '--full' => 'show extended information about the user',\n+ '--short' => 'show basic information about the user (this is the default)',\n+ ),\n+ );\n+ $items['user-block'] = array(\n+ 'callback' => 'drush_user_block',\n+ 'description' => 'Block the specified user(s).',\n+ 'aliases' => array('ublk'),\n+ 'arguments' => array(\n+ 'users' => 'A comma delimited list of uids, user names, or email addresses.',\n+ ),\n+ 'examples' => array(\n+ 'drush user-block 5,user3 --uid=2,3 --name=someguy,somegal --mail=billgates@microsoft.com' => \n+ 'Block the users with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com',\n+ ),\n+ 'options' => array(\n+ '--uid' => 'A comma delimited list of uids to block',\n+ '--name' => 'A comma delimited list of user names to block',\n+ '--mail' => 'A comma delimited list of user mail addresses to block',\n+ ),\n+ );\n+ $items['user-unblock'] = array(\n+ 'callback' => 'drush_user_unblock',\n+ 'description' => 'Unblock the specified user(s).',\n+ 'aliases' => array('uublk'),\n+ 'arguments' => array(\n+ 'users' => 'A comma delimited list of uids, user names, or email addresses.',\n+ ),\n+ 'examples' => array(\n+ 'drush user-unblock 5,user3 --uid=2,3 --name=someguy,somegal --mail=billgates@microsoft.com' => \n+ 'Unblock the users with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com',\n+ ),\n+ 'options' => array(\n+ '--uid' => 'A comma delimited list of uids to unblock',\n+ '--name' => 'A comma delimited list of user names to unblock',\n+ '--mail' => 'A comma delimited list of user mail addresses to unblock',\n+ ),\n+ );\n+ $items['user-add-role'] = array(\n+ 'callback' => 'drush_user_add_role',\n+ 'description' => 'Add a role to the specified user accounts.',\n+ 'aliases' => array('urol'),\n+ 'arguments' => array(\n+ 'role' => 'The name of the role to add',\n+ 'users' => '(optional) A comma delimited list of uids, user names, or email addresses.',\n+ ),\n+ 'examples' => array(\n+ 'drush user-add-role \"power user\" 5,user3 --uid=2,3 --name=someguy,somegal --mail=billgates@microsoft.com' => \n+ 'Add the \"power user\" role to the accounts with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com',\n+ ),\n+ 'options' => array(\n+ '--uid' => 'A comma delimited list of uids',\n+ '--name' => 'A comma delimited list of user names',\n+ '--mail' => 'A comma delimited list of user mail addresses',\n+ ),\n+ );\n+ $items['user-remove-role'] = array(\n+ 'callback' => 'drush_user_remove_role',\n+ 'description' => 'Remove a role from the specified user accounts.',\n+ 'aliases' => array('urrol'),\n+ 'arguments' => array(\n+ 'role' => 'The name of the role to remove',\n+ 'users' => '(optional) A comma delimited list of uids, user names, or email addresses.',\n+ ),\n+ 'examples' => array(\n+ 'drush user-remove-role \"power user\" 5,user3 --uid=2,3 --name=someguy,somegal --mail=billgates@microsoft.com' => \n+ 'Remove the \"power user\" role from the accounts with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com',\n+ ),\n+ 'options' => array(\n+ '--uid' => 'A comma delimited list of uids',\n+ '--name' => 'A comma delimited list of user names',\n+ '--mail' => 'A comma delimited list of user mail addresses',\n+ ),\n+ );\n+ $items['user-create'] = array(\n+ 'callback' => 'drush_user_create',\n+ 'description' => 'Create a user account with the specified name.',\n+ 'aliases' => array('ucrt'),\n+ 'arguments' => array(\n+ 'name' => 'The name of the account to add'\n+ ),\n+ 'examples' => array(\n+ 'drush user-create newuser --mail=\"person@example.com\" --password=\"letmein\"' => \n+ 'Create a new user account with the name newuser, the email address person@example.com, and the password letmein',\n+ ),\n+ 'options' => array(\n+ '--password' => 'The password for the new account',\n+ '--mail' => 'The email address for the new account',\n+ ),\n+ );\n+ $items['user-cancel'] = array(\n+ 'callback' => 'drush_user_cancel',\n+ 'description' => 'Cancel a user account with the specified name.',\n+ 'aliases' => array('ucan'),\n+ 'arguments' => array(\n+ 'name' => 'The name of the account to cancel',\n+ ),\n+ 'examples' => array(\n+ 'drush user-cancel username' => \n+ 'Cancel the user account with the name username and anonymize all content created by that user.',\n+ ),\n+ );\n+ $items['user-password'] = array(\n+ 'callback' => 'drush_user_password',\n+ 'description' => '(Re)Set the password for the user account with the specified name.',\n+ 'aliases' => array('upwd'),\n+ 'arguments' => array(\n+ 'name' => 'The name of the account to modify'\n+ ),\n+ 'options' => array(\n+ '--password' => '(required) The new password for the account',\n+ ),\n+ 'examples' => array(\n+ 'drush user-password someuser --password=\"gr3@tP@$s\"' => \n+ 'Set the password for the username someuser to gr3@tP@$s.',\n+ ),\n+ );\n+\n+ // Drupal 7 only options.\n+ if (drush_drupal_major_version() >= 7) {\n+ $items['user-cancel']['options'] = array(\n+ 'delete-content' => 'Delete all content created by the user',\n+ );\n+ $items['user-cancel']['examples']['drush user-cancel --delete-content=true username'] = \n+ 'Cancel the user account with the name username and delete all content created by that user.';\n+ }\n+ return $items;\n+}\n+\n+// Implementation of hook_drush_init().\n+function user_drush_init() {\n+ $command_info = drush_get_command();\n+ $command = $command_info['command'];\n+ $needs_parse_args = array('user-block', 'user-unblock', 'user-add-role', 'user-remove-role');\n+ if (in_array($command, $needs_parse_args)) {\n+ // parse args and call drush_set_option for --uids\n+ $users = array();\n+ foreach (array('uid', 'name', 'mail' ) as $user_attr) {\n+ if ($arg = drush_get_option($user_attr)) {\n+ foreach(explode(',', $arg) as $search) {\n+ $uid_query = FALSE;\n+ switch ($user_attr) {\n+ case 'uid':\n+ if (drush_drupal_major_version() >= 7) {\n+ $uid_query = db_query(\"SELECT uid FROM {users} WHERE uid = :uid\", array(':uid' => $search));\n+ }\n+ else {\n+ $uid_query = db_query(\"SELECT uid FROM {users} WHERE uid = %d\", $search);\n+ }\n+ break;\n+ case 'name':\n+ if (drush_drupal_major_version() >= 7) {\n+ $uid_query = db_query(\"SELECT uid FROM {users} WHERE name = :name\", array(':name' => $search));\n+ }\n+ else {\n+ $uid_query = db_query(\"SELECT uid FROM {users} WHERE name = '%s'\", $search);\n+ }\n+ break;\n+ case 'mail':\n+ if (drush_drupal_major_version() >= 7) {\n+ $uid_query = db_query(\"SELECT uid FROM {users} WHERE mail = :mail\", array(':mail' => $search));\n+ }\n+ else {\n+ $uid_query = db_query(\"SELECT uid FROM {users} WHERE mail = '%s'\", $search);\n+ }\n+ break;\n+ }\n+ if ($uid_query !== FALSE) {\n+ if ($uid = drush_db_result($uid_query)) {\n+ $users[] = $uid;\n+ }\n+ else {\n+ drush_set_error(\"Could not find a uid for $user_attr = $search\");\n+ }\n+ }\n+ }\n+ }\n+ }\n+ if (!empty($users)) {\n+ drush_set_option('uids', $users);\n+ }\n+ }\n+}\n+\n+/**\n+ * Prints information about the specified user(s).\n+ */\n+function drush_user_information($users) {\n+ $users = explode(',', $users);\n+ foreach($users as $user) {\n+ $uid = _drush_user_get_uid($user); \n+ if ($uid !== FALSE) {\n+ _drush_user_print_info($uid);\n+ }\n+ }\n+}\n+\n+/**\n+ * Block the specified user(s).\n+ */\n+function drush_user_block($users = '') {\n+ $uids = drush_get_option('uids');\n+ if ($users !== '') {\n+ $users = explode(',', $users);\n+ foreach($users as $user) {\n+ $uid = _drush_user_get_uid($user); \n+ if ($uid !== FALSE) {\n+ $uids[] = $uid;\n+ }\n+ }\n+ }\n+ if (!empty($uids)) {\n+ user_user_operations_block($uids);\n+ }\n+ else {\n+ return drush_set_error(\"Could not find any valid uids!\");\n+ }\n+}\n+\n+/**\n+ * Unblock the specified user(s).\n+ */\n+function drush_user_unblock($users = '') {\n+ $uids = drush_get_option('uids');\n+ if ($users !== '') {\n+ $users = explode(',', $users);\n+ foreach($users as $user) {\n+ $uid = _drush_user_get_uid($user); \n+ if ($uid !== FALSE) {\n+ $uids[] = $uid;\n+ }\n+ }\n+ }\n+ if (!empty($uids)) {\n+ user_user_operations_unblock($uids);\n+ }\n+ else {\n+ return drush_set_error(\"Could not find any valid uids!\");\n+ }\n+}\n+\n+/**\n+ * Add a role to the specified user accounts.\n+ */\n+function drush_user_add_role($role, $users = '') {\n+ $uids = drush_get_option('uids');\n+ if ($users !== '') {\n+ $users = explode(',', $users);\n+ foreach($users as $user) {\n+ $uid = _drush_user_get_uid($user); \n+ if ($uid !== FALSE) {\n+ $uids[] = $uid;\n+ }\n+ }\n+ }\n+ if (drush_drupal_major_version() >= 7) {\n+ $rid_query = db_query(\"SELECT rid FROM {role} WHERE name = :role\", array(':role' => $role));\n+ }\n+ else {\n+ $rid_query = db_query(\"SELECT rid FROM {role} WHERE name = '%s'\", $role);\n+ }\n+ if (!empty($uids)) {\n+ if ($rid = drush_db_result($rid_query)) {\n+ user_multiple_role_edit($uids, 'add_role', $rid);\n+ foreach($uids as $uid) {\n+ drush_log(dt(\"Added the %role role to uid %uid\", array('%role' => $role, '%uid' => $uid)), 'success');\n+ }\n+ }\n+ else {\n+ return drush_set_error(\"There is no role named: \\\"$role\\\"!\");\n+ }\n+ }\n+ else {\n+ return drush_set_error(\"Could not find any valid uids!\");\n+ }\n+}\n+\n+/**\n+ * Remove a role from the specified user accounts.\n+ */\n+function drush_user_remove_role($role, $users = '') {\n+ $uids = drush_get_option('uids');\n+ if ($users !== '') {\n+ $users = explode(',', $users);\n+ foreach($users as $user) {\n+ $uid = _drush_user_get_uid($user); \n+ if ($uid !== FALSE) {\n+ $uids[] = $uid;\n+ }\n+ }\n+ }\n+ if (drush_drupal_major_version() >= 7) {\n+ $rid_query = db_query(\"SELECT rid FROM {role} WHERE name = :role\", array(':role' => $role));\n+ }\n+ else {\n+ $rid_query = db_query(\"SELECT rid FROM {role} WHERE name = '%s'\", $role);\n+ }\n+ if (!empty($uids)) {\n+ if ($rid = drush_db_result($rid_query)) {\n+ user_multiple_role_edit($uids, 'remove_role', $rid);\n+ foreach($uids as $uid) {\n+ drush_log(dt(\"Removed the %role role from uid %uid\", array('%role' => $role, '%uid' => $uid)), 'success');\n+ }\n+ }\n+ else {\n+ return drush_set_error(\"There is no role named: \\\"$role\\\"!\");\n+ }\n+ }\n+ else {\n+ return drush_set_error(\"Could not find any valid uids!\");\n+ }\n+}\n+\n+/**\n+ * Creates a new user account.\n+ */\n+function drush_user_create($name) {\n+ $mail = drush_get_option('mail');\n+ $pass = drush_get_option('password');\n+ $new_user = array(\n+ 'name' => $name,\n+ 'pass' => $pass,\n+ 'mail' => $mail,\n+ 'access' => '0',\n+ 'status' => 1,\n+ );\n+ if (drush_drupal_major_version() >= 7) {\n+ $result = db_query(\"SELECT uid FROM {users} WHERE name = :name OR mail = :mail\", array(':name' => $name, ':mail' => $new_user['mail']));\n+ }\n+ else {\n+ $result = db_query(\"SELECT uid FROM {users} WHERE name = '%s' OR mail = '%s'\", $name, $new_user['mail']);\n+ }\n+ if (drush_db_result($result) === FALSE) {\n+ $new_user_object = user_save(NULL, $new_user, NULL);\n+ if ($new_user_object !== FALSE) {\n+ _drush_user_print_info($new_user_object->uid);\n+ }\n+ else {\n+ drush_set_error(\"Could not create a new user account with the name \" . $name . \"!\");\n+ }\n+ }\n+ else {\n+ drush_set_error(\"There is already a user account with the name \" . $name . \" or email address \" . $new_user['mail'] . \"!\");\n+ }\n+}\n+\n+/**\n+ * Cancels a user account.\n+ */\n+function drush_user_cancel($name) {\n+ if (drush_drupal_major_version() >= 7) {\n+ $result = db_query(\"SELECT uid FROM {users} WHERE name = :name\", array(':name' => $name));\n+ }\n+ else {\n+ $result = db_query(\"SELECT uid FROM {users} WHERE name = '%s'\", $name);\n+ }\n+ $uid = drush_db_result($result);\n+ if ($uid !== FALSE) {\n+ drush_print(\"Cancelling the user account with the following information:\");\n+ _drush_user_print_info($uid);\n+ if (drush_get_option('delete-content') && drush_drupal_major_version() >= 7) {\n+ drush_print(\"All content created by this user will be deleted!\");\n+ }\n+ if (drush_confirm('Cancel user account?: ')) {\n+ if (drush_drupal_major_version() >= 7) {\n+ if (drush_get_option('delete-content')) {\n+ user_cancel(array(), $uid, 'user_cancel_delete');\n+ }\n+ else {\n+ user_cancel(array(), $uid, 'user_cancel_reassign');\n+ }\n+ // I got the following technique here: https://drupal.org/node/638712\n+ $batch =& batch_get();\n+ $batch['progressive'] = FALSE;\n+ batch_process();\n+ }\n+ else {\n+ user_delete(array(), $uid);\n+ }\n+ }\n+ }\n+ else {\n+ drush_set_error(\"Could not find a user account with the name \" . $name . \"!\");\n+ }\n+}\n+\n+/**\n+ * Sets the password for the account with the given username\n+ */\n+function drush_user_password($name) {\n+ $pass = drush_get_option('password');\n+ if (empty($pass)) {\n+ return drush_set_error(\"You must specify a password!\");\n+ }\n+ if (drush_drupal_major_version() >= 7) {\n+ $result = db_query(\"SELECT uid, name FROM {users} WHERE name = :name\", array(':name' => $name));\n+ $userinfo = drush_db_fetch_object($result);\n+ if ($userinfo->name != $name) return drush_set_error(\"Could not find a user with the name '\" . $name . \"'!\");\n+ $user = user_load(drush_db_result($result));\n+ }\n+ else {\n+ $user = user_load(array('name' => $name));\n+ }\n+ if ($user !== FALSE) {\n+ $user_object = user_save($user, array('pass' => $pass));\n+ if ($user_object === FALSE) {\n+ drush_set_error(\"Could not change the password for the user account with the name \" . $name . \"!\");\n+ }\n+ }\n+ else {\n+ drush_set_error(\"The user account with the name \" . $name . \" could not be loaded!\");\n+ }\n+}\n+\n+/**\n+ * Print information about a given uid\n+ */\n+function _drush_user_print_info($uid) {\n+ if (drush_drupal_major_version() >= 7) {\n+ $userinfo = user_load($uid);\n+ }\n+ else {\n+ $userinfo = user_load(array('uid' => $uid));\n+ }\n+ if (drush_get_option('full')) {\n+ $userinfo = (array)$userinfo;\n+ $userinfo_pipe = array();\n+ unset($userinfo['data']);\n+ unset($userinfo['block']);\n+ unset($userinfo['form_build_id']);\n+ foreach($userinfo as $key => $val) {\n+ if (is_array($val)) {\n+ drush_print($key . ': ');\n+ drush_print_r($val);\n+ $userinfo_pipe[] = '\"' . implode(\",\", $val) . '\"';\n+ }\n+ else {\n+ if ($key === 'created' OR $key === 'access' OR $key === 'login') {\n+ drush_print($key . ': ' . format_date($val));\n+ $userinfo_pipe[] = $val;\n+ }\n+ else {\n+ drush_print($key . ': ' . $val);\n+ $userinfo_pipe[] = $val;\n+ }\n+ }\n+ }\n+ drush_print_pipe(implode(\",\", $userinfo_pipe));\n+ drush_print_pipe(\"\\n\");\n+ }\n+ else {\n+ $userinfo_short = array(\n+ 'User ID' => $userinfo->uid,\n+ 'User name' => $userinfo->name,\n+ 'User mail' => $userinfo->mail,\n+ );\n+ $userinfo_short['User roles'] = implode(', ', $userinfo->roles);\n+ $userinfo->status ? $userinfo_short['User status'] = 'active' : $userinfo_short['User status'] = 'blocked';\n+ drush_print_table(drush_key_value_to_array_table($userinfo_short));\n+ drush_print_pipe(\"$userinfo->name, $userinfo->uid, $userinfo->mail, $userinfo->status, \\\"\" . implode(', ', $userinfo->roles) . \"\\\"\\n\");\n+ }\n+}\n+\n+/**\n+ * Get uid(s) from a uid, user name, or email address.\n+ * Returns a uid, or FALSE if none found.\n+ */\n+function _drush_user_get_uid($search) {\n+ // We use a DB query while looking for the uid to keep things speedy.\n+ $uids = array();\n+ if (is_numeric($search)) {\n+ if (drush_drupal_major_version() >= 7) {\n+ $uid_query = db_query(\"SELECT uid, name FROM {users} WHERE uid = :uid OR name = :name\", array(':uid' => $search, ':name' => $search));\n+ }\n+ else {\n+ $uid_query = db_query(\"SELECT uid, name FROM {users} WHERE uid = %d OR name = '%d'\", $search, $search);\n+ }\n+ }\n+ else {\n+ if (drush_drupal_major_version() >= 7) {\n+ $uid_query = db_query(\"SELECT uid, name FROM {users} WHERE mail = :mail OR name = :name\", array(':mail' => $search, ':name' => $search));\n+ }\n+ else {\n+ $uid_query = db_query(\"SELECT uid, name FROM {users} WHERE mail = '%s' OR name = '%s'\", $search, $search);\n+ }\n+ }\n+ while ($uid = drush_db_fetch_object($uid_query)) {\n+ $uids[$uid->uid] = $uid->name;\n+ }\n+ switch (count($uids)) {\n+ case 0:\n+ return drush_set_error(\"Could not find a uid for the search term '\" . $search . \"'!\");\n+ break;\n+ case 1:\n+ return array_pop(array_keys($uids));\n+ break;\n+ default:\n+ drush_print('More than one user account was found for the search string \"' . $search . '\".');\n+ return(drush_choice($uids, 'Please choose a name:', '!value (uid=!key)'));\n+ }\n+}\n" }, { "path": "aegir/patches/videola.patch", "content": "diff -urp a/videola.info b/videola.info\n--- a/videola.info\t2011-06-15 10:17:14.000000000 +0000\n+++ b/videola.info\t2011-07-01 13:15:48.000000000 +0000\n@@ -119,7 +119,7 @@ dependencies[] = jquery_ui\n dependencies[] = jquery_update\n dependencies[] = vertical_tabs\n dependencies[] = better_formats\n-dependencies[] = bueditor\n+;dependencies[] = bueditor\n \n \n ; Other\n@@ -132,7 +132,7 @@ dependencies[] = commentmail\n dependencies[] = context\n dependencies[] = context_ui\n dependencies[] = date\n-dependencies[] = devel\n+;dependencies[] = devel\n dependencies[] = diff\n dependencies[] = features\n dependencies[] = flag\n@@ -154,6 +154,11 @@ dependencies[] = strongarm\n dependencies[] = term_node_count\n dependencies[] = token\n \n+; o_contrib\n+dependencies[] = cache\n+dependencies[] = path_alias_cache\n+dependencies[] = filefield_nginx_progress\n+\n ; Videola\n dependencies[] = videola_core\n dependencies[] = videola_video\n@@ -197,6 +202,8 @@ users[superduper][status] = 1\n variables[site_name] = Videola\n variables[site_mail] = testing@testing.com\n variables[site_frontpage] = videola-front\n+variables[admin_theme] = rubik\n+variables[node_admin_theme] = 1\n \n variables[pathauto_node_pattern] = 0\n variables[pathauto_node_videola_video_pattern] = videos/[title-raw]\ndiff -urp a/videola.profile b/videola.profile\n--- a/videola.profile\t2011-06-15 10:17:14.000000000 +0000\n+++ b/videola.profile\t2011-07-01 12:47:56.000000000 +0000\n@@ -67,7 +67,12 @@ function videola_profile_tasks(&$task, $\n profiler_profile_tasks(profiler_v2_load_config('videola'), $task, $url);\n // Profiler stets the $task to 'profile-finished', in order to add our own\n // tasks we need to override that and set it to our task.\n- $task = 'videola';\n+ if (defined('DRUSH_BASE_PATH')) {\n+ $task = 'profile-finished'; // Required to support Aegir.\n+ }\n+ else {\n+ $task = 'videola';\n+ }\n }\n \n if ($task == 'videola') {\n" }, { "path": "aegir/patches/views-853864_2.patch", "content": "Index: includes/cache.inc\n===================================================================\nRCS file: /cvs/drupal-contrib/contributions/modules/views/includes/cache.inc,v\nretrieving revision 1.25.2.4\ndiff -u -p -r1.25.2.4 cache.inc\n--- includes/cache.inc\t12 Mar 2010 01:51:47 -0000\t1.25.2.4\n+++ includes/cache.inc\t4 Jan 2011 12:16:36 -0000\n@@ -100,20 +100,64 @@ function _views_discover_default_views()\n static $cache = NULL;\n \n if (!isset($cache)) {\n+ $lock_name = __FUNCTION__;\n $index = views_cache_get('views_default_views_index', TRUE);\n \n+ $rebuild_cache = TRUE;\n // Retrieve each cached default view\n if (isset($index->data) && is_array($index->data)) {\n+ $rebuild_cache = FALSE;\n $cache = array();\n foreach ($index->data as $view_name) {\n- $data = views_cache_get('views_default:' . $view_name, TRUE);\n- if (isset($data->data) && is_object($data->data)) {\n- $cache[$view_name] = $data->data;\n+ $cid = 'views_default:' . $view_name;\n+ if ($cached = views_cache_get($cid, TRUE)) {\n+ $cache[$view_name] = $cached->data;\n+ }\n+ else {\n+ // As soon as there is a cache miss on one item, try to acquire a\n+ // lock.\n+ if (!$lock_acquired = lock_acquire($lock_name)) {\n+ lock_wait($lock_name);\n+ // After waiting, try to fetch the default view from cache again.\n+ // If available another process may have rebuilt it, so do not\n+ // attempt to rebuild the cache.\n+ if ($cached = views_cache_get($cid, TRUE)) {\n+ $cache[$view_name] = $cached->data;\n+ }\n+ // If the item is still not in the cache, try to acquire the lock\n+ // again and rebuild the cache.\n+ else {\n+ $lock_acquired = lock_acquire($lock_name);\n+ $rebuild_cache = TRUE;\n+ break;\n+ }\n+ }\n+ // If the lock was acquired, always rebuild the cache.\n+ else {\n+ $rebuild_cache = TRUE;\n+ break;\n+ }\n }\n }\n }\n- // If missing index, rebuild the cache\n else {\n+ if (!$lock_acquired = lock_acquire($lock_name)) {\n+ lock_wait($lock_name);\n+ if ($cached = views_cache_get('views_default_views_index', TRUE)) {\n+ // Another process has rebuilt the cache while we waited. Re-run the\n+ // function to avoid a full cache rebuild.\n+ $cache = _views_discover_default_views();\n+ $rebuild_cache = FALSE;\n+ }\n+ else {\n+ // Try to re-acquire the lock and re-build the cache either way.\n+ lock_acquire($lock_name);\n+ $rebuild_cache = TRUE;\n+ }\n+ }\n+ }\n+ // Rebuild the cache if necessary.\n+ if ($rebuild_cache) {\n views_include_default_views();\n $cache = array();\n \n@@ -139,13 +183,16 @@ function _views_discover_default_views()\n // Allow modules to modify default views before they are cached.\n drupal_alter('views_default_views', $cache);\n \n- // Cache the index\n- $index = array_keys($cache);\n- views_cache_set('views_default_views_index', $index, TRUE);\n-\n- // Cache each view\n- foreach ($cache as $name => $view) {\n- views_cache_set('views_default:' . $name, $view, TRUE);\n+ if (!empty($lock_acquired)) {\n+ // Cache the index\n+ $index = array_keys($cache);\n+ views_cache_set('views_default_views_index', $index, TRUE);\n+\n+ // Cache each view\n+ foreach ($cache as $name => $view) {\n+ views_cache_set('views_default:' . $name, $view, TRUE);\n+ }\n+ lock_release($lock_name);\n }\n }\n }\n" }, { "path": "aegir/patches/views-exposed-sorts-2037469-1.patch", "content": "diff --git a/plugins/views_plugin_exposed_form.inc b/plugins/views_plugin_exposed_form.inc\nindex 5d54600..1d19ed1 100644\n--- a/plugins/views_plugin_exposed_form.inc\n+++ b/plugins/views_plugin_exposed_form.inc\n@@ -220,17 +220,24 @@ class views_plugin_exposed_form extends views_plugin {\n }\n \n if (count($exposed_sorts)) {\n+ if (isset($form_state['input']['sort_by']) && isset($this->view->sort[$form_state['input']['sort_by']])) {\n+ $default_sort_order = $form_state['input']['sort_by'];\n+ } else {\n+ $first_sort = reset($this->view->sort);\n+ $default_sort_order = $first_sort->options['order'];\n+ }\n $form['sort_by'] = array(\n '#type' => 'select',\n '#options' => $exposed_sorts,\n '#title' => $this->options['exposed_sorts_label'],\n+ '#default_value' => $default_sort_order,\n );\n $sort_order = array(\n 'ASC' => $this->options['sort_asc_label'],\n 'DESC' => $this->options['sort_desc_label'],\n );\n if (isset($form_state['input']['sort_by']) && isset($this->view->sort[$form_state['input']['sort_by']])) {\n- $default_sort_order = $this->view->sort[$form_state['input']['sort_by']]->options['order'];\n+ $default_sort_order = $form_state['input']['sort_order'];\n } else {\n $first_sort = reset($this->view->sort);\n $default_sort_order = $first_sort->options['order'];\n" }, { "path": "aegir/patches/views-revert-broken-filter-or-groups-1766338-7.patch", "content": "diff --git a/modules/field/views_handler_filter_field_list.inc b/modules/field/views_handler_filter_field_list.inc\nindex 440d55b..b955e70 100644\n--- a/modules/field/views_handler_filter_field_list.inc\n+++ b/modules/field/views_handler_filter_field_list.inc\n@@ -10,21 +10,7 @@\n *\n * @ingroup views_filter_handlers\n */\n-class views_handler_filter_field_list extends views_handler_filter_many_to_one {\n-\n- function init(&$view, &$options) {\n- parent::init($view, $options);\n- // Migrate the settings from the old filter_in_operator values to filter_many_to_one.\n- if ($this->options['operator'] == 'in') {\n- $this->options['operator'] = 'or';\n- }\n- if ($this->options['operator'] == 'not in') {\n- $this->options['operator'] = 'not';\n- }\n- $this->operator = $this->options['operator'];\n- }\n-\n-\n+class views_handler_filter_field_list extends views_handler_filter_in_operator {\n function get_value_options() {\n $field = field_info_field($this->definition['field_name']);\n $this->value_options = list_allowed_values($field);\n" }, { "path": "aegir/patches/views-unpack_options-cache-6.2-51.patch", "content": "diff --git a/plugins/views_plugin_display.inc b/plugins/views_plugin_display.inc\nindex 3c47037..a66c3c0 100644\n--- a/plugins/views_plugin_display.inc\n+++ b/plugins/views_plugin_display.inc\n@@ -39,7 +39,28 @@ class views_plugin_display extends views_plugin {\n unset($options['defaults']);\n }\n \n- $this->unpack_options($this->options, $options);\n+ // Cache for unpack_options, but not if we are in the ui.\n+ static $unpack_options = array();\n+ if (empty($view->editing)) {\n+ $cid = 'unpack_options:' . md5(serialize(array($this->options, $options)));\n+ if (empty($unpack_options[$cid])) {\n+ $cache = views_cache_get($cid, TRUE);\n+ if (!empty($cache->data)) {\n+ $this->options = $cache->data;\n+ }\n+ else {\n+ $this->unpack_options($this->options, $options);\n+ views_cache_set($cid, $this->options, TRUE);\n+ }\n+ $unpack_options[$cid] = $this->options;\n+ }\n+ else {\n+ $this->options = $unpack_options[$cid];\n+ }\n+ }\n+ else {\n+ $this->unpack_options($this->options, $options);\n+ }\n }\n \n function destroy() {\n" }, { "path": "aegir/scripts/AegirSetupA.sh.txt", "content": "#!/bin/bash\n\n\n###----------------------------------------###\n###\n### Octopus Ægir Installer\n###\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n### This program is free software. You can\n### redistribute it and/or modify it under\n### the terms of the GNU GPL as published by\n### the Free Software Foundation, version 2\n### or later.\n###\n### This program is distributed in the hope\n### that it will be useful, but WITHOUT ANY\n### WARRANTY; without even the implied\n### warranty of MERCHANTABILITY or FITNESS\n### FOR A PARTICULAR PURPOSE. See the GNU GPL\n### for more details.\n###\n### You should have received a copy of the\n### GNU GPL along with this program.\n### If not, see http://www.gnu.org/licenses/\n###\n### Code: https://github.com/omega8cc/boa\n###\n###----------------------------------------###\n\n\n###----------------------------------------###\n### DON'T EDIT ANYTHING BELOW THIS LINE ###\n###----------------------------------------###\n\n\n###\n### Helper variables\n###\n_bldPth=\"/opt/tmp/boa\"\n_crlGet=\"-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab\"\n_wgetGet=\"--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'\"\n_filIncO=\"octopus.sh.cnf\"\n_gCb=\"git clone --branch\"\n_gitHub=\"https://github.com/omega8cc\"\n_gitLab=\"https://gitlab.com/omega8cc\"\n_libFnc=\"${_bldPth}/lib/functions\"\n_tocIncO=\"${_filIncO}.$1\"\n_vBs=\"/var/backups\"\n_vSet=\"variable-set --always-set\"\nexport _tRee=dev\n\n\n###\n### Panic on missing include\n###\n_panic_exit() {\n echo\n echo \" EXIT: Required lib file not available?\"\n echo \" EXIT: $1\"\n echo \" EXIT: Cannot continue\"\n echo \" EXIT: Bye (0)\"\n echo\n touch /opt/tmp/status-AegirSetupA-FAIL\n exit 1\n}\n\n\n###\n### Include helper functions\n###\nif [ -e \"${_vBs}/${_tocIncO}\" ]; then\n source \"${_vBs}/${_tocIncO}\"\n _tInc=\"${_vBs}/${_tocIncO}\"\nelif [ -e \"${_vBs}/${_filIncO}\" ]; then\n source \"${_vBs}/${_filIncO}\"\n _tInc=\"${_vBs}/${_filIncO}\"\nelse\n _panic_exit \"${_tInc}\"\nfi\n\n\n###\n### Env debugging\n###\nif [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo DEBUG AegirSetupA\n echo DEBUG AegirSetupA\n echo Effective _USER is $1\n [ -r \"${_vBs}/${_tocIncO}\" ] && echo Effective _tocIncO is ${_tocIncO}\n echo DEBUG AegirSetupA\n echo DEBUG AegirSetupA\n env\n echo DEBUG AegirSetupA\n echo DEBUG AegirSetupA\nfi\n\n\n###\n### More helper variables\n###\nexport _urlDev=\"http://${_USE_MIR}/dev\"\nexport _urlHmr=\"http://${_USE_MIR}/versions/${_tRee}/boa/aegir\"\n\n\n###\n### Include shared functions\n###\n_FL=\"helper satellite\"\nfor f in ${_FL}; do\n [ -r \"${_libFnc}/${f}.sh.inc\" ] || _panic_exit \"${f}\"\n source \"${_libFnc}/${f}.sh.inc\"\ndone\n\n\n###\n### Local variables\n###\nif [ \"${_THIS_DB_HOST}\" = \"FQDN\" ]; then\n _THIS_DB_HOST=\"$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\nfi\n_DIST_INSTALL=NO\n_STATUS=INIT\n_LOCAL_STATUS=\"${_STATUS}\"\n_ROOT=\"/data/disk/${_USER}\"\n_HM_ROOT=\"${_ROOT}/aegir/distro/${_HM_DISTRO}\"\n_DISTRO_ROOT=\"${_ROOT}/distro/${_DISTRO}\"\n_D=\"/data/all\"\n_SRCDIR=\"/opt/tmp/files\"\nif [ \"${_PHP_CLI_VERSION}\" = \"8.5\" ] \\\n && [ -x \"/opt/php85/bin/php\" ]; then\n _T_CLI=/opt/php85/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.4\" ] \\\n && [ -x \"/opt/php84/bin/php\" ]; then\n _T_CLI=/opt/php84/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.3\" ] \\\n && [ -x \"/opt/php83/bin/php\" ]; then\n _T_CLI=/opt/php83/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.2\" ] \\\n && [ -x \"/opt/php82/bin/php\" ]; then\n _T_CLI=/opt/php82/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.1\" ] \\\n && [ -x \"/opt/php81/bin/php\" ]; then\n _T_CLI=/opt/php81/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.0\" ] \\\n && [ -x \"/opt/php80/bin/php\" ]; then\n _T_CLI=/opt/php80/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.4\" ] \\\n && [ -x \"/opt/php74/bin/php\" ]; then\n _T_CLI=/opt/php74/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.3\" ] \\\n && [ -x \"/opt/php73/bin/php\" ]; then\n _T_CLI=/opt/php73/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.2\" ] \\\n && [ -x \"/opt/php72/bin/php\" ]; then\n _T_CLI=/opt/php72/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.1\" ] \\\n && [ -x \"/opt/php71/bin/php\" ]; then\n _T_CLI=/opt/php71/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.0\" ] \\\n && [ -x \"/opt/php70/bin/php\" ]; then\n _T_CLI=/opt/php70/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"5.6\" ] \\\n && [ -x \"/opt/php56/bin/php\" ]; then\n _T_CLI=/opt/php56/bin\nfi\n_DRUSHCMD=\"${_T_CLI}/php ${_ROOT}/tools/drush/drush.php\"\nPATH=${_T_CLI}:/usr/local/bin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin\nSHELL=/bin/bash\n\n\n###\n### Status check and update on the fly\n###\nif [ -e \"${_ROOT}/aegir.sh\" ]; then\n _STATUS=UPGRADE\n cd ${_ROOT}\n rm -f ${_ROOT}/AegirSetupC.sh.txt*\n rm -f ${_ROOT}/AegirSetupB.sh.txt*\n _LOCAL_STATUS=\"${_STATUS}\"\nfi\n\n\n###\n### User check\n###\nif [ \"$(id -u)\" -eq 0 ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"${_STATUS} A: Ægir automated install script part A\"\n fi\nelse\n _msg \"${_STATUS} A: FATAL ERROR: This script should be run as a root user\"\n _msg \"${_STATUS} A: FATAL ERROR: Aborting AegirSetupA installer NOW!\"\n touch /opt/tmp/status-AegirSetupA-FAIL\n exit 1\nfi\n\n\n###\n### Run key pre/child/post procedures\n###\n_satellite_hot_sauce_check\n_satellite_add_user_dirs\n_satellite_if_add_snail_access\n_satellite_prepare_child_scripts\n_satellite_run_pre_install\nif [ \"${_OS_CODE}\" = \"excalibur\" ]; then\n _DB_SERVER=Percona\nelse\n _DB_SERVER=Percona\nfi\nif [ \"$(boa info | grep -c ${_DB_SERVER})\" -lt 3 ] || [ ! -e \"/usr/sbin/csf\" ]; then\n if [ ! -e \"/opt/tmp/make_local/hostmaster/hostmaster.make\" ] \\\n || [ ! -e \"/opt/tmp/make_local/hosting/server/hosting_server.install\" ] \\\n || [ ! -e \"/opt/tmp/make_local/drupal/includes/database/mysql/schema.inc\" ]; then\n _satellite_download_for_local_build\n fi\nelse\n _satellite_download_for_local_build\nfi\n_satellite_run_child_b\n\n\n###\n### Run accelerated tasks queue\n###\nif [ -e \"/var/xdrago/run-${_USER}\" ]; then\n _msg \"${_STATUS} A: Ægir accelerated task queue will run for 60 seconds...\"\n su -s /bin/bash - ${_USER} -c \"drush8 @hostmaster ${_vSet} hosting_queue_tasks_items 3\" &> /dev/null\n _msg \"${_STATUS} A: Please wait...\"\n for _iteration in {1..10}; do\n nohup /var/xdrago/run-${_USER} > /dev/null 2>&1 &\n sleep 5\n done\nfi\nsu -s /bin/bash - ${_USER} -c \"drush8 @hostmaster ${_vSet} hosting_queue_tasks_items 1\" &> /dev/null\n\n\n###\n### Run more pre/child/post procedures\n###\n_satellite_if_create_local_bin\n_satellite_run_post_install\n_satellite_set_permissions_for_all\n_satellite_run_child_c\n_satellite_child_scripts_cleanup\n_satellite_if_add_ftps_lshell_access\n_satellite_if_add_update_user_symlinks\n_satellite_if_add_update_user_dot_dirs\n_satellite_if_read_create_pass_txt\n_satellite_if_add_update_user_platforms_symlinks\n_satellite_if_add_update_backend_user_dirs_files_clean\n[ ! -e \"/root/.silent.update.cnf\" ] && _satellite_prepare_setup_email_tpl\n[ ! -e \"/root/.silent.update.cnf\" ] && _satellite_send_welcome_email\n_satellite_letsencrypt_vhost_setup\n_satellite_log_update\n_satellite_batch_cleanup\n_satellite_display_url_finalize\n\n\n###----------------------------------------###\n###\n### Octopus Ægir Installer\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n###----------------------------------------###\n" }, { "path": "aegir/scripts/AegirSetupB.sh.txt", "content": "#!/bin/bash\n\n\n###----------------------------------------###\n###\n### Octopus Ægir Installer\n###\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n### This program is free software. You can\n### redistribute it and/or modify it under\n### the terms of the GNU GPL as published by\n### the Free Software Foundation, version 2\n### or later.\n###\n### This program is distributed in the hope\n### that it will be useful, but WITHOUT ANY\n### WARRANTY; without even the implied\n### warranty of MERCHANTABILITY or FITNESS\n### FOR A PARTICULAR PURPOSE. See the GNU GPL\n### for more details.\n###\n### You should have received a copy of the\n### GNU GPL along with this program.\n### If not, see http://www.gnu.org/licenses/\n###\n### Code: https://github.com/omega8cc/boa\n###\n###----------------------------------------###\n\n\n###----------------------------------------###\n### DON'T EDIT ANYTHING BELOW THIS LINE ###\n###----------------------------------------###\n\n\n###\n### Helper variables\n###\n_bldPth=\"/opt/tmp/boa\"\n_crlGet=\"-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab\"\n_wgetGet=\"--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'\"\n_filIncO=\"octopus.sh.cnf\"\n_gCb=\"git clone --branch\"\n_gitHub=\"https://github.com/omega8cc\"\n_gitLab=\"https://gitlab.com/omega8cc\"\n_libFnc=\"${_bldPth}/lib/functions\"\n_tocIncO=\"${_filIncO}.$1\"\n_vBs=\"/var/backups\"\n_vSet=\"variable-set --always-set\"\nexport _tRee=dev\n\n\n###\n### Panic on missing include\n###\n_panic_exit() {\n echo\n echo \" EXIT: Required lib file not available?\"\n echo \" EXIT: $1\"\n echo \" EXIT: Cannot continue\"\n echo \" EXIT: Bye (0)\"\n echo\n touch /opt/tmp/status-AegirSetupB-FAIL\n exit 1\n}\n\n\n###\n### Include helper functions\n###\nif [ -e \"${_vBs}/${_tocIncO}\" ]; then\n source \"${_vBs}/${_tocIncO}\"\n _tInc=\"${_vBs}/${_tocIncO}\"\nelif [ -e \"${_vBs}/${_filIncO}\" ]; then\n source \"${_vBs}/${_filIncO}\"\n _tInc=\"${_vBs}/${_filIncO}\"\nelse\n _panic_exit \"${_tInc}\"\nfi\n\n\n###\n### Env debugging\n###\nif [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo DEBUG AegirSetupB\n echo DEBUG AegirSetupB\n echo Effective _USER is $1\n [ -r \"${_vBs}/${_tocIncO}\" ] && echo Effective _tocIncO is ${_tocIncO}\n echo DEBUG AegirSetupB\n echo DEBUG AegirSetupB\n env\n echo DEBUG AegirSetupB\n echo DEBUG AegirSetupB\nfi\n\n\n###\n### More helper variables\n###\nexport _urlDev=\"http://${_USE_MIR}/dev\"\nexport _urlHmr=\"http://${_USE_MIR}/versions/${_tRee}/boa/aegir\"\n\n\n###\n### Include shared functions\n###\n_FL=\"helper satellite\"\nfor f in ${_FL}; do\n [ -r \"${_libFnc}/${f}.sh.inc\" ] || _panic_exit \"${f}\"\n source \"${_libFnc}/${f}.sh.inc\"\ndone\n\n\n###\n### Local variables\n###\nif [ \"${_THIS_DB_HOST}\" = \"FQDN\" ]; then\n _THIS_DB_HOST=\"$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\nfi\n_DIST_INSTALL=NO\n_STATUS=INIT\n_LOCAL_STATUS=\"${_STATUS}\"\n_ROOT=\"/data/disk/${_USER}\"\n_HM_ROOT=\"${_ROOT}/aegir/distro/${_HM_DISTRO}\"\n_DISTRO_ROOT=\"${_ROOT}/distro/${_DISTRO}\"\n_PREV_HM_ROOT=\"${_ROOT}/aegir/distro/${_LAST_HMR}\"\n_D=\"/data/all\"\n_SRCDIR=\"/opt/tmp/files\"\nif [ \"${_PHP_CLI_VERSION}\" = \"8.5\" ] \\\n && [ -x \"/opt/php85/bin/php\" ]; then\n _T_CLI=/opt/php85/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.4\" ] \\\n && [ -x \"/opt/php84/bin/php\" ]; then\n _T_CLI=/opt/php84/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.3\" ] \\\n && [ -x \"/opt/php83/bin/php\" ]; then\n _T_CLI=/opt/php83/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.2\" ] \\\n && [ -x \"/opt/php82/bin/php\" ]; then\n _T_CLI=/opt/php82/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.1\" ] \\\n && [ -x \"/opt/php81/bin/php\" ]; then\n _T_CLI=/opt/php81/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.0\" ] \\\n && [ -x \"/opt/php80/bin/php\" ]; then\n _T_CLI=/opt/php80/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.4\" ] \\\n && [ -x \"/opt/php74/bin/php\" ]; then\n _T_CLI=/opt/php74/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.3\" ] \\\n && [ -x \"/opt/php73/bin/php\" ]; then\n _T_CLI=/opt/php73/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.2\" ] \\\n && [ -x \"/opt/php72/bin/php\" ]; then\n _T_CLI=/opt/php72/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.1\" ] \\\n && [ -x \"/opt/php71/bin/php\" ]; then\n _T_CLI=/opt/php71/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.0\" ] \\\n && [ -x \"/opt/php70/bin/php\" ]; then\n _T_CLI=/opt/php70/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"5.6\" ] \\\n && [ -x \"/opt/php56/bin/php\" ]; then\n _T_CLI=/opt/php56/bin\nfi\n_DRUSHCMD=\"${_T_CLI}/php ${_ROOT}/tools/drush/drush.php\"\nPATH=${_T_CLI}:/usr/local/bin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin\nSHELL=/bin/bash\n\n\n###\n### Status check and update on the fly\n###\nif [ -e \"${_ROOT}/aegir.sh\" ]; then\n _STATUS=UPGRADE\n cd ${_ROOT}\nfi\n\n\n###\n### User check\n###\nif [ \"$(id -u)\" -eq 0 ]; then\n _msg \"${_STATUS} B: FATAL ERROR: This script should be run as a non-root user\"\n _msg \"${_STATUS} B: FATAL ERROR: Aborting AegirSetupB installer NOW!\"\n touch /opt/tmp/status-AegirSetupB-FAIL\n exit 1\nelse\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"${_STATUS} B: Ægir automated install script part B\"\n fi\nfi\n\n\n###\n### Run all child B procedures\n###\n_satellite_child_b_prepare_dirs_permissions\n_satellite_child_b_install_drush\n_satellite_child_b_drush_xts_cleanup\n_satellite_child_b_drush_xts_install\n_satellite_child_b_drush_test\n_satellite_child_b_aegir_build\n_satellite_child_b_aegir_health_check\n_satellite_child_b_letsencrypt\n_satellite_child_b_aegir_ui_enhance\n_satellite_child_b_vhosts_hotfix\n_satellite_child_b_symlink_global_inc\n_satellite_child_b_redis_enable_finalize\n\n\n###----------------------------------------###\n###\n### Octopus Ægir Installer\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n###----------------------------------------###\n" }, { "path": "aegir/scripts/AegirSetupC.sh.txt", "content": "#!/bin/bash\n\n\n###----------------------------------------###\n###\n### Octopus Ægir Installer\n###\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n### This program is free software. You can\n### redistribute it and/or modify it under\n### the terms of the GNU GPL as published by\n### the Free Software Foundation, version 2\n### or later.\n###\n### This program is distributed in the hope\n### that it will be useful, but WITHOUT ANY\n### WARRANTY; without even the implied\n### warranty of MERCHANTABILITY or FITNESS\n### FOR A PARTICULAR PURPOSE. See the GNU GPL\n### for more details.\n###\n### You should have received a copy of the\n### GNU GPL along with this program.\n### If not, see http://www.gnu.org/licenses/\n###\n### Code: https://github.com/omega8cc/boa\n###\n###----------------------------------------###\n\n\n###----------------------------------------###\n### DON'T EDIT ANYTHING BELOW THIS LINE ###\n###----------------------------------------###\n\n\n###\n### Helper variables\n###\nexport _bldPth=\"/opt/tmp/boa\"\nexport _crlGet=\"-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab\"\nexport _wgetGet=\"--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'\"\nexport _filIncO=\"octopus.sh.cnf\"\nexport _gCb=\"git clone --branch\"\nexport _gitHub=\"https://github.com/omega8cc\"\nexport _gitLab=\"https://gitlab.com/omega8cc\"\nexport _libFnc=\"${_bldPth}/lib/functions\"\nexport _tocIncO=\"${_filIncO}.$1\"\nexport _vBs=\"/var/backups\"\nexport _vSet=\"variable-set --always-set\"\nexport _tRee=dev\n\n\n###\n### Panic on missing include\n###\n_panic_exit() {\n echo\n echo \" EXIT: Required lib file not available?\"\n echo \" EXIT: $1\"\n echo \" EXIT: Cannot continue\"\n echo \" EXIT: Bye (0)\"\n echo\n touch /opt/tmp/status-AegirSetupC-FAIL\n exit 1\n}\n\n\n###\n### Include helper functions\n###\nif [ -e \"${_vBs}/${_tocIncO}\" ]; then\n source \"${_vBs}/${_tocIncO}\"\n _tInc=\"${_vBs}/${_tocIncO}\"\nelif [ -e \"${_vBs}/${_filIncO}\" ]; then\n source \"${_vBs}/${_filIncO}\"\n _tInc=\"${_vBs}/${_filIncO}\"\nelse\n _panic_exit \"${_tInc}\"\nfi\n\n\n###\n### Env debugging\n###\nif [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo DEBUG AegirSetupC\n echo DEBUG AegirSetupC\n echo Effective _USER is $1\n [ -r \"${_vBs}/${_tocIncO}\" ] && echo Effective _tocIncO is ${_tocIncO}\n echo DEBUG AegirSetupC\n echo DEBUG AegirSetupC\n env\n echo DEBUG AegirSetupC\n echo DEBUG AegirSetupC\nfi\n\n\n###\n### More helper variables\n###\nexport _urlDev=\"http://${_USE_MIR}/dev\"\nexport _urlHmr=\"http://${_USE_MIR}/versions/${_tRee}/boa/aegir\"\n\n\n###\n### Include shared functions\n###\n_FL=\"helper satellite\"\nfor f in ${_FL}; do\n [ -r \"${_libFnc}/${f}.sh.inc\" ] || _panic_exit \"${f}\"\n source \"${_libFnc}/${f}.sh.inc\"\ndone\n\n\n###\n### Local variables\n###\nif [ \"${_THIS_DB_HOST}\" = \"FQDN\" ]; then\n export _THIS_DB_HOST=\"$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\nfi\nexport _USE_AEGIR_VER=SRC\nexport _T_BUILD=SRC\nexport _DIST_INSTALL=NO\nexport _STATUS=INIT\nexport _USE_DISTRO_CORE=NO\nexport _LOCAL_STATUS=\"${_STATUS}\"\nexport _ROOT=\"/data/disk/${_USER}\"\nexport _HM_ROOT=\"${_ROOT}/aegir/distro/${_HM_DISTRO}\"\nexport _DISTRO_ROOT=\"${_ROOT}/distro/${_DISTRO}\"\nexport _PREV_HM_ROOT=\"${_ROOT}/aegir/distro/${_LAST_HMR}\"\nexport _D=\"/data/all\"\nexport _SRCDIR=\"/opt/tmp/files\"\n\nif [ \"${_PHP_CLI_VERSION}\" = \"8.5\" ] \\\n && [ -x \"/opt/php85/bin/php\" ]; then\n _T_CLI=/opt/php85/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.4\" ] \\\n && [ -x \"/opt/php84/bin/php\" ]; then\n _T_CLI=/opt/php84/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.3\" ] \\\n && [ -x \"/opt/php83/bin/php\" ]; then\n _T_CLI=/opt/php83/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.2\" ] \\\n && [ -x \"/opt/php82/bin/php\" ]; then\n _T_CLI=/opt/php82/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.1\" ] \\\n && [ -x \"/opt/php81/bin/php\" ]; then\n _T_CLI=/opt/php81/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.0\" ] \\\n && [ -x \"/opt/php80/bin/php\" ]; then\n _T_CLI=/opt/php80/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.4\" ] \\\n && [ -x \"/opt/php74/bin/php\" ]; then\n _T_CLI=/opt/php74/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.3\" ] \\\n && [ -x \"/opt/php73/bin/php\" ]; then\n _T_CLI=/opt/php73/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.2\" ] \\\n && [ -x \"/opt/php72/bin/php\" ]; then\n _T_CLI=/opt/php72/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.1\" ] \\\n && [ -x \"/opt/php71/bin/php\" ]; then\n _T_CLI=/opt/php71/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"7.0\" ] \\\n && [ -x \"/opt/php70/bin/php\" ]; then\n _T_CLI=/opt/php70/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"5.6\" ] \\\n && [ -x \"/opt/php56/bin/php\" ]; then\n _T_CLI=/opt/php56/bin\nfi\nexport _DRUSHCMD=\"${_T_CLI}/php ${_ROOT}/tools/drush/drush.php\"\n#\nexport PATH=${_T_CLI}:/usr/local/bin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin\nexport SHELL=/bin/bash\n#\nexport _pthPch=\"/opt/tmp/boa/aegir/patches\"\nexport _urlDrp=\"http://ftp.drupal.org/files/projects\"\nexport _urlPrt=\"https://drupal.org/project\"\n#\nexport _noT=\"not installed\"\nexport _yOk=\"installation in progress...\"\n\n\n###---### Checking status.\n#\nif [ -e \"${_ROOT}/log/setupmail.txt\" ] \\\n || [ -e \"${_ROOT}/log/legacy_setupmail.txt\" ] \\\n || [ -e \"${_ROOT}/log/latest_setupmail.txt\" ]; then\n _STATUS=UPGRADE\n cd ${_ROOT}\nfi\n\n\n###---### User check.\n#\nif [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"${_STATUS} C: Ægir automated install script part C\"\nfi\nif [ \"$(id -u)\" -eq 0 ]; then\n _msg \"${_STATUS} C: FATAL ERROR: This script should be run as a non-root user\"\n _msg \"${_STATUS} C: FATAL ERROR: Aborting AegirSetupC installer NOW!\"\n touch /opt/tmp/status-AegirSetupC-FAIL\n exit 1\nfi\n\n\n###---### Hot Sauce check.\n#\nif [ \"${_HOT_SAUCE}\" = \"NO\" ]; then\n export _CORE=\"/data/all/${_LAST_ALL}\"\n export _THIS_CORE=\"${_LAST_ALL}\"\n if [ \"${_USE_CURRENT}\" = \"YES\" ] \\\n && [ -e \"/data/all/000/core-v-${_SMALLCORE6_V}.txt\" ] \\\n && [ -e \"/data/all/000/core-v-${_SMALLCORE7_V}.txt\" ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"${_STATUS} C: Shared platforms code v.${_LAST_ALL} will be used\"\n fi\n elif [ \"${_USE_CURRENT}\" = \"NO\" ] \\\n || [ ! -e \"/data/all/000/core-v-${_SMALLCORE6_V}.txt\" ] \\\n || [ ! -e \"/data/all/000/core-v-${_SMALLCORE7_V}.txt\" ]; then\n export _CORE=\"/data/all/${_ALL_DISTRO}\"\n export _THIS_CORE=\"${_ALL_DISTRO}\"\n _msg \"${_STATUS} C: Shared platforms code v.${_ALL_DISTRO} (new) will be created\"\n else\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"${_STATUS} C: Shared platforms code v.${_LAST_ALL} will be used\"\n fi\n fi\nelse\n export _CORE=\"/data/all/${_ALL_DISTRO}\"\n export _THIS_CORE=\"${_ALL_DISTRO}\"\n _msg \"${_STATUS} C: Shared platforms code v.${_ALL_DISTRO} (new) will be created\"\nfi\nexport _D6_CORE_DIR=\"/data/all/000/core/${_DRUPAL6}\"\nexport _D7_CORE_DIR=\"/data/all/000/core/${_DRUPAL7}\"\n\nexport _pthDst=\"${_ROOT}/distro/${_THIS_CORE}\"\n\nmkdir -p ${_pthDst}\nchmod 0711 ${_ROOT}/distro &> /dev/null\nchmod 0711 ${_pthDst} &> /dev/null\n\n###---###\nexport _ALLOW_ALL=YES\nif [ \"${_CLIENT_CORES}\" -lt 1 ]; then\n _ALLOW_ALL=NO\n _D_8_ALLOW=NO\nfi\n\n\n###\n###---### Functions.\n###\n\n#\n# Prepare for Save & Verify Platforms.\n_prepare_for_save_verify_platforms() {\n _LOCAL_STATUS=\"NOT_SET\"\n if [ \"${_LOCAL_STATUS}\" = \"INIT\" ]; then\n _THIS_HM=\"${_HM_ROOT}/sites/${_DOMAIN}\"\n else\n if [ -e \"${_ROOT}/.drush/hostmaster.alias.drushrc.php\" ]; then\n _THIS_HM=$(cat ${_ROOT}/.drush/hostmaster.alias.drushrc.php \\\n | grep 'site_path' \\\n | cut -d: -f2 \\\n | awk '{ print $3}' 2>&1)\n _THIS_HM=$(echo ${_THIS_HM} | sed \"s/[\\,']//g\" 2>&1)\n else\n _THIS_HM=\"${_HM_ROOT}/sites/${_DOMAIN}\"\n fi\n fi\n if [ ! -d \"${_THIS_HM}\" ]; then\n _THIS_HM=\"${_PREV_HM_ROOT}/sites/${_DOMAIN}\"\n fi\n if [ -d \"${_THIS_HM}\" ] && [ ! -e \"${_THIS_HM}/make_platform.php\" ]; then\n cp -af /opt/tmp/boa/aegir/helpers/make_platform.php.txt ${_THIS_HM}/make_platform.php\n fi\n if [ \"${_SERIES_RESULT}\" = \"OK\" ]; then\n export _drhSrc=\"sites/all/drush/drushrc.php\"\n else\n export _drhSrc=\"drushrc.php\"\n fi\n}\n\n#\n# Save & Verify Platform\n_save_verify_this_platform() {\n\n # Declare 'params' as local to the function\n local -A params=(\n [dist]=\"$1\"\n [version]=\"$2\"\n [core_version]=\"$3\"\n [description]=\"$4\"\n [profile_path]=\"$5\"\n [profile_name]=\"$6\"\n [web_dir]=\"$7\"\n [php_version]=\"$8\"\n [url]=\"$9\"\n )\n\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"DEBUG: _save_verify_this_platform\"\n for key in \"${!params[@]}\"; do\n _msg \"DEBUG: _save_verify_this_platform ${key} is '${params[$key]}'\"\n done\n fi\n\n # _save_verify_this_platform \"${1}\" \"${_SHRD_PLNAME}\" \"${3}\" \"${params[description]} [P.${_THIS_CORE}]\" \"${5}\" \"${6}\" \"${7}\"\n # _save_verify_this_platform \"${1}\" \"${2}\" \"${3}\" \"${_DIST_PLNAME}\" \"${5}\" \"${6}\" \"${7}\"\n\n # _save_verify_this_platform 'OCS' '2.2.1' '10.3.6' 'openculturas-2.2.1-10.3.6' 'contrib/' 'openculturas' '/web'\n # make_platform 'ezcontent-2.2.15-10.3.6' ezcontent /data/disk/o8/distro/001/ezcontent-2.2.15-10.3.6/web\n # make_platform 'commerce_base-2.40-10.1.8' commerce_base /data/disk/o8/distro/001/commerce_base-2.40-10.1.8/web\n _make_p=\"${_pthDst}/${params[profile_name]}-${params[version]}-${params[core_version]}${params[web_dir]}\"\n\n # _save_verify_this_platform 'UC7' '3.13' '7.105.1' 'ubercart-3.13-7.105.1' '/' 'minimal' ''\n _make_u=\"${_pthDst}/ubercart-${params[version]}-${params[core_version]}${params[web_dir]}\"\n\n # _save_verify_this_platform 'DX3' '10.3.6' '10.3.6' 'drupal-10.3.6-dev' '/' 'standard' '/web'\n # /data/disk/o8/distro/001/drupal-10.3.6-prod\n _make_x=\"${_pthDst}/${params[version]}${params[web_dir]}\"\n\n if [ -d \"${_make_p}\" ]; then\n if [ ! -e \"${_make_p}/${_drhSrc}\" ]; then\n if [ -d \"${_THIS_HM}\" ] && [ -e \"${_THIS_HM}/make_platform.php\" ]; then\n cd ${_THIS_HM}\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: ${_DRUSHCMD} php-script make_platform '${4}' ${6} ${_make_p}\"\n ${_DRUSHCMD} php-script make_platform \"${4}\" ${6} ${_make_p} &> /dev/null\n fi\n fi\n elif [ -d \"${_make_u}\" ]; then\n if [ ! -e \"${_make_u}/${_drhSrc}\" ]; then\n if [ -d \"${_THIS_HM}\" ] && [ -e \"${_THIS_HM}/make_platform.php\" ]; then\n cd ${_THIS_HM}\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: ${_DRUSHCMD} php-script make_platform '${4}' ${6} ${_make_u}\"\n ${_DRUSHCMD} php-script make_platform \"${4}\" ${6} ${_make_u} &> /dev/null\n fi\n fi\n elif [ -d \"${_make_x}\" ]; then\n if [ ! -e \"${_make_x}/${_drhSrc}\" ]; then\n if [ -d \"${_THIS_HM}\" ] && [ -e \"${_THIS_HM}/make_platform.php\" ]; then\n cd ${_THIS_HM}\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: ${_DRUSHCMD} php-script make_platform '${4}' ${6} ${_make_x}\"\n ${_DRUSHCMD} php-script make_platform \"${4}\" ${6} ${_make_x} &> /dev/null\n fi\n fi\n fi\n}\n\n#\n# Download and extract from core archive.\n_get_core_ext() {\n if [ ! -z \"$1\" ]; then\n _max_attempts=10\n _attempt_num=1\n _success=0\n while [ ${_attempt_num} -le ${_max_attempts} ]; do\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DNLD: Attempt ${_attempt_num} of ${_max_attempts}: Downloading $1...\"\n if curl ${_crlGet} \"http://${_USE_MIR}/core/$1\" -o \"$1\"; then\n _success=1\n break\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DNLD: Attempt ${_attempt_num} failed.\"\n _attempt_num=$((_attempt_num+1))\n if [ \"${_attempt_num}\" -le \"${_max_attempts}\" ]; then\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DNLD: Retrying in 9 seconds...\"\n sleep 9\n fi\n fi\n done\n if [ \"${_success}\" -eq 1 ]; then\n _extract_archive \"$1\"\n else\n _msg \"OOPS: Failed to download http://${_USE_MIR}/core/$1 after ${_max_attempts} attempts\"\n return 1 # Exit the function but continue the script\n fi\n fi\n}\n\n#\n# Download and extract from distro archive.\n_get_distro_ext() {\n if [ ! -z \"$1\" ]; then\n _max_attempts=10\n _attempt_num=1\n _success=0\n while [ ${_attempt_num} -le ${_max_attempts} ]; do\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DNLD: Attempt ${_attempt_num} of ${_max_attempts}: Downloading $1...\"\n if curl ${_crlGet} \"http://${_USE_MIR}/distro/$1\" -o \"$1\"; then\n _success=1\n break\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DNLD: Attempt ${_attempt_num} failed.\"\n _attempt_num=$((_attempt_num+1))\n if [ \"${_attempt_num}\" -le \"${_max_attempts}\" ]; then\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DNLD: Retrying in 9 seconds...\"\n sleep 9\n fi\n fi\n done\n if [ \"${_success}\" -eq 1 ]; then\n _extract_archive \"$1\"\n else\n _msg \"OOPS: Failed to download http://${_USE_MIR}/distro/$1 after ${_max_attempts} attempts\"\n return 1 # Exit the function but continue the script\n fi\n fi\n}\n\n#\n# Create standard directories.\n_fix_dirs_files() {\n rm -f ./*.txt\n rm -f ./modules/*.txt\n rm -f ./themes/*.txt\n rm -rf ./modules/cookie_cache_bypass\n mkdir -p ./sites/default/files\n mkdir -p ./cache/{normal,perm}\n chmod -R 777 ./cache\n if [ -e \"./sites/default/default.settings.php\" ]; then\n cp -af ./sites/default/default.settings.php ./sites/default/settings.php\n fi\n chmod a+rw ./sites/default/settings.php\n chmod a+rwx ./sites/default/files\n mkdir -p ./profiles\n mkdir -p ./sites/all/{modules,libraries,themes}\n rm -f ./core/modules/*.txt\n rm -f ./core/themes/*.txt\n rm -f ./modules/*.txt\n rm -f ./themes/*.txt\n rm -f ./sites/all/*.txt\n echo empty > ./profiles/EMPTY.txt\n echo empty > ./sites/all/EMPTY.txt\n echo empty > ./sites/all/modules/EMPTY.txt\n echo empty > ./sites/all/libraries/EMPTY.txt\n echo empty > ./sites/all/themes/EMPTY.txt\n chmod 0755 ./profiles &> /dev/null\n chmod 0755 ./sites\n chmod 0755 ./sites/all\n chmod 02775 ./sites/all/{modules,libraries,themes}\n cp -af /opt/tmp/boa/aegir/conf/var/get.htaccess.txt ./.htaccess\n cp -af /opt/tmp/boa/aegir/conf/var/crossdomain.xml ./\n}\n\n#\n# Create D6 symlinks.\n_create_d6_symlinks() {\n if [ ! -L \"includes\" ]; then\n ln -sfn ${_D6_CORE_DIR}/.htaccess .htaccess\n ln -sfn ${_D6_CORE_DIR}/boost_stats.php boost_stats.php\n ln -sfn ${_D6_CORE_DIR}/cron.php cron.php\n ln -sfn ${_D6_CORE_DIR}/crossdomain.xml crossdomain.xml\n ln -sfn ${_D6_CORE_DIR}/includes includes\n ln -sfn ${_D6_CORE_DIR}/index.php index.php\n ln -sfn ${_D6_CORE_DIR}/install.php install.php\n ln -sfn ${_D6_CORE_DIR}/js.php js.php\n ln -sfn ${_D6_CORE_DIR}/misc misc\n ln -sfn ${_D6_CORE_DIR}/modules modules\n ln -sfn ${_D6_CORE_DIR}/themes themes\n ln -sfn ${_D6_CORE_DIR}/update.php update.php\n ln -sfn ${_D6_CORE_DIR}/xmlrpc.php xmlrpc.php\n cp -af ${_D6_CORE_DIR}/sites ./\n fi\n if [ ! -L \"${_OCTO_PLPATH}/profiles\" ] && [ -d \"${_SHRD_PLPATH}/profiles\" ]; then\n rm -rf ${_OCTO_PLPATH}/profiles\n ln -sfn ${_SHRD_PLPATH}/profiles ${_OCTO_PLPATH}/profiles\n fi\n}\n\n#\n# Create D7 symlinks.\n_create_d7_symlinks() {\n if [ ! -L \"web.config\" ]; then\n ln -sfn ${_D7_CORE_DIR}/.htaccess .htaccess\n ln -sfn ${_D7_CORE_DIR}/authorize.php authorize.php\n ln -sfn ${_D7_CORE_DIR}/cron.php cron.php\n ln -sfn ${_D7_CORE_DIR}/crossdomain.xml crossdomain.xml\n ln -sfn ${_D7_CORE_DIR}/includes includes\n ln -sfn ${_D7_CORE_DIR}/index.php index.php\n ln -sfn ${_D7_CORE_DIR}/install.php install.php\n ln -sfn ${_D7_CORE_DIR}/js.php js.php\n ln -sfn ${_D7_CORE_DIR}/misc misc\n ln -sfn ${_D7_CORE_DIR}/modules modules\n ln -sfn ${_D7_CORE_DIR}/themes themes\n ln -sfn ${_D7_CORE_DIR}/update.php update.php\n ln -sfn ${_D7_CORE_DIR}/web.config web.config\n ln -sfn ${_D7_CORE_DIR}/xmlrpc.php xmlrpc.php\n cp -af ${_D7_CORE_DIR}/sites ./\n fi\n if [ ! -L \"${_OCTO_PLPATH}/profiles\" ] && [ -d \"${_SHRD_PLPATH}/profiles\" ]; then\n rm -rf ${_OCTO_PLPATH}/profiles\n ln -sfn ${_SHRD_PLPATH}/profiles ${_OCTO_PLPATH}/profiles\n fi\n}\n\n#\n# Create distro own D7 core symlinks.\n_create_distro_d7_symlinks() {\n if [ ! -L \"web.config\" ]; then\n if [ ! -f \"${_SHRD_PLPATH}/crossdomain.xml\" ]; then\n rm -f ${_SHRD_PLPATH}/crossdomain.xml\n cd ${_SHRD_PLPATH}\n _fix_dirs_files\n fi\n if [ ! -L \"${_SHRD_PLPATH}/modules/o_contrib_seven\" ]; then\n ln -sfn ${_CORE}/o_contrib_seven ${_SHRD_PLPATH}/modules/o_contrib_seven\n fi\n cd ${_OCTO_PLPATH}\n ln -sfn ${_SHRD_PLPATH}/.htaccess .htaccess\n ln -sfn ${_SHRD_PLPATH}/authorize.php authorize.php\n ln -sfn ${_SHRD_PLPATH}/cron.php cron.php\n ln -sfn ${_SHRD_PLPATH}/crossdomain.xml crossdomain.xml\n ln -sfn ${_SHRD_PLPATH}/includes includes\n ln -sfn ${_SHRD_PLPATH}/index.php index.php\n ln -sfn ${_SHRD_PLPATH}/install.php install.php\n ln -sfn ${_CORE}/o_contrib_seven/js/js.php js.php\n ln -sfn ${_SHRD_PLPATH}/misc misc\n ln -sfn ${_SHRD_PLPATH}/modules modules\n ln -sfn ${_SHRD_PLPATH}/themes themes\n ln -sfn ${_SHRD_PLPATH}/update.php update.php\n ln -sfn ${_SHRD_PLPATH}/web.config web.config\n ln -sfn ${_SHRD_PLPATH}/xmlrpc.php xmlrpc.php\n cp -af ${_SHRD_PLPATH}/sites ./\n fi\n if [ ! -L \"${_OCTO_PLPATH}/profiles\" ] && [ -d \"${_SHRD_PLPATH}/profiles\" ]; then\n rm -rf ${_OCTO_PLPATH}/profiles\n ln -sfn ${_SHRD_PLPATH}/profiles ${_OCTO_PLPATH}/profiles\n fi\n}\n\n#\n# Rename D7 profiles.\n_rename_drupal7_profiles() {\n for _Files in `find ./profiles -type f`; do\n sed -i \"s/name = Minimal/name = Vanilla Minimal/g\" ${_Files} &> /dev/null\n wait\n sed -i \"s/name = Standard/name = Vanilla Standard/g\" ${_Files} &> /dev/null\n wait\n sed -i \"s/name = Testing/name = Vanilla Testing/g\" ${_Files} &> /dev/null\n wait\n sed -i \"s/hidden = TRUE//g\" ${_Files} &> /dev/null\n wait\n done\n}\n\n#\n# Rename D9 profiles.\n_rename_drupal9_profiles() {\n for _Files in `find ./core/profiles -type f`; do\n sed -i \"s/name: Minimal/name: Vanilla Minimal/g\" ${_Files} &> /dev/null\n wait\n sed -i \"s/name: Standard/name: Vanilla Standard/g\" ${_Files} &> /dev/null\n wait\n sed -i \"s/name: Testing/name: Vanilla Testing/g\" ${_Files} &> /dev/null\n wait\n done\n}\n\n#\n# Prepare D6 core.\n_prepare_drupal6_core() {\n if [ ! -e \"${_D6_CORE_DIR}\" ]; then\n if [ -L \"${_D6_CORE_DIR}\" ]; then\n unlink ${_D6_CORE_DIR}\n fi\n cd /data/all/000/core\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _get_core_ext '${_DRUPAL6}.tar.gz'\"\n _get_core_ext \"${_DRUPAL6}.tar.gz\"\n find ${_D6_CORE_DIR} -type d -exec chmod 0755 {} \\; &> /dev/null\n find ${_D6_CORE_DIR} -type f -exec chmod 0644 {} \\; &> /dev/null\n cd ${_D6_CORE_DIR}/\n _fix_dirs_files\n patch -p0 < ${_pthPch}/taxonomy-6.26.patch &> /dev/null\n rm -f ${_D6_CORE_DIR}/modules/taxonomy/taxonomy.module.orig\n rm -f modules/o_contrib\n ln -sfn ${_CORE}/o_contrib modules/o_contrib\n ln -sfn ${_CORE}/o_contrib/js/js.php js.php\n cp -af ${_CORE}/o_contrib/image/image.imagemagick.inc includes/\n cp -af ${_CORE}/o_contrib/boost/stats/boost_stats.php ./ &> /dev/null\n rm -rf ${_D6_CORE_DIR}/scripts\n cd ${_D6_CORE_DIR}/themes\n _get_dev_contrib \"rubik-6.x-3.0-beta5.tar.gz\"\n _get_dev_contrib \"tao-6.x-3.3.tar.gz\"\n rm -f ${_D6_CORE_DIR}/sites/all/*.txt\n cd ${_CORE}\n fi\n}\n\n#\n# Prepare D7 core.\n_prepare_drupal7_core() {\n if [ ! -e \"${_D7_CORE_DIR}\" ]; then\n if [ -L \"${_D7_CORE_DIR}\" ]; then\n unlink ${_D7_CORE_DIR}\n fi\n cd /data/all/000/core\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _get_core_ext '${_DRUPAL7}.tar.gz'\"\n _get_core_ext \"${_DRUPAL7}.tar.gz\"\n find ${_D7_CORE_DIR} -type d -exec chmod 0755 {} \\; &> /dev/null\n find ${_D7_CORE_DIR} -type f -exec chmod 0644 {} \\; &> /dev/null\n cd ${_D7_CORE_DIR}/\n _fix_dirs_files\n _rename_drupal7_profiles\n patch -p0 < ${_pthPch}/taxonomy-7.12.patch &> /dev/null\n rm -f ${_D7_CORE_DIR}/modules/taxonomy/taxonomy.module.orig\n rm -f modules/o_contrib_seven\n ln -sfn ${_CORE}/o_contrib_seven modules/o_contrib_seven\n ln -sfn ${_CORE}/o_contrib_seven/js/js.php js.php\n rm -rf ${_D7_CORE_DIR}/scripts\n cd ${_D7_CORE_DIR}/themes\n _get_dev_contrib \"rubik-7.x-4.4.tar.gz\"\n _get_dev_contrib \"tao-7.x-3.1.tar.gz\"\n cd ${_CORE}\n fi\n}\n\n#\n# Remove D6 core from distro directory.\n_nocore_d6_dist_clean() {\n rm -f ${_SHRD_PLPATH}/.gitignore\n rm -f ${_SHRD_PLPATH}/.htaccess\n rm -f ${_SHRD_PLPATH}/*.php\n rm -f ${_SHRD_PLPATH}/*.txt\n rm -f ${_SHRD_PLPATH}/*.xml\n rm -rf ${_SHRD_PLPATH}/cache\n rm -rf ${_SHRD_PLPATH}/includes\n rm -rf ${_SHRD_PLPATH}/misc\n rm -rf ${_SHRD_PLPATH}/modules\n rm -rf ${_SHRD_PLPATH}/sites\n rm -rf ${_SHRD_PLPATH}/scripts\n rm -rf ${_SHRD_PLPATH}/themes\n if [ ! -d \"${_SHRD_PLPATH}/profiles\" ] && [ -d \"${_D6_CORE_DIR}/profiles\" ]; then\n rm -rf ${_SHRD_PLPATH}/profiles\n cp -af ${_D6_CORE_DIR}/profiles ${_SHRD_PLPATH}/\n fi\n sed -i \"s/'dblog'/'robotstxt', 'path_alias_cache'/g\" \\\n ${_SHRD_PRPATH}/${_REAL_PRNAME}.profile &> /dev/null\n}\n\n#\n# Remove D7 core from distro directory.\n_nocore_d7_dist_clean() {\n if [ \"${_USE_DISTRO_CORE}\" = \"NO\" ]; then\n rm -f ${_SHRD_PLPATH}/.gitignore\n rm -f ${_SHRD_PLPATH}/.htaccess\n rm -f ${_SHRD_PLPATH}/*.php\n rm -f ${_SHRD_PLPATH}/*.txt\n rm -f ${_SHRD_PLPATH}/*.xml\n rm -f ${_SHRD_PLPATH}/web.config\n rm -rf ${_SHRD_PLPATH}/cache\n rm -rf ${_SHRD_PLPATH}/includes\n rm -rf ${_SHRD_PLPATH}/misc\n rm -rf ${_SHRD_PLPATH}/modules\n rm -rf ${_SHRD_PLPATH}/sites\n rm -rf ${_SHRD_PLPATH}/scripts\n rm -rf ${_SHRD_PLPATH}/themes\n _REVISIONS=\"34 35 36 37 38 39\"\n for i in ${_REVISIONS}; do\n if [ -d \"${_CORE}/drupal-7.$i\" ] && [ ! -e \"${_SHRD_PLPATH}\" ]; then\n mv ${_CORE}/drupal-7.$i ${_SHRD_PLPATH}\n fi\n done\n if [ ! -d \"${_SHRD_PLPATH}/profiles\" ] && [ -d \"${_D7_CORE_DIR}/profiles\" ]; then\n rm -rf ${_SHRD_PLPATH}/profiles\n cp -af ${_D7_CORE_DIR}/profiles ${_SHRD_PLPATH}/\n fi\n fi\n}\n\n#\n# Enable D6 admin.\n_enable_drupal6_admin() {\n sed -i \"s/'path_alias_cache'/'path_alias_cache', 'admin'/g\" \\\n ${_SHRD_PRPATH}/${_REAL_PRNAME}.profile &> /dev/null\n}\n\n#\n# Remove default core seven profiles.\n_remove_default_core_seven_profiles() {\n rm -rf ${_SHRD_PLPATH}/profiles/minimal\n rm -rf ${_SHRD_PLPATH}/profiles/standard\n rm -rf ${_SHRD_PLPATH}/profiles/testing\n}\n\n#\n# Init this distro root.\n_init_this_distro_root() {\n mkdir -p ${_OCTO_PLPATH}\n cd ${_OCTO_PLPATH}\n if [[ \"${_USE_DISTRO_CORE}\" = \"YES\" ]]; then\n _create_distro_d7_symlinks\n else\n if [[ \"${_SHRD_PLNAME}\" =~ \"-${_SMALLCORE6_V}\" ]]; then\n _create_d6_symlinks\n elif [[ \"${_SHRD_PLNAME}\" =~ \"-${_SMALLCORE7_V}\" ]]; then\n _create_d7_symlinks\n fi\n fi\n}\n\n#\n# Upgrade contrib less.\n_upgrade_contrib_less() {\n if [ -e \"${_SHRD_PRPATH}/modules/contrib/rules_conditional\" ]; then\n rm -rf ${_SHRD_PRPATH}/modules/contrib/rules_conditional\n cd ${_SHRD_PRPATH}/modules/contrib\n _get_dev_contrib \"rules_conditional-7.x-1.x-dev.tar.gz\"\n if [ ! -e \"${_SHRD_PRPATH}/modules/contrib/rules_conditional\" ]; then\n _get_dev_contrib \"rules_conditional-7.x-1.x-dev.tar.gz\"\n fi\n cd ${_CORE}\n fi\n if [ -e \"${_SHRD_PRPATH}/modules/contrib/webform\" ]; then\n rm -rf ${_SHRD_PRPATH}/modules/contrib/webform\n cd ${_SHRD_PRPATH}/modules/contrib\n _get_dev_contrib \"webform-7.x-4.18.tar.gz\"\n if [ ! -e \"${_SHRD_PRPATH}/modules/contrib/webform\" ]; then\n _get_dev_contrib \"webform-7.x-4.18.tar.gz\"\n fi\n cd ${_CORE}\n fi\n if [ -e \"${_SHRD_PRPATH}/modules/contrib/panels\" ]; then\n rm -rf ${_SHRD_PRPATH}/modules/contrib/panels\n cd ${_SHRD_PRPATH}/modules/contrib\n _get_dev_contrib \"panels-7.x-3.8.tar.gz\"\n if [ ! -e \"${_SHRD_PRPATH}/modules/contrib/panels\" ]; then\n _get_dev_contrib \"panels-7.x-3.8.tar.gz\"\n fi\n cd ${_CORE}\n fi\n if [ -e \"${_SHRD_PRPATH}/modules/contrib/rules\" ]; then\n rm -rf ${_SHRD_PRPATH}/modules/contrib/rules\n cd ${_SHRD_PRPATH}/modules/contrib\n _get_dev_contrib \"rules-7.x-2.12.tar.gz\"\n if [ ! -e \"${_SHRD_PRPATH}/modules/contrib/rules\" ]; then\n _get_dev_contrib \"rules-7.x-2.12.tar.gz\"\n fi\n cd ${_CORE}\n fi\n if [ -e \"${_SHRD_PRPATH}/modules/rules\" ]; then\n rm -rf ${_SHRD_PRPATH}/modules/rules\n cd ${_SHRD_PRPATH}/modules\n _get_dev_contrib \"rules-7.x-2.12.tar.gz\"\n if [ ! -e \"${_SHRD_PRPATH}/modules/rules\" ]; then\n _get_dev_contrib \"rules-7.x-2.12.tar.gz\"\n fi\n cd ${_CORE}\n fi\n}\n\n# Create Drupal basic platform for versions 6 and 7.\n_create_drupal6_or_7_basic() {\n local version=\"$1\" # Accepts \"6\" or \"7\"\n if [ ! -d \"${_SHRD_PLPATH}\" ]; then\n mkdir -p \"${_SHRD_PLPATH}\"\n local core_dir_var=\"_D${version}_CORE_DIR\"\n local core_dir=\"${!core_dir_var}\"\n if [ ! -e \"${core_dir}\" ]; then\n local prepare_func=\"_prepare_drupal${version}_core\"\n if declare -f \"$prepare_func\" > /dev/null; then\n \"$prepare_func\"\n else\n echo \"Function $prepare_func does not exist.\"\n fi\n fi\n if [ \"$version\" = \"6\" ]; then\n cd \"${_CORE}\"\n _nocore_d6_dist_clean\n _enable_drupal6_admin\n elif [ \"$version\" = \"7\" ]; then\n _nocore_d7_dist_clean\n fi\n fi\n _init_this_distro_root\n}\n\n# Create Drupal basic platform for versions 9 and 10.x.\n_create_drupal_basic_version() {\n local version=\"$1\" # Accepts \"9\", \"10_0\", \"10_1\", etc.\n if [ ! -d \"${_OCTO_PLPATH}\" ]; then\n cd \"${_pthDst}\"\n local drupal_var=\"_DRUPAL${version}\"\n local drupal_version=\"${!drupal_var}\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _get_core_ext '${drupal_version}.tar.gz'\"\n _get_core_ext \"${drupal_version}.tar.gz\"\n mv -f \"${drupal_version}\" \"${_SHRD_PLNAME}\"\n if [ \"$version\" = \"9\" ]; then\n cd \"${_pthDst}/${_SHRD_PLNAME}/web\"\n _rename_drupal9_profiles\n fi\n fi\n}\n\n# Create Drupal core-only basic platform.\n_create_drupal_core_basic() {\n local version_code=\"$1\"\n case \"$version_code\" in\n \"DL6\")\n _create_drupal6_or_7_basic \"6\"\n ;;\n \"DL7\")\n _create_drupal6_or_7_basic \"7\"\n ;;\n \"DL9\")\n _create_drupal_basic_version \"9\"\n ;;\n \"DX0\")\n _create_drupal_basic_version \"10_0\"\n ;;\n \"DX1\")\n _create_drupal_basic_version \"10_1\"\n ;;\n \"DX2\")\n _create_drupal_basic_version \"10_2\"\n ;;\n \"DX3\")\n _create_drupal_basic_version \"10_3\"\n ;;\n \"DX4\")\n _create_drupal_basic_version \"10_4\"\n ;;\n \"DX5\")\n _create_drupal_basic_version \"10_5\"\n ;;\n \"DX6\")\n _create_drupal_basic_version \"10_6\"\n ;;\n \"DE1\")\n _create_drupal_basic_version \"11_1\"\n ;;\n \"DE2\")\n _create_drupal_basic_version \"11_2\"\n ;;\n \"DE3\")\n _create_drupal_basic_version \"11_3\"\n ;;\n *)\n echo \"Unsupported version code: $version_code\"\n ;;\n esac\n}\n\n# Define distros names and their key-words for configuration\ndeclare -A _distros_names=(\n [\"CMS\"]=\"Drupal CMS\"\n [\"CK1\"]=\"Commerce v.1\"\n [\"CK2\"]=\"Commerce v.2\"\n [\"CK3\"]=\"Commerce v.3\"\n [\"DXP\"]=\"DXPR Marketing\"\n [\"EZC\"]=\"EzContent\"\n [\"FOS\"]=\"farmOS\"\n [\"LGV\"]=\"LocalGov\"\n [\"OCS\"]=\"OpenCulturas\"\n [\"OFD\"]=\"OpenFed\"\n [\"OLS\"]=\"OpenLucius\"\n [\"OPG\"]=\"Opigno LMS\"\n [\"SCR\"]=\"Sector\"\n [\"SOC\"]=\"Social\"\n [\"THR\"]=\"Thunder\"\n [\"UC6\"]=\"Ubercart\"\n [\"UC7\"]=\"Ubercart\"\n [\"VB9\"]=\"Varbase\"\n [\"VBX\"]=\"Varbase\"\n [\"DL6\"]=\"Pressflow\"\n [\"DL7\"]=\"Drupal\"\n [\"DL9\"]=\"Drupal\"\n [\"DX0\"]=\"Drupal\"\n [\"DX1\"]=\"Drupal\"\n [\"DX2\"]=\"Drupal\"\n [\"DX3\"]=\"Drupal\"\n [\"DX4\"]=\"Drupal\"\n [\"DX5\"]=\"Drupal\"\n [\"DX6\"]=\"Drupal\"\n [\"DE1\"]=\"Drupal\"\n [\"DE2\"]=\"Drupal\"\n [\"DE3\"]=\"Drupal\"\n)\n\n# Define distros versions for configuration\ndeclare -A _distros_versions=(\n [\"CMS\"]=\"2.0.0\"\n [\"CK1\"]=\"2.77\"\n [\"CK2\"]=\"2.40\"\n [\"CK3\"]=\"3.2.0\"\n [\"DXP\"]=\"10.3.0\"\n [\"EZC\"]=\"2.2.15\"\n [\"FOS\"]=\"3.5.1\"\n [\"LGV\"]=\"3.4.0\"\n [\"OCS\"]=\"2.5.4\"\n [\"OFD\"]=\"12.2.4\"\n [\"OLS\"]=\"2.0.0\"\n [\"OPG\"]=\"3.1.0\"\n [\"SCR\"]=\"11.0.x-dev\"\n [\"SOC\"]=\"12.4.5\"\n [\"THR\"]=\"8.3.1\"\n [\"UC6\"]=\"2.15\"\n [\"UC7\"]=\"3.13\"\n [\"VB9\"]=\"9.1.13\"\n [\"VBX\"]=\"10.1.0\"\n [\"DL6\"]=\"${_SMALLCORE6_V}\"\n [\"DL7\"]=\"${_SMALLCORE7_V}\"\n [\"DL9\"]=\"${_SMALLCORE9_V}\"\n [\"DX0\"]=\"${_SMALLCORE10_0_V}\"\n [\"DX1\"]=\"${_SMALLCORE10_1_V}\"\n [\"DX2\"]=\"${_SMALLCORE10_2_V}\"\n [\"DX3\"]=\"${_SMALLCORE10_3_V}\"\n [\"DX4\"]=\"${_SMALLCORE10_4_V}\"\n [\"DX5\"]=\"${_SMALLCORE10_5_V}\"\n [\"DX6\"]=\"${_SMALLCORE10_6_V}\"\n [\"DE1\"]=\"${_SMALLCORE11_1_V}\"\n [\"DE2\"]=\"${_SMALLCORE11_2_V}\"\n [\"DE3\"]=\"${_SMALLCORE11_3_V}\"\n)\n\n# Define distros Drupal cores versions for configuration\ndeclare -A _distros_drupal_cores=(\n [\"CMS\"]=\"${_SMALLCORE11_3_V}\"\n [\"CK1\"]=\"${_SMALLCORE7_V}\"\n [\"CK2\"]=\"${_SMALLCORE10_1_V}\"\n [\"CK3\"]=\"${_SMALLCORE11_3_V}\"\n [\"DXP\"]=\"10.3.6\"\n [\"EZC\"]=\"10.3.6\"\n [\"FOS\"]=\"10.6.2\"\n [\"LGV\"]=\"${_SMALLCORE10_6_V}\"\n [\"OCS\"]=\"${_SMALLCORE10_5_V}\"\n [\"OFD\"]=\"10.2.10\"\n [\"OLS\"]=\"${_SMALLCORE9_V}\"\n [\"OPG\"]=\"${_SMALLCORE9_V}\"\n [\"SCR\"]=\"${_SMALLCORE11_3_V}\"\n [\"SOC\"]=\"10.2.10\"\n [\"THR\"]=\"${_SMALLCORE11_3_V}\"\n [\"UC6\"]=\"${_SMALLCORE6_V}\"\n [\"UC7\"]=\"${_SMALLCORE7_V}\"\n [\"VB9\"]=\"10.6.1\"\n [\"VBX\"]=\"11.3.1\"\n [\"DL6\"]=\"${_SMALLCORE6_V}\"\n [\"DL7\"]=\"${_SMALLCORE7_V}\"\n [\"DL9\"]=\"${_SMALLCORE9_V}\"\n [\"DX0\"]=\"${_SMALLCORE10_0_V}\"\n [\"DX1\"]=\"${_SMALLCORE10_1_V}\"\n [\"DX2\"]=\"${_SMALLCORE10_2_V}\"\n [\"DX3\"]=\"${_SMALLCORE10_3_V}\"\n [\"DX4\"]=\"${_SMALLCORE10_4_V}\"\n [\"DX5\"]=\"${_SMALLCORE10_5_V}\"\n [\"DX6\"]=\"${_SMALLCORE10_6_V}\"\n [\"DE1\"]=\"${_SMALLCORE11_1_V}\"\n [\"DE2\"]=\"${_SMALLCORE11_2_V}\"\n [\"DE3\"]=\"${_SMALLCORE11_3_V}\"\n)\n\n# Define distros profiles names for configuration\ndeclare -A _distros_profiles_names=(\n [\"CMS\"]=\"drupal_cms_installer\"\n [\"CK1\"]=\"commerce_kickstart\"\n [\"CK2\"]=\"commerce_base\"\n [\"CK3\"]=\"commerce_kickstart\"\n [\"DXP\"]=\"dxpr_marketing_cms\"\n [\"EZC\"]=\"ezcontent\"\n [\"FOS\"]=\"farm\"\n [\"LGV\"]=\"localgov\"\n [\"OCS\"]=\"openculturas\"\n [\"OFD\"]=\"openfed\"\n [\"OLS\"]=\"openlucius\"\n [\"OPG\"]=\"opigno_lms\"\n [\"SCR\"]=\"sector\"\n [\"SOC\"]=\"social\"\n [\"THR\"]=\"thunder\"\n [\"UC6\"]=\"uberdrupal\"\n [\"UC7\"]=\"minimal\"\n [\"VB9\"]=\"varbase\"\n [\"VBX\"]=\"varbase\"\n [\"DL6\"]=\"default\"\n [\"DL7\"]=\"standard\"\n [\"DL9\"]=\"standard\"\n [\"DX0\"]=\"standard\"\n [\"DX1\"]=\"standard\"\n [\"DX2\"]=\"standard\"\n [\"DX3\"]=\"standard\"\n [\"DX4\"]=\"standard\"\n [\"DX5\"]=\"standard\"\n [\"DX6\"]=\"standard\"\n [\"DE1\"]=\"standard\"\n [\"DE2\"]=\"standard\"\n [\"DE3\"]=\"standard\"\n)\n\n# Define distros profiles paths for configuration\ndeclare -A _distros_profiles_paths=(\n [\"CMS\"]=\"/\"\n [\"CK1\"]=\"/\"\n [\"CK2\"]=\"contrib/\"\n [\"CK3\"]=\"contrib/\"\n [\"DXP\"]=\"contrib/\"\n [\"EZC\"]=\"contrib/\"\n [\"FOS\"]=\"/\"\n [\"LGV\"]=\"contrib/\"\n [\"OCS\"]=\"contrib/\"\n [\"OFD\"]=\"contrib/\"\n [\"OLS\"]=\"contrib/\"\n [\"OPG\"]=\"contrib/\"\n [\"SCR\"]=\"contrib/\"\n [\"SOC\"]=\"contrib/\"\n [\"THR\"]=\"contrib/\"\n [\"UC6\"]=\"/\"\n [\"UC7\"]=\"/\"\n [\"VB9\"]=\"/\"\n [\"VBX\"]=\"contrib/\"\n [\"DL6\"]=\"/\"\n [\"DL7\"]=\"/\"\n [\"DL9\"]=\"/\"\n [\"DX0\"]=\"/\"\n [\"DX1\"]=\"/\"\n [\"DX2\"]=\"/\"\n [\"DX3\"]=\"/\"\n [\"DX4\"]=\"/\"\n [\"DX5\"]=\"/\"\n [\"DX6\"]=\"/\"\n [\"DE1\"]=\"/\"\n [\"DE2\"]=\"/\"\n [\"DE3\"]=\"/\"\n)\n\n# Define distros web dirs for configuration\ndeclare -A _distros_web_dirs=(\n [\"CMS\"]=\"/web\"\n [\"CK1\"]=\"\"\n [\"CK2\"]=\"/web\"\n [\"CK3\"]=\"/web\"\n [\"DXP\"]=\"/web\"\n [\"EZC\"]=\"/web\"\n [\"FOS\"]=\"/web\"\n [\"LGV\"]=\"/web\"\n [\"OCS\"]=\"/web\"\n [\"OFD\"]=\"/docroot\"\n [\"OLS\"]=\"/web\"\n [\"OPG\"]=\"/web\"\n [\"SCR\"]=\"/web\"\n [\"SOC\"]=\"/html\"\n [\"THR\"]=\"/docroot\"\n [\"UC6\"]=\"\"\n [\"UC7\"]=\"\"\n [\"VB9\"]=\"/docroot\"\n [\"VBX\"]=\"/docroot\"\n [\"DL6\"]=\"\"\n [\"DL7\"]=\"\"\n [\"DL9\"]=\"/web\"\n [\"DX0\"]=\"/web\"\n [\"DX1\"]=\"/web\"\n [\"DX2\"]=\"/web\"\n [\"DX3\"]=\"/web\"\n [\"DX4\"]=\"/web\"\n [\"DX5\"]=\"/web\"\n [\"DX6\"]=\"/web\"\n [\"DE1\"]=\"/web\"\n [\"DE2\"]=\"/web\"\n [\"DE3\"]=\"/web\"\n)\n\n# Define distros names and their URLs for information\ndeclare -A _distros_urls=(\n [\"CMS\"]=\"https://new.drupal.org/drupal-cms\"\n [\"CK1\"]=\"${_urlPrt}/commerce_kickstart\"\n [\"CK2\"]=\"${_urlPrt}/commerce\"\n [\"CK3\"]=\"${_urlPrt}/commerce_kickstart\"\n [\"DXP\"]=\"${_urlPrt}/dxpr_marketing_cms\"\n [\"EZC\"]=\"${_urlPrt}/ezcontent\"\n [\"FOS\"]=\"${_urlPrt}/farm\"\n [\"LGV\"]=\"${_urlPrt}/localgov\"\n [\"OCS\"]=\"${_urlPrt}/openculturas\"\n [\"OFD\"]=\"${_urlPrt}/openfed\"\n [\"OLS\"]=\"${_urlPrt}/openlucius\"\n [\"OPG\"]=\"${_urlPrt}/opigno_lms\"\n [\"SCR\"]=\"${_urlPrt}/sector\"\n [\"SOC\"]=\"${_urlPrt}/social\"\n [\"THR\"]=\"${_urlPrt}/thunder\"\n [\"UC6\"]=\"${_urlPrt}/ubercart\"\n [\"UC7\"]=\"${_urlPrt}/ubercart\"\n [\"VB9\"]=\"${_urlPrt}/varbase\"\n [\"VBX\"]=\"${_urlPrt}/varbase\"\n [\"DL6\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE6_V}\"\n [\"DL7\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE7_V}\"\n [\"DL9\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE9_V}\"\n [\"DX0\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE10_0_V}\"\n [\"DX1\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE10_1_V}\"\n [\"DX2\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE10_2_V}\"\n [\"DX3\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE10_3_V}\"\n [\"DX4\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE10_4_V}\"\n [\"DX5\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE10_5_V}\"\n [\"DX6\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE10_6_V}\"\n [\"DE1\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE11_1_V}\"\n [\"DE2\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE11_2_V}\"\n [\"DE3\"]=\"${_urlPrt}/drupal/releases/${_SMALLCORE11_3_V}\"\n)\n\n# Define distros names and their compatible max PHP versions for information\ndeclare -A _distros_php_versions=(\n [\"CMS\"]=\"8.4\"\n [\"CK1\"]=\"7.4\"\n [\"CK2\"]=\"8.3\"\n [\"CK3\"]=\"8.4\"\n [\"DXP\"]=\"8.3\"\n [\"EZC\"]=\"8.3\"\n [\"FOS\"]=\"8.3\"\n [\"LGV\"]=\"8.3\"\n [\"OCS\"]=\"8.3\"\n [\"OFD\"]=\"8.3\"\n [\"OLS\"]=\"8.3\"\n [\"OPG\"]=\"8.3\"\n [\"SCR\"]=\"8.4\"\n [\"SOC\"]=\"8.3\"\n [\"THR\"]=\"8.4\"\n [\"UC6\"]=\"7.4\"\n [\"UC7\"]=\"7.4\"\n [\"VB9\"]=\"8.3\"\n [\"VBX\"]=\"8.4\"\n [\"DL6\"]=\"7.4\"\n [\"DL7\"]=\"8.3\"\n [\"DL9\"]=\"8.3\"\n [\"DX0\"]=\"8.3\"\n [\"DX1\"]=\"8.3\"\n [\"DX2\"]=\"8.3\"\n [\"DX3\"]=\"8.3\"\n [\"DX4\"]=\"8.3\"\n [\"DX5\"]=\"8.3\"\n [\"DX6\"]=\"8.3\"\n [\"DE1\"]=\"8.4\"\n [\"DE2\"]=\"8.4\"\n [\"DE3\"]=\"8.4\"\n)\n\n\n_commerce_7_2_install() {\n###---### Commerce 7.x-2.x\n#\n # Declare 'params' as local to the function\n local -A params=(\n [dist]=\"$1\"\n [version]=\"$2\"\n [core_version]=\"$3\"\n [description]=\"$4\"\n [profile_path]=\"$5\"\n [profile_name]=\"$6\"\n [web_dir]=\"$7\"\n [php_version]=\"$8\"\n [url]=\"$9\"\n )\n\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"DEBUG: _commerce_7_2_install\"\n for key in \"${!params[@]}\"; do\n _msg \"DEBUG: _commerce_7_2_install ${key} is '${params[$key]}'\"\n done\n fi\n\n # /data/disk/o8/distro/001/commerce_kickstart-2.77-7.105.1\n _REAL_PRNAME=\"${params[profile_name]}\"\n _SHRD_PLNAME=\"${params[profile_name]}-${params[version]}-${params[core_version]}\"\n _SHRD_PLPATH=\"${_CORE}/${_SHRD_PLNAME}\"\n _SHRD_PRPATH=\"${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}\"\n _OCTO_PLPATH=\"${_pthDst}/${_SHRD_PLNAME}\"\n if [ \"${_ALLOW_ALL}\" = \"YES\" ]; then\n if [[ \"${_PLATFORMS_LIST}\" =~ ALL ]] \\\n || [[ \"${_PLATFORMS_LIST}\" =~ ${params[dist]} ]]; then\n if [ ! -d \"${_OCTO_PLPATH}\" ]; then\n if _prompt_yes_no \"${params[description]} - ${params[url]}\" ; then\n true\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} ${_yOk}\"\n if [ ! -d \"${_SHRD_PLPATH}\" ]; then\n cd ${_CORE}\n if [ \"${_DL_MODE}\" = \"GIT\" ] \\\n && [ \"${_T_BUILD}\" = \"SRC\" ]; then\n if [ ! -e \"${_D7_CORE_DIR}\" ]; then\n _prepare_drupal7_core\n fi\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _get_distro_ext '${params[profile_name]}-7.x-${params[version]}-core.tar.gz'\"\n _get_distro_ext \"${params[profile_name]}-7.x-${params[version]}-core.tar.gz\"\n if [ -d \"${_CORE}/commerce-7.x-${params[version]}\" ]; then\n mv -f commerce-7.x-${params[version]} ${_SHRD_PLNAME}\n elif [ -d \"${_CORE}/${_REAL_PRNAME}-7.x-${params[version]}\" ]; then\n mv -f ${_REAL_PRNAME}-7.x-${params[version]} ${_SHRD_PLNAME}\n fi\n _nocore_d7_dist_clean\n _remove_default_core_seven_profiles\n _upgrade_contrib_less\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _get_distro_ext '${_SHRD_PLNAME}.tar.gz'\"\n _get_distro_ext \"${_SHRD_PLNAME}.tar.gz\"\n fi\n fi\n _init_this_distro_root\n _msg \"DISTRO: ${params[description]} installed\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _save_verify_this_platform '${1}' '${2}' '${3}' '${params[description]}' '${5}' '${6}' '${7}'\"\n _save_verify_this_platform \"${1}\" \"${2}\" \"${3}\" \"${params[description]}\" \"${5}\" \"${6}\" \"${7}\"\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} ${_noT}\"\n fi\n fi\n fi\n fi\n}\n\n\n_ubercart6_install() {\n###---### Ubercart 2\n#\n # Declare 'params' as local to the function\n local -A params=(\n [dist]=\"$1\"\n [version]=\"$2\"\n [core_version]=\"$3\"\n [description]=\"$4\"\n [profile_path]=\"$5\"\n [profile_name]=\"$6\"\n [web_dir]=\"$7\"\n [php_version]=\"$8\"\n [url]=\"$9\"\n )\n\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"DEBUG: _ubercart6_install\"\n for key in \"${!params[@]}\"; do\n _msg \"DEBUG: _ubercart6_install ${key} is '${params[$key]}'\"\n done\n fi\n\n # /data/disk/o8/distro/001/ubercart-2.15-6.60.1\n _REAL_PRNAME=\"${params[profile_name]}\"\n _VIRT_PRNAME=\"ubercart\"\n _SHRD_PLNAME=\"${_VIRT_PRNAME}-${params[version]}-${params[core_version]}\"\n _SHRD_PLPATH=\"${_CORE}/${_SHRD_PLNAME}\"\n _SHRD_PRPATH=\"${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}\"\n _OCTO_PLPATH=\"${_pthDst}/${_SHRD_PLNAME}\"\n if [[ \"${_PLATFORMS_LIST}\" =~ ALL ]] \\\n || [[ \"${_PLATFORMS_LIST}\" =~ ${params[dist]} ]]; then\n if [ ! -d \"${_OCTO_PLPATH}/modules/path_alias_cache\" ]; then\n if _prompt_yes_no \"${params[description]} - ${params[url]}\" ; then\n true\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} ${_yOk}\"\n if [ ! -d \"${_SHRD_PLPATH}\" ]; then\n if [ \"${_DL_MODE}\" = \"GIT\" ] \\\n && [ \"${_T_BUILD}\" = \"SRC\" ]; then\n cd ${_CORE}\n if [ ! -e \"${_D6_CORE_DIR}\" ]; then\n _prepare_drupal6_core\n fi\n mkdir -p ${_SHRD_PLPATH}\n _nocore_d6_dist_clean\n rm -rf ${_SHRD_PLPATH}/profiles/default\n cd ${_SHRD_PLPATH}/profiles\n _get_dev_contrib \"uberdrupal.tar.gz\"\n cd ${_CORE}\n mkdir -p ${_SHRD_PRPATH}/{modules,themes,libraries}\n cd ${_SHRD_PRPATH}/libraries\n _get_dev_contrib \"colorbox-1.3.18.zip\"\n cd ${_SHRD_PRPATH}/modules\n _get_dev_contrib \"admin_menu-6.x-3.x-dev.tar.gz\"\n _get_dev_contrib \"cck-6.x-3.0-alpha4.tar.gz\"\n _get_dev_contrib \"colorbox-6.x-1.4.tar.gz\"\n _get_dev_contrib \"date-6.x-2.9.tar.gz\"\n _get_dev_contrib \"filefield-6.x-3.14.tar.gz\"\n _get_dev_contrib \"google_analytics-6.x-4.3.tar.gz\"\n _get_dev_contrib \"imageapi-6.x-1.10.tar.gz\"\n _get_dev_contrib \"imagecache-6.x-2.x-dev.tar.gz\"\n _get_dev_contrib \"imagefield-6.x-3.11.tar.gz\"\n _get_dev_contrib \"jquery_update-6.x-2.0-alpha1.tar.gz\"\n _get_dev_contrib \"libraries-6.x-1.0.tar.gz\"\n _get_dev_contrib \"lightbox2-6.x-1.x-dev.tar.gz\"\n _get_dev_contrib \"rules-6.x-1.5.tar.gz\"\n _get_dev_contrib \"skinr-6.x-1.7.tar.gz\"\n _get_dev_contrib \"token-6.x-1.19.tar.gz\"\n _get_dev_contrib \"ubercart-6.x-${params[version]}.tar.gz\"\n _get_dev_contrib \"views-6.x-3.3.tar.gz\"\n _get_dev_contrib \"webform-6.x-3.23.tar.gz\"\n ### https://drupal.org/node/1167276#comment-5138248\n cd ${_SHRD_PRPATH}/modules/${_VIRT_PRNAME}\n patch -p1 < ${_pthPch}/${_VIRT_PRNAME}-1167276-reroll.patch &> /dev/null\n cd ${_SHRD_PRPATH}/modules/imagecache\n # https://drupal.org/node/1243258#comment-4850634\n patch -p1 < ${_pthPch}/imagecache-1243258-5.patch &> /dev/null\n cd ${_SHRD_PRPATH}/themes\n _get_dev_contrib \"fusion-6.x-1.x-dev.tar.gz\"\n _get_dev_contrib \"acquia_prosper-6.x-1.1.tar.gz\"\n else\n cd ${_CORE}\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _get_distro_ext '${_SHRD_PLNAME}.tar.gz'\"\n _get_distro_ext \"${_SHRD_PLNAME}.tar.gz\"\n fi\n fi\n _init_this_distro_root\n _msg \"DISTRO: ${params[description]} installed\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _save_verify_this_platform '${1}' '${2}' '${3}' '${params[description]}' '${5}' '${6}' '${7}'\"\n _save_verify_this_platform \"${1}\" \"${2}\" \"${3}\" \"${params[description]}\" \"${5}\" \"${6}\" \"${7}\"\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} ${_noT}\"\n fi\n fi\n fi\n}\n\n\n_ubercart7_install() {\n###---### Ubercart 3\n#\n # Declare 'params' as local to the function\n local -A params=(\n [dist]=\"$1\"\n [version]=\"$2\"\n [core_version]=\"$3\"\n [description]=\"$4\"\n [profile_path]=\"$5\"\n [profile_name]=\"$6\"\n [web_dir]=\"$7\"\n [php_version]=\"$8\"\n [url]=\"$9\"\n )\n\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"DEBUG: _ubercart7_install\"\n for key in \"${!params[@]}\"; do\n _msg \"DEBUG: _ubercart7_install ${key} is '${params[$key]}'\"\n done\n fi\n\n # /data/disk/o8/distro/001/ubercart-3.13-7.105.1\n _REAL_PRNAME=\"${params[profile_name]}\"\n _VIRT_PRNAME=\"ubercart\"\n _SHRD_PLNAME=\"${_VIRT_PRNAME}-${params[version]}-${params[core_version]}\"\n _SHRD_PLPATH=\"${_CORE}/${_SHRD_PLNAME}\"\n _SHRD_PRPATH=\"${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}\"\n _OCTO_PLPATH=\"${_pthDst}/${_SHRD_PLNAME}\"\n if [ \"${_ALLOW_ALL}\" = \"YES\" ]; then\n if [[ \"${_PLATFORMS_LIST}\" =~ ALL ]] \\\n || [[ \"${_PLATFORMS_LIST}\" =~ ${params[dist]} ]]; then\n if [ ! -d \"${_OCTO_PLPATH}\" ]; then\n if _prompt_yes_no \"${params[description]} - ${params[url]}\" ; then\n true\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} ${_yOk}\"\n if [ ! -d \"${_SHRD_PLPATH}\" ]; then\n cd ${_CORE}\n if [ \"${_DL_MODE}\" = \"GIT\" ] \\\n && [ \"${_T_BUILD}\" = \"SRC\" ]; then\n if [ ! -e \"${_D7_CORE_DIR}\" ]; then\n _prepare_drupal7_core\n fi\n mkdir -p ${_SHRD_PLPATH}\n _nocore_d7_dist_clean\n rm -rf ${_SHRD_PLPATH}/profiles/standard\n rm -rf ${_SHRD_PLPATH}/profiles/testing\n sed -i \"s/version = VERSION/version = \\\"${_SMALLCORE7_V}\\\"/g\" \\\n ${_SHRD_PLPATH}/profiles/minimal/minimal.info &> /dev/null\n mkdir -p ${_SHRD_PRPATH}/libraries\n cd ${_SHRD_PRPATH}/libraries\n _get_dev_contrib \"colorbox-1.5.13.zip\"\n if [ -d \"colorbox-master\" ]; then\n mv -f colorbox-master colorbox\n fi\n mkdir -p ${_SHRD_PRPATH}/modules\n cd ${_SHRD_PRPATH}/modules\n _get_dev_contrib \"colorbox-7.x-2.13.tar.gz\"\n _get_dev_contrib \"ctools-7.x-1.21.tar.gz\"\n _get_dev_contrib \"entity-7.x-1.12.tar.gz\"\n _get_dev_contrib \"google_analytics-7.x-2.6.tar.gz\"\n _get_dev_contrib \"libraries-7.x-2.5.tar.gz\"\n _get_dev_contrib \"pathauto-7.x-1.3.tar.gz\"\n _get_dev_contrib \"rules-7.x-2.12.tar.gz\"\n _get_dev_contrib \"token-7.x-1.7.tar.gz\"\n _get_dev_contrib \"ubercart-7.x-${params[version]}.tar.gz\"\n _get_dev_contrib \"views-7.x-3.30.tar.gz\"\n cd ${_SHRD_PRPATH}/modules/views\n # https://drupal.org/node/1766338#comment-6445882\n patch -p1 < \\\n ${_pthPch}/views-revert-broken-filter-or-groups-1766338-7.patch &> /dev/null\n # https://drupal.org/node/2037469\n patch -p1 < \\\n ${_pthPch}/views-exposed-sorts-2037469-1.patch &> /dev/null\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _get_distro_ext '${_SHRD_PLNAME}.tar.gz'\"\n _get_distro_ext \"${_SHRD_PLNAME}.tar.gz\"\n fi\n fi\n _init_this_distro_root\n _msg \"DISTRO: ${params[description]} installed\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _save_verify_this_platform '${1}' '${2}' '${3}' '${params[description]}' '${5}' '${6}' '${7}'\"\n _save_verify_this_platform \"${1}\" \"${2}\" \"${3}\" \"${params[description]}\" \"${5}\" \"${6}\" \"${7}\"\n # _save_verify_this_platform 'UC7' '3.13' '7.105.1' 'ubercart-3.13-7.105.1' '/' 'minimal' ''\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} ${_noT}\"\n fi\n fi\n fi\n fi\n}\n\n\n_d_dist_custom_platform_install() {\n###---### Template function for distros-custom-type platforms\n#\n # Declare 'params' as local to the function\n local -A params=(\n [dist]=\"$1\"\n [version]=\"$2\"\n [core_version]=\"$3\"\n [description]=\"$4\"\n [profile_path]=\"$5\"\n [profile_name]=\"$6\"\n [web_dir]=\"$7\"\n [php_version]=\"$8\"\n [url]=\"$9\"\n )\n\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"DEBUG: _d_dist_custom_platform_install\"\n for key in \"${!params[@]}\"; do\n _msg \"DEBUG: _d_dist_custom_platform_install ${key} is '${params[$key]}'\"\n done\n fi\n\n if [[ \"${1}\" == \"CK1\" ]]; then\n _commerce_7_2_install \"${1}\" \"${2}\" \"${3}\" \"${4}\" \"${5}\" \"${6}\" \"${7}\" \"${8}\" \"${9}\"\n elif [[ \"${1}\" == \"UC6\" ]]; then\n _ubercart6_install \"${1}\" \"${2}\" \"${3}\" \"${4}\" \"${5}\" \"${6}\" \"${7}\" \"${8}\" \"${9}\"\n elif [[ \"${1}\" == \"UC7\" ]]; then\n _ubercart7_install \"${1}\" \"${2}\" \"${3}\" \"${4}\" \"${5}\" \"${6}\" \"${7}\" \"${8}\" \"${9}\"\n fi\n}\n\n\n_d_dist_platform_install() {\n###---### Template function for distros-type platforms\n#\n # Declare 'params' as local to the function\n local -A params=(\n [dist]=\"$1\"\n [version]=\"$2\"\n [core_version]=\"$3\"\n [description]=\"$4\"\n [profile_path]=\"$5\"\n [profile_name]=\"$6\"\n [web_dir]=\"$7\"\n [php_version]=\"$8\"\n [url]=\"$9\"\n )\n\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"DEBUG: _d_dist_platform_install\"\n for key in \"${!params[@]}\"; do\n _msg \"DEBUG: _d_dist_platform_install ${key} is '${params[$key]}'\"\n done\n fi\n\n # Access parameters by name\n _REAL_PRNAME=\"${params[profile_name]}\"\n _DIST_PLNAME=\"${params[profile_name]}-${params[version]}-${params[core_version]}\"\n _DIST_PLPATH=\"${_CORE}/${_DIST_PLNAME}\"\n _DIST_PRPATH=\"${_DIST_PLPATH}/profiles/${params[profile_path]}${params[profile_name]}\"\n _OCTO_PLPATH=\"${_pthDst}/${_DIST_PLNAME}${7}\"\n if [ \"${_ALLOW_ALL}\" = \"YES\" ]; then\n if [[ \"${_PLATFORMS_LIST}\" =~ ALL ]] \\\n || [[ \"${_PLATFORMS_LIST}\" =~ ${params[dist]} ]]; then\n if [ ! -d \"${_OCTO_PLPATH}\" ]; then\n if _prompt_yes_no \"${params[description]} - ${params[url]}\" ; then\n true\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} ${_yOk}\"\n if [ ! -d \"${_OCTO_PLPATH}\" ]; then\n cd ${_pthDst}\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _get_distro_ext '${_DIST_PLNAME}.tar.gz'\"\n _get_distro_ext \"${_DIST_PLNAME}.tar.gz\"\n fi\n if [ -d \"${_OCTO_PLPATH}\" ]; then\n _msg \"DISTRO: ${params[description]} installed\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _save_verify_this_platform '${1}' '${2}' '${3}' '${params[description]}' '${5}' '${6}' '${7}'\"\n _save_verify_this_platform \"${1}\" \"${2}\" \"${3}\" \"${params[description]}\" \"${5}\" \"${6}\" \"${7}\"\n fi\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} ${_noT}\"\n fi\n fi\n fi\n fi\n}\n\n\n_d_core_platform_install() {\n###---### Template function for core-only-type platforms\n#\n if [ \"${1}\" = \"DE1\" ]; then\n _CORE_DEV=\"${_DRUPAL11_1_D}\"\n _CORE_STG=\"${_DRUPAL11_1_S}\"\n _CORE_PRD=\"${_DRUPAL11_1_P}\"\n elif [ \"${1}\" = \"DE2\" ]; then\n _CORE_DEV=\"${_DRUPAL11_2_D}\"\n _CORE_STG=\"${_DRUPAL11_2_S}\"\n _CORE_PRD=\"${_DRUPAL11_2_P}\"\n elif [ \"${1}\" = \"DE3\" ]; then\n _CORE_DEV=\"${_DRUPAL11_3_D}\"\n _CORE_STG=\"${_DRUPAL11_3_S}\"\n _CORE_PRD=\"${_DRUPAL11_3_P}\"\n elif [ \"${1}\" = \"DX6\" ]; then\n _CORE_DEV=\"${_DRUPAL10_6_D}\"\n _CORE_STG=\"${_DRUPAL10_6_S}\"\n _CORE_PRD=\"${_DRUPAL10_6_P}\"\n elif [ \"${1}\" = \"DX5\" ]; then\n _CORE_DEV=\"${_DRUPAL10_5_D}\"\n _CORE_STG=\"${_DRUPAL10_5_S}\"\n _CORE_PRD=\"${_DRUPAL10_5_P}\"\n elif [ \"${1}\" = \"DX4\" ]; then\n _CORE_DEV=\"${_DRUPAL10_4_D}\"\n _CORE_STG=\"${_DRUPAL10_4_S}\"\n _CORE_PRD=\"${_DRUPAL10_4_P}\"\n elif [ \"${1}\" = \"DX3\" ]; then\n _CORE_DEV=\"${_DRUPAL10_3_D}\"\n _CORE_STG=\"${_DRUPAL10_3_S}\"\n _CORE_PRD=\"${_DRUPAL10_3_P}\"\n elif [ \"${1}\" = \"DX2\" ]; then\n _CORE_DEV=\"${_DRUPAL10_2_D}\"\n _CORE_STG=\"${_DRUPAL10_2_S}\"\n _CORE_PRD=\"${_DRUPAL10_2_P}\"\n elif [ \"${1}\" = \"DX1\" ]; then\n _CORE_DEV=\"${_DRUPAL10_1_D}\"\n _CORE_STG=\"${_DRUPAL10_1_S}\"\n _CORE_PRD=\"${_DRUPAL10_1_P}\"\n elif [ \"${1}\" = \"DX0\" ]; then\n _CORE_DEV=\"${_DRUPAL10_0_D}\"\n _CORE_STG=\"${_DRUPAL10_0_S}\"\n _CORE_PRD=\"${_DRUPAL10_0_P}\"\n elif [ \"${1}\" = \"DL9\" ]; then\n _CORE_DEV=\"${_DRUPAL9_D}\"\n _CORE_STG=\"${_DRUPAL9_S}\"\n _CORE_PRD=\"${_DRUPAL9_P}\"\n elif [ \"${1}\" = \"DL7\" ]; then\n _CORE_DEV=\"${_DRUPAL7_D}\"\n _CORE_STG=\"${_DRUPAL7_S}\"\n _CORE_PRD=\"${_DRUPAL7_P}\"\n elif [ \"${1}\" = \"DL6\" ]; then\n _CORE_DEV=\"${_DRUPAL6_D}\"\n _CORE_STG=\"${_DRUPAL6_S}\"\n _CORE_PRD=\"${_DRUPAL6_P}\"\n fi\n\n # Declare 'params' as local to the function\n local -A params=(\n [dist]=\"$1\"\n [version]=\"$2\"\n [core_version]=\"$3\"\n [description]=\"$4\"\n [profile_path]=\"$5\"\n [profile_name]=\"$6\"\n [web_dir]=\"$7\"\n [php_version]=\"$8\"\n [url]=\"$9\"\n )\n\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"DEBUG: _d_core_platform_install\"\n for key in \"${!params[@]}\"; do\n _msg \"DEBUG: _d_core_platform_install ${key} is '${params[$key]}'\"\n done\n fi\n\n # Access parameters by name\n _REAL_PRNAME=\"${params[profile_name]}\"\n\n if [[ \"${_PLATFORMS_LIST}\" =~ ALL ]] \\\n || [[ \"${_PLATFORMS_LIST}\" =~ ${params[dist]} ]]; then\n if [ ! -d \"${_pthDst}/${_CORE_DEV}\" ]; then\n if _prompt_yes_no \"${params[description]} - ${params[url]}\" ; then\n true\n ###---### Drupal Core-Only Development\n #\n _SHRD_PLNAME=\"${_CORE_DEV}\"\n [[ \"${1}\" =~ DL7 || \"${1}\" =~ DL6 ]] && _SHRD_PLPATH=\"${_CORE}/${_SHRD_PLNAME}\"\n [[ \"${1}\" =~ DL7 || \"${1}\" =~ DL6 ]] && _SHRD_PRPATH=\"${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}\"\n _OCTO_PLPATH=\"${_pthDst}/${_SHRD_PLNAME}\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} [D.${_THIS_CORE}] ${_yOk}\"\n _create_drupal_core_basic \"${params[dist]}\"\n if [ -d \"${_OCTO_PLPATH}\" ]; then\n _msg \"DISTRO: ${params[description]} [D.${_THIS_CORE}] installed\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _save_verify_this_platform '${1}' '${_SHRD_PLNAME}' '${3}' '${params[description]} [D.${_THIS_CORE}]' '${5}' '${6}' '${7}'\"\n _save_verify_this_platform \"${1}\" \"${_SHRD_PLNAME}\" \"${3}\" \"${params[description]} [D.${_THIS_CORE}]\" \"${5}\" \"${6}\" \"${7}\"\n fi\n\n ###---### Drupal Core-Only Staging\n #\n _SHRD_PLNAME=\"${_CORE_STG}\"\n [[ \"${1}\" =~ DL7 || \"${1}\" =~ DL6 ]] && _SHRD_PLPATH=\"${_CORE}/${_SHRD_PLNAME}\"\n [[ \"${1}\" =~ DL7 || \"${1}\" =~ DL6 ]] && _SHRD_PRPATH=\"${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}\"\n _OCTO_PLPATH=\"${_pthDst}/${_SHRD_PLNAME}\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} [S.${_THIS_CORE}] ${_yOk}\"\n _create_drupal_core_basic \"${params[dist]}\"\n if [ -d \"${_OCTO_PLPATH}\" ]; then\n _msg \"DISTRO: ${params[description]} [S.${_THIS_CORE}] installed\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _save_verify_this_platform '${1}' '${_SHRD_PLNAME}' '${3}' '${params[description]} [S.${_THIS_CORE}]' '${5}' '${6}' '${7}'\"\n _save_verify_this_platform \"${1}\" \"${_SHRD_PLNAME}\" \"${3}\" \"${params[description]} [S.${_THIS_CORE}]\" \"${5}\" \"${6}\" \"${7}\"\n fi\n\n ###---### Drupal Core-Only Production\n #\n _SHRD_PLNAME=\"${_CORE_PRD}\"\n [[ \"${1}\" =~ DL7 || \"${1}\" =~ DL6 ]] && _SHRD_PLPATH=\"${_CORE}/${_SHRD_PLNAME}\"\n [[ \"${1}\" =~ DL7 || \"${1}\" =~ DL6 ]] && _SHRD_PRPATH=\"${_SHRD_PLPATH}/profiles/${_REAL_PRNAME}\"\n _OCTO_PLPATH=\"${_pthDst}/${_SHRD_PLNAME}\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} [P.${_THIS_CORE}] ${_yOk}\"\n _create_drupal_core_basic \"${params[dist]}\"\n if [ -d \"${_OCTO_PLPATH}\" ]; then\n _msg \"DISTRO: ${params[description]} [P.${_THIS_CORE}] installed\"\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DEBUG: _save_verify_this_platform '${1}' '${_SHRD_PLNAME}' '${3}' '${params[description]} [P.${_THIS_CORE}]' '${5}' '${6}' '${7}'\"\n _save_verify_this_platform \"${1}\" \"${_SHRD_PLNAME}\" \"${3}\" \"${params[description]} [P.${_THIS_CORE}]\" \"${5}\" \"${6}\" \"${7}\"\n fi\n else\n [ \"${_DEBUG_MODE}\" = \"YES\" ] && _msg \"DISTRO: ${params[description]} ${_noT}\"\n fi\n fi\n fi\n}\n\n_d_dist_loop() {\n # Loop through the _distros_names\n for _dist in \"${!_distros_names[@]}\"; do\n _d_name=\"${_distros_names[${_dist}]}\"\n _d_vers=\"${_distros_versions[${_dist}]}\"\n _d_core=\"${_distros_drupal_cores[${_dist}]}\"\n _d_desc=\"${_d_name} ${_d_vers} ${_d_core} [${_THIS_CORE}]\"\n _d_xdes=\"${_d_name} ${_d_vers}\"\n _d_ppth=\"${_distros_profiles_paths[${_dist}]}\"\n _d_prfn=\"${_distros_profiles_names[${_dist}]}\"\n _d_webd=\"${_distros_web_dirs[${_dist}]}\"\n _d_phpv=\"${_distros_php_versions[${_dist}]}\"\n _d_xurl=\"${_distros_urls[${_dist}]}\"\n if [[ \"${_dist}\" =~ DL || \"${_dist}\" =~ DX || \"${_dist}\" =~ DE ]]; then\n _d_core_platform_install \"${_dist}\" \"${_d_vers}\" \"${_d_core}\" \"${_d_xdes}\" \"${_d_ppth}\" \"${_d_prfn}\" \"${_d_webd}\" \"${_d_phpv}\" \"${_d_xurl}\"\n elif [[ \"${_dist}\" =~ CK1 || \"${_dist}\" =~ UC ]]; then\n _d_dist_custom_platform_install \"${_dist}\" \"${_d_vers}\" \"${_d_core}\" \"${_d_desc}\" \"${_d_ppth}\" \"${_d_prfn}\" \"${_d_webd}\" \"${_d_phpv}\" \"${_d_xurl}\"\n else\n _d_dist_platform_install \"${_dist}\" \"${_d_vers}\" \"${_d_core}\" \"${_d_desc}\" \"${_d_ppth}\" \"${_d_prfn}\" \"${_d_webd}\" \"${_d_phpv}\" \"${_d_xurl}\"\n fi\n done\n}\n\n###\n###---### Action starts here.\n###\n\n\n###---### Prepare D6 and D7 shared core\n#\n_prepare_drupal6_core\n_prepare_drupal7_core\n\n# Prepare\n_prepare_for_save_verify_platforms\n\n# Loop\n_d_dist_loop\n\n\n###---### Remove some unused core files.\n#\nif [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n echo \" \"\n _msg \"${_STATUS} C: Removing some unused core files...\"\nfi\nif [[ \"${_CORE}\" =~ \"/data/all/\" ]]; then\n rm -rf ${_CORE}/*/scripts\n rm -f ${_CORE}/*{.make,.tar,.tar.gz,.zip}\nfi\n[ -e \"${_THIS_HM}/make_platform.php\" ] && rm -f ${_THIS_HM}/make_platform.php\n[ -e \"${_THIS_HM}/make_client.php\" ] && rm -f ${_THIS_HM}/make_client.php\n[ -e \"${_THIS_HM}/make_home.php\" ] && rm -f ${_THIS_HM}/make_home.php\ncd ${_CORE}\n\n###----------------------------------------###\n###\n### Octopus Ægir Installer\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n###----------------------------------------###\n" }, { "path": "aegir/scripts/AegirSetupM.sh.txt", "content": "#!/bin/bash\n\n\n###----------------------------------------###\n###\n### Barracuda Ægir Installer\n###\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n### This program is free software. You can\n### redistribute it and/or modify it under\n### the terms of the GNU GPL as published by\n### the Free Software Foundation, version 2\n### or later.\n###\n### This program is distributed in the hope\n### that it will be useful, but WITHOUT ANY\n### WARRANTY; without even the implied\n### warranty of MERCHANTABILITY or FITNESS\n### FOR A PARTICULAR PURPOSE. See the GNU GPL\n### for more details.\n###\n### You should have received a copy of the\n### GNU GPL along with this program.\n### If not, see http://www.gnu.org/licenses/\n###\n### Code: https://github.com/omega8cc/boa\n###\n###----------------------------------------###\n\n\n###----------------------------------------###\n### DON'T EDIT ANYTHING BELOW THIS LINE ###\n###----------------------------------------###\n\n\n###\n### Default variables\n###\n_bldPth=\"/opt/tmp/boa\"\n_filIncB=\"barracuda.sh.cnf\"\n_libFnc=\"${_bldPth}/lib/functions\"\n_vBs=\"/var/backups\"\nexport _tRee=dev\n\n\n###\n### Panic on missing include\n###\n_panic_exit() {\n echo\n echo \" EXIT: Required lib file not available?\"\n echo \" EXIT: $1\"\n echo \" EXIT: Cannot continue\"\n echo \" EXIT: Bye (0)\"\n echo\n touch /opt/tmp/status-AegirSetupM-FAIL\n exit 1\n}\n\n\n###\n### Include default settings and basic functions\n###\n[ -r \"${_vBs}/${_filIncB}\" ] || _panic_exit \"${_vBs}/${_filIncB}\"\n source \"${_vBs}/${_filIncB}\"\n\n\n###\n### Include shared functions\n###\n_FL=\"helper master\"\nfor f in ${_FL}; do\n [ -r \"${_libFnc}/${f}.sh.inc\" ] || _panic_exit \"${f}\"\n source \"${_libFnc}/${f}.sh.inc\"\ndone\n\n\n###\n### Local settings\n###\nif [ \"${_THIS_DB_HOST}\" = \"FQDN\" ]; then\n _THIS_DB_HOST=\"$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\nfi\nif [ \"${_PHP_CLI_VERSION}\" = \"8.4\" ] \\\n && [ -x \"/opt/php84/bin/php\" ]; then\n _T_CLI=/opt/php84/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.5\" ] \\\n && [ -x \"/opt/php85/bin/php\" ]; then\n _T_CLI=/opt/php85/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.3\" ] \\\n && [ -x \"/opt/php83/bin/php\" ]; then\n _T_CLI=/opt/php83/bin\nfi\n_ROOT=\"${HOME}\"\n_DRUSHCMD=\"${_T_CLI}/php ${_ROOT}/drush/drush.php\"\n#\nPATH=${_T_CLI}:/usr/local/bin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin\nSHELL=/bin/bash\n#\n_crlGet=\"-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab\"\n_wgetGet=\"--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'\"\n_gCb=\"git clone --branch\"\n_gitHub=\"https://github.com/omega8cc\"\n_gitLab=\"https://gitlab.com/omega8cc\"\n#\nexport _urlDev=\"http://${_USE_MIR}/dev\"\nexport _urlHmr=\"http://${_USE_MIR}/versions/${_tRee}/boa/aegir\"\n\n###--------------------###\n\nif [ \"$(id -u)\" -eq 0 ]; then\n _msg \"FATAL ERROR: This script should be run as a non-root user\"\n _msg \"FATAL ERROR: Aborting AegirSetupM installer NOW!\"\n touch /opt/tmp/status-AegirSetupM-FAIL\n exit 1\nfi\n\nif [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Installing Ægir Provision backend...\"\nfi\n\n_hostmaster_dr_up\n_provision_backend_up\n\nif ${_DRUSHCMD} help | grep \"^ provision-install\" > /dev/null ; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Drush test result OK\"\n fi\nelse\n _msg \"FATAL ERROR: Drush is broken (${_DRUSHCMD} help failed)\"\n _msg \"FATAL ERROR: Aborting AegirSetupM installer NOW!\"\n touch /opt/tmp/status-AegirSetupM-FAIL\n exit 1\nfi\n\nsed -i \"s/files.aegir.cc/${_USE_MIR}/g\" ${_ROOT}/.drush/sys/provision/aegir.make &> /dev/null\n\nif [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Installing the frontend\"\nfi\n${_DRUSHCMD} cc drush >${_ROOT}/install.log 2>&1\nrm -rf ${_ROOT}/.tmp/cache\n_HM_ROOT=\"${_ROOT}/hostmaster-${_AEGIR_VERSION}\"\n\n${_DRUSHCMD} hostmaster-install \\\n --aegir_host=${_AEGIR_HOST} \\\n --aegir_db_user=${_AEGIR_DB_USER} \\\n --aegir_db_pass=${_ESC_PASS} \\\n --aegir_root=${_ROOT} \\\n --root=${_HM_ROOT} \\\n --version=${_AEGIR_VERSION} $@\n\nmkdir -p /var/aegir/backups/system\nchmod 700 /var/aegir/backups/system\n_L_SYS=\"/var/aegir/backups/system/.${_AEGIR_DB_USER}.pass.txt\"\necho \"${_ESC_PASS}\" > ${_L_SYS}\nchmod 0600 ${_L_SYS}\n\n###----------------------------------------###\n###\n### Barracuda Ægir Installer\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n###----------------------------------------###\n" }, { "path": "aegir/scripts/AegirUpgrade.sh.txt", "content": "#!/bin/bash\n\n\n###----------------------------------------###\n###\n### Barracuda Ægir Installer\n###\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n### This program is free software. You can\n### redistribute it and/or modify it under\n### the terms of the GNU GPL as published by\n### the Free Software Foundation, version 2\n### or later.\n###\n### This program is distributed in the hope\n### that it will be useful, but WITHOUT ANY\n### WARRANTY; without even the implied\n### warranty of MERCHANTABILITY or FITNESS\n### FOR A PARTICULAR PURPOSE. See the GNU GPL\n### for more details.\n###\n### You should have received a copy of the\n### GNU GPL along with this program.\n### If not, see http://www.gnu.org/licenses/\n###\n### Code: https://github.com/omega8cc/boa\n###\n###----------------------------------------###\n\n\n###----------------------------------------###\n### DON'T EDIT ANYTHING BELOW THIS LINE ###\n###----------------------------------------###\n\n\n###\n### Default variables\n###\n_bldPth=\"/opt/tmp/boa\"\n_filIncB=\"barracuda.sh.cnf\"\n_libFnc=\"${_bldPth}/lib/functions\"\n_vBs=\"/var/backups\"\nexport _tRee=dev\n\n\n###\n### Panic on missing include\n###\n_panic_exit() {\n echo\n echo \" EXIT: Required lib file not available?\"\n echo \" EXIT: $1\"\n echo \" EXIT: Cannot continue\"\n echo \" EXIT: Bye (0)\"\n echo\n touch /opt/tmp/status-AegirUpgrade-FAIL\n exit 1\n}\n\n\n###\n### Include default settings and basic functions\n###\n[ -r \"${_vBs}/${_filIncB}\" ] || _panic_exit \"${_vBs}/${_filIncB}\"\n source \"${_vBs}/${_filIncB}\"\n\n\n###\n### Include shared functions\n###\n_FL=\"helper master\"\nfor f in ${_FL}; do\n [ -r \"${_libFnc}/${f}.sh.inc\" ] || _panic_exit \"${f}\"\n source \"${_libFnc}/${f}.sh.inc\"\ndone\n\n\n###\n### Local settings\n###\nif [ \"${_THIS_DB_HOST}\" = \"FQDN\" ]; then\n _THIS_DB_HOST=\"$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\nfi\nif [ \"${_PHP_CLI_VERSION}\" = \"8.4\" ] \\\n && [ -x \"/opt/php84/bin/php\" ]; then\n _T_CLI=/opt/php84/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.5\" ] \\\n && [ -x \"/opt/php85/bin/php\" ]; then\n _T_CLI=/opt/php85/bin\nelif [ \"${_PHP_CLI_VERSION}\" = \"8.3\" ] \\\n && [ -x \"/opt/php83/bin/php\" ]; then\n _T_CLI=/opt/php83/bin\nfi\n_ROOT=\"${HOME}\"\n_DRUSHCMD=\"${_T_CLI}/php ${_ROOT}/drush/drush.php\"\n#\nPATH=${_T_CLI}:/usr/local/bin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin\nSHELL=/bin/bash\n#\n_crlGet=\"-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab\"\n_wgetGet=\"--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'\"\n_gCb=\"git clone --branch\"\n_gitHub=\"https://github.com/omega8cc\"\n_gitLab=\"https://gitlab.com/omega8cc\"\n#\nexport _urlDev=\"http://${_USE_MIR}/dev\"\nexport _urlHmr=\"http://${_USE_MIR}/versions/${_tRee}/boa/aegir\"\n\n\n###---### Local functions\n#\n#\nexport DEBIAN_FRONTEND=noninteractive\nexport APT_LISTCHANGES_FRONTEND=none\nif [ -z \"${TERM+x}\" ]; then\n export TERM=vt100\nfi\n#\n_hostmaster_mv_up() {\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Moving old directories\"\n fi\n mkdir -p ${_ROOT}/backups/system\n chmod 700 ${_ROOT}/backups/system\n mv -f ${_ROOT}/backups/drush-pre* ${_ROOT}/backups/system/ &> /dev/null\n _D_EXT=\"provision clean_missing_modules drupalgeddon drush_ecl make_local \\\n provision_boost provision_cdn provision_civicrm provision_site_backup \\\n provision_tasks_extra registry_rebuild remote_import \\\n safe_cache_form_clear security_check security_review utf8mb4_convert\"\n for e in ${_D_EXT}; do\n if [ -e \"${_ROOT}/.drush/$e\" ]; then\n mv -f ${_ROOT}/.drush/$e \\\n ${_ROOT}/backups/system/$e-pre-${_DISTRO}-${_NOW} &> /dev/null\n mv -f ${_ROOT}/backups/$e-pre* ${_ROOT}/backups/system/ &> /dev/null\n fi\n if [ -e \"${_ROOT}/.drush/xts/$e\" ]; then\n mv -f ${_ROOT}/.drush/xts/$e \\\n ${_ROOT}/backups/system/$e-pre-${_DISTRO}-${_NOW} &> /dev/null\n mv -f ${_ROOT}/backups/$e-pre* ${_ROOT}/backups/system/ &> /dev/null\n fi\n if [ -e \"${_ROOT}/.drush/usr/$e\" ]; then\n mv -f ${_ROOT}/.drush/usr/$e \\\n ${_ROOT}/backups/system/$e-pre-${_DISTRO}-${_NOW} &> /dev/null\n mv -f ${_ROOT}/backups/$e-pre* ${_ROOT}/backups/system/ &> /dev/null\n fi\n if [ -e \"${_ROOT}/.drush/sys/$e\" ]; then\n mv -f ${_ROOT}/.drush/sys/$e \\\n ${_ROOT}/backups/system/$e-pre-${_DISTRO}-${_NOW} &> /dev/null\n mv -f ${_ROOT}/backups/$e-pre* ${_ROOT}/backups/system/ &> /dev/null\n fi\n done\n}\n#\n_hostmaster_go_up() {\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Installing Ægir Provision backend...\"\n fi\n mkdir -p ${_ROOT}/.drush/{sys,xts,usr}\n rm -rf ${_ROOT}/.drush/drush_make\n rm -rf ${_ROOT}/.drush/sys/drush_make\n cd ${_ROOT}/.drush\n if [ \"${_DL_MODE}\" = \"BATCH\" ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Downloading Drush and Provision extensions from ${_DL_MODE}-${_AEGIR_VERSION}...\"\n fi\n rm -rf ${_ROOT}/.drush/{sys,xts,usr}\n rm -rf ${_ROOT}/.drush/{provision,drush_make}\n _get_dev_ext \"backend.tar.gz\"\n mv -f ${_ROOT}/.drush/backend/sys ${_ROOT}/.drush/\n mv -f ${_ROOT}/.drush/backend/xts ${_ROOT}/.drush/\n mv -f ${_ROOT}/.drush/backend/usr ${_ROOT}/.drush/\n if [ -e \"${_ROOT}/.drush/sys/provision/provision.inc\" ] \\\n && [ -d \"${_ROOT}/.drush/xts/security_review\" ] \\\n && [ -d \"${_ROOT}/.drush/usr/registry_rebuild\" ]; then\n [ -e \"${_ROOT}/.drush/backend\" ] && rm -rf ${_ROOT}/.drush/backend*\n fi\n elif [ \"${_DL_MODE}\" = \"GIT\" ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Downloading Drush and Provision extensions from ${_DL_MODE}-${_AEGIR_VERSION}...\"\n fi\n rm -rf ${_ROOT}/.drush/{sys,xts,usr}\n rm -rf ${_ROOT}/.drush/{provision,drush_make}\n mkdir -p ${_ROOT}/.drush/{sys,xts,usr}\n _rD=\"${_ROOT}/.drush\"\n ${_gCb} ${_BRANCH_PRN} ${_gitHub}/provision.git ${_rD}/sys/provision &> /dev/null\n ${_gCb} 7.x-1.x-dev ${_gitHub}/drupalgeddon.git ${_rD}/usr/drupalgeddon &> /dev/null\n ${_gCb} 7.x-1.x ${_gitHub}/drush_ecl.git ${_rD}/usr/drush_ecl &> /dev/null\n ${_gCb} 7.x-1.x ${_gitHub}/security_review.git ${_rD}/xts/security_review &> /dev/null\n ${_gCb} 7.x-2.x ${_gitHub}/provision_boost.git ${_rD}/xts/provision_boost &> /dev/null\n ${_gCb} 7.x-2.x ${_gitHub}/registry_rebuild.git ${_rD}/usr/registry_rebuild &> /dev/null\n ${_gCb} 7.x-1.x ${_gitHub}/safe_cache_form_clear.git ${_rD}/usr/safe_cache_form_clear &> /dev/null\n rm -rf ${_rD}/*/.git\n rm -rf ${_rD}/*/*/.git\n cd ${_rD}/usr\n _get_dev_ext \"clean_missing_modules.tar.gz\"\n _get_dev_ext \"utf8mb4_convert-7.x-1.3.tar.gz\"\n else\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Downloading Drush and Provision extensions from ${_DL_MODE}-${_AEGIR_VERSION}...\"\n fi\n cd ${_ROOT}/.drush/sys\n _get_dev_ext \"provision.tar.gz\"\n cd ${_ROOT}/.drush/usr\n _get_dev_ext \"clean_missing_modules.tar.gz\"\n _get_dev_ext \"drupalgeddon.tar.gz\"\n _get_dev_ext \"drush_ecl.tar.gz\"\n _get_dev_ext \"registry_rebuild.tar.gz\"\n _get_dev_ext \"safe_cache_form_clear.tar.gz\"\n _get_dev_ext \"utf8mb4_convert-7.x-1.3.tar.gz\"\n cd ${_ROOT}/.drush/xts\n _get_dev_ext \"provision_boost.tar.gz\"\n _get_dev_ext \"security_review.tar.gz\"\n fi\n rm -rf ${_ROOT}/.drush/*/.git\n rm -rf ${_ROOT}/.drush/*/*/.git\n sed -i \"s/files.aegir.cc/${_USE_MIR}/g\" ${_ROOT}/.drush/sys/provision/aegir.make &> /dev/null\n cd ${_PREV_HM_ROOT}\n}\n#\n_hostmaster_dr_tt() {\n if ${_DRUSHCMD} help | grep \"^ provision-install\" > /dev/null ; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"${_STATUS} B: Drush test result OK\"\n fi\n else\n _msg \"FATAL ERROR: Drush is broken (${_DRUSHCMD} help failed)\"\n _msg \"FATAL ERROR: Aborting AegirUpgrade installer NOW!\"\n touch /opt/tmp/status-AegirUpgrade-FAIL\n exit 1\n fi\n}\n#\n_hostmaster_mi_up() {\n _msg \"INFO: Running hostmaster-migrate, please wait...\"\n ### security_review breaks the upgrade if active\n mv -f ${_ROOT}/.drush/xts/security_review/security_review.drush.inc \\\n ${_ROOT}/.drush/xts/security_review/foo.txt &> /dev/null\n export DEBIAN_FRONTEND=noninteractive\n export APT_LISTCHANGES_FRONTEND=none\n if [ -z \"${TERM+x}\" ]; then\n export TERM=vt100\n fi\n\n #\n # Fix broken Entity module if needed.\n #\n _pthA=\"profiles/hostmaster/modules/contrib/entity\"\n _pthB=\"module_filter.module\"\n #\n if [ -e \"${_PREV_HM_ROOT}/${_pthA}/${_pthB}\" ]; then\n _msg \"INFO: Fixing broken Entity module...\"\n rm -rf ${_PREV_HM_ROOT}/${_pthA}\n cd ${_PREV_HM_ROOT}/profiles/hostmaster/modules/contrib\n _get_dev_stc \"entity-7.x-1.12.tar.gz\"\n ${_DRUSHCMD} @hostmaster en entity -y\n ${_DRUSHCMD} @hostmaster dis hosting_ssl -y\n ${_DRUSHCMD} @hostmaster dis hosting_le -y\n ${_DRUSHCMD} @hostmaster dis hosting_le_vhost -y\n ${_DRUSHCMD} @hostmaster dis hosting_nginx_ssl -y\n ${_DRUSHCMD} @hostmaster sqlq \"DELETE FROM hosting_service WHERE service LIKE 'http'\"\n ${_DRUSHCMD} @hostmaster sqlq \"INSERT INTO hosting_service (nid, vid, service, type, restart_cmd, port, available) VALUES ('2', '2', 'http', 'nginx', 'sudo /etc/init.d/nginx reload', '80', '1')\"\n ${_DRUSHCMD} @hostmaster sqlq \"UPDATE hosting_service SET type='nginx' WHERE service='http'\"\n ${_DRUSHCMD} @hostmaster hosting-task @server_master verify --force\n ${_DRUSHCMD} @hostmaster hosting-dispatch\n wait\n sleep 5\n ${_DRUSHCMD} @hostmaster hosting-tasks --force\n wait\n sleep 5\n ${_DRUSHCMD} @hostmaster hosting-tasks --force\n wait\n sleep 5\n ${_DRUSHCMD} @hostmaster hosting-tasks --force\n wait\n _msg \"INFO: Waiting 15 seconds...\"\n sleep 15\n fi\n _BROKEN_SSL_TEST=$(grep \"nginx default ssl server\" /var/aegir/config/server_master/nginx.conf 2>&1)\n if [ ! -z \"${_BROKEN_SSL_TEST}\" ]; then\n _msg \"INFO: Disabling nginx_ssl on master...\"\n ${_DRUSHCMD} @hostmaster dis hosting_ssl -y\n ${_DRUSHCMD} @hostmaster dis hosting_le -y\n ${_DRUSHCMD} @hostmaster dis hosting_le_vhost -y\n ${_DRUSHCMD} @hostmaster dis hosting_nginx_ssl -y\n ${_DRUSHCMD} @hostmaster sqlq \"DELETE FROM hosting_service WHERE service LIKE 'http'\"\n ${_DRUSHCMD} @hostmaster sqlq \"INSERT INTO hosting_service (nid, vid, service, type, restart_cmd, port, available) VALUES ('2', '2', 'http', 'nginx', 'sudo /etc/init.d/nginx reload', '80', '1')\"\n ${_DRUSHCMD} @hostmaster sqlq \"UPDATE hosting_service SET type='nginx' WHERE service='http'\"\n ${_DRUSHCMD} @hostmaster hosting-task @server_master verify --force\n ${_DRUSHCMD} @hostmaster hosting-dispatch\n wait\n sleep 5\n ${_DRUSHCMD} @hostmaster hosting-tasks --force\n wait\n sleep 5\n ${_DRUSHCMD} @hostmaster hosting-tasks --force\n wait\n sleep 5\n ${_DRUSHCMD} @hostmaster hosting-tasks --force\n wait\n touch /var/aegir/disable_nginx_ssl.log\n _msg \"INFO: Waiting 5 seconds...\"\n sleep 5\n fi\n if [ -e \"${_PREV_HM_ROOT}/modules/path_alias_cache\" ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n ${_DRUSHCMD} @hostmaster dis aegir_custom_settings -y\n ${_DRUSHCMD} @hostmaster pm-uninstall aegir_custom_settings -y\n ${_DRUSHCMD} @hostmaster dis hosting_advanced_cron -y\n ${_DRUSHCMD} @hostmaster en ctools -y\n ${_DRUSHCMD} @hostmaster registry-rebuild\n else\n ${_DRUSHCMD} @hostmaster dis aegir_custom_settings -y &> /dev/null\n ${_DRUSHCMD} @hostmaster pm-uninstall aegir_custom_settings -y &> /dev/null\n ${_DRUSHCMD} @hostmaster dis hosting_advanced_cron -y &> /dev/null\n ${_DRUSHCMD} @hostmaster en ctools -y &> /dev/null\n ${_DRUSHCMD} @hostmaster registry-rebuild &> /dev/null\n fi\n else\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n ${_DRUSHCMD} @hostmaster dis hosting_custom_settings -y\n ${_DRUSHCMD} @hostmaster pm-uninstall hosting_custom_settings -y\n ${_DRUSHCMD} @hostmaster registry-rebuild\n else\n ${_DRUSHCMD} @hostmaster dis hosting_custom_settings -y &> /dev/null\n ${_DRUSHCMD} @hostmaster pm-uninstall hosting_custom_settings -y &> /dev/null\n ${_DRUSHCMD} @hostmaster registry-rebuild &> /dev/null\n fi\n fi\n ${_DRUSHCMD} cc drush &> /dev/null\n rm -rf ${_ROOT}/.tmp/cache\n ${_DRUSHCMD} @hostmaster sqlc < ${_bldPth}/aegir/helpers/hosting_cron.sql &> /dev/null\n ${_DRUSHCMD} @hostmaster sqlq \"DELETE FROM hosting_task_log \\\n WHERE timestamp < UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 3 MONTH))\" &> /dev/null\n ${_DRUSHCMD} @hostmaster sqlq \"OPTIMIZE TABLE hosting_task_log\" &> /dev/null\n ${_DRUSHCMD} @hostmaster sqlq \"DELETE FROM hosting_task \\\n WHERE task_type='delete' AND task_status='-1'\" &> /dev/null\n ${_DRUSHCMD} @hostmaster sqlq \"DELETE FROM hosting_task \\\n WHERE task_type='delete' AND task_status='0' AND executed='0'\" &> /dev/null\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n ${_DRUSHCMD} hostmaster-migrate ${_DOMAIN} ${_HM_ROOT} -y -d\n else\n ${_DRUSHCMD} hostmaster-migrate ${_DOMAIN} ${_HM_ROOT} -y &> /dev/null\n fi\n if [ -e \"${_ROOT}/.drush/hostmaster.alias.drushrc.php\" ]; then\n _THIS_HM_ROOT=$(cat ${_ROOT}/.drush/hostmaster.alias.drushrc.php \\\n | grep \"root'\" \\\n | cut -d: -f2 \\\n | awk '{ print $3}' \\\n | sed \"s/[\\,']//g\" 2>&1)\n if [ -e \"${_THIS_HM_ROOT}/sites/all\" ] \\\n && [ ! -e \"${_THIS_HM_ROOT}/sites/all/libraries\" ]; then\n mkdir -p \\\n ${_THIS_HM_ROOT}/sites/all/{modules,themes,libraries} &> /dev/null\n fi\n fi\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n ${_DRUSHCMD} @hostmaster registry-rebuild\n ${_DRUSHCMD} @hostmaster en hosting_cron -y\n ${_DRUSHCMD} @hostmaster cache-clear all\n ${_DRUSHCMD} @hostmaster updb -y\n else\n ${_DRUSHCMD} @hostmaster registry-rebuild &> /dev/null\n ${_DRUSHCMD} @hostmaster en hosting_cron -y &> /dev/null\n ${_DRUSHCMD} @hostmaster cache-clear all &> /dev/null\n ${_DRUSHCMD} @hostmaster updb -y &> /dev/null\n fi\n export DEBIAN_FRONTEND=text\n mv -f ${_ROOT}/.drush/xts/security_review/foo.txt \\\n ${_ROOT}/.drush/xts/security_review/security_review.drush.inc &> /dev/null\n mkdir -p ${_ROOT}/backups/system/old_hostmaster\n chmod 700 ${_ROOT}/backups/system/old_hostmaster\n chmod 700 ${_ROOT}/backups/system\n mv -f ${_ROOT}/backups/*host8* \\\n ${_ROOT}/backups/system/old_hostmaster/ &> /dev/null\n mv -f ${_ROOT}/backups/*o8.io* \\\n ${_ROOT}/backups/system/old_hostmaster/ &> /dev/null\n mv -f ${_ROOT}/backups/*boa.io* \\\n ${_ROOT}/backups/system/old_hostmaster/ &> /dev/null\n mv -f ${_ROOT}/backups/*aegir.cc* \\\n ${_ROOT}/backups/system/old_hostmaster/ &> /dev/null\n chmod 600 ${_ROOT}/backups/system/old_hostmaster/* &> /dev/null\n}\n\n###--------------------###\n\n_LASTNUM=001\n_DISTRO=001\n_PREV_HM_ROOT=$(find ${_ROOT} -maxdepth 1 -type d | grep hostmaster 2>&1)\n\nif [ -d \"${_ROOT}/host_master\" ]; then\n if [ ! -d \"${_ROOT}/host_master/000\" ]; then\n mkdir -p ${_ROOT}/host_master/000\n if [ ! -e \"${_ROOT}/host_master/000/placeholder_dont_remove.txt\" ]; then\n touch ${_ROOT}/host_master/000/placeholder_dont_remove.txt\n fi\n fi\nfi\n\nif [ -d \"${_ROOT}/host_master/000\" ]; then\n cd ${_ROOT}/host_master\n _list=([0-9]*)\n _last=${_list[@]: -1}\n _LASTNUM=$_last\n _BASH_TEST=$(bash --version 2>&1)\n if [[ \"${_BASH_TEST}\" =~ \"version 5.1\" ]] || [[ \"${_BASH_TEST}\" =~ \"version 5.2\" ]]; then\n _nextnum=00$((10#0${_last%%[^0-9]*} + 1))\n else\n _nextnum=00$((10#${_last%%[^0-9]*} + 1))\n fi\n _nextnum=${_nextnum: -3}\n _PREV_HM_ROOT_TEST=\"${_ROOT}/host_master/${_LASTNUM}\"\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Testing previous install...\"\n fi\n if [ -e \"${_PREV_HM_ROOT_TEST}/sites/${_DOMAIN}/settings.php\" ]; then\n _DISTRO=${_nextnum}\n _PREV_HM_ROOT=\"${_ROOT}/host_master/${_LASTNUM}\"\n if [ -e \"${_PREV_HM_ROOT}/modules/path_alias_cache\" ]; then\n _DEBUG_MODE=YES\n fi\n else\n _DEBUG_MODE=YES\n _msg \"INFO: Testing previous install...\"\n _msg \"INFO: OPS, zombie found, moving it to backups...\"\n sleep 1\n mv -f ${_PREV_HM_ROOT_TEST} \\\n ${_ROOT}/backups/system/empty-hm-${_LASTNUM}-${_NOW} &> /dev/null\n cd ${_ROOT}/host_master\n _list=([0-9]*)\n _last=${_list[@]: -1}\n _LASTNUM=$_last\n _BASH_TEST=$(bash --version 2>&1)\n if [[ \"${_BASH_TEST}\" =~ \"version 5.1\" ]] || [[ \"${_BASH_TEST}\" =~ \"version 5.2\" ]]; then\n _nextnum=00$((10#0${_last%%[^0-9]*} + 1))\n else\n _nextnum=00$((10#${_last%%[^0-9]*} + 1))\n fi\n _nextnum=${_nextnum: -3}\n _DISTRO=${_nextnum}\n _PREV_HM_ROOT_TEST=\"${_ROOT}/host_master/${_LASTNUM}\"\n _msg \"INFO: Testing previous install again after removing zombie...\"\n sleep 1\n if [ -e \"${_PREV_HM_ROOT_TEST}/sites/${_DOMAIN}/settings.php\" ]; then\n _DISTRO=${_nextnum}\n _PREV_HM_ROOT=\"${_ROOT}/host_master/${_LASTNUM}\"\n else\n _DEBUG_MODE=YES\n _msg \"INFO: Testing previous install again...\"\n _msg \"INFO: OPS, another zombie found, moving it to backups...\"\n sleep 1\n mv -f ${_PREV_HM_ROOT_TEST} \\\n ${_ROOT}/backups/system/empty-hm-${_LASTNUM}-${_NOW}-sec &> /dev/null\n cd ${_ROOT}/host_master\n _list=([0-9]*)\n _last=${_list[@]: -1}\n _LASTNUM=$_last\n _BASH_TEST=$(bash --version 2>&1)\n if [[ \"${_BASH_TEST}\" =~ \"version 5.1\" ]] || [[ \"${_BASH_TEST}\" =~ \"version 5.2\" ]]; then\n _nextnum=00$((10#0${_last%%[^0-9]*} + 1))\n else\n _nextnum=00$((10#${_last%%[^0-9]*} + 1))\n fi\n _nextnum=${_nextnum: -3}\n _DISTRO=${_nextnum}\n _PREV_HM_ROOT_TEST=\"${_ROOT}/host_master/${_LASTNUM}\"\n _msg \"INFO: Testing previous install again after removing second zombie...\"\n sleep 1\n if [ -e \"${_PREV_HM_ROOT_TEST}/sites/${_DOMAIN}/settings.php\" ]; then\n _DISTRO=${_nextnum}\n _PREV_HM_ROOT=\"${_ROOT}/host_master/${_LASTNUM}\"\n fi\n fi\n fi\nfi\n\n_HM_ROOT=\"${_ROOT}/host_master/${_DISTRO}\"\nif [ -d \"${_HM_ROOT}\" ]; then\n _msg \"FATAL ERROR: ${_HM_ROOT} already exists\"\n _msg \"FATAL ERROR: Too many zombies to delete! Try again...\"\n _msg \"FATAL ERROR: Aborting AegirUpgrade installer NOW!\"\n touch /opt/tmp/status-AegirUpgrade-FAIL\n exit 1\nfi\n\nmkdir -p ${_ROOT}/host_master\nchmod 711 ${_ROOT}/host_master &> /dev/null\nif [ ! -d \"/var/aegir/.drush/sys/provision/http\" ]; then\n _msg \"FATAL ERROR: Required directory does not exist:\"\n _msg \"FATAL ERROR: /var/aegir/.drush/sys/provision/http\"\n _msg \"FATAL ERROR: Aborting AegirUpgrade installer NOW!\"\n touch /opt/tmp/status-AegirUpgrade-FAIL\n exit 1\nfi\nif [ -e \"${_PREV_HM_ROOT}/sites/${_DOMAIN}/settings.php\" ]; then\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Test OK, we can proceed with Hostmaster upgrade\"\n fi\n _hostmaster_mv_up\n _hostmaster_dr_up\n _hostmaster_go_up\n _hostmaster_dr_tt\n _hostmaster_mi_up\nelse\n _msg \"FATAL ERROR: Your setup is probably broken because required file\"\n _msg \"FATAL ERROR: ${_PREV_HM_ROOT}/sites/${_DOMAIN}/settings.php\"\n _msg \"FATAL ERROR: does not exist\"\n _msg \"FATAL ERROR: Aborting AegirUpgrade installer NOW!\"\n touch /opt/tmp/status-AegirUpgrade-FAIL\n exit 1\nfi\n\n\n###----------------------------------------###\n###\n### Barracuda Ægir Installer\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n###----------------------------------------###\n" }, { "path": "aegir/scripts/run-xdrago", "content": "#!/bin/bash\n\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nexport _tRee=dev\n\n_H_USER=EDIT_USER\n\n_check_root() {\n if [ \"$(id -u)\" -eq 0 ]; then\n ionice -c2 -n7 -p $$\n renice 9 -p $$\n chmod a+w /dev/null\n else\n echo \"ERROR: This script should be run as a root user\"\n exit 1\n fi\n _DF_TEST=\"$(command df -P -l / 2>/dev/null | awk '\n NR==1 { for (i=1; i<=NF; i++) if ($i==\"Use%\" || $i==\"Capacity\") u=i }\n NR==2 { gsub(/%/,\"\",$u); print $u }')\"\n if [ ! -z \"${_DF_TEST}\" ] && [ \"${_DF_TEST}\" -gt 90 ]; then\n echo \"ERROR: Your disk space is almost full !!! ${_DF_TEST}/100\"\n echo \"ERROR: We can not proceed until it is below 90/100\"\n exit 1\n fi\n}\n_check_root\n\n_run_cleanup() {\n _buildTest=\"1\"\n _tpDir=\"/data/disk/${_H_USER}/.tmp\"\n _ceDir=\"${_tpDir}/cache\"\n _dlDir=\"${_ceDir}/download\"\n _gtDir=\"${_ceDir}/git\"\n _clCtr=\"/data/disk/${_H_USER}/static/control/clear-drush-cache.info\"\n _exCtr=\"/data/disk/${_H_USER}/backups/tmp_expim/metadata\"\n if [ -e \"${_tpDir}\" ]; then\n _buildTest=$(ls ${_tpDir} | grep \"_tmp_\" | wc -l | tr -d \"\\n\" 2>&1)\n _buildTest=${_buildTest//[^0-9]/}\n fi\n if [ -e \"${_clCtr}\" ]; then\n if [ -e \"${_exCtr}\" ]; then\n rm -f ${_exCtr}\n rm -f ${_clCtr}\n _buildTest=\"0\"\n fi\n if [ -e \"${_gtDir}\" ] || [ \"${_buildTest}\" -ge 1 ]; then\n rm -rf ${_tpDir}/*\n rm -f ${_clCtr}\n _buildTest=\"0\"\n fi\n fi\n if [ \"${_buildTest}\" = \"0\" ] && [ -e \"${_gtDir}\" ]; then\n rm -rf ${_gtDir}\n rm -rf ${_dlDir}\n fi\n}\n_run_cleanup\n\n# Remove dangerous stuff from the string.\n_sanitize_string() {\n echo \"$1\" | sed 's/[\\\\\\/\\^\\?\\>\\`\\#\\\"\\{\\(\\&\\|\\*]//g; s/\\(['\"'\"'\\]\\)//g'\n}\n\n# Generate new sftp password and update expiration date\n_if_sftp_password_update() {\n _upCtr=\"/data/disk/${_H_USER}/static/control/run-sftp-password-update.pid\"\n if [ -e \"${_upCtr}\" ]; then\n _sftpUser=\"${_H_USER}.ftp\"\n rm -f ${_upCtr}\n _PWD_CHARS=64\n _RANDPASS_TEST=$(randpass -V 2>&1)\n if [[ \"${_RANDPASS_TEST}\" =~ \"alnum\" ]]; then\n _ESC_PASS=$(randpass \"${_PWD_CHARS}\" alnum 2>&1)\n else\n _ESC_PASS=$(shuf -zer -n64 {A..Z} {a..z} {0..9} % @ | tr -d '\\0' 2>&1)\n _ESC_PASS=$(echo -n \"${_ESC_PASS}\" | tr -d \"\\n\" 2>&1)\n _ESC_PASS=$(_sanitize_string \"${_ESC_PASS}\" 2>&1)\n fi\n _ESC_PASS=$(echo -n \"${_ESC_PASS}\" | tr -d \"\\n\" 2>&1)\n _LEN_PASS=$(echo ${#_ESC_PASS} 2>&1)\n if [ -z \"${_ESC_PASS}\" ] || [ \"${_LEN_PASS}\" -lt 9 ]; then\n _ESC_PASS=$(shuf -zer -n64 {A..Z} {a..z} {0..9} % @ | tr -d '\\0' 2>&1)\n _ESC_PASS=$(echo -n \"${_ESC_PASS}\" | tr -d \"\\n\" 2>&1)\n _ESC_PASS=$(_sanitize_string \"${_ESC_PASS}\" 2>&1)\n fi\n _LEN_PASS=$(echo ${#_ESC_PASS} 2>&1)\n if [ ! -z \"${_ESC_PASS}\" ] && [ \"${_LEN_PASS}\" -gt 9 ]; then\n chage -I -1 -m 0 -M 99999 -E -1 ${_sftpUser}\n echo \"${_sftpUser}:${_ESC_PASS}\" | chpasswd\n chage -M 90 ${_sftpUser}\n chage -W 7 ${_sftpUser}\n chage -d $(date +%Y-%m-%d) ${_sftpUser}\n echo \"${_ESC_PASS}\" > /data/disk/${_H_USER}/static/control/new-${_sftpUser}-password.txt\n fi\n fi\n}\n\n_if_octopus_upgrade() {\n _upCtr=\"/data/disk/${_H_USER}/static/control/run-upgrade.pid\"\n _plCtr=\"/data/disk/${_H_USER}/static/control/platforms.info\"\n if [ -e \"${_plCtr}\" ] && [ -e \"${_upCtr}\" ]; then\n rm -f ${_upCtr}\n [ -e \"/root/.silent.update.cnf\" ] && rm -f /root/.silent.update.cnf\n _TODAY=$(date +%y%m%d)\n _TODAY=${_TODAY//[^0-9]/}\n _NOW=$(date +%y%m%d-%H%M%S)\n _NOW=${_NOW//[^0-9-]/}\n _vBs=\"/var/backups\"\n _LOG_UP_DIR=\"${_vBs}/reports/up/$(basename \"$0\")/${_TODAY}\"\n _UP_OCTOPUS_LOG=\"${_LOG_UP_DIR}/$(basename \"$0\")-up-octopus-${_NOW}.log\"\n mkdir -p ${_LOG_UP_DIR}\n nohup /opt/local/bin/octopus up-${_tRee} ${_H_USER} force log noscreen >${_UP_OCTOPUS_LOG} 2>&1 &\n fi\n}\n\n_run_action() {\n if [ \"${_buildTest}\" = \"0\" ] \\\n || [ -z \"${_buildTest}\" ] \\\n || [ ! -e \"${_ceDir}\" ]; then\n su -s /bin/bash - ${_H_USER} -c \"drush8 cc drush\" &> /dev/null\n wait\n su -s /bin/bash - ${_H_USER} -c \"bash /data/disk/${_H_USER}/aegir.sh\"\n wait\n touch /var/log/boa/last-run-${_H_USER}\n else\n touch /var/log/boa/skip-run-${_H_USER}\n fi\n}\n\nif [ -e \"/run/boa_wait.pid\" ]; then\n touch /var/log/boa/wait-${_H_USER}\n exit 0\nelse\n _if_sftp_password_update\n _if_octopus_upgrade\n _run_action\n exit 0\nfi\n" }, { "path": "aegir/tools/BOND.sh.txt", "content": "#!/bin/bash\n\n\n###----------------------------------------###\n###\n### Barracuda-Octopus-Nginx-Drupal Tuner\n###\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n### This program is free software. You can\n### redistribute it and/or modify it under\n### the terms of the GNU GPL as published by\n### the Free Software Foundation, version 2\n### or later.\n###\n### This program is distributed in the hope\n### that it will be useful, but WITHOUT ANY\n### WARRANTY; without even the implied\n### warranty of MERCHANTABILITY or FITNESS\n### FOR A PARTICULAR PURPOSE. See the GNU GPL\n### for more details.\n###\n### You should have received a copy of the\n### GNU GPL along with this program.\n### If not, see http://www.gnu.org/licenses/\n###\n### Code: https://github.com/omega8cc/boa\n###\n###----------------------------------------###\n\n\n###----------------------------------------###\n### How To: run it with bash, not with sh ###\n###----------------------------------------###\n###\n### $ bash BOND.sh.txt\n###\n### Note: to restore default values it is\n### enough to start this script with\n### any values defined below and answer\n### NO when it prompts for confirmation\n### \"Are you ready to tune your Ægir\".\n###\n\n\n###----------------------------------------###\n### EDITME ###\n###----------------------------------------###\n###\n### Enter below the settings you wish to use.\n###\n\n\n###----------------------------------------###\n### Hostmaster root directory - /var/aegir\n###\n### Note: most of values tuned by this script\n### are server-vide, while some, like\n### mod_evasive settings will affect\n### only sites hosted on the Ægir\n### Satellite Instance defined below.\n###\n_TUNE_HOSTMASTER=/data/disk/o1\n\n\n###----------------------------------------###\n### Nginx server mod_evasive - default ON\n###\n### Note: running verify task on any SITE\n### will restore default value ON\n### for that site only, while TUNER\n### will turn OFF/ON this feature\n### for all sites hosted on the\n### Hostmaster defined above.\n###\n_TUNE_NGINX_CONNECT=OFF\n\n\n###----------------------------------------###\n### Nginx server fastcgi timeout - default 180\n###\n### Note: running verify task on the SERVER\n### in the Hostmaster created\n### by Barracuda (not Octopus!)\n### will restore default value\n### for the server and all existing\n### Ægir Satellite Instances.\n###\n_TUNE_NGINX_TIMEOUT=9999\n\n\n###----------------------------------------###\n### Nginx server firewall limit - default 300\n###\n### Note: don't change the default value\n### if you are the only visitor, or\n### you will lock yourself easily.\n###\n### The default value 300 means the\n### firewall limit is OFF because\n### it scans only the last 300 lines\n### of your web server log file.\n###\n### If you will set this value to 100\n### then every visitor IP with more\n### than 100 out of the last 300\n### requests will be locked.\n###\n### Only dynamic requests (pages) are\n### counted because static files like\n### images are generally not logged.\n###\n_TUNE_NGINX_FIREWALL=300\n\n\n###----------------------------------------###\n### Database server timeout - default 9999\n###\n_TUNE_SQL_TIMEOUT=9999\n\n\n###----------------------------------------###\n### PHP-FPM server timeout - default 180\n###\n_TUNE_PHP_FPM_TIMEOUT=9999\n\n\n###----------------------------------------###\n### PHP-CLI server timeout - default 9999\n###\n_TUNE_PHP_CLI_TIMEOUT=9999\n\n\n###----------------------------------------###\n### DON'T EDIT ANYTHING BELOW THIS LINE ###\n###----------------------------------------###\n\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nexport _tRee=dev\nexport _xSrl=591devT01\n\n_AEGIR_VERSION=\"${_tRee}\"\n_BRANCH_BOA=\"5.x-${_tRee}\"\n_X_VERSION=\"BOA-5.9.1-${_tRee}\"\n_MYSQLTUNER_VRN=1.9.4\n\n_NOW=$(date +%y%m%d-%H%M%S)\n_NOW=${_NOW//[^0-9-]/}\n_RAM=$(free -mt | grep Mem: | awk '{ print $2 }' 2>&1)\n_SPINNER=NO\nif [ -n \"${STY+x}\" ]; then\n _SPINNER=NO\nfi\n_PHP56_API=20131226\n_PHP56_VRN=5.6.40\n_PHP70_API=20151012\n_PHP70_VRN=7.0.33\n_PHP71_API=20160303\n_PHP71_VRN=7.1.33\n_PHP72_API=20170718\n_PHP72_VRN=7.2.34\n_PHP73_API=20180731\n_PHP73_VRN=7.3.33\n_PHP74_API=20190902\n_PHP74_VRN=7.4.33\n_PHP80_API=20200930\n_PHP80_VRN=8.0.30\n_PHP81_API=20210902\n_PHP81_VRN=8.1.34\n_PHP82_API=20220829\n_PHP82_VRN=8.2.31\n_PHP83_API=20230831\n_PHP83_VRN=8.3.31\n_PHP84_API=20240924\n_PHP84_VRN=8.4.21\n_PHP85_API=20250925\n_PHP85_VRN=8.5.6\n\n###\n### Helper variables\n###\n_bldPth=\"/opt/tmp/boa\"\n_crlGet=\"-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab\"\n_wgetGet=\"--max-redirect=3 --no-check-certificate -q --tries=9 --wait=9 --user-agent='iCab'\"\n_aptAllow=\"--allow-unauthenticated\"\n_aptYesUnth=\"-y ${_aptAllow}\"\n_gCb=\"git clone --branch\"\n_gitHub=\"https://github.com/omega8cc\"\n_gitLab=\"https://gitlab.com/omega8cc\"\n_libFnc=\"${_bldPth}/lib/functions\"\n_locCnf=\"${_bldPth}/aegir/conf\"\n_vBs=\"/var/backups\"\n\n###\n### Avoid too many questions\n###\nexport DEBIAN_FRONTEND=noninteractive\nexport APT_LISTCHANGES_FRONTEND=none\nif [ -z \"${TERM+x}\" ]; then\n export TERM=vt100\nfi\n\n###---### Functions\n#\n# Clean pid files on exit.\n_clean_pid_exit() {\n if [ -n \"${1}\" ]; then\n echo \"REASON ${1} on $(date)\" >> /root/.bond.sh.exit.exceptions.log\n [ -e \"/opt/tmp/boa\" ] && rm -rf /opt/tmp/*\n fi\n [ -e \"/run/boa_wait.pid\" ] && rm -f /run/boa_wait.pid\n [ -e \"/run/boa_run.pid\" ] && rm -f /run/boa_run.pid\n service cron start &> /dev/null\n exit 1\n}\n\n_check_root() {\n if [ \"$(id -u)\" -eq 0 ]; then\n # shellcheck disable=SC1091\n [ -e \"/root/.barracuda.cnf\" ] && source /root/.barracuda.cnf\n\n # Sanitize to allow only digits and minus sign\n export _B_NICE=${_B_NICE//[^0-9-]/}\n\n # Validate and set default if necessary\n if ! [[ \"${_B_NICE}\" =~ ^-?[0-9]+$ ]]; then\n _B_NICE=0\n fi\n\n # Clamp the value within -20 to 19\n if (( _B_NICE < -20 )); then\n _B_NICE=-20\n elif (( _B_NICE > 19 )); then\n _B_NICE=19\n fi\n\n renice ${_B_NICE} -p $$ &> /dev/null\n ionice -c2 -n7 -p $$\n else\n echo \"ERROR: This script should be run as a root user\"\n _clean_pid_exit\n fi\n _hName=\"$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\n}\n_check_root\n\n_os_detection_minimal() {\n _APT_UPDATE=\"apt-get update\"\n _OS_CODE=$(lsb_release -ar 2>/dev/null | grep -i codename | cut -s -f2)\n _OS_LIST=\"excalibur daedalus chimaera beowulf buster bullseye bookworm trixie\"\n for e in ${_OS_LIST}; do\n if [ \"${e}\" = \"${_OS_CODE}\" ]; then\n _APT_UPDATE=\"apt-get update --allow-releaseinfo-change\"\n fi\n done\n}\n_os_detection_minimal\n\n_apt_clean_update() {\n ${_APT_UPDATE} -qq 2>/dev/null\n _CALLER_SCRIPT=\"$(basename \"${BASH_SOURCE[-1]}\")\"\n _CALLER_SCRIPT=\"${_CALLER_SCRIPT//[^a-zA-Z0-9._-]/_}\"\n date +%s > \"/run/_latest_apt_clean_update.${_CALLER_SCRIPT}.pid\"\n}\n\n_if_hosted_sys() {\n if [ -e \"/root/.host8.cnf\" ] \\\n || [[ \"${_hName}\" =~ \".aegir.cc\"($) ]]; then\n _hostedSys=YES\n else\n _hostedSys=NO\n fi\n}\n\n_check_sql_running() {\n while [ -z \"${_IS_MYSQLD_RUNNING}\" ] \\\n || [ ! -e \"/run/mysqld/mysqld.sock\" ]; do\n _IS_MYSQLD_RUNNING=$(pgrep -f /usr/sbin/mysqld)\n echo \"INFO: Waiting for MySQLD availability...\"\n sleep 3\n done\n}\n_check_sql_running\n\n_check_sql_access() {\n if [ -e \"/root/.my.pass.txt\" ] && [ -e \"/root/.my.cnf\" ]; then\n _SQL_PSWD=$(cat /root/.my.pass.txt 2>/dev/null | tr -d '\\n')\n _IS_SYNC_SQL_PSWD=$(grep \"${_SQL_PSWD}\" /root/.my.cnf 2>&1)\n else\n echo \"ALERT: /root/.my.cnf or /root/.my.pass.txt not found.\"\n echo \"ALERT: Please fix this before trying again, giving up.\"\n echo \"Bye\"\n echo \" \"\n _clean_pid_exit _check_sql_access_a\n fi\n if [ -z \"${_IS_SYNC_SQL_PSWD}\" ] \\\n || [[ ! \"${_IS_SYNC_SQL_PSWD}\" =~ \"password=${_SQL_PSWD}\" ]]; then\n echo \"ALERT: SQL password is out of sync between\"\n echo \"ALERT: /root/.my.cnf and /root/.my.pass.txt\"\n echo \"ALERT: Please fix this before trying again, giving up.\"\n echo \"Bye\"\n echo \" \"\n _clean_pid_exit _check_sql_access_b\n else\n _IS_MYSQLD_RUNNING=$(pgrep -f /usr/sbin/mysqld)\n if [ -z \"${_IS_MYSQLD_RUNNING}\" ]; then\n echo \"ALERT: SQL server on this system is not running at all.\"\n echo \"ALERT: Please fix this before trying again, giving up.\"\n echo \"Bye\"\n echo \" \"\n _clean_pid_exit _check_sql_access_c\n else\n _MYSQL_CONN_TEST=$(mysql -u root -e \"status\" 2>&1)\n if [ -z \"${_MYSQL_CONN_TEST}\" ] \\\n || [[ \"${_MYSQL_CONN_TEST}\" =~ \"Access denied\" ]]; then\n echo \"ALERT: SQL password in /root/.my.cnf does not work.\"\n echo \"ALERT: Please fix this before trying again, giving up.\"\n echo \"Bye\"\n echo \" \"\n _clean_pid_exit _check_sql_access_d\n fi\n fi\n fi\n}\n_check_sql_access\n\n#\n# Noticeable messages.\n_msg() {\n echo \"Tuner [$(date)] ==> $*\"\n}\n# Simple prompt.\n_prompt_yes_no() {\nif [ \"${_AUTOPILOT}\" = \"YES\" ]; then\n return 0\nelse\n while true; do\n printf \"$* [Y/n] \"\n read _answer\n if [ -z \"${_answer}\" ]; then\n return 0\n fi\n case ${_answer} in\n [Yy]|[Yy][Ee][Ss])\n return 0\n ;;\n [Nn]|[Nn][Oo])\n return 1\n ;;\n *)\n echo \"Please answer yes or no\"\n ;;\n esac\n done\nfi\n}\n#\n# Count system CPUs.\n_count_cpu() {\n _CPU_INFO=\"$(grep -c processor /proc/cpuinfo)\"\n _CPU_INFO=${_CPU_INFO//[^0-9]/}\n _NPROC_TEST=\"$(which nproc)\"\n if [ -z \"${_NPROC_TEST}\" ]; then\n _CPU_NR=\"${_CPU_INFO}\"\n else\n _CPU_NR=$(nproc 2>&1)\n fi\n _CPU_NR=${_CPU_NR//[^0-9]/}\n if [ ! -z \"${_CPU_NR}\" ] \\\n && [ ! -z \"${_CPU_INFO}\" ] \\\n && [ \"${_CPU_NR}\" -gt \"${_CPU_INFO}\" ] \\\n && [ \"${_CPU_INFO}\" -gt 0 ]; then\n _CPU_NR=\"${_CPU_INFO}\"\n fi\n if [ -z \"${_CPU_NR}\" ] || [ \"${_CPU_NR}\" -lt 1 ]; then\n _CPU_NR=1\n fi\n}\n#\n# Find the fastest mirror.\n_find_fast_mirror_early() {\n _isNetc=\"$(which netcat)\"\n if [ ! -x \"${_isNetc}\" ] || [ -z \"${_isNetc}\" ]; then\n if [ ! -e \"/etc/apt/apt.conf.d/00sandboxoff\" ] \\\n && [ -e \"/etc/apt/apt.conf.d\" ]; then\n echo \"APT::Sandbox::User \\\"root\\\";\" > /etc/apt/apt.conf.d/00sandboxoff\n fi\n _apt_clean_update\n apt-get install netcat-traditional ${_aptYesUnth} 2> /dev/null\n wait\n fi\n _ffMirr=/opt/local/bin/ffmirror\n if [ -x \"${_ffMirr}\" ]; then\n _ffList=\"/var/backups/boa-mirrors-2025-01.txt\"\n [ -d \"/var/backups\" ] || mkdir -p /var/backups\n if [ ! -e \"${_ffList}\" ]; then\n echo \"eu.files.aegir.cc\" > ${_ffList}\n echo \"us.files.aegir.cc\" >> ${_ffList}\n echo \"ao.files.aegir.cc\" >> ${_ffList}\n fi\n if [ -e \"${_ffList}\" ]; then\n _BROKEN_FFMIRR_TEST=$(grep \"stuff\" ${_ffMirr} 2>&1)\n if [[ \"${_BROKEN_FFMIRR_TEST}\" =~ \"stuff\" ]]; then\n _CHECK_MIRROR=$(bash ${_ffMirr} < ${_ffList} 2>&1)\n _CHECK_MIRROR=$(bash ${_ffMirr} < ${_ffList} 2>&1)\n _USE_MIR=\"${_CHECK_MIRROR}\"\n [[ \"${_USE_MIR}\" =~ \"printf\" ]] && _USE_MIR=\"files.aegir.cc\"\n else\n _USE_MIR=\"files.aegir.cc\"\n fi\n else\n _USE_MIR=\"files.aegir.cc\"\n fi\n else\n _USE_MIR=\"files.aegir.cc\"\n fi\n _urlDev=\"http://${_USE_MIR}/dev\"\n _urlHmr=\"http://${_USE_MIR}/versions/${_tRee}/boa/aegir\"\n}\n#\n# Find correct IP.\n_find_correct_ip() {\n if [ -e \"/root/.found_correct_ipv4.cnf\" ]; then\n _LOC_IP=$(cat /root/.found_correct_ipv4.cnf 2>/dev/null | tr -d '\\n')\n else\n _LOC_IP=$(curl ${_crlGet} https://api.ipify.org | sed 's/[^0-9\\.]//g')\n if [ -z \"${_LOC_IP}\" ]; then\n _LOC_IP=$(curl ${_crlGet} http://ipv4.icanhazip.com | sed 's/[^0-9\\.]//g')\n fi\n if [ ! -z \"${_LOC_IP}\" ]; then\n echo ${_LOC_IP} > /root/.found_correct_ipv4.cnf\n fi\n fi\n}\n#\n# Fix php.ini files to remove ionCube\n_fix_php_ini_ioncube() {\n if [ -e \"${_THIS_FILE}\" ] && [ \"${_PHP_IONCUBE}\" = \"NO\" ]; then\n _IONCUBE_INI_TEST=$(grep \"ioncube_loader\" ${_THIS_FILE} 2>&1)\n if [[ \"${_IONCUBE_INI_TEST}\" =~ \"ioncube_loader\" ]]; then\n sed -i \"s/.*ioncube_loader.*//g\" ${_THIS_FILE} &> /dev/null\n wait\n fi\n fi\n}\n#\n# Fix php.ini files to remove jsmin.so\n_remove_php_ini_jsmin() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _JSMIN_INI_TEST=$(grep \"^extension=jsmin.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_JSMIN_INI_TEST}\" =~ \"extension=jsmin.so\" ]]; then\n sed -i \"s/.*jsmin.*//g\" ${_THIS_FILE} &> /dev/null\n wait\n fi\n fi\n}\n#\n# Fix php.ini files to remove suhosin.so\n_remove_php_ini_suhosin() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _SUHOSIN_INI_TEST=$(grep \"^extension=suhosin.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_SUHOSIN_INI_TEST}\" =~ \"extension=suhosin.so\" ]]; then\n sed -i \"s/.*suhosin.*//g\" ${_THIS_FILE} &> /dev/null\n wait\n fi\n fi\n}\n#\n# Fix php.ini files to add mailparse.so\n_fix_php_ini_mailparse() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _MAILPARSE_INI_TEST=$(grep \"^extension=mailparse.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_MAILPARSE_INI_TEST}\" =~ \"extension=mailparse.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=mailparse.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix php.ini files to add yaml.so\n_fix_php_ini_yaml() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _YAML_INI_TEST=$(grep \"^extension=yaml.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_YAML_INI_TEST}\" =~ \"extension=yaml.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=yaml.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix php.ini files to add jsmin.so\n_add_php_ini_jsmin() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _JSMIN_INI_TEST=$(grep \"^extension=jsmin.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_JSMIN_INI_TEST}\" =~ \"extension=jsmin.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=jsmin.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix php.ini files to add twig.so\n_fix_php_ini_twig() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _TWIG_INI_TEST=$(grep \"^extension=twig.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_TWIG_INI_TEST}\" =~ \"extension=twig.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=twig.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix php.ini files to add redis.so\n_fix_php_ini_redis() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _REDIS_INI_TEST=$(grep \"^extension=redis.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_REDIS_INI_TEST}\" =~ \"extension=redis.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=redis.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix php.ini files to add mcrypt.so\n_fix_php_ini_mcrypt() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _MCRYPT_INI_TEST=$(grep \"^extension=mcrypt.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_MCRYPT_INI_TEST}\" =~ \"extension=mcrypt.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=mcrypt.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix php.ini files to add apcu.so\n_fix_php_ini_apcu() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _APCU_INI_TEST=$(grep \"^apc.shm_size\" ${_THIS_FILE} 2>&1)\n if [[ \"${_APCU_INI_TEST}\" =~ \"apc.shm_size\" ]]; then\n _DO_NOTHING=YES\n else\n echo \" \" >> ${_THIS_FILE}\n echo \"; APCu\" >> ${_THIS_FILE}\n echo \"extension=apcu.so\" >> ${_THIS_FILE}\n echo \"apc.enable_cli=1\" >> ${_THIS_FILE}\n echo \"apc.gc_ttl=300\" >> ${_THIS_FILE}\n echo \"apc.shm_segments=1\" >> ${_THIS_FILE}\n echo \"apc.shm_size=256M\" >> ${_THIS_FILE}\n echo \"apc.slam_defense=0\" >> ${_THIS_FILE}\n echo \"apc.ttl=0\" >> ${_THIS_FILE}\n echo \";\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix php.ini files to add igbinary.so\n_fix_php_ini_igbinary() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _IGBINARY_INI_TEST=$(grep \"^extension=igbinary.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_IGBINARY_INI_TEST}\" =~ \"extension=igbinary.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=igbinary.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix php.ini file to add newrelic.ini\n_fix_php_ini_newrelic() {\n _NR_TPL=\"${_locCnf}/php/newrelic.ini\"\n if [ -e \"${_THIS_FILE}\" ]; then\n _NEWRELIC_INI_TEST_A=$(grep \"^extension=newrelic.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_NEWRELIC_INI_TEST_A}\" =~ \"extension=newrelic.so\" ]]; then\n _DO_NOTHING=YES\n else\n cat ${_NR_TPL} >> ${_THIS_FILE}\n fi\n _NEWRELIC_INI_TEST_B=$(grep \"newrelic.framework.drupal.modules\" ${_THIS_FILE} 2>&1)\n if [[ \"${_NEWRELIC_INI_TEST_B}\" =~ \"newrelic.framework.drupal.modules\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"newrelic.framework.drupal.modules = 1\" >> ${_THIS_FILE}\n fi\n sed -i \"/REPLACE_WITH_REAL_KEY//g\" ${_THIS_FILE} &> /dev/null\n wait\n sed -i \"s/license_key=//g\" ${_THIS_FILE} &> /dev/null\n wait\n fi\n}\n#\n# Fix all php.ini files to add newrelic.ini\n_fix_php_ini_newrelic_all() {\n if [ -e \"/etc/newrelic/newrelic.cfg\" ]; then\n if [ -z \"${_NEWRELIC_KEY}\" ]; then\n _NEWRELIC_KEY=$(grep license_key /etc/newrelic/newrelic.cfg 2>/dev/null | tr -d '\\n')\n fi\n _PHP_V=\"84 83 82 81 80 74 73 72\"\n for e in ${_PHP_V}; do\n _THIS_FILE=/opt/php${e}/etc/php${e}.ini\n _fix_php_ini_newrelic\n _THIS_FILE=/opt/php${e}/lib/php.ini\n _fix_php_ini_newrelic\n done\n fi\n}\n#\n# Fix FMP php.ini file to add opcache.so\n_fix_php_ini_opcache() {\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"PROC: _fix_php_ini_opcache $1\"\n fi\n if [ -e \"${_THIS_FILE}\" ]; then\n if grep -q \"opcache.so\" -- \"${_THIS_FILE}\"; then\n _DO_NOTHING=YES\n else\n {\n echo\n echo \"; Zend OPcache\"\n echo \"zend_extension=\\\"${_OPCACHE_SO}\\\"\"\n echo \"opcache.enable=1\"\n echo \"opcache.memory_consumption=181\"\n echo \"opcache.revalidate_freq=60\"\n echo \"opcache.dups_fix=1\"\n echo \"opcache.file_update_protection=8\"\n echo \"opcache.huge_code_pages=0\"\n case \"${1}\" in\n 80|74|73|72|71|70|56)\n echo \"opcache.interned_strings_buffer=32\"\n ;;\n 81|82|83|84)\n echo \"opcache.interned_strings_buffer=128\"\n ;;\n *)\n echo \"opcache.interned_strings_buffer=128\"\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"WARN: Unknown PHP version '${1}', using default buffer=128\"\n fi\n ;;\n esac\n echo \"opcache.jit=off\"\n echo \"opcache.lockfile_path=/var/tmp/fpm\"\n echo \"opcache.max_accelerated_files=200000\"\n echo \"opcache.restrict_api=/var/www\"\n echo \"opcache.revalidate_path=1\"\n echo \"opcache.save_comments=1\"\n echo \"opcache.use_cwd=1\"\n echo \"opcache.validate_permission=1\"\n echo \"opcache.validate_root=1\"\n echo \"opcache.validate_timestamps=1\"\n echo \";\"\n } >> \"${_THIS_FILE}\"\n fi\n fi\n}\n#\n# Fix all FMP php.ini files to add Zend OPcache\n_fix_php_ini_opcache_all() {\n _PHP_V=\"85 84 83 82 81 80 74 73 72 71 70 56\"\n for e in ${_PHP_V}; do\n _P_API=\n case \"${e}\" in\n 85) _P_API=\"${_PHP85_API}\" ;;\n 84) _P_API=\"${_PHP84_API}\" ;;\n 83) _P_API=\"${_PHP83_API}\" ;;\n 82) _P_API=\"${_PHP82_API}\" ;;\n 81) _P_API=\"${_PHP81_API}\" ;;\n 80) _P_API=\"${_PHP80_API}\" ;;\n 74) _P_API=\"${_PHP74_API}\" ;;\n 73) _P_API=\"${_PHP73_API}\" ;;\n 72) _P_API=\"${_PHP72_API}\" ;;\n 71) _P_API=\"${_PHP71_API}\" ;;\n 70) _P_API=\"${_PHP70_API}\" ;;\n 56) _P_API=\"${_PHP56_API}\" ;;\n *) _msg \"WARN: Unknown PHP API version for PHP ${e}\"\n ;;\n esac\n _THIS_FILE=/opt/php${e}/etc/php${e}.ini\n _OPCACHE_LP=\"/opt/php${e}/lib/php/extensions/no-debug-non-zts\"\n _OPCACHE_SO=\"${_OPCACHE_LP}-${_P_API}/opcache.so\"\n _fix_php_ini_opcache \"${e}\"\n done\n}\n#\n# Fix php.ini file to add php_tet.so\n_fix_php_ini_tet() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _TET_INI_TEST=$(grep \"^extension=php_tet.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_TET_INI_TEST}\" =~ \"extension=php_tet.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=php_tet.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix all php.ini files to add php_tet.so\n_fix_php_ini_tet_all() {\n if [ \"${_PHP_TET}\" = \"YES\" ] || [[ \"${_XTRAS_LIST}\" =~ \"TET\" ]]; then\n _PHP_V=\"85 84 83 82 81 80 74 73 72 71 70 56\"\n for e in ${_PHP_V}; do\n _P_API=\n case \"${e}\" in\n 85) _P_API=\"${_PHP85_API}\" ;;\n 84) _P_API=\"${_PHP84_API}\" ;;\n 83) _P_API=\"${_PHP83_API}\" ;;\n 82) _P_API=\"${_PHP82_API}\" ;;\n 81) _P_API=\"${_PHP81_API}\" ;;\n 80) _P_API=\"${_PHP80_API}\" ;;\n 74) _P_API=\"${_PHP74_API}\" ;;\n 73) _P_API=\"${_PHP73_API}\" ;;\n 72) _P_API=\"${_PHP72_API}\" ;;\n 71) _P_API=\"${_PHP71_API}\" ;;\n 70) _P_API=\"${_PHP70_API}\" ;;\n 56) _P_API=\"${_PHP56_API}\" ;;\n *) _msg \"WARN: Unknown PHP API version for PHP ${e}\"\n ;;\n esac\n _TET_BASE=\"/opt/php${e}/lib/php/extensions/no-debug-non-zts\"\n _TET_SO=\"${_TET_BASE}-${_P_API}/php_tet.so\"\n if [ ! -e \"${_TET_SO}\" ]; then\n if [[ \"${e}\" =~ \"80\" ]] || [[ \"${e}\" =~ \"74\" ]] || [[ \"${e}\" =~ \"73\" ]]; then\n _TET_VRN=\"5.3-Linux-x64-Perl-PHP-Python-Ruby\"\n else\n _TET_VRN=\"5.2-Linux-x86_64-Perl-PHP-Python-Ruby\"\n fi\n if [ ! -e \"/var/opt/TET-${_TET_VRN}/bind/php\" ]; then\n mkdir -p /var/opt\n cd /var/opt\n _get_dev_src \"TET-${_TET_VRN}.tar.gz\"\n fi\n if [ -e \"/var/opt/TET-${_TET_VRN}/bind/php/php-${e}0-nts\" ]; then\n cd /var/opt/TET-${_TET_VRN}/bind/php/php-${e}0-nts/\n cp -a php_tet.so ${_TET_SO}\n fi\n fi\n if [ -e \"${_TET_SO}\" ]; then\n _THIS_FILE=/opt/php${e}/etc/php${e}.ini\n _fix_php_ini_tet\n _THIS_FILE=/opt/php${e}/lib/php.ini\n _fix_php_ini_tet\n fi\n done\n fi\n}\n#\n# Fix php.ini file to add geos.so\n_fix_php_ini_geos() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _GEOS_INI_TEST=$(grep \"^extension=geos.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_GEOS_INI_TEST}\" =~ \"extension=geos.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=geos.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix all php.ini files to add geos.so\n_fix_php_ini_geos_all() {\n if [ \"${_PHP_GEOS}\" = \"YES\" ] || [[ \"${_XTRAS_LIST}\" =~ \"GEO\" ]]; then\n _PHP_V=\"56\"\n for e in ${_PHP_V}; do\n _THIS_FILE=/opt/php${e}/etc/php${e}.ini\n _fix_php_ini_geos\n _THIS_FILE=/opt/php${e}/lib/php.ini\n _fix_php_ini_geos\n done\n fi\n}\n#\n# Fix php.ini file to add mongo.so\n_fix_php_ini_mongo() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _MONGO_INI_TEST=$(grep \"^extension=mongo.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_MONGO_INI_TEST}\" =~ \"extension=mongo.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=mongo.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix php.ini file to add mongodb.so\n_fix_php_ini_mongodb() {\n if [ -e \"${_THIS_FILE}\" ]; then\n _MONGODB_INI_TEST=$(grep \"^extension=mongodb.so\" ${_THIS_FILE} 2>&1)\n if [[ \"${_MONGODB_INI_TEST}\" =~ \"extension=mongodb.so\" ]]; then\n _DO_NOTHING=YES\n else\n echo \"extension=mongodb.so\" >> ${_THIS_FILE}\n fi\n fi\n}\n#\n# Fix all php.ini files to add mongo.so or mongodb.so\n_fix_php_ini_mongo_all() {\n if [ \"${_PHP_MONGODB}\" = \"YES\" ] || [[ \"${_XTRAS_LIST}\" =~ \"MNG\" ]]; then\n _PHP_V=\"56\"\n for e in ${_PHP_V}; do\n _THIS_FILE=/opt/php${e}/etc/php${e}.ini\n _fix_php_ini_mongo\n _THIS_FILE=/opt/php${e}/lib/php.ini\n _fix_php_ini_mongo\n done\n _PHP_V=\"72 71 70\"\n for e in ${_PHP_V}; do\n _THIS_FILE=/opt/php${e}/etc/php${e}.ini\n _fix_php_ini_mongodb\n _THIS_FILE=/opt/php${e}/lib/php.ini\n _fix_php_ini_mongodb\n done\n fi\n}\n#\n# Update PHP Config.\n_php_conf_update() {\n if [ -z \"${_THISHTIP}\" ]; then\n _LOC_DOM=\"${_hName}\"\n _find_correct_ip\n _THISHTIP=\"${_LOC_IP}\"\n fi\n if [ ! -e \"/opt/etc/fpm\" ] \\\n || [ ! -e \"/opt/etc/fpm/fpm-pool-common.conf\" ] \\\n || [ ! -e \"/opt/etc/fpm/fpm-pool-common-legacy.conf\" ] \\\n || [ ! -e \"/opt/etc/fpm/fpm-pool-common-modern.conf\" ]; then\n mkdir -p /opt/etc/fpm\n fi\n cp -af ${_locCnf}/php/fpm-pool-common.conf /opt/etc/fpm/fpm-pool-common.conf\n cp -af ${_locCnf}/php/fpm-pool-common-legacy.conf /opt/etc/fpm/fpm-pool-common-legacy.conf\n cp -af ${_locCnf}/php/fpm-pool-common-modern.conf /opt/etc/fpm/fpm-pool-common-modern.conf\n sed -i \"s/127.0.0.1/127.0.0.1,${_THISHTIP}/g\" /opt/etc/fpm/fpm-pool-commo*.conf\n wait\n sed -i \"s/mode =.*/mode = 0660/g\" /opt/etc/fpm/fpm-pool-commo*.conf\n wait\n _PHP_V=\"85 84 83 82 81 80 74 73 72 71 70 56\"\n for e in ${_PHP_V}; do\n if [ ! -e \"/var/www/www${e}\" ]; then\n adduser --system --group --home /var/www/www${e} www${e} &> /dev/null\n usermod -aG www-data www${e}\n fi\n if [ ! -e \"/opt/php${e}/etc/php${e}.ini\" ] \\\n || [ ! -e \"/opt/php${e}/etc/pool.d/www${e}.conf\" ]; then\n mkdir -p /opt/php${e}/etc/pool.d\n cp -af ${_locCnf}/php/php${e}.ini /opt/php${e}/etc/php${e}.ini\n fi\n cp -af ${_locCnf}/php/fpm${e}-pool-www.conf /opt/php${e}/etc/pool.d/www${e}.conf\n if [ ! -e \"/opt/php${e}/lib/php.ini\" ]; then\n mkdir -p /opt/php${e}/lib\n cp -af ${_locCnf}/php/php${e}-cli.ini /opt/php${e}/lib/php.ini\n fi\n cp -af ${_locCnf}/php/php${e}.ini /opt/php${e}/etc/php${e}.ini\n cp -af ${_locCnf}/php/php${e}-cli.ini /opt/php${e}/lib/php.ini\n cp -af ${_locCnf}/php/php${e}-fpm.conf /opt/php${e}/etc/php${e}-fpm.conf\n\n _THIS_FILE=/opt/php${e}/etc/php${e}.ini\n if [ \"${e}\" != \"56\" ]; then\n _fix_php_ini_apcu\n fi\n if [ \"${e}\" != \"56\" ] && [ \"${e}\" != \"70\" ] && [ \"${e}\" != \"71\" ]; then\n _fix_php_ini_mcrypt\n fi\n if [ \"${e}\" = 56 ]; then\n _fix_php_ini_mailparse\n _fix_php_ini_twig\n fi\n if [ \"${e}\" != 80 ] && [ \"${e}\" != 81 ]; then\n _add_php_ini_jsmin\n fi\n if [ \"${e}\" = 80 ] || [ \"${e}\" = 81 ]; then\n _remove_php_ini_jsmin\n fi\n _fix_php_ini_igbinary\n _fix_php_ini_redis\n _fix_php_ini_ioncube\n _remove_php_ini_suhosin\n _fix_php_ini_yaml\n\n _THIS_FILE=/opt/php${e}/lib/php.ini\n if [ \"${e}\" != \"56\" ]; then\n _fix_php_ini_apcu\n fi\n if [ \"${e}\" != \"56\" ] && [ \"${e}\" != \"70\" ] && [ \"${e}\" != \"71\" ]; then\n _fix_php_ini_mcrypt\n fi\n if [ \"${e}\" = 56 ]; then\n _fix_php_ini_mailparse\n _fix_php_ini_twig\n fi\n if [ \"${e}\" != 80 ] && [ \"${e}\" != 81 ]; then\n _add_php_ini_jsmin\n fi\n if [ \"${e}\" = 80 ] || [ \"${e}\" = 81 ]; then\n _remove_php_ini_jsmin\n fi\n _fix_php_ini_igbinary\n _fix_php_ini_redis\n _fix_php_ini_ioncube\n _remove_php_ini_suhosin\n _fix_php_ini_yaml\n\n if [ -e \"/opt/php${e}/etc/php${e}.ini\" ]; then\n sed -i \"s/^zlib.output_compression.*/zlib.output_compression = Off/g\" /opt/php${e}/etc/php${e}.ini\n wait\n sed -i \"s/.*zlib.output_compression_level/;zlib.output_compression_level/g\" /opt/php${e}/etc/php${e}.ini\n wait\n fi\n if [ -e \"/opt/php${e}/lib/php.ini\" ]; then\n sed -i \"s/^zlib.output_compression.*/zlib.output_compression = Off/g\" /opt/php${e}/lib/php.ini\n wait\n sed -i \"s/.*zlib.output_compression_level/;zlib.output_compression_level/g\" /opt/php${e}/lib/php.ini\n wait\n fi\n done\n rm -f /etc/php5/conf.d/{opcache.ini,apc.ini,imagick.ini,memcached.ini}\n rm -f /etc/php5/conf.d/{redis.ini,suhosin.ini,newrelic.ini}\n _fix_php_ini_newrelic_all\n _fix_php_ini_geos_all\n _fix_php_ini_mongo_all\n _fix_php_ini_tet_all\n _fix_php_ini_opcache_all\n}\n#\n_restore_default_php() {\n _msg \"INFO: Restoring default PHP configuration\"\n cp -af ${_locCnf}/php/php85-cli.ini /opt/php85/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php85.ini /opt/php85/etc/php85.ini &> /dev/null\n cp -af ${_locCnf}/php/php84-cli.ini /opt/php84/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php84.ini /opt/php84/etc/php84.ini &> /dev/null\n cp -af ${_locCnf}/php/php83-cli.ini /opt/php83/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php83.ini /opt/php83/etc/php83.ini &> /dev/null\n cp -af ${_locCnf}/php/php82-cli.ini /opt/php82/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php82.ini /opt/php82/etc/php82.ini &> /dev/null\n cp -af ${_locCnf}/php/php81-cli.ini /opt/php81/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php81.ini /opt/php81/etc/php81.ini &> /dev/null\n cp -af ${_locCnf}/php/php80-cli.ini /opt/php80/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php80.ini /opt/php80/etc/php80.ini &> /dev/null\n cp -af ${_locCnf}/php/php74-cli.ini /opt/php74/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php74.ini /opt/php74/etc/php74.ini &> /dev/null\n cp -af ${_locCnf}/php/php73-cli.ini /opt/php73/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php73.ini /opt/php73/etc/php73.ini &> /dev/null\n cp -af ${_locCnf}/php/php72-cli.ini /opt/php72/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php72.ini /opt/php72/etc/php72.ini &> /dev/null\n cp -af ${_locCnf}/php/php71-cli.ini /opt/php71/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php71.ini /opt/php71/etc/php71.ini &> /dev/null\n cp -af ${_locCnf}/php/php70-cli.ini /opt/php70/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php70.ini /opt/php70/etc/php70.ini &> /dev/null\n cp -af ${_locCnf}/php/php56-cli.ini /opt/php56/lib/php.ini &> /dev/null\n cp -af ${_locCnf}/php/php56.ini /opt/php56/etc/php56.ini &> /dev/null\n}\n#\n_tune_php() {\n _msg \"INFO: Tuning PHP configuration\"\n if [ \"${_TUNE_PHP_FPM_TIMEOUT}\" -lt 60 ]; then\n _TUNE_PHP_FPM_TIMEOUT=60\n fi\n # PHP-FPM pools\n sed -i \"s/180s/${_TUNE_PHP_FPM_TIMEOUT}s/g\" /opt/php*/etc/pool.d/*.conf &> /dev/null\n wait\n sed -i \"s/180s/${_TUNE_PHP_FPM_TIMEOUT}s/g\" /opt/php*/etc/php*-fpm.conf &> /dev/null\n wait\n sed -i \"s/180/${_TUNE_PHP_FPM_TIMEOUT}/g\" /opt/etc/fpm/fpm-pool-common*.conf &> /dev/null\n wait\n # PHP-FPM INI\n sed -i \"s/^default_socket_timeout =.*/default_socket_timeout = ${_TUNE_PHP_FPM_TIMEOUT}/g\" /opt/php*/etc/php*.ini &> /dev/null\n wait\n sed -i \"s/^max_execution_time =.*/max_execution_time = ${_TUNE_PHP_FPM_TIMEOUT}/g\" /opt/php*/etc/php*.ini &> /dev/null\n wait\n sed -i \"s/^max_input_time =.*/max_input_time = ${_TUNE_PHP_FPM_TIMEOUT}/g\" /opt/php*/etc/php*.ini &> /dev/null\n wait\n # PHP-CLI INI\n sed -i \"s/^max_execution_time =.*/max_execution_time = ${_TUNE_PHP_CLI_TIMEOUT}/g\" /opt/php*/lib/php.ini &> /dev/null\n wait\n sed -i \"s/^max_input_time =.*/max_input_time = ${_TUNE_PHP_CLI_TIMEOUT}/g\" /opt/php*/lib/php.ini &> /dev/null\n wait\n sed -i \"s/^default_socket_timeout =.*/default_socket_timeout = ${_TUNE_PHP_CLI_TIMEOUT}/g\" /opt/php*/lib/php.ini &> /dev/null\n wait\n # Redis config should sync with PHP-CLI\n sed -i \"s/^timeout .*/timeout ${_TUNE_PHP_CLI_TIMEOUT}/g\" /etc/redis/redis.conf &> /dev/null\n wait\n}\n#\n# Update innodb_log_file_size.\n_innodb_log_file_size_update() {\n _msg \"INFO: InnoDB log file will be set to ${_INNODB_LOG_FILE_SIZE_MB}...\"\n _DBS_TEST=\"$(which mysql)\"\n if [ ! -z \"${_DBS_TEST}\" ]; then\n _DB_SERVER_TEST=$(mysql -V 2>&1)\n fi\n if [[ \"${_DB_SERVER_TEST}\" =~ \"Ver 8.4.\" ]]; then\n _DB_V=8.4\n elif [[ \"${_DB_SERVER_TEST}\" =~ \"Ver 8.0.\" ]]; then\n _DB_V=8.0\n elif [[ \"${_DB_SERVER_TEST}\" =~ \"Distrib 5.7.\" ]]; then\n _DB_V=5.7\n fi\n _IS_MYSQLD_RUNNING=$(pgrep -f /usr/sbin/mysqld)\n if [ ! -z \"${_IS_MYSQLD_RUNNING}\" ] && [ \"${_DB_V}\" = \"5.7\" ]; then\n _SQL_PSWD=$(cat /root/.my.pass.txt 2>/dev/null | tr -d '\\n')\n mysql -u root -e \"SET GLOBAL innodb_max_dirty_pages_pct = 0;\" &> /dev/null\n mysql -u root -e \"SET GLOBAL innodb_change_buffering = 'none';\" &> /dev/null\n mysql -u root -e \"SET GLOBAL innodb_buffer_pool_dump_at_shutdown = 1;\" &> /dev/null\n mysql -u root -e \"SET GLOBAL innodb_io_capacity=3000;\" &> /dev/null\n mysql -u root -e \"SET GLOBAL innodb_io_capacity_max=6000;\" &> /dev/null\n if [ \"${_DB_V}\" = \"5.7\" ]; then\n mysql -u root -e \"SET GLOBAL innodb_buffer_pool_dump_pct = 100;\" &> /dev/null\n mysql -u root -e \"SET GLOBAL innodb_buffer_pool_dump_now = ON;\" &> /dev/null\n fi\n mysql -u root -e \"SET GLOBAL innodb_fast_shutdown = 0;\" &> /dev/null\n fi\n service mysql stop\n echo \"Waiting 15 seconds...\"\n sleep 15\n if [ ! -e \"/run/mysqld/mysqld.sock\" ] \\\n && [ ! -e \"/run/mysqld/mysqld.pid\" ]; then\n mkdir -p ${_vBs}/old-sql-ib-log-${_NOW}\n sleep 5\n mv -f /var/lib/mysql/ib_logfile0 ${_vBs}/old-sql-ib-log-${_NOW}/ &> /dev/null\n mv -f /var/lib/mysql/ib_logfile1 ${_vBs}/old-sql-ib-log-${_NOW}/ &> /dev/null\n sed -i \"s/.*innodb_log_file_size.*/innodb_log_file_size = ${_INNODB_LOG_FILE_SIZE_MB}/g\" /etc/mysql/my.cnf\n wait\n echo \"Waiting 15 seconds...\"\n sleep 15\n fi\n if [ ! -e \"/run/mysqld/mysqld.sock\" ]; then\n service mysql start &> /dev/null\n fi\n}\n#\n_restore_default_sql() {\n _msg \"INFO: Restoring default SQL configuration\"\n sed -i \"s/.*check_for_crashed_tables/#check_for_crashed_tables/g\" /etc/mysql/debian-start &> /dev/null\n wait\n _if_hosted_sys\n if [ \"${_CUSTOM_CONFIG_SQL}\" = \"NO\" ] \\\n || [ \"${_hostedSys}\" = \"YES\" ]; then\n if [ \"${_CUSTOM_CONFIG_SQL}\" = \"YES\" ]; then\n _DO_NOTHING=YES\n else\n cp -af /etc/mysql/my.cnf \\\n /var/backups/dragon/t/my.cnf-pre-${_xSrl}-${_X_VERSION}-${_NOW} &> /dev/null\n cp -af ${_locCnf}/var/my.cnf.txt /etc/mysql/my.cnf\n _INNODB_LOG_FILE_SIZE=${_INNODB_LOG_FILE_SIZE//[^0-9]/}\n if [ ! -z \"${_INNODB_LOG_FILE_SIZE}\" ]; then\n if [ \"${_INNODB_LOG_FILE_SIZE}\" -ge 50 ]; then\n _INNODB_LOG_FILE_SIZE_MB=\"${_INNODB_LOG_FILE_SIZE}M\"\n _INNODB_LOG_FILE_SIZE_TEST=$(grep \"innodb_log_file_size\" \\\n /var/backups/dragon/t/my.cnf-pre-${_xSrl}-${_X_VERSION}-${_NOW} 2>&1)\n if [[ \"${_INNODB_LOG_FILE_SIZE_TEST}\" =~ \"= ${_INNODB_LOG_FILE_SIZE_MB}\" ]]; then\n _INNODB_LOG_FILE_SIZE_SAME=YES\n else\n _INNODB_LOG_FILE_SIZE_SAME=NO\n fi\n fi\n fi\n sed -i \"s/.*slow_query_log/#slow_query_log/g\" /etc/mysql/my.cnf\n wait\n sed -i \"s/.*long_query_time/#long_query_time/g\" /etc/mysql/my.cnf\n wait\n sed -i \"s/.*slow_query_log_file/#slow_query_log_file/g\" /etc/mysql/my.cnf\n wait\n if [ ! -e \"/etc/mysql/skip-name-resolve.txt\" ]; then\n sed -i \"s/.*skip-name-resolve/#skip-name-resolve/g\" /etc/mysql/my.cnf\n wait\n fi\n fi\n fi\n mv -f /etc/mysql/my.cnf-pre* /var/backups/dragon/t/ &> /dev/null\n sed -i \"s/.*default-table-type/#default-table-type/g\" /etc/mysql/my.cnf &> /dev/null\n wait\n sed -i \"s/.*language/#language/g\" /etc/mysql/my.cnf &> /dev/null\n wait\n sed -i \"s/.*innodb_lazy_drop_table.*//g\" /etc/mysql/my.cnf &> /dev/null\n wait\n if [ \"${_CUSTOM_CONFIG_SQL}\" = \"NO\" ]; then\n if [ \"${_DB_BINARY_LOG}\" = \"NO\" ]; then\n # Disable binary logging\n sed -i \\\n -e \"s/^\\s*\\(log_bin\\s*=.*\\)/#\\1/\" \\\n -e \"s/^\\s*#\\s*\\(skip-log-bin\\)/\\1/\" \\\n -e \"s/^\\s*\\(max_binlog_size\\s*=.*\\)/#\\1/\" \\\n -e \"s/^\\s*\\(binlog_row_image\\s*=.*\\)/#\\1/\" \\\n -e \"s/^\\s*\\(binlog_format\\s*=.*\\)/#\\1/\" \\\n /etc/mysql/my.cnf &> /dev/null\n elif [ \"${_DB_BINARY_LOG}\" = \"YES\" ]; then\n # Enable binary logging\n sed -i \\\n -e \"s/^\\s*#\\s*\\(log_bin\\s*=.*\\)/\\1/\" \\\n -e \"s/^\\s*\\(skip-log-bin\\)/#\\1/\" \\\n -e \"s/^\\s*#\\s*\\(max_binlog_size\\s*=.*\\)/\\1/\" \\\n -e \"s/^\\s*#\\s*\\(binlog_row_image\\s*=.*\\)/\\1/\" \\\n -e \"s/^\\s*#\\s*\\(binlog_format\\s*=.*\\)/\\1/\" \\\n /etc/mysql/my.cnf &> /dev/null\n fi\n if [ ! -z \"${_INNODB_LOG_FILE_SIZE}\" ]; then\n if [ \"${_INNODB_LOG_FILE_SIZE}\" -ge 50 ]; then\n _INNODB_LOG_FILE_SIZE_MB=\"${_INNODB_LOG_FILE_SIZE}M\"\n _INNODB_LOG_FILE_SIZE_TEST=$(grep \"innodb_log_file_size\" /etc/mysql/my.cnf 2>&1)\n if [[ \"${_INNODB_LOG_FILE_SIZE_TEST}\" =~ \"= ${_INNODB_LOG_FILE_SIZE_MB}\" ]]; then\n _DO_NOTHING=YES\n else\n if [ \"${_INNODB_LOG_FILE_SIZE_SAME}\" = \"YES\" ]; then\n sed -i \"s/.*innodb_log_file_size.*/innodb_log_file_size = ${_INNODB_LOG_FILE_SIZE_MB}/g\" \\\n /etc/mysql/my.cnf &> /dev/null\n wait\n else\n _innodb_log_file_size_update\n fi\n fi\n fi\n fi\n fi\n}\n#\n_tune_sql() {\n _msg \"INFO: Tuning SQL configuration\"\n sed -i \"s/9999/${_TUNE_SQL_TIMEOUT}/g\" /etc/mysql/my.cnf &> /dev/null\n wait\n sed -i \"s/9999/${_TUNE_SQL_TIMEOUT}/g\" /var/xdrago/minute.sh &> /dev/null\n wait\n}\n#\n_restore_default_nginx() {\n _msg \"INFO: Restoring default Nginx configuration\"\n if [ -d \"${_TUNE_HOSTMASTER}\" ]; then\n for _Files in `find ${_TUNE_HOSTMASTER}/config/server_master/nginx/vhost.d -type f`; do\n sed -i \"s/#limit_conn /limit_conn /g\" ${_Files} &> /dev/null\n wait\n done\n fi\n su -s /bin/bash - aegir -c \"drush8 @server_master provision-verify\" &> /dev/null\n wait\n sleep 8\n}\n#\n_tune_nginx() {\n _msg \"INFO: Tuning Nginx configuration\"\n sed -i \"s/60/${_TUNE_NGINX_TIMEOUT}/g\" /var/aegir/config/server_master/nginx.conf &> /dev/null\n wait\n sed -i \"s/300/${_TUNE_NGINX_TIMEOUT}/g\" /var/aegir/config/server_master/nginx.conf &> /dev/null\n wait\n sed -i \"s/180/${_TUNE_NGINX_TIMEOUT}/g\" /var/aegir/config/server_master/nginx.conf &> /dev/null\n wait\n if [ \"${_TUNE_NGINX_CONNECT}\" = \"OFF\" ]; then\n sed -i \"s/limit_conn /#limit_conn /g\" /var/aegir/config/server_master/nginx.conf &> /dev/null\n wait\n if [ -d \"${_TUNE_HOSTMASTER}\" ]; then\n for _Files in `find ${_TUNE_HOSTMASTER}/config/server_master/nginx/vhost.d -type f`; do\n sed -i \"s/limit_conn /#limit_conn /g\" ${_Files} &> /dev/null\n wait\n done\n fi\n fi\n}\n#\n_restart_services() {\n _msg \"INFO: Reloading services\"\n _PHP_V=\"85 84 83 82 81 80 74 73 72 71 70 56\"\n for e in ${_PHP_V}; do\n if [ -e \"/etc/init.d/php${e}-fpm\" ]; then\n service \"php${e}-fpm\" reload &> /dev/null\n fi\n done\n bash /var/xdrago/move_sql.sh &> /dev/null\n wait\n service nginx reload &> /dev/null\n if [ -e \"/etc/init.d/valkey-server\" ]; then\n service valkey-server reload &> /dev/null\n elif [ -e \"/etc/init.d/redis-server\" ]; then\n service redis-server reload &> /dev/null\n fi\n if [ -x \"/usr/sbin/csf\" ] && [ -e \"/etc/csf/csf.deny\" ]; then\n if [ -e \"/etc/csf/csfpost.d/synproxy.sh\" ]; then\n csf -ra &> /dev/null\n synproxy_reassert -p \"443 80\" --no-quic -q &> /dev/null\n else\n csf -r &> /dev/null\n fi\n ### Linux kernel TCP SACK CVEs mitigation\n ### CVE-2019-11477 SACK Panic\n ### CVE-2019-11478 SACK Slowness\n ### CVE-2019-11479 Excess Resource Consumption Due to Low MSS Values\n if [ -x \"/usr/sbin/csf\" ] && [ -e \"/etc/csf/csf.deny\" ]; then\n _SACK_TEST=$(ip6tables --list | grep tcpmss)\n if [[ ! \"${_SACK_TEST}\" =~ \"tcpmss\" ]]; then\n sysctl net.ipv4.tcp_mtu_probing=0 &> /dev/null\n iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null\n ip6tables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP &> /dev/null\n [ -e \"/etc/csf/csfpost.d/synproxy.sh\" ] && synproxy_reassert -p \"443 80\" --no-quic -q &> /dev/null\n fi\n fi\n fi\n}\n#\n# Tune Web Sever configuration.\n_tune_web_server_config() {\n _LIM_FPM=\"${_L_PHP_FPM_WORKERS}\"\n if [ \"${_LIM_FPM}\" -lt 48 ]; then\n _if_hosted_sys\n if [ \"${_hostedSys}\" = \"YES\" ]; then\n _LIM_FPM=48\n fi\n fi\n _CHILD_MAX_FPM=$(( _LIM_FPM * 2 ))\n if [ \"${_PHP_FPM_WORKERS}\" != \"AUTO\" ]; then\n _PHP_FPM_WORKERS=${_PHP_FPM_WORKERS//[^0-9]/}\n if [ ! -z \"${_PHP_FPM_WORKERS}\" ] && [ \"${_PHP_FPM_WORKERS}\" -gt 0 ]; then\n _CHILD_MAX_FPM=\"${_PHP_FPM_WORKERS}\"\n fi\n fi\n _PHP_V=\"85 84 83 82 81 80 74 73 72 71 70 56\"\n for e in ${_PHP_V}; do\n sed -i \"s/pm.max_children =.*/pm.max_children = ${_CHILD_MAX_FPM}/g\" \\\n /opt/php${e}/etc/pool.d/www${e}.conf &> /dev/null\n wait\n if [ ! -z \"${_PHP_FPM_DENY}\" ]; then\n sed -i \"s/passthru,/${_PHP_FPM_DENY},/g\" \\\n /opt/php${e}/etc/pool.d/www${e}.conf &> /dev/null\n wait\n fi\n done\n # PHP-FPM INI\n sed -i \"s/^default_socket_timeout =.*/default_socket_timeout = 180/g\" /opt/php*/etc/php*.ini &> /dev/null\n wait\n sed -i \"s/^max_execution_time =.*/max_execution_time = 180/g\" /opt/php*/etc/php*.ini &> /dev/null\n wait\n sed -i \"s/^max_input_time =.*/max_input_time = 180/g\" /opt/php*/etc/php*.ini &> /dev/null\n wait\n # PHP-CLI INI\n sed -i \"s/^default_socket_timeout =.*/default_socket_timeout = 3600/g\" /opt/php*/lib/php.ini &> /dev/null\n wait\n sed -i \"s/^max_execution_time =.*/max_execution_time = 3600/g\" /opt/php*/lib/php.ini &> /dev/null\n wait\n sed -i \"s/^max_input_time =.*/max_input_time = 3600/g\" /opt/php*/lib/php.ini &> /dev/null\n wait\n # Redis config should sync with PHP-CLI\n sed -i \"s/^timeout .*/timeout 3600/g\" /etc/redis/redis.conf &> /dev/null\n wait\n}\n#\n#\n_check_mysqld_running() {\n while [ -z \"${_IS_MYSQLD_RUNNING}\" ] \\\n || [ ! -e \"/run/mysqld/mysqld.sock\" ]; do\n _IS_MYSQLD_RUNNING=$(pgrep -f /usr/sbin/mysqld)\n _msg \"INFO: Waiting for MySQLD availability before _tune_sql_memory_limits...\"\n sleep 5\n service mysql start &> /dev/null\n done\n}\n#\n# Tune memory limits for SQL server.\n_tune_sql_memory_limits() {\n _check_mysqld_running\n # https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl\n _pthTun=\"/var/opt/mysqltuner.pl\"\n _outTun=\"/var/opt/mysqltuner-${_xSrl}-${_X_VERSION}-${_NOW}.txt\"\n if [ ! -e \"${_outTun}\" ] \\\n && [ \"${_STATUS}\" = \"UPGRADE\" ]; then\n _msg \"INFO: Running MySQLTuner check on all databases\"\n _msg \"WAIT: This may take a while, please wait...\"\n _MYSQLTUNER_TEST_RESULT=OK\n rm -f /var/opt/mysqltuner*\n curl ${_crlGet} \"${_urlDev}/mysqltuner.pl.${_MYSQLTUNER_VRN}\" -o ${_pthTun}\n if [ ! -e \"${_pthTun}\" ]; then\n curl ${_crlGet} \"${_urlDev}/mysqltuner.pl\" -o ${_pthTun}\n fi\n if [ -e \"${_pthTun}\" ]; then\n perl ${_pthTun} > ${_outTun} 2>&1\n fi\n fi\n if [ -e \"${_pthTun}\" ] \\\n && [ -e \"${_outTun}\" ] \\\n && [ \"${_STATUS}\" = \"UPGRADE\" ]; then\n _REC_MYISAM_MEM=$(cat ${_outTun} \\\n | grep \"Data in MyISAM tables\" \\\n | cut -d: -f2 \\\n | awk '{ print $1}' 2>&1)\n _REC_INNODB_MEM=$(cat ${_outTun} \\\n | grep \"data size:\" \\\n | cut -d/ -f3 \\\n | awk '{ print $1}' 2>&1)\n _MYSQLTUNER_TEST=$(cat ${_outTun} 2>&1)\n cp -a ${_outTun} ${_pthLog}/\n if [ -z \"${_REC_INNODB_MEM}\" ] \\\n || [[ \"${_MYSQLTUNER_TEST}\" =~ \"Cannot calculate MyISAM index\" ]] \\\n || [[ \"${_MYSQLTUNER_TEST}\" =~ \"InnoDB is enabled but isn\" ]]; then\n _MYSQLTUNER_TEST_RESULT=FAIL\n _msg \"NOTE: The MySQLTuner test failed!\"\n _msg \"NOTE: Please review ${_outTun}\"\n _msg \"NOTE: We will use some sane SQL defaults instead, do not worry!\"\n fi\n ###--------------------###\n if [ ! -z \"${_REC_MYISAM_MEM}\" ] \\\n && [ \"${_MYSQLTUNER_TEST_RESULT}\" = \"OK\" ]; then\n _RAW_MYISAM_MEM=$(echo ${_REC_MYISAM_MEM} | sed \"s/[A-Z]//g\" 2>&1)\n if [[ \"${_REC_MYISAM_MEM}\" =~ \"G\" ]]; then\n _RAW_MYISAM_MEM=$(( _RAW_MYISAM_MEM * 1024 ))\n fi\n if [ \"${_RAW_MYISAM_MEM}\" -gt \"${_USE_SQL}\" ]; then\n _USE_MYISAM_MEM=\"${_USE_SQL}\"\n else\n _USE_MYISAM_MEM=\"${_RAW_MYISAM_MEM}\"\n fi\n if [ \"${_USE_MYISAM_MEM}\" -lt 256 ] || [ -z \"${_USE_MYISAM_MEM}\" ]; then\n _USE_MYISAM_MEM=\"${_USE_SQL}\"\n fi\n _USE_MYISAM_MEM=\"${_USE_MYISAM_MEM}M\"\n sed -i \"s/^key_buffer_size.*/key_buffer_size = ${_USE_MYISAM_MEM}/g\" /etc/mysql/my.cnf\n wait\n else\n _USE_MYISAM_MEM=\"${_USE_SQL}M\"\n if [ \"${_MYSQLTUNER_TEST_RESULT}\" = \"FAIL\" ]; then\n _msg \"NOTE: _USE_MYISAM_MEM is ${_USE_MYISAM_MEM} because _REC_MYISAM_MEM was empty!\"\n fi\n sed -i \"s/^key_buffer_size.*/key_buffer_size = ${_USE_MYISAM_MEM}/g\" /etc/mysql/my.cnf\n wait\n fi\n ###--------------------###\n if [ ! -z \"${_REC_INNODB_MEM}\" ] && [ \"${_MYSQLTUNER_TEST_RESULT}\" = \"OK\" ]; then\n _RAW_INNODB_MEM=$(echo ${_REC_INNODB_MEM} | sed \"s/[A-Z]//g\" 2>&1)\n if [[ \"${_REC_INNODB_MEM}\" =~ \"G\" ]]; then\n _RAW_INNODB_MEM=$(echo ${_RAW_INNODB_MEM} | awk '{print int($1+0.6)}' 2>&1)\n _RAW_INNODB_MEM=$(echo \"${_RAW_INNODB_MEM} * 1024\" | bc -l 2>&1)\n elif [[ \"${_REC_INNODB_MEM}\" =~ \"M\" ]]; then\n _RAW_INNODB_MEM=$(echo ${_RAW_INNODB_MEM} | awk '{print int($1+0.6)}' 2>&1)\n _RAW_INNODB_MEM=$(echo \"${_RAW_INNODB_MEM} * 1\" | bc -l 2>&1)\n fi\n _RAW_INNODB_MEM=$(echo \"(${_RAW_INNODB_MEM}+0.5)/1\" | bc 2>&1)\n if [ \"${_RAW_INNODB_MEM}\" -gt \"${_USE_SQL}\" ] \\\n || [ -z \"${_USE_INNODB_MEM}\" ] \\\n || [ \"${_RAW_INNODB_MEM}\" -lt 512 ]; then\n _USE_INNODB_MEM=\"${_USE_SQL}\"\n else\n _RAW_INNODB_MEM=$(echo \"scale=2; (${_RAW_INNODB_MEM} * 1.1)\" | bc 2>&1)\n _USE_INNODB_MEM=$(echo \"(${_RAW_INNODB_MEM}+0.5)/1\" | bc 2>&1)\n fi\n _INNODB_BPI=$(echo \"scale=0; ${_USE_INNODB_MEM}/1024/2\" | bc 2>&1)\n if [ \"${_INNODB_BPI}\" -lt 1 ] || [ -z \"${_INNODB_BPI}\" ]; then\n _INNODB_BPI=\"1\"\n fi\n sed -i \"s/^innodb_buffer_pool_instances.*/innodb_buffer_pool_instances = ${_INNODB_BPI}/g\" /etc/mysql/my.cnf\n wait\n sed -i \"s/^innodb_page_cleaners.*/innodb_page_cleaners = ${_INNODB_BPI}/g\" /etc/mysql/my.cnf\n wait\n _USE_INNODB_MEM=\"${_USE_INNODB_MEM}M\"\n sed -i \"s/^innodb_buffer_pool_size.*/innodb_buffer_pool_size = ${_USE_INNODB_MEM}/g\" /etc/mysql/my.cnf\n wait\n else\n _USE_INNODB_MEM=\"${_USE_SQL}M\"\n _msg \"NOTE: _USE_INNODB_MEM is ${_USE_INNODB_MEM} because _REC_INNODB_MEM was empty!\"\n sed -i \"s/^innodb_buffer_pool_size.*/innodb_buffer_pool_size = ${_USE_INNODB_MEM}/g\" /etc/mysql/my.cnf\n wait\n fi\n else\n _THIS_USE_MEM=\"${_USE_SQL}M\"\n if [ \"${_MYSQLTUNER_TEST_RESULT}\" = \"FAIL\" ] \\\n && [ \"${_STATUS}\" = \"UPGRADE\" ]; then\n _msg \"NOTE: _USE_MYISAM_MEM is ${_THIS_USE_MEM} because _REC_MYISAM_MEM was empty!\"\n _msg \"NOTE: _USE_INNODB_MEM is ${_THIS_USE_MEM} because _REC_INNODB_MEM was empty!\"\n fi\n sed -i \"s/= 181/= ${_USE_SQL}/g\" /etc/mysql/my.cnf\n wait\n fi\n}\n#\n# Tune memory limits for PHP, Nginx and Percona.\n_tune_memory_limits() {\n _msg \"INFO: Default Memory Tuning\"\n _VM_TEST=\"$(uname -a)\"\n if [ -e \"/proc/bean_counters\" ]; then\n _VMFAMILY=\"VZ\"\n elif [ -e \"/root/.tg.cnf\" ]; then\n _VMFAMILY=\"TG\"\n else\n _VMFAMILY=\"XEN\"\n fi\n if [[ \"${_VM_TEST}\" =~ \"-beng\" ]]; then\n _VMFAMILY=\"VS\"\n fi\n # Check for Amazon EC2 in the system manufacturer field\n if dmidecode -s system-manufacturer | grep -i 'Amazon EC2' &> /dev/null; then\n _VMFAMILY=\"AWS\"\n fi\n _CPU_INFO=\"$(grep -c processor /proc/cpuinfo)\"\n _CPU_INFO=${_CPU_INFO//[^0-9]/}\n _NPROC_TEST=\"$(which nproc)\"\n if [ -z \"${_NPROC_TEST}\" ]; then\n _CPU_NR=\"${_CPU_INFO}\"\n else\n _CPU_NR=$(nproc 2>&1)\n fi\n _CPU_NR=${_CPU_NR//[^0-9]/}\n if [ ! -z \"${_CPU_NR}\" ] && [ ! -z \"${_CPU_INFO}\" ] \\\n && [ \"${_CPU_NR}\" -gt \"${_CPU_INFO}\" ] && [ \"${_CPU_INFO}\" -gt 0 ]; then\n _CPU_NR=\"${_CPU_INFO}\"\n fi\n if [ -z \"${_CPU_NR}\" ] || [ \"${_CPU_NR}\" -lt 1 ]; then\n _CPU_NR=1\n fi\n _CPU_MX=$(( _CPU_NR * 2 ))\n if [ \"${_CPU_MX}\" -lt 4 ]; then\n _CPU_MX=4\n fi\n _CPU_TG=$(( _CPU_NR / 2 ))\n if [ \"${_CPU_TG}\" -lt 4 ]; then\n _CPU_TG=4\n fi\n _CPU_VS=$(( _CPU_NR / 12 ))\n if [ \"${_CPU_VS}\" -lt 2 ]; then\n _CPU_VS=2\n fi\n _PrTest=$(grep \"POWER\" /root/.*.octopus.cnf 2>&1)\n if [[ \"${_PrTest}\" =~ \"POWER\" ]]; then\n if [ \"${_CPU_VS}\" -lt 8 ]; then\n _CPU_VS=8\n fi\n fi\n _PrTest=$(grep \"PHANTOM\" /root/.*.octopus.cnf 2>&1)\n if [[ \"${_PrTest}\" =~ \"PHANTOM\" ]]; then\n if [ \"${_CPU_VS}\" -lt 8 ]; then\n _CPU_VS=8\n fi\n fi\n _PrTest=$(grep \"CLUSTER\" /root/.*.octopus.cnf 2>&1)\n if [[ \"${_PrTest}\" =~ \"CLUSTER\" ]]; then\n if [ \"${_CPU_VS}\" -lt 8 ]; then\n _CPU_VS=8\n fi\n fi\n _PrTest=$(grep \"ULTRA\" /root/.*.octopus.cnf 2>&1)\n if [[ \"${_PrTest}\" =~ \"ULTRA\" ]]; then\n if [ \"${_CPU_VS}\" -lt 8 ]; then\n _CPU_VS=8\n fi\n fi\n _PrTest=$(grep \"MONSTER\" /root/.*.octopus.cnf 2>&1)\n if [[ \"${_PrTest}\" =~ \"MONSTER\" ]]; then\n if [ \"${_CPU_VS}\" -lt 8 ]; then\n _CPU_VS=8\n fi\n fi\n _RAM=$(free -mt | grep Mem: | awk '{ print $2 }' 2>&1)\n if [ \"${_RESERVED_RAM}\" -gt 0 ]; then\n _RAM=$(( _RAM - _RESERVED_RAM ))\n else\n _RESERVED_RAM=$(( _RAM / 4 ))\n _RAM=$(( _RAM - _RESERVED_RAM ))\n fi\n _USE=$(( _RAM / 4 ))\n _if_hosted_sys\n if [ \"${_VMFAMILY}\" = \"VS\" ] \\\n || [ \"${_hostedSys}\" = \"YES\" ]; then\n if [ \"${_VMFAMILY}\" = \"VS\" ]; then\n if [ -e \"/root/.tg.cnf\" ]; then\n _USE_SQL=$(( _RAM / 12 ))\n else\n _USE_SQL=$(( _RAM / 24 ))\n fi\n else\n _USE_SQL=$(( _RAM / 8 ))\n fi\n else\n _USE_SQL=$(( _RAM / 8 ))\n fi\n if [ \"${_USE_SQL}\" -lt 64 ]; then\n _USE_SQL=64\n fi\n _TMP_SQL=\"${_USE_SQL}M\"\n _SRT_SQL=$(( _USE_SQL * 2 ))\n _SRT_SQL=\"${_SRT_SQL}K\"\n if [ \"${_USE}\" -ge 512 ] && [ \"${_USE}\" -lt 2048 ]; then\n _USE_PHP=1024\n _USE_OPC=1024\n _USE_CLI=2048\n _QCE_SQL=32M\n _RND_SQL=8M\n _JBF_SQL=4M\n if [ \"${_PHP_FPM_WORKERS}\" = \"AUTO\" ]; then\n _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 ))\n else\n _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS}\n fi\n _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 ))\n if [ \"${_NGINX_WORKERS}\" = \"AUTO\" ]; then\n _L_NGX_WRKS=${_CPU_MX}\n else\n _L_NGX_WRKS=${_NGINX_WORKERS}\n fi\n elif [ \"${_USE}\" -ge 2048 ]; then\n if [ \"${_VMFAMILY}\" = \"XEN\" ] || [ \"${_VMFAMILY}\" = \"AWS\" ]; then\n _USE_PHP=2048\n _USE_OPC=2048\n _USE_CLI=2048\n _QCE_SQL=64M\n _RND_SQL=8M\n _JBF_SQL=4M\n if [ \"${_PHP_FPM_WORKERS}\" = \"AUTO\" ]; then\n _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 ))\n else\n _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS}\n fi\n _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 ))\n if [ \"${_NGINX_WORKERS}\" = \"AUTO\" ]; then\n _L_NGX_WRKS=${_CPU_MX}\n else\n _L_NGX_WRKS=${_NGINX_WORKERS}\n fi\n elif [ \"${_VMFAMILY}\" = \"VS\" ] || [ \"${_VMFAMILY}\" = \"TG\" ]; then\n if [ -e \"/boot/grub/grub.cfg\" ] \\\n || [ -e \"/boot/grub/menu.lst\" ] \\\n || [ -e \"/root/.tg.cnf\" ]; then\n _USE_PHP=2048\n _USE_OPC=2048\n _USE_CLI=2048\n _QCE_SQL=64M\n _RND_SQL=8M\n _JBF_SQL=4M\n if [ \"${_PHP_FPM_WORKERS}\" = \"AUTO\" ]; then\n _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 ))\n else\n _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS}\n fi\n _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 ))\n if [ \"${_MXC_SQL}\" -lt 10 ]; then\n _MXC_SQL=10\n fi\n if [ \"${_NGINX_WORKERS}\" = \"AUTO\" ]; then\n _L_NGX_WRKS=${_CPU_TG}\n else\n _L_NGX_WRKS=${_NGINX_WORKERS}\n fi\n sed -i \"s/64000/128000/g\" /opt/php85/etc/php85.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php84/etc/php84.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php83/etc/php83.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php82/etc/php82.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php81/etc/php81.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php80/etc/php80.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php74/etc/php74.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php73/etc/php73.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php72/etc/php72.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php71/etc/php71.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php70/etc/php70.ini &> /dev/null\n sed -i \"s/64000/128000/g\" /opt/php56/etc/php56.ini &> /dev/null\n else\n _USE_PHP=2048\n _USE_OPC=2048\n _USE_CLI=2048\n _QCE_SQL=64M\n _RND_SQL=2M\n _JBF_SQL=2M\n if [ \"${_PHP_FPM_WORKERS}\" = \"AUTO\" ]; then\n _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 ))\n else\n _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS}\n fi\n _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 ))\n if [ \"${_NGINX_WORKERS}\" = \"AUTO\" ]; then\n _L_NGX_WRKS=${_CPU_VS}\n else\n _L_NGX_WRKS=${_NGINX_WORKERS}\n fi\n fi\n else\n _USE_PHP=512\n _USE_OPC=512\n _USE_CLI=512\n _QCE_SQL=32M\n _RND_SQL=2M\n _JBF_SQL=2M\n if [ \"${_PHP_FPM_WORKERS}\" = \"AUTO\" ]; then\n _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 ))\n else\n _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS}\n fi\n _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 ))\n if [ \"${_NGINX_WORKERS}\" = \"AUTO\" ]; then\n _L_NGX_WRKS=${_CPU_MX}\n else\n _L_NGX_WRKS=${_NGINX_WORKERS}\n fi\n fi\n else\n _USE_PHP=\"${_USE}\"\n _USE_OPC=\"${_USE}\"\n _USE_CLI=\"${_USE}\"\n _QCE_SQL=32M\n _RND_SQL=1M\n _JBF_SQL=1M\n if [ \"${_PHP_FPM_WORKERS}\" = \"AUTO\" ]; then\n _L_PHP_FPM_WORKERS=$(( _CPU_NR * 4 ))\n else\n _L_PHP_FPM_WORKERS=${_PHP_FPM_WORKERS}\n fi\n _MXC_SQL=$(( _L_PHP_FPM_WORKERS * 4 ))\n if [ \"${_NGINX_WORKERS}\" = \"AUTO\" ]; then\n _L_NGX_WRKS=${_CPU_MX}\n else\n _L_NGX_WRKS=${_NGINX_WORKERS}\n fi\n fi\n _USE_JETTY=\"-Xmx${_USE_OPC}m\"\n if [ \"${_VMFAMILY}\" = \"VZ\" ]; then\n _USE_OPC=64\n fi\n if [ \"${_USE_PHP}\" -lt 1024 ]; then\n _USE_PHP=1024\n fi\n _USE_FPM=$(( _USE_PHP / 2 ))\n if [ \"${_USE_FPM}\" -lt 1024 ]; then\n _USE_FPM=1024\n fi\n if [ ! -e \"/var/xdrago/conf/fpm-pool-foo-multi.conf\" ]; then\n mkdir -p /var/xdrago/conf\n fi\n if [ ! -e \"/data/conf\" ]; then\n mkdir -p /data/conf\n fi\n cp -af ${_locCnf}/php/fpm-pool-foo-multi.conf /var/xdrago/conf/\n cp -af ${_locCnf}/php/fpm-pool-foo.conf /var/xdrago/conf/\n cp -af ${_locCnf}/php/fpm-pool-common.conf /var/xdrago/conf/\n cp -af ${_locCnf}/php/fpm-pool-common-legacy.conf /var/xdrago/conf/\n cp -af ${_locCnf}/php/fpm-pool-common-modern.conf /var/xdrago/conf/\n sed -i \"s/127.0.0.1/127.0.0.1,${_THISHTIP}/g\" /var/xdrago/conf/fpm-pool-commo*.conf\n if [ -e \"/opt/etc/fpm/fpm-pool-common.conf\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/etc/fpm/fpm-pool-commo*.conf &> /dev/null\n wait\n fi\n if [ -e \"/opt/php85/etc/php85.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php85/etc/php85.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php85/etc/php85.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php85/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php84/etc/php84.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php84/etc/php84.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php84/etc/php84.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php84/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php83/etc/php83.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php83/etc/php83.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php83/etc/php83.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php83/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php82/etc/php82.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php82/etc/php82.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php82/etc/php82.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php82/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php81/etc/php81.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php81/etc/php81.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php81/etc/php81.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php81/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php80/etc/php80.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php80/etc/php80.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php80/etc/php80.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php80/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php74/etc/php74.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php74/etc/php74.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php74/etc/php74.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php74/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php73/etc/php73.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php73/etc/php73.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php73/etc/php73.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php73/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php72/etc/php72.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php72/etc/php72.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php72/etc/php72.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php72/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php71/etc/php71.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php71/etc/php71.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php71/etc/php71.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php71/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php70/etc/php70.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php70/etc/php70.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php70/etc/php70.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php70/lib/php.ini &> /dev/null\n fi\n if [ -e \"/opt/php56/etc/php56.ini\" ]; then\n sed -i \"s/395/${_USE_FPM}/g\" /opt/php56/etc/php56.ini &> /dev/null\n wait\n sed -i \"s/181/${_USE_OPC}/g\" /opt/php56/etc/php56.ini &> /dev/null\n sed -i \"s/395/${_USE_CLI}/g\" /opt/php56/lib/php.ini &> /dev/null\n fi\n if [ \"${_CUSTOM_CONFIG_SQL}\" = \"NO\" ]; then\n _tune_sql_memory_limits\n _PrTestPower=$(grep \"POWER\" /root/.*.octopus.cnf 2>&1)\n _PrTestPhantom=$(grep \"PHANTOM\" /root/.*.octopus.cnf 2>&1)\n _PrTestCluster=$(grep \"CLUSTER\" /root/.*.octopus.cnf 2>&1)\n _PrTestUltra=$(grep \"ULTRA\" /root/.*.octopus.cnf 2>&1)\n _PrTestMonster=$(grep \"MONSTER\" /root/.*.octopus.cnf 2>&1)\n if [[ \"${_PrTestPower}\" =~ \"POWER\" ]] \\\n || [[ \"${_PrTestPhantom}\" =~ \"PHANTOM\" ]] \\\n || [[ \"${_PrTestUltra}\" =~ \"ULTRA\" ]] \\\n || [[ \"${_PrTestMonster}\" =~ \"MONSTER\" ]] \\\n || [[ \"${_PrTestCluster}\" =~ \"CLUSTER\" ]] \\\n || [ -e \"/root/.my.cluster_root_pwd.txt\" ]; then\n _UXC_SQL=\"${_MXC_SQL}\"\n else\n _UXC_SQL=$(echo \"scale=0; ${_MXC_SQL}/2\" | bc 2>&1)\n fi\n sed -i \"s/= 191/= ${_UXC_SQL}/g\" /etc/mysql/my.cnf\n wait\n sed -i \"s/= 292/= ${_MXC_SQL}/g\" /etc/mysql/my.cnf\n wait\n sed -i \"s/^tmp_table_size.*/tmp_table_size = ${_TMP_SQL}/g\" /etc/mysql/my.cnf\n wait\n sed -i \"s/^max_heap_table_size.*/max_heap_table_size = ${_TMP_SQL}/g\" /etc/mysql/my.cnf\n wait\n sed -i \"s/^myisam_sort_buffer_size.*/myisam_sort_buffer_size = ${_SRT_SQL}/g\" /etc/mysql/my.cnf\n wait\n sed -i \"s/^read_rnd_buffer_size.*/read_rnd_buffer_size = ${_RND_SQL}/g\" /etc/mysql/my.cnf\n wait\n sed -i \"s/^join_buffer_size.*/join_buffer_size = ${_JBF_SQL}/g\" /etc/mysql/my.cnf\n wait\n fi\n if [ \"${_USE_OPC}\" -gt 2048 ]; then\n _MAX_MEM_VALKEY=2048\n else\n _MAX_MEM_VALKEY=\"${_USE_OPC}\"\n fi\n _MAX_MEM_VALKEY=\"${_MAX_MEM_VALKEY}MB\"\n sed -i \"s/^maxmemory .*/maxmemory ${_MAX_MEM_VALKEY}/g\" /etc/valkey/valkey.conf &> /dev/null\n sed -i \"s/^maxmemory .*/maxmemory ${_MAX_MEM_VALKEY}/g\" /etc/redis/redis.conf &> /dev/null\n wait\n if [ -e \"/etc/default/jetty9\" ] && [ -e \"/opt/solr4\" ]; then\n sed -i \"s/^JAVA_OPTIONS.*/JAVA_OPTIONS=\\\"-Xms64m ${_USE_JETTY} -Djava.awt.headless=true -Dsolr.solr.home=\\/opt\\/solr4 \\$JAVA_OPTIONS\\\" # Options/g\" /etc/default/jetty9\n wait\n fi\n _tune_web_server_config\n}\n#\n_check_git_repos() {\n if [ \"${_DL_MODE}\" != \"GIT\" ]; then\n return 1 # Exit the function but continue the script\n fi\n _GITHUB_WORKS=NO\n _GITLAB_WORKS=NO\n if [ \"${_FORCE_GIT_MIRROR}\" = \"drupal\" ]; then\n _FORCE_GIT_MIRROR=github\n fi\n if [ \"${_FORCE_GIT_MIRROR}\" = \"gitorious\" ]; then\n _FORCE_GIT_MIRROR=gitlab\n fi\n if [ \"${_FORCE_GIT_MIRROR}\" = \"github\" ]; then\n _msg \"INFO: We will use forced GitHub repository without testing connection\"\n _GITHUB_WORKS=YES\n _GITLAB_WORKS=NO\n sleep 1\n elif [ \"${_FORCE_GIT_MIRROR}\" = \"gitlab\" ]; then\n _msg \"INFO: We will use forced GitLab mirror without testing connection\"\n _GITHUB_WORKS=NO\n _GITLAB_WORKS=YES\n sleep 1\n else\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Testing repository mirror servers availability...\"\n fi\n sleep 1\n _GITHUB_WORKS=YES\n _GITLAB_WORKS=YES\n if ! command nc -w 10 -z github.com 443 >/dev/null 2>&1 ; then\n _GITHUB_WORKS=NO\n _msg \"WARN: The GitHub master repository server doesn't respond...\"\n elif ! command nc -w 10 -z gitlab.com 443 >/dev/null 2>&1 ; then\n _GITLAB_WORKS=NO\n _msg \"WARN: The GitLab mirror repository server doesn't respond...\"\n fi\n fi\n if [ \"${_GITHUB_WORKS}\" = \"YES\" ]; then\n _BOA_REPO_NAME=\"boa\"\n _BOA_REPO_GIT_URL=\"https://github.com/omega8cc\"\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: GitHub master repository will be used\"\n fi\n elif [ \"${_GITLAB_WORKS}\" = \"YES\" ]; then\n _BOA_REPO_NAME=\"boa\"\n _BOA_REPO_GIT_URL=\"${_gitLab}\"\n if [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: GitLab mirror repository will be used\"\n fi\n else\n cat <&1)\n if [[ \"${_VERSIONS_TEST}\" =~ \"${_X_VERSION}\" ]]; then\n _VERSIONS_TEST_RESULT=OK\n else\n _msg \"ERROR: Please upgrade this system to BOA version ${_X_VERSION} first\"\n _msg \"Bye\"\n _clean_pid_exit version_b\n fi\nfi\n#\n#\nrm -f /opt/tmp/testecho*\n_SRCDIR=\"/opt/tmp/files\"\nmkdir -p ${_SRCDIR}\nchmod -R 777 /opt/tmp &> /dev/null\ncd /opt/tmp\nrm -rf /opt/tmp/boa\nif [ \"${_DL_MODE}\" = \"GIT\" ]; then\n ${_gCb} ${_BRANCH_BOA} ${_BOA_REPO_GIT_URL}/${_BOA_REPO_NAME}.git &> /dev/null\nelse\n curl ${_crlGet} \"${_urlDev}/${_AEGIR_VERSION}/boa.tar.gz\" | tar -xzf -\n _BOA_REPO_NAME=\"boa\"\nfi\n#\n# Create tmp stuff\n_LOG=/var/backups/bond-${_NOW}.log\n#\n#\n\n\n###---### Tune Your Ægir Hosting System\n#\necho \" \"\nif [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"TUNER START -> checkpoint: \"\n cat <&1)\nif _prompt_yes_no \"${_tPrmt}?\" ; then\n true\n if [ ! -e \"/root/.upstart.cnf\" ]; then\n _msg \"INFO: We will stop cron and then wait 30 seconds...\"\n service cron stop &> /dev/null\n sleep 30\n fi\n _msg \"INFO: Tuning in progress, please wait...\"\n _restore_default_php\n _php_conf_update\n _tune_php\n _restore_default_sql\n _tune_sql\n _restore_default_nginx\n _tune_nginx\n _tune_memory_limits\n _restart_services\n _msg \"INFO: Tuning completed\"\nelse\n if [ ! -e \"/root/.upstart.cnf\" ]; then\n _msg \"INFO: We will stop cron and then wait 30 seconds...\"\n service cron stop &> /dev/null\n sleep 30\n fi\n _restore_default_php\n _php_conf_update\n _restore_default_sql\n _restore_default_nginx\n _tune_memory_limits\n _restart_services\n _msg \"INFO: Tuning stopped and default settings restored\"\nfi\n[ -e \"/run/boa_run.pid\" ] && rm -f /run/boa_run.pid\nif [ ! -e \"/root/.upstart.cnf\" ]; then\n service cron start &> /dev/null\nfi\nif [ \"${_DEBUG_MODE}\" = \"YES\" ]; then\n _msg \"INFO: Cron started again\"\nfi\n_msg \"BYE!\"\n\n###----------------------------------------###\n###\n### Barracuda-Octopus-Nginx-Drupal Tuner\n### Copyright (C) 2009-2026 Omega8.cc\n### noc@omega8.cc www.omega8.cc\n###\n###----------------------------------------###\n" }, { "path": "aegir/tools/backup/run/create_config_readme.sh", "content": "#!/bin/bash\n\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nexport _sPid=\"f62\"\n\n# Base directory for user configurations\n_BASE_DIR=\"/data/disk\"\n\n# Function to ensure the config directory exists\n_ensure_config_dir() {\n _user=$1\n _config_dir=\"${_BASE_DIR}/${_user}/static/control/remote_backups/config\"\n _dir_ctrl_file=\"${_BASE_DIR}/${_user}/log/.backboa.${_user}.${_sPid}.config.dir.ctrl\"\n if [ ! -d \"${_config_dir}\" ] || [ ! -e \"${_dir_ctrl_file}\" ]; then\n mkdir -p \"${_config_dir}\"\n chown -R ${_user}.ftp:users \"${_config_dir}\"\n chmod 700 \"${_config_dir}\"\n touch \"${_dir_ctrl_file}\"\n echo \"Created config directory for user: ${_user}\"\n fi\n}\n\n# Function to create a README file in the config directory\n_create_config_readme_file() {\n _user=$1\n _config_dir=\"${_BASE_DIR}/${_user}/static/control/remote_backups/config\"\n _readme_file=\"${_config_dir}/README.txt\"\n _readme_ctrl_file=\"${_BASE_DIR}/${_user}/log/.backboa.${_user}.${_sPid}.config.readme.ctrl\"\n _user_static_dir=\"/data/disk/${_user}/static\"\n _user_ftp_dir=\"/home/${_user}.ftp\"\n _user_ftp_dir_regex=\"/home/${_user}\\.ftp\"\n\n _ensure_config_dir \"${_user}\"\n\n if [ ! -f \"${_readme_ctrl_file}\" ]; then\n cat << EOF > \"${_readme_file}\"\nBackup Configuration README\n\nThis directory contains configuration files for customizing backup behavior.\nUsers can define include and exclude directives for their backups.\n\nAllowed paths for backups are restricted to:\n- ${_user_static_dir}\n- ${_user_ftp_dir}\n\nAvailable Configuration Files:\n\n1. include.txt\n Use this file to specify additional directories or files to include in the backup.\n\n2. exclude.txt\n Use this file to specify directories or files to exclude from the backup.\n\n3. include_regexp.txt\n Use this file to specify patterns for including directories or files using regular expressions.\n\n4. exclude_regexp.txt\n Use this file to specify patterns for excluding directories or files using regular expressions.\n\nUsage Instructions:\n\n1. include.txt\n List full paths to the directories or files you want to include in the backup.\n Example:\n --include ${_user_static_dir}/documents\n --include ${_user_ftp_dir}/documents\n\n2. exclude.txt\n List full paths to the directories or files you want to exclude from the backup.\n Example:\n --exclude ${_user_static_dir}/cache\n --exclude ${_user_ftp_dir}/temp\n\n3. include_regexp.txt\n Use regular expressions to specify patterns for directories or files to include in the backup.\n Example:\n --include-regexp '^${_user_ftp_dir_regex}/documents/.*\\.pdf$'\n --include-regexp '^${_user_static_dir}/project_data/.*'\n\n4. exclude_regexp.txt\n Use regular expressions to specify patterns for directories or files to exclude from the backup.\n Example:\n --exclude-regexp '^${_user_static_dir}/trash/.*'\n --exclude-regexp '^${_user_ftp_dir_regex}/temp_files/.*'\n\nSecurity:\n- Ensure these files are restricted to the user only:\n - Files should have permissions set to 600 (chmod 600 ).\n - The directory should have permissions set to 700 (chmod 700 ).\n\nNotes:\n- Directives in these files will be merged with default system directives during backup operations.\n- Patterns defined in exclude_regexp.txt will take precedence over those in include_regexp.txt.\n- You can only define paths in the /data/disk/${_user}/static/ directory tree.\n- Paths for platforms without direct access in /data/disk/${_user}/distro are included by default.\n- Invalid entries may cause the backup process to fail.\n\nExample Configuration:\n\nIf you want to exclude temporary files:\n- Add the following to exclude_regexp.txt:\n --exclude-regexp '^${_user_static_dir}/temp/.*'\n --exclude-regexp '^${_user_ftp_dir_regex}/temp/.*'\n\nIf you want to include specific documents:\n- Add the following to include_regexp.txt:\n --include-regexp '^${_user_ftp_dir_regex}/documents/.*\\.pdf$'\n --include-regexp '^${_user_static_dir}/important_data/.*'\n\nEOF\n chmod 600 \"${_readme_file}\"\n chown ${_user}.ftp:users \"${_readme_file}\"\n echo \"Created README file for config directory of user: ${_user}\"\n touch \"${_readme_ctrl_file}\"\n else\n echo \"README file already updated for config directory of user: ${_user}\"\n fi\n}\n\n# Main function to create README files for all users\n_main() {\n for _user_dir in \"${_BASE_DIR}\"/*; do\n if [ -d \"${_user_dir}\" ]; then\n _user=$(basename \"${_user_dir}\")\n if [ \"${_user}\" != \"arch\" ] \\\n && [ \"${_user}\" != \"data\" ] \\\n && [ \"${_user}\" != \"global\" ] \\\n && [ \"${_user}\" != \"static\" ] \\\n && [ \"${_user}\" != \"custom\" ]; then\n _create_config_readme_file \"${_user}\"\n fi\n fi\n done\n}\n\n# Execute the script\n_main\n" }, { "path": "aegir/tools/backup/run/create_credentials_templates.sh", "content": "#!/bin/bash\n\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\n\n# Global credentials directory\n_GLOBAL_CREDENTIALS_DIR=\"/root/.remote_backups/credentials\"\n\n# Base directory for user-specific credentials\n_USER_BASE_DIR=\"/data/disk\"\n\n# Function to ensure a directory exists\n_ensure_directory() {\n _dir=$1\n if [ ! -d \"${_dir}\" ]; then\n mkdir -p \"${_dir}\"\n chmod 700 \"${_dir}\"\n echo \"Created directory: ${_dir}\"\n fi\n}\n\n# Function to create credentials template files\n_create_credentials_templates() {\n _target_dir=$1\n\n # List of supported services\n _services=(\n \"aws_one_zone\"\n \"aws_standard_ia\"\n \"aws\"\n \"azure\"\n \"b2\"\n \"cloudflare\"\n \"do_spaces\"\n \"gcs\"\n \"ibm\"\n \"linode\"\n \"wasabi\"\n )\n\n for _service in \"${_services[@]}\"; do\n _template_file=\"${_target_dir}/${_service}.txt\"\n\n if [ -e \"${_user_pid_dir}\" ] && [ ! -e \"${_user_pid_dir}/.backboa.${_user}.credentials.${_service}.tpl.ctrl\" ]; then\n sed -i \"s/FULL_BACKUP_FREQUENCY=.*/FULL_BACKUP_FREQUENCY=\\\"28D\\\"/g\" ${_template_file}\n touch ${_user_pid_dir}/.backboa.${_user}.credentials.${_service}.tpl.ctrl\n fi\n\n if [ ! -f \"${_template_file}\" ]; then\n case \"${_service}\" in\n aws|aws_one_zone|aws_standard_ia)\n cat << EOF > \"${_template_file}\"\nexport AWS_ACCESS_KEY_ID=\"your_aws_access_key\"\nexport AWS_SECRET_ACCESS_KEY=\"your_aws_secret_key\"\nexport AWS_REGION=\"your_aws_region\" # E.g., \"us-east-1\"\nexport KEEP_WITHIN=\"3M\"\nexport FULL_BACKUP_FREQUENCY=\"28D\"\nEOF\n ;;\n azure)\n cat << EOF > \"${_template_file}\"\nexport AZURE_STORAGE_ACCOUNT=\"your_azure_storage_account\"\nexport AZURE_STORAGE_KEY=\"your_azure_storage_key\"\nexport KEEP_WITHIN=\"3M\"\nexport FULL_BACKUP_FREQUENCY=\"28D\"\nEOF\n ;;\n b2)\n cat << EOF > \"${_template_file}\"\nexport B2_ACCOUNT_ID=\"your_b2_account_id\"\nexport B2_APPLICATION_KEY=\"your_b2_application_key\"\nexport KEEP_WITHIN=\"3M\"\nexport FULL_BACKUP_FREQUENCY=\"28D\"\nEOF\n ;;\n cloudflare)\n cat << EOF > \"${_template_file}\"\nexport R2_ACCOUNT_ID=\"your_account_id\"\nexport R2_ACCESS_KEY_ID=\"your_access_key_id\"\nexport R2_SECRET_ACCESS_KEY=\"your_secret_access_key\"\nexport KEEP_WITHIN=\"3M\"\nexport FULL_BACKUP_FREQUENCY=\"28D\"\nEOF\n ;;\n do_spaces)\n cat << EOF > \"${_template_file}\"\nexport DO_SPACES_KEY=\"your_do_spaces_key\"\nexport DO_SPACES_SECRET=\"your_do_spaces_secret\"\nexport DO_SPACES_REGION=\"your_do_spaces_region\" # E.g., \"nyc3\"\nexport KEEP_WITHIN=\"3M\"\nexport FULL_BACKUP_FREQUENCY=\"28D\"\nEOF\n ;;\n gcs)\n cat << EOF > \"${_template_file}\"\nexport GCS_PROJECT_ID=\"your_gcs_project_id\"\nexport GCS_SERVICE_ACCOUNT_KEY=\"your_gcs_service_account_key\"\nexport KEEP_WITHIN=\"3M\"\nexport FULL_BACKUP_FREQUENCY=\"28D\"\nEOF\n ;;\n ibm)\n cat << EOF > \"${_template_file}\"\nexport IBM_API_KEY_ID=\"your_ibm_api_key_id\"\nexport IBM_SERVICE_INSTANCE_ID=\"your_ibm_service_instance_id\"\nexport IBM_REGION=\"your_ibm_region\"\nexport KEEP_WITHIN=\"3M\"\nexport FULL_BACKUP_FREQUENCY=\"28D\"\nEOF\n ;;\n linode)\n cat << EOF > \"${_template_file}\"\nexport LINODE_ACCESS_KEY=\"your_linode_access_key\"\nexport LINODE_SECRET_KEY=\"your_linode_secret_key\"\nexport LINODE_REGION=\"your_linode_region\" # E.g., \"us-east-1\"\nexport KEEP_WITHIN=\"3M\"\nexport FULL_BACKUP_FREQUENCY=\"28D\"\nEOF\n ;;\n wasabi)\n cat << EOF > \"${_template_file}\"\nexport WASABI_ACCESS_KEY=\"your_wasabi_access_key\"\nexport WASABI_SECRET_KEY=\"your_wasabi_secret_key\"\nexport WASABI_REGION=\"your_wasabi_region\" # E.g., \"us-east-1\"\nexport KEEP_WITHIN=\"3M\"\nexport FULL_BACKUP_FREQUENCY=\"28D\"\nEOF\n ;;\n esac\n chmod 600 \"${_template_file}\"\n echo \"Created template for service: ${_service} at ${_template_file}\"\n else\n echo \"Template for service: ${_service} already exists at ${_template_file}\"\n fi\n done\n}\n\n# Main function to create templates globally and for all users\n_main() {\n # Create templates in the global credentials directory\n _ensure_directory \"${_GLOBAL_CREDENTIALS_DIR}\"\n _create_credentials_templates \"${_GLOBAL_CREDENTIALS_DIR}\"\n\n # Iterate over user directories and create templates for each user\n for _user_dir in \"${_USER_BASE_DIR}\"/*; do\n if [ -d \"${_user_dir}\" ]; then\n _user=$(basename \"${_user_dir}\")\n if [ \"${_user}\" != \"arch\" ] \\\n && [ \"${_user}\" != \"data\" ] \\\n && [ \"${_user}\" != \"global\" ] \\\n && [ \"${_user}\" != \"static\" ] \\\n && [ \"${_user}\" != \"custom\" ]; then\n _user_pid_dir=\"${_USER_BASE_DIR}/${_user}/log\"\n _user_credentials_dir=\"${_USER_BASE_DIR}/${_user}/static/control/remote_backups/credentials\"\n _ensure_directory \"${_user_credentials_dir}\"\n _create_credentials_templates \"${_user_credentials_dir}\"\n fi\n fi\n done\n}\n\n# Execute the script\n_main\n" }, { "path": "aegir/tools/backup/run/create_cron_entries.sh", "content": "#!/bin/bash\n\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\n\n# Configurable in /root/.barracuda.cnf interval in minutes between backup cycles\n_BACKUP_INTERVAL=360\n_WRAPPER_DIR=\"/root/.remote_backups/run\"\n_WRAPPER_SCRIPT=\"${_WRAPPER_DIR}/sequential_backups.sh\"\n_SCHEDULE_DIR=\"/root/.remote_backups/schedule\"\n_SCHEDULE_FILE=\"${_SCHEDULE_DIR}/backup_schedule.txt\"\n_CRON_FILE=\"/etc/cron.d/duplicity_backup\"\n_LOGFILE=\"/var/log/backup_runtime.log\"\n\n# Function to verify root access\n_check_root() {\n if [ \"$(id -u)\" -eq 0 ]; then\n ionice -c2 -n7 -p $$\n renice 0 -p $$\n chmod a+w /dev/null\n [ -e \"/root/.gnupg\" ] && chmod 700 /root/.gnupg\n else\n echo \"ERROR: This script should be run as a root user\"\n exit 1\n fi\n _DF_TEST=\"$(command df -P -l / 2>/dev/null | awk '\n NR==1 { for (i=1; i<=NF; i++) if ($i==\"Use%\" || $i==\"Capacity\") u=i }\n NR==2 { gsub(/%/,\"\",$u); print $u }')\"\n if [ ! -z \"${_DF_TEST}\" ] && [ \"${_DF_TEST}\" -gt 90 ]; then\n echo \"ERROR: Your disk space is almost full !!! ${_DF_TEST}/100\"\n echo \"ERROR: We can not proceed until it is below 90/100\"\n exit 1\n fi\n}\n_check_root\n\n# shellcheck disable=SC1091\n[ -e \"/root/.barracuda.cnf\" ] && source /root/.barracuda.cnf\nexport _BACKUP_INTERVAL=${_BACKUP_INTERVAL//[^0-9]/}\n: \"${_BACKUP_INTERVAL:=360}\"\n\n# Ensure global run directory exists and is owned by root\nmkdir -p \"${_WRAPPER_DIR}\"\nchown root:root \"${_WRAPPER_DIR}\"\nchmod 700 \"${_WRAPPER_DIR}\"\n\n# Ensure global schedule directory exists and is owned by root\nmkdir -p \"${_SCHEDULE_DIR}\"\nchown root:root \"${_SCHEDULE_DIR}\"\nchmod 700 \"${_SCHEDULE_DIR}\"\n\n# Function to generate the wrapper script\n_generate_wrapper_script() {\n cat << 'EOF' > \"${_WRAPPER_SCRIPT}\"\n#!/bin/bash\n\n# Enable strict error handling for debugging only\n# set -euo pipefail\n\n# Environment setup\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\n\n# File paths\n_SCHEDULE_FILE=\"/root/.remote_backups/schedule/backup_schedule.txt\"\n_PID_DIR=\"/run\"\n_LOGFILE=\"/var/log/backup_runtime.log\"\n\n# Function to create PID file\n_create_pid_file() {\n local _pidfile=$1\n if [ -e \"${_pidfile}\" ]; then\n echo \"Process already running with PID file ${_pidfile}\"\n exit 1\n else\n echo $$ > \"${_pidfile}\"\n fi\n}\n\n# Function to remove PID file\n_remove_pid_file() {\n local _pidfile=$1\n if [ -f \"${_pidfile}\" ]; then\n rm -f \"${_pidfile}\" || {\n echo \"Warning: Failed to remove PID file: ${_pidfile}\"\n }\n fi\n}\n\n# Function to remove stale multiback PID file\n_remove_stale_multiback_pid() {\n _multiback_pidfile=\"/run/duplicity_${_service}_${_user}.pid\"\n if [ -f \"${_multiback_pidfile}\" ]; then\n _old_pid=$(cat \"${_multiback_pidfile}\")\n if [ -n \"${_old_pid}\" ] && ! kill -0 \"${_old_pid}\" 2>/dev/null; then\n echo \"Stale multiback PID file detected: ${_multiback_pidfile}. Removing it.\"\n rm -f \"${_multiback_pidfile}\"\n fi\n fi\n}\n\n# Read backup services and users from the configuration file\nif [ ! -f \"${_SCHEDULE_FILE}\" ]; then\n echo \"Error: Backup schedule file ${_SCHEDULE_FILE} not found.\"\n exit 1\nfi\n\n# Function to print env for debugging\n_print_env() {\n if [ \"$(id -u)\" -eq 0 ] && [ -e \"/root/.dev.server.cnf\" ]; then\n _ENV=$(env 2>&1)\n echo\n echo \"_ENV in $1 start\"\n echo \"${_ENV}\"\n echo \"_ENV in $1 end\"\n echo\n _ENV=\n fi\n}\n\n# Process each line in the backup configuration file\nwhile IFS= read -r _line || [ -n \"${_line}\" ]; do\n # Skip empty lines and comments\n if [[ \"${_line}\" =~ ^\\s*# ]] || [[ -z \"${_line}\" ]]; then\n continue\n fi\n\n # Parse the service and user\n _service=$(echo \"${_line}\" | cut -d' ' -f1)\n _user=$(echo \"${_line}\" | cut -d' ' -f2)\n\n # Ensure both service and user are defined\n if [ -z \"${_service}\" ] || [ -z \"${_user}\" ]; then\n echo \"Error: Invalid line in configuration file: ${_line}\"\n continue\n fi\n\n echo \"Starting backup for ${_service} (${_user})...\"\n export _service=\"${_service}\"\n export _user=\"${_user}\"\n\n # Define the PID file path\n _CURRENT_PIDFILE=\"${_PID_DIR}/duplicity_${_service}_${_user}_sequential.pid\"\n\n # Create the PID file\n _create_pid_file \"${_CURRENT_PIDFILE}\"\n trap \"rm -f ${_PIDFILE}; exit\" EXIT\n\n # Remove stale multiback PID file if necessary\n _remove_stale_multiback_pid\n\n # Determine the paths configuration file\n if [ \"${_user}\" = \"global\" ] || [ \"${_user}\" = \"data\" ] || [ \"${_user}\" = \"custom\" ]; then\n _paths_file=\"/root/.remote_backups/paths/${_user}_paths.txt\"\n _credentials_file=\"/root/.remote_backups/credentials/${_service}.txt\"\n _secret_file=\"/root/.remote_backups/.secret.txt\"\n\n if [ ! -f \"${_secret_file}\" ]; then\n echo \"Secret file ${_secret_file} not found.\"\n _remove_pid_file \"${_CURRENT_PIDFILE}\"\n continue\n fi\n\n # Check if _paths_file exists\n if [ ! -f \"${_paths_file}\" ]; then\n echo \"Error: Paths configuration file ${_paths_file} not found.\"\n _remove_pid_file \"${_CURRENT_PIDFILE}\"\n continue\n fi\n\n # Check if credentials file exists\n if [ ! -f \"${_credentials_file}\" ]; then\n echo \"Error: Credentials file ${_credentials_file} not found.\"\n _remove_pid_file \"${_CURRENT_PIDFILE}\"\n continue\n fi\n\n # Change to the directory where _paths_file and credentials are located\n cd /root/.remote_backups\n _print_env \"sequential_backups_a\"\n\n elif [ \"${_user}\" != \"arch\" ] \\\n && [ \"${_user}\" != \"data\" ] \\\n && [ \"${_user}\" != \"global\" ] \\\n && [ \"${_user}\" != \"static\" ] \\\n && [ \"${_user}\" != \"custom\" ]; then\n _paths_file=\"/data/disk/${_user}/remote_backups/paths/paths.txt\"\n _credentials_file=\"/data/disk/${_user}/static/control/remote_backups/credentials/${_service}.txt\"\n _secret_file=\"/data/disk/${_user}/remote_backups/.secret.txt\"\n\n if [ ! -f \"${_secret_file}\" ]; then\n echo \"Secret file ${_secret_file} not found.\"\n _remove_pid_file \"${_CURRENT_PIDFILE}\"\n continue\n fi\n\n if [ ! -f \"${_paths_file}\" ]; then\n echo \"Error: Paths configuration file ${_paths_file} not found.\"\n _remove_pid_file \"${_CURRENT_PIDFILE}\"\n continue\n fi\n\n if [ ! -f \"${_credentials_file}\" ]; then\n echo \"Error: Credentials file ${_credentials_file} not found.\"\n _remove_pid_file \"${_CURRENT_PIDFILE}\"\n continue\n fi\n\n # Change to the directory where _paths_file and credentials are located\n cd \"/data/disk/${_user}/remote_backups\"\n _print_env \"sequential_backups_b\"\n fi\n\n # Perform the backup\n if multiback backup \"${_service}\" \"${_user}\"; then\n echo \"Backup for ${_service} (${_user}) completed successfully.\"\n else\n echo \"Backup for ${_service} (${_user}) failed.\"\n fi\n\n # Wipe out exported variables to clean up env after running the backup\n export _service=\n export _user=\n\n # Return to the original directory\n cd -\n _print_env \"sequential_backups_d\"\n\n # Remove the PID file\n _remove_pid_file \"${_CURRENT_PIDFILE}\"\n\ndone < \"${_SCHEDULE_FILE}\"\nEOF\n\n chmod +x \"${_WRAPPER_SCRIPT}\"\n echo \"Wrapper script created at ${_WRAPPER_SCRIPT}\"\n}\n\n# Function to create cron entries\n_create_cron_entries() {\n echo \"# Cron job for sequential backups\" > \"${_CRON_FILE}\"\n echo \"0 */$((_BACKUP_INTERVAL / 60)) * * * root ${_WRAPPER_SCRIPT}\" >> \"${_CRON_FILE}\"\n chmod 644 \"${_CRON_FILE}\"\n echo \"Cron entry created at ${_CRON_FILE}\"\n\n # Validate the cron file\n _validate_cron_file\n}\n\n# Function to validate the cron file\n_validate_cron_file() {\n if ! grep -q -E \"^[^#]*${_WRAPPER_SCRIPT}\" \"${_CRON_FILE}\"; then\n echo \"Error: Cron file validation failed. Please check the file at ${_CRON_FILE}.\"\n exit 1\n fi\n echo \"Cron file validated successfully.\"\n}\n\n# Function to generate the backup schedule\n_generate_backup_schedule() {\n echo \"# Backup schedule (service user)\" > \"${_SCHEDULE_FILE}\"\n\n # Add global backups\n _custom_paths_file=\"/root/.remote_backups/paths/custom_paths.txt\"\n _GLOBAL_CRED_DIR=\"/root/.remote_backups/credentials\"\n for _service in aws aws_one_zone aws_standard_ia azure b2 cloudflare do_spaces gcs ibm linode wasabi; do\n if [ -f \"${_GLOBAL_CRED_DIR}/${_service}.txt\" ] && ! grep -q \"your_\" \"${_GLOBAL_CRED_DIR}/${_service}.txt\"; then\n echo \"${_service} global\" >> \"${_SCHEDULE_FILE}\"\n echo \"${_service} data\" >> \"${_SCHEDULE_FILE}\"\n [ -s \"${_custom_paths_file}\" ] && echo \"${_service} custom\" >> \"${_SCHEDULE_FILE}\"\n fi\n done\n\n # Add user-specific backups\n for _user_dir in /data/disk/*; do\n if [ -d \"${_user_dir}\" ]; then\n _user=$(basename \"${_user_dir}\")\n _USER_CRED_DIR=\"/data/disk/${_user}/static/control/remote_backups/credentials\"\n for _service in aws aws_one_zone aws_standard_ia azure b2 cloudflare do_spaces gcs ibm linode wasabi; do\n if [ -f \"${_USER_CRED_DIR}/${_service}.txt\" ] && ! grep -q \"your_\" \"${_USER_CRED_DIR}/${_service}.txt\"; then\n echo \"${_service} ${_user}\" >> \"${_SCHEDULE_FILE}\"\n fi\n done\n fi\n done\n\n echo \"Backup schedule created at ${_SCHEDULE_FILE}\"\n}\n\n# Function to adjust the backup interval dynamically\n_adjust_backup_interval() {\n if [ -f \"${_LOGFILE}\" ]; then\n _TOTAL_RUNTIME=$(tail -n1 \"${_LOGFILE}\" | awk '{print $NF}')\n _NEW_INTERVAL=$(( (_TOTAL_RUNTIME / 3600 + 1) * 60 )) # Round up to the next hour\n if [ \"${_NEW_INTERVAL}\" -gt \"${_BACKUP_INTERVAL}\" ]; then\n _BACKUP_INTERVAL=\"${_NEW_INTERVAL}\"\n echo \"Adjusted backup interval to $((_BACKUP_INTERVAL / 60)) hours.\"\n _create_cron_entries\n fi\n fi\n}\n\n# Main script execution\n_generate_wrapper_script\n_generate_backup_schedule\n_adjust_backup_interval\n_create_cron_entries\n" }, { "path": "aegir/tools/backup/run/create_global_paths_config.sh", "content": "#!/bin/bash\n\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nexport _sPid=\"f62\"\n\n# Function to create or update global paths configuration\n_create_global_paths_config() {\n _global_config_dir=\"/root/.remote_backups/paths\"\n _include_list=\"${_global_config_dir}/.backboa.include.list\"\n _exclude_list=\"${_global_config_dir}/.backboa.exclude.list\"\n _custom_include_list=\"${_global_config_dir}/.backboa.custom_include.list\"\n _custom_exclude_list=\"${_global_config_dir}/.backboa.custom_exclude.list\"\n\n _include_global_regexp_file=\"${_global_config_dir}/.backboa.include_global_regexp.file\"\n _include_global_file=\"${_global_config_dir}/.backboa.include_global.file\"\n _exclude_global_file=\"${_global_config_dir}/.backboa.exclude.file\"\n _merged_global_include_file=\"${_global_config_dir}/.backboa.global_include.merged.file\"\n _merged_global_exclude_file=\"${_global_config_dir}/.backboa.global_exclude.merged.file\"\n\n _include_data_file=\"${_global_config_dir}/.backboa.include_data.file\"\n _exclude_data_file=\"${_global_config_dir}/.backboa.exclude_data.file\"\n _merged_data_include_file=\"${_global_config_dir}/.backboa.data_include.merged.file\"\n _merged_data_exclude_file=\"${_global_config_dir}/.backboa.data_exclude.merged.file\"\n\n _global_ctrl_file=\"${_global_config_dir}/.backboa.${_sPid}.paths.ctrl.file\"\n _global_paths_file=\"${_global_config_dir}/global_paths.txt\"\n _data_paths_file=\"${_global_config_dir}/data_paths.txt\"\n _custom_paths_file=\"${_global_config_dir}/custom_paths.txt\"\n _disk_dir=\"/data/disk\"\n _home_dir=\"/home\"\n\n # Ensure global configuration directory exists and is owned by root\n mkdir -p \"${_global_config_dir}\"\n chown root:root \"${_global_config_dir}\"\n chmod 700 \"${_global_config_dir}\"\n\n # Function to validate configuration files\n _validate_config() {\n _file=$1\n _type=$2\n\n # Check for invalid entries\n if [ \"${_type}\" = \"regexp\" ]; then\n _invalid_lines=$(grep -Ev \"^--(include-regexp|exclude-regexp)\" \"${_file}\" || true)\n if [ -n \"${_invalid_lines}\" ]; then\n echo \"Error: Invalid entries in ${_file}:\"\n echo \"${_invalid_lines}\"\n exit 1\n fi\n else\n _invalid_lines=$(grep -Ev \"^--(include|exclude)\" \"${_file}\" || true)\n if [ -n \"${_invalid_lines}\" ]; then\n echo \"Error: Invalid entries in ${_file}:\"\n echo \"${_invalid_lines}\"\n exit 1\n fi\n fi\n }\n\n # Function to append unique entries from source to target file\n _append_unique_entries() {\n _source_file=$1\n _target_file=$2\n if [ -f \"${_source_file}\" ]; then\n grep -v -F -x -f \"${_target_file}\" \"${_source_file}\" >> \"${_target_file}\"\n fi\n }\n\n if [ ! -f \"${_global_ctrl_file}\" ]; then\n\n ### Migrate legacy exclude/include files if present and merge unique entries\n\n # _include_list\n if [ -f \"/root/.backboa.include\" ]; then\n if [ ! -f \"${_include_list}\" ]; then\n cp \"/root/.backboa.include\" \"${_include_list}\"\n else\n _append_unique_entries \"/root/.backboa.include\" \"${_include_list}\"\n fi\n fi\n\n # _exclude_list\n if [ -f \"/root/.backboa.exclude\" ]; then\n if [ ! -f \"${_exclude_list}\" ]; then\n cp \"/root/.backboa.exclude\" \"${_exclude_list}\"\n else\n _append_unique_entries \"/root/.backboa.exclude\" \"${_exclude_list}\"\n fi\n else\n cat << EOF > \"${_exclude_list}\"\n**files/advagg_css/**\n**files/advagg_js/**\n**files/css/**\n**files/js/**\n**private/temp/**\nEOF\n fi\n\n # _custom_include_list\n if [ -f \"/root/.backboa.custom.include\" ]; then\n if [ ! -f \"${_custom_include_list}\" ]; then\n cp \"/root/.backboa.custom.include\" \"${_custom_include_list}\"\n else\n _append_unique_entries \"/root/.backboa.custom.include\" \"${_custom_include_list}\"\n fi\n fi\n\n # _custom_exclude_list\n if [ -f \"/root/.backboa.custom.exclude\" ]; then\n if [ ! -f \"${_custom_exclude_list}\" ]; then\n cp \"/root/.backboa.custom.exclude\" \"${_custom_exclude_list}\"\n else\n _append_unique_entries \"/root/.backboa.custom.exclude\" \"${_custom_exclude_list}\"\n fi\n fi\n\n ### Create default exclude/include files if they don't exist\n\n # _include_global_file\n cat << EOF > \"${_include_global_file}\"\n--include /data/disk/arch\n--include /var/backups/csf\n--include /var/backups/dragon\n--include /var/backups/reports\nEOF\n\n # _exclude_global_file\n cat << EOF > \"${_exclude_global_file}\"\n--exclude /var/aegir/backups\n--exclude /var/aegir/.tmp\nEOF\n\n # _include_data_file\n # Start writing to the include data file\n cat << EOF > \"${_include_data_file}\"\nEOF\n\n # Iterate over each item in the disk directory\n for subdir in \"${_disk_dir}\"/*/; do\n # Check if it's a directory\n if [ -d \"${subdir}\" ]; then\n # Remove the trailing slash for consistency\n sanitized_subdir=\"${subdir%/}\"\n # Append the --include line to the include data file\n if [ \"${sanitized_subdir}\" != \"/data/disk/arch\" ] \\\n && [ \"${sanitized_subdir}\" != \"/data/disk/static\" ]; then\n echo \"--include ${sanitized_subdir}\" >> \"${_include_data_file}\"\n fi\n fi\n done\n\n # Append the additional include statements\n cat << EOF >> \"${_include_data_file}\"\n--include /data/all\n--include /data/conf\n--include /home\nEOF\n\n # _include_global_regexp_file\n cat << EOF > \"${_include_global_regexp_file}\"\n--include-regexp '^/root/\\..*\\.cnf$'\nEOF\n\n # _exclude_data_file\n # Start writing to the exclude data file\n cat << EOF > \"${_exclude_data_file}\"\nEOF\n\n # Iterate over each item in the disk directory\n for subdir in \"${_disk_dir}\"/*/; do\n # Check if it's a directory\n if [ -d \"${subdir}\" ]; then\n # Remove the trailing slash for consistency\n sanitized_subdir=\"${subdir%/}\"\n # Append the --exclude line to the exclude data path\n if [ \"${sanitized_subdir}\" != \"/data/disk/arch\" ] \\\n && [ \"${sanitized_subdir}\" != \"/data/disk/static\" ]; then\n echo \"--exclude ${sanitized_subdir}/.tmp\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/backup-exports\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/backups\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/clients\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/src\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/static/.tmp\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/static/restores\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/static/tmp\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/static/trash\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/u\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/undo\" >> \"${_exclude_data_file}\"\n else\n echo \"--exclude ${sanitized_subdir}\" >> \"${_exclude_data_file}\"\n fi\n fi\n done\n\n # Iterate over each item in the home directory\n for subdir in \"${_home_dir}\"/*/; do\n # Check if it's a directory\n if [ -d \"${subdir}\" ]; then\n # Remove the trailing slash for consistency\n sanitized_subdir=\"${subdir%/}\"\n # Append the --exclude line to the exclude home path\n if [[ \"${sanitized_subdir}\" =~ \".ftp\"($) ]]; then\n echo \"--exclude ${sanitized_subdir}/.tmp\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/backups\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/clients\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/platforms\" >> \"${_exclude_data_file}\"\n echo \"--exclude ${sanitized_subdir}/static\" >> \"${_exclude_data_file}\"\n else\n echo \"--exclude ${sanitized_subdir}\" >> \"${_exclude_data_file}\"\n fi\n fi\n done\n\n # Append the additional exclude statements\n cat << EOF >> \"${_exclude_data_file}\"\n--exclude /var/www\nEOF\n\n\n # Validate and merge exclude/include files\n [ -e \"${_include_data_file}\" ] && _validate_config \"${_include_data_file}\"\n [ -e \"${_include_global_file}\" ] && _validate_config \"${_include_global_file}\"\n [ -e \"${_exclude_global_file}\" ] && _validate_config \"${_exclude_global_file}\"\n\n [ -e \"${_include_data_file}\" ] && cat \"${_include_data_file}\" > \"${_merged_data_include_file}\"\n [ -e \"${_include_global_file}\" ] && cat \"${_include_global_file}\" > \"${_merged_global_include_file}\"\n [ -e \"${_exclude_global_file}\" ] && cat \"${_exclude_global_file}\" > \"${_merged_global_exclude_file}\"\n\n # Merge regexp files into final configurations\n if [ -s \"${_include_global_regexp_file}\" ]; then\n _validate_config \"${_include_global_regexp_file}\" \"regexp\"\n cat \"${_include_global_regexp_file}\" >> \"${_merged_global_include_file}\"\n fi\n if [ -s \"${_exclude_data_file}\" ]; then\n _validate_config \"${_exclude_data_file}\"\n cat \"${_exclude_data_file}\" > \"${_merged_data_exclude_file}\"\n fi\n\n # Convert the exclude file contents to a single-line variable without backslashes and excessive whitespace\n [ -e \"${_merged_data_include_file}\" ] && _MERGED_DATA_INCLUDE=$(cat \"${_merged_data_include_file}\" | tr '\\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//')\n [ -e \"${_merged_data_exclude_file}\" ] && _MERGED_DATA_EXCLUDE=$(cat \"${_merged_data_exclude_file}\" | tr '\\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//')\n [ -e \"${_merged_global_include_file}\" ] && _MERGED_GLOBAL_INCLUDE=$(cat \"${_merged_global_include_file}\" | tr '\\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//')\n [ -e \"${_merged_global_exclude_file}\" ] && _MERGED_GLOBAL_EXCLUDE=$(cat \"${_merged_global_exclude_file}\" | tr '\\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//')\n\n # Create the final paths configuration file\n cat << EOF > \"${_global_paths_file}\"\n_SOURCE=\"/etc /opt/solr4 /var/aegir /var/solr7 /var/solr9 /var/www /var/xdrago\"\n_INCLUDE_PATHS=\"${_MERGED_GLOBAL_INCLUDE}\"\n_EXCLUDE_PATHS=\"${_MERGED_GLOBAL_EXCLUDE}\"\n_INCLUDE_LIST=\"${_include_list}\"\n_EXCLUDE_LIST=\"${_exclude_list}\"\nEOF\n\n echo \"Global paths configuration created or updated at ${_global_paths_file}\"\n\n # Create the final paths configuration file\n cat << EOF > \"${_data_paths_file}\"\n_SOURCE=\"\"\n_INCLUDE_PATHS=\"${_MERGED_DATA_INCLUDE}\"\n_EXCLUDE_PATHS=\"${_MERGED_DATA_EXCLUDE}\"\n_INCLUDE_LIST=\"${_include_list}\"\n_EXCLUDE_LIST=\"${_exclude_list}\"\nEOF\n\n echo \"Global paths configuration created or updated at ${_data_paths_file}\"\n\n [ -s \"${_custom_include_list}\" ] && cat << EOF > \"${_custom_paths_file}\"\n_SOURCE=\"\"\n_INCLUDE_PATHS=\"\"\n_EXCLUDE_PATHS=\"\"\n_INCLUDE_LIST=\"${_custom_include_list}\"\nEOF\n\n [ -s \"${_custom_exclude_list}\" ] && cat << EOF >> \"${_custom_paths_file}\"\n_EXCLUDE_LIST=\"${_custom_exclude_list}\"\nEOF\n\n [ -s \"${_custom_paths_file}\" ] && echo \"Global paths configuration created or updated at ${_custom_paths_file}\"\n\n rm -f ${_global_config_dir}/.backboa*paths.ctrl.file\n touch ${_global_ctrl_file}\n fi\n}\n\n#### Generate Passphrase for Root\n_generate_global_secret_file() {\n local _secret_file=\"/root/.remote_backups/.secret.txt\"\n\n if [ ! -s \"${_secret_file}\" ]; then\n openssl rand -base64 32 > \"${_secret_file}\"\n chmod 600 \"${_secret_file}\"\n chattr +i \"${_secret_file}\"\n echo \"Global secret file created at ${_secret_file} and made immutable.\"\n else\n echo \"Global secret file already exists at ${_secret_file}.\"\n fi\n}\n\n# Main execution\n_create_global_paths_config\n_generate_global_secret_file\n\nexit 0\n" }, { "path": "aegir/tools/backup/run/create_readme.sh", "content": "#!/bin/bash\n\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nexport _sPid=\"f62\"\n\n# Directory for storing README files\n_BASE_DIR=\"/data/disk\"\n\n# Function to ensure the README directory exists\n_ensure_readme_dir() {\n _user=$1\n _credentials_dir=\"${_BASE_DIR}/${_user}/static/control/remote_backups/credentials\"\n _dir_ctrl_file=\"${_BASE_DIR}/${_user}/log/.backboa.${_user}.${_sPid}.credentials.dir.ctrl\"\n if [ ! -d \"${_credentials_dir}\" ] || [ ! -e \"${_dir_ctrl_file}\" ]; then\n mkdir -p \"${_credentials_dir}\"\n chown -R ${_user}.ftp:users \"${_credentials_dir}\"\n chmod 700 \"${_credentials_dir}\"\n touch \"${_dir_ctrl_file}\"\n echo \"Created credentials directory for user: ${_user}\"\n fi\n}\n\n# Function to create a README file for a specific user\n_create_readme_file() {\n _user=$1\n _credentials_dir=\"${_BASE_DIR}/${_user}/static/control/remote_backups/credentials\"\n _readme_file=\"${_credentials_dir}/README.txt\"\n _readme_ctrl_file=\"${_BASE_DIR}/${_user}/log/.backboa.${_user}.${_sPid}.credentials.readme.ctrl\"\n\n _ensure_readme_dir \"${_user}\"\n\n if [ ! -f \"${_readme_ctrl_file}\" ]; then\n cat << EOF > \"${_readme_file}\"\n# Backup Credentials README\n\nThis directory contains credentials files for the backup services supported by the system.\nEach file corresponds to a specific backup service and must follow the correct format.\n\n## Supported Services and Corresponding Files:\nAmazon S3 (Standard, One Zone, Standard-IA)\n File: aws.txt\n export AWS_ACCESS_KEY_ID=\"your_aws_access_key\"\n export AWS_SECRET_ACCESS_KEY=\"your_aws_secret_key\"\n export AWS_REGION=\"your_aws_region\" # E.g., \"us-east-1\"\n export KEEP_WITHIN=\"3M\" # Retain backups from the last 3 months\n export FULL_BACKUP_FREQUENCY=\"28D\" # Create a full backup every 28 days\n\nGoogle Cloud Storage\n File: gcs.txt\n export GCS_PROJECT_ID=\"your_gcs_project_id\"\n export GCS_SERVICE_ACCOUNT_KEY=\"your_gcs_service_account_key\"\n export KEEP_WITHIN=\"3M\"\n export FULL_BACKUP_FREQUENCY=\"28D\"\n\nBackblaze B2\n File: b2.txt\n export B2_ACCOUNT_ID=\"your_b2_account_id\"\n export B2_APPLICATION_KEY=\"your_b2_application_key\"\n export KEEP_WITHIN=\"3M\"\n export FULL_BACKUP_FREQUENCY=\"28D\"\n\nCloudflare R2 Object Storage\n File: cloudflare.txt\n export R2_ACCOUNT_ID=\"your_account_id\"\n export R2_ACCESS_KEY_ID=\"your_access_key_id\"\n export R2_SECRET_ACCESS_KEY=\"your_secret_access_key\"\n export KEEP_WITHIN=\"3M\"\n export FULL_BACKUP_FREQUENCY=\"28D\"\n\nAzure Blob Storage\n File: azure.txt\n export AZURE_STORAGE_ACCOUNT=\"your_azure_storage_account\"\n export AZURE_STORAGE_KEY=\"your_azure_storage_key\"\n export KEEP_WITHIN=\"3M\"\n export FULL_BACKUP_FREQUENCY=\"28D\"\n\nIBM Cloud Object Storage\n File: ibm.txt\n export IBM_API_KEY_ID=\"your_ibm_api_key_id\"\n export IBM_SERVICE_INSTANCE_ID=\"your_ibm_service_instance_id\"\n export IBM_REGION=\"your_ibm_region\"\n export KEEP_WITHIN=\"3M\"\n export FULL_BACKUP_FREQUENCY=\"28D\"\n\nWasabi Hot Cloud Storage\n File: wasabi.txt\n export WASABI_ACCESS_KEY=\"your_wasabi_access_key\"\n export WASABI_SECRET_KEY=\"your_wasabi_secret_key\"\n export WASABI_REGION=\"your_wasabi_region\" # E.g., \"us-east-1\"\n export KEEP_WITHIN=\"3M\"\n export FULL_BACKUP_FREQUENCY=\"28D\"\n\nDigitalOcean Spaces\n File: do_spaces.txt\n export DO_SPACES_KEY=\"your_do_spaces_key\"\n export DO_SPACES_SECRET=\"your_do_spaces_secret\"\n export DO_SPACES_REGION=\"your_do_spaces_region\" # E.g., \"nyc3\"\n export KEEP_WITHIN=\"3M\"\n export FULL_BACKUP_FREQUENCY=\"28D\"\n\nLinode Object Storage by Akamai\n File: linode.txt\n export LINODE_ACCESS_KEY=\"your_linode_access_key\"\n export LINODE_SECRET_KEY=\"your_linode_secret_key\"\n export LINODE_REGION=\"your_linode_region\" # E.g., \"us-east-1\"\n export KEEP_WITHIN=\"3M\"\n export FULL_BACKUP_FREQUENCY=\"28D\"\n\n## Security\n- Ensure credentials files are securely managed:\n - Files should have permissions set to 600 (\\`chmod 600 \\`).\n - The credentials directory should have permissions set to 700 (\\`chmod 700 \\`).\n\n## Notes\n- The backup process will fail if the credentials file for a required service is missing or contains invalid placeholders.\n- Users are responsible for managing these credentials files securely.\n\nEOF\n chmod 600 \"${_readme_file}\"\n chown ${_user}.ftp:users \"${_readme_file}\"\n echo \"Created README file for user: ${_user}\"\n touch \"${_readme_ctrl_file}\"\n else\n echo \"README file already updated for user: ${_user}\"\n fi\n}\n\n# Main function to create README files for all users\n_main() {\n for _user_dir in \"${_BASE_DIR}\"/*; do\n if [ -d \"${_user_dir}\" ]; then\n _user=$(basename \"${_user_dir}\")\n if [ \"${_user}\" != \"arch\" ] \\\n && [ \"${_user}\" != \"data\" ] \\\n && [ \"${_user}\" != \"global\" ] \\\n && [ \"${_user}\" != \"static\" ] \\\n && [ \"${_user}\" != \"custom\" ]; then\n _create_readme_file \"${_user}\"\n fi\n fi\n done\n}\n\n# Execute the script\n_main\n" }, { "path": "aegir/tools/backup/run/create_user_paths_config.sh", "content": "#!/bin/bash\n\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nexport _sPid=\"f62\"\n\n# Log file for escape attempts and validation issues\n_VALIDATION_LOG_FILE=\"/var/log/backup_validation_issues.log\"\n\n_check_root() {\n if [ \"$(id -u)\" -eq 0 ]; then\n # shellcheck disable=SC1091\n [ -e \"/root/.barracuda.cnf\" ] && source /root/.barracuda.cnf\n fi\n}\n_check_root\n\n###\n### Load + normalize _INCIDENT_REPORT\n###\n### Legacy values:\n### NO becomes OFF (see below)\n### YES becomes MINI (see below)\n###\n### Current values:\n### OFF == Total silence, no email alerts\n### ALL == Very noisy, good for debugging\n### MINI == Only the most important alerts (default)\n### CRIT == Only critical if _lvl=ALERT\n###\n_normalize_incident_report() {\n : \"${_INCIDENT_REPORT:=MINI}\"\n _INCIDENT_REPORT=\"${_INCIDENT_REPORT^^}\"\n _INCIDENT_REPORT=\"${_INCIDENT_REPORT//[^A-Z]/}\"\n ###\n ### Map legacy + validate\n ###\n case \"${_INCIDENT_REPORT}\" in\n NO) _INCIDENT_REPORT=\"OFF\" ;;\n YES) _INCIDENT_REPORT=\"MINI\" ;;\n OFF|ALL|MINI|CRIT) : ;;\n *) _INCIDENT_REPORT=\"MINI\" ;;\n esac\n}\n_normalize_incident_report\n\n# Function to generate passphrase for user level backups\n_generate_user_secret_file() {\n local _user=$1\n local _secret_file=\"/data/disk/${_user}/remote_backups/.secret.txt\"\n if [ ! -s \"${_secret_file}\" ]; then\n openssl rand -base64 32 > \"${_secret_file}\"\n chmod 600 \"${_secret_file}\"\n chattr +i \"${_secret_file}\"\n echo \"User secret file created at ${_secret_file} and made immutable.\"\n else\n echo \"User secret file already exists at ${_secret_file}.\"\n fi\n}\n\n# Function to log validation issues\n_log_issue() {\n local _type=$1\n local _file=$2\n local _message=$3\n echo \"[$(date)] Validation issue: [${_type}] in file: [${_file}] with error: ${_message}\" >> \"${_VALIDATION_LOG_FILE}\"\n if [ -n \"${_MY_EMAIL}\" ] && [ \"${_INCIDENT_REPORT}\" = \"ALL\" ]; then\n # Alert the admin\n echo \"Sending Backup Validation Alert to ${_MY_EMAIL} on $(date)\" >> ${_VALIDATION_LOG_FILE}\n s-nail -s \"Backup Validation Alert for [$(hostname)] on $(date)\" ${_MY_EMAIL} < ${_VALIDATION_LOG_FILE}\n fi\n}\n\n# Function to validate and merge configuration files\n_validate_and_merge_paths() {\n local _file=$1\n local _user=$2\n local _allowed_prefixes=\"'^/((data/disk/${_user}/static)|(home/${_user}\\.ftp))\"\n local _output_file=$3\n local _if_validate=$4\n local _invalid_paths_found=false\n\n # Ensure output file exists and is empty\n > \"${_output_file}\"\n\n while IFS= read -r _line; do\n # Skip empty lines and comments\n if [[ \"${_line}\" =~ ^\\s*(#|$) ]]; then\n echo \"${_line}\" >> \"${_output_file}\"\n continue\n fi\n\n if [ \"${_if_validate}\" = \"YES\" ]; then\n # Validate directives\n if [[ \"${_line}\" =~ ^--(include|exclude|include-regexp|exclude-regexp) ]]; then\n if echo \"${_line}\" | grep -Eq \"^--(include|exclude|include-regexp|exclude-regexp) ${_allowed_prefixes}\"; then\n echo \"${_line}\" >> \"${_output_file}\"\n else\n _log_issue \"${_user}\" \"${_file}\" \"Invalid path: ${_line}\"\n _invalid_paths_found=true\n fi\n else\n _log_issue \"${_user}\" \"${_file}\" \"Invalid directive: ${_line}\"\n _invalid_paths_found=true\n fi\n elif [ \"${_if_validate}\" = \"NO\" ]; then\n echo \"${_line}\" >> \"${_output_file}\"\n fi\n done < \"${_file}\"\n\n # If invalid paths were found, alert and skip merging\n if [ \"${_invalid_paths_found}\" = true ]; then\n echo \"Skipping invalid file '${_file}' for user '${_user}'.\"\n > \"${_output_file}\" # Clear output to avoid invalid entries\n fi\n}\n\n# Function to create or update a user's paths configuration file\n_create_user_paths_config() {\n local _user=$1\n local _user_config_dir=\"/data/disk/${_user}/remote_backups/paths\"\n local _user_control_dir=\"/data/disk/${_user}/static/control/remote_backups/config\"\n local _include_list=\"${_user_config_dir}/.backboa.${_user}.include.list\"\n local _exclude_list=\"${_user_config_dir}/.backboa.${_user}.exclude.list\"\n local _include_file=\"${_user_config_dir}/.backboa.${_user}.include.file\"\n local _exclude_file=\"${_user_config_dir}/.backboa.${_user}.exclude.file\"\n local _include_regexp_file=\"${_user_config_dir}/.backboa.${_user}.include_regexp.file\"\n local _exclude_regexp_file=\"${_user_config_dir}/.backboa.${_user}.exclude_regexp.file\"\n local _merged_include_file=\"${_user_config_dir}/.backboa.${_user}.include.merged.file\"\n local _merged_exclude_file=\"${_user_config_dir}/.backboa.${_user}.exclude.merged.file\"\n local _merged_regexp_include_file=\"${_user_config_dir}/.backboa.${_user}.include_regexp.merged.file\"\n local _merged_regexp_exclude_file=\"${_user_config_dir}/.backboa.${_user}.exclude_regexp.merged.file\"\n local _user_ctrl_file=\"${_user_config_dir}/.backboa.${_sPid}.paths.ctrl.file\"\n local _include_ctrl_file=\"${_user_config_dir}/.backboa.${_user}.${_sPid}.include.ctrl.file\"\n local _exclude_ctrl_file=\"${_user_config_dir}/.backboa.${_user}.${_sPid}.exclude.ctrl.file\"\n local _merged_all_include_file=\"${_user_config_dir}/.backboa.${_user}.all.include.merged.file\"\n local _merged_all_exclude_file=\"${_user_config_dir}/.backboa.${_user}.all.exclude.merged.file\"\n local _user_paths_file=\"${_user_config_dir}/paths.txt\"\n\n # Ensure user configuration directory exists and is owned by root\n mkdir -p \"${_user_config_dir}\"\n chown root:root \"${_user_config_dir}\"\n chmod 755 \"${_user_config_dir}\"\n\n # Function to append unique entries from source to target file\n _append_unique_entries() {\n _source_file=$1\n _target_file=$2\n if [ -f \"${_source_file}\" ]; then\n grep -v -F -x -f \"${_target_file}\" \"${_source_file}\" >> \"${_target_file}\"\n fi\n }\n\n if [ ! -f \"${_user_ctrl_file}\" ]; then\n\n ### Migrate legacy exclude/include files if present and merge unique entries\n\n # _include_list\n if [ -f \"/root/.backboa.include\" ]; then\n if [ ! -f \"${_include_list}\" ]; then\n cp \"/root/.backboa.include\" \"${_include_list}\"\n else\n _append_unique_entries \"/root/.backboa.include\" \"${_include_list}\"\n fi\n fi\n\n # _exclude_list\n if [ -f \"/root/.backboa.exclude\" ]; then\n if [ ! -f \"${_exclude_list}\" ]; then\n cp \"/root/.backboa.exclude\" \"${_exclude_list}\"\n else\n _append_unique_entries \"/root/.backboa.exclude\" \"${_exclude_list}\"\n fi\n else\n cat << EOF > \"${_exclude_list}\"\n**files/advagg_css/**\n**files/advagg_js/**\n**files/css/**\n**files/js/**\n**private/temp/**\nEOF\n fi\n\n ### Create default exclude/include files if they don't exist\n\n # _include_file\n if [ ! -f \"${_include_ctrl_file}\" ]; then\n cat << EOF > \"${_include_file}\"\n--include /data/disk/${_user}/distro\n--include /data/disk/${_user}/platforms\n--include /data/disk/${_user}/static\n--include /home/${_user}.ftp\nEOF\n rm -f \"${_user_config_dir}/.backboa.${_user}.*.include.ctrl.file\"\n touch \"${_include_ctrl_file}\"\n fi\n\n # _exclude_file\n if [ ! -f \"${_exclude_ctrl_file}\" ]; then\n cat << EOF > \"${_exclude_file}\"\n--exclude /data/disk/${_user}/.tmp\n--exclude /data/disk/${_user}/clients\n--exclude /data/disk/${_user}/static/restores\n--exclude /data/disk/${_user}/static/tmp\n--exclude /data/disk/${_user}/static/trash\n--exclude /data/disk/${_user}/u\n--exclude /data/disk/${_user}/undo\n--exclude /home/${_user}.ftp/.tmp\n--exclude /home/${_user}.ftp/backups\n--exclude /home/${_user}.ftp/clients\n--exclude /home/${_user}.ftp/platforms\n--exclude /home/${_user}.ftp/static\nEOF\n rm -f ${_user_config_dir}/.backboa.${_user}.*.exclude.ctrl.file\n touch \"${_exclude_ctrl_file}\"\n fi\n\n # Cleanup for empty or not used include config files\n if [ ! -f \"${_user_control_dir}/include_regexp.txt\" ]; then\n [ -e \"${_include_regexp_file}\" ] && rm -f \"${_include_regexp_file}\"\n [ -e \"${_merged_regexp_include_file}\" ] && rm -f \"${_merged_regexp_include_file}\"\n fi\n\n # Cleanup for empty or not used exclude config files\n if [ ! -f \"${_user_control_dir}/exclude_regexp.txt\" ]; then\n [ -e \"${_exclude_regexp_file}\" ] && rm -f \"${_exclude_regexp_file}\"\n [ -e \"${_merged_regexp_exclude_file}\" ] && rm -f \"${_merged_regexp_exclude_file}\"\n fi\n\n # Validate and merge system and user-space include files\n _validate_and_merge_paths \"${_include_file}\" \"${_user}\" \"${_merged_include_file}\" NO\n if [ -f \"${_user_control_dir}/include.txt\" ]; then\n _validate_and_merge_paths \"${_user_control_dir}/include.txt\" \"${_user}\" \"${_merged_include_file}\" YES\n fi\n\n # Validate and merge system and user-space exclude files\n _validate_and_merge_paths \"${_exclude_file}\" \"${_user}\" \"${_merged_exclude_file}\" NO\n if [ -f \"${_user_control_dir}/exclude.txt\" ]; then\n _validate_and_merge_paths \"${_user_control_dir}/exclude.txt\" \"${_user}\" \"${_merged_exclude_file}\" YES\n fi\n\n # Validate and merge regexp include files\n if [ -f \"${_include_regexp_file}\" ]; then\n _validate_and_merge_paths \"${_include_regexp_file}\" \"${_user}\" \"${_merged_regexp_include_file}\" NO\n fi\n if [ -f \"${_user_control_dir}/include_regexp.txt\" ]; then\n _validate_and_merge_paths \"${_user_control_dir}/include_regexp.txt\" \"${_user}\" \"${_merged_regexp_include_file}\" YES\n fi\n\n # Validate and merge regexp exclude files\n if [ -f \"${_exclude_regexp_file}\" ]; then\n _validate_and_merge_paths \"${_exclude_regexp_file}\" \"${_user}\" \"${_merged_regexp_exclude_file}\" NO\n fi\n if [ -f \"${_user_control_dir}/exclude_regexp.txt\" ]; then\n _validate_and_merge_paths \"${_user_control_dir}/exclude_regexp.txt\" \"${_user}\" \"${_merged_regexp_exclude_file}\" YES\n fi\n\n # Merge all include path directives into single file\n cat \"${_merged_include_file}\" > \"${_merged_all_include_file}\"\n cat \"${_merged_regexp_include_file}\" >> \"${_merged_all_include_file}\"\n\n # Merge all exclude path directives into single file\n cat \"${_merged_exclude_file}\" > \"${_merged_all_exclude_file}\"\n cat \"${_merged_regexp_exclude_file}\" >> \"${_merged_all_exclude_file}\"\n\n # Convert the include file contents to a single-line variable without extra backslashes and excessive whitespace\n local _MERGED_ALL_INCLUDE=$(cat \"${_merged_all_include_file}\" | tr '\\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//')\n\n # Convert the exclude file contents to a single-line variable without extra backslashes and excessive whitespace\n local _MERGED_ALL_EXCLUDE=$(cat \"${_merged_all_exclude_file}\" | tr '\\n' ' ' | tr -s ' ' | sed 's/^ *//;s/ *$//')\n\n # Create the final paths configuration file\n cat << EOF > \"${_user_paths_file}\"\n_SOURCE=\"\"\n_USER_INCLUDE_PATHS=\"${_MERGED_ALL_INCLUDE}\"\n_USER_EXCLUDE_PATHS=\"${_MERGED_ALL_EXCLUDE}\"\n_INCLUDE_LIST=\"${_include_list}\"\n_EXCLUDE_LIST=\"${_exclude_list}\"\nEOF\n\n rm -f ${_user_config_dir}/.backboa*paths.ctrl.file\n touch ${_user_ctrl_file}\n echo \"Paths configuration for '${_user}' created or updated at '${_user_paths_file}'.\"\n fi\n}\n\n# Generate paths configuration for each user\nfor _user_dir in /data/disk/*; do\n if [ -d \"${_user_dir}\" ]; then\n _user=$(basename \"${_user_dir}\")\n if [ \"${_user}\" != \"arch\" ] \\\n && [ \"${_user}\" != \"data\" ] \\\n && [ \"${_user}\" != \"global\" ] \\\n && [ \"${_user}\" != \"static\" ] \\\n && [ \"${_user}\" != \"custom\" ]; then\n _create_user_paths_config \"${_user}\"\n _generate_user_secret_file \"${_user}\"\n fi\n fi\ndone\n" }, { "path": "aegir/tools/backup/run/duplicity_backup.sh", "content": "#!/bin/bash\n\n# Environment setup\nexport HOME=/root\nexport SHELL=/bin/bash\nexport PATH=/usr/local/bin:/usr/local/sbin:/opt/local/bin:/usr/bin:/usr/sbin:/bin:/sbin:/usr/libexec\nexport _tRee=dev\n\n# Function to print env for debugging\n_print_env() {\n if [ \"$(id -u)\" -eq 0 ] && [ -e \"/root/.dev.server.cnf\" ]; then\n _ENV=$(env 2>&1)\n echo\n echo \"_ENV in $1 start\"\n echo \"${_ENV}\"\n echo \"_ENV in $1 end\"\n echo\n _ENV=\n fi\n}\n\n# Function to verify BOA keys\n_verify_boa_keys() {\n if [ -e \"/root/.dev.server.cnf\" ]; then\n echo \"PROC: _verify_boa_keys in multiback\"\n fi\n if [ \"${_tRee}\" = \"pro\" ] || [ \"${_tRee}\" = \"dev\" ]; then\n _allw=NO\n _crlGet=\"-L --max-redirs 3 -k -s --retry 9 --retry-delay 9 -A iCab\"\n _urlEnc=\"http://files.aegir.cc/enc/2024\"\n _encName=$(echo ${_hName} \\\n | openssl md5 \\\n | awk '{ print $2}' \\\n | tr -d \"\\n\" 2>&1)\n if [[ \"${_hName}\" =~ \".aegir.cc\"($) ]] \\\n || [[ \"${_hName}\" =~ \".o8.io\"($) ]] \\\n || [[ \"${_hName}\" =~ \".boa.io\"($) ]]; then\n _allw=YES\n fi\n mkdir -p /var/opt\n rm -f /var/opt/_encN*\n curl ${_crlGet} \"${_urlEnc}/${_encName}\" -o /var/opt/_encN.${_encName}.tmp\n wait\n echo \"${_hName}.${_encName}\" > /var/opt/_encN_local.${_encName}.tmp\n wait\n if [ -e \"/var/opt/_encN.${_encName}.tmp\" ] && [ -e \"/var/opt/_encN_local.${_encName}.tmp\" ]; then\n _diffTestIf=$(diff -w -B /var/opt/_encN.${_encName}.tmp /var/opt/_encN_local.${_encName}.tmp 2>&1)\n if [ ! -z \"${_diffTestIf}\" ] && [ \"${_allw}\" = \"NO\" ]; then\n echo\n echo \"Your system requires valid license to use this function\"\n echo \"Please visit https://omega8.cc/licenses to purchase your own\"\n echo\n if [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"/var/aegir/key/barracuda_key.txt\" ]; then\n mkdir -p /var/aegir/key\n cat /var/opt/_encN_local.${_encName}.tmp > /var/aegir/key/barracuda_key.txt\n fi\n rm -f /var/opt/_encN*\n exit 0\n else\n if [ -e \"/var/aegir/.drush/hm.alias.drushrc.php\" ] \\\n && [ ! -e \"/var/aegir/key/barracuda_key.txt\" ]; then\n mkdir -p /var/aegir/key\n cat /var/opt/_encN_local.${_encName}.tmp > /var/aegir/key/barracuda_key.txt\n fi\n fi\n else\n echo\n echo \"Your system requires valid license to use this BOA feature\"\n echo \"Unfortunately it was not possible to verify your system status\"\n echo \"Please contact our support but visit https://omega8.cc/licenses first\"\n echo\n exit 0\n fi\n fi\n}\n\n_if_hosted_sys() {\n if [ -e \"/root/.host8.cnf\" ] \\\n || [[ \"${_hName}\" =~ \".aegir.cc\"($) ]]; then\n _hostedSys=YES\n else\n _hostedSys=NO\n fi\n}\n\n# Function to calculate RAM usage percentage as an integer\n_calculate_ram_usage_percent() {\n _total_ram_kb=$1\n _available_ram_kb=$2\n used_ram_kb=$((_total_ram_kb - _available_ram_kb))\n\n # Using integer division to get a whole number percentage\n echo $(( (used_ram_kb * 100) / _total_ram_kb ))\n}\n\n# Function to check and display system info\n_check_system_ram() {\n # Get the total and available RAM in KB\n _total_ram_kb=$(grep MemTotal /proc/meminfo | awk '{print $2}')\n _available_ram_kb=$(grep MemAvailable /proc/meminfo | awk '{print $2}')\n\n # Calculate RAM usage percentage\n _ram_usage_percent=$(_calculate_ram_usage_percent ${_total_ram_kb} ${_available_ram_kb})\n}\n\n# Function to check and optimize RAM and disk caches\n_optimize_ram() {\n swapoff -a\n _check_system_ram\n if [ \"${_ram_usage_percent}\" -gt 50 ]; then\n sync && echo 3 | tee /proc/sys/vm/drop_caches\n fi\n swapon -a\n}\n\n###\n### Load + normalize _INCIDENT_REPORT\n###\n### Legacy values:\n### NO becomes OFF (see below)\n### YES becomes MINI (see below)\n###\n### Current values:\n### OFF == Total silence, no email alerts\n### ALL == Very noisy, good for debugging\n### MINI == Only the most important alerts (default)\n### CRIT == Only critical if _lvl=ALERT\n###\n_normalize_incident_report() {\n : \"${_INCIDENT_REPORT:=MINI}\"\n _INCIDENT_REPORT=\"${_INCIDENT_REPORT^^}\"\n _INCIDENT_REPORT=\"${_INCIDENT_REPORT//[^A-Z]/}\"\n ###\n ### Map legacy + validate\n ###\n case \"${_INCIDENT_REPORT}\" in\n NO) _INCIDENT_REPORT=\"OFF\" ;;\n YES) _INCIDENT_REPORT=\"MINI\" ;;\n OFF|ALL|MINI|CRIT) : ;;\n *) _INCIDENT_REPORT=\"MINI\" ;;\n esac\n}\n\n# Function to verify root access\n_check_root() {\n if [ \"$(id -u)\" -eq 0 ]; then\n ionice -c2 -n7 -p $$\n renice 19 -p $$\n chmod a+w /dev/null\n [ -e \"/root/.gnupg\" ] && chmod 700 /root/.gnupg\n else\n echo \"ERROR: This script should be run as a root user\"\n exit 1\n fi\n _DF_TEST=\"$(command df -P -l / 2>/dev/null | awk '\n NR==1 { for (i=1; i<=NF; i++) if ($i==\"Use%\" || $i==\"Capacity\") u=i }\n NR==2 { gsub(/%/,\"\",$u); print $u }')\"\n if [ ! -z \"${_DF_TEST}\" ] && [ \"${_DF_TEST}\" -gt 90 ]; then\n echo \"ERROR: Your disk space is almost full !!! ${_DF_TEST}/100\"\n echo \"ERROR: We can not proceed until it is below 90/100\"\n exit 1\n fi\n # shellcheck disable=SC1091\n [ -e \"/root/.barracuda.cnf\" ] && source /root/.barracuda.cnf\n _AWS_VLV=${_AWS_VLV//[^a-z]/}\n if [ -z \"${_AWS_VLV}\" ]; then\n _AWS_VLV=\"warning\"\n fi\n _hName=\"$(cat /etc/hostname 2>/dev/null | tr -d '\\n' || hostname -f 2>/dev/null)\"\n _cpuNr=\"$(cat /data/all/cpuinfo 2>/dev/null | tr -d '\\n' || nproc 2>/dev/null)\"\n if [ -n \"${_cpuNr}\" ]; then\n [ \"${_cpuNr}\" -gt 8 ] && _useCpu=4\n [ \"${_cpuNr}\" -le 8 ] && _useCpu=2\n [ \"${_cpuNr}\" -le 4 ] && _useCpu=1\n else\n _useCpu=1\n fi\n}\n_check_root\n_normalize_incident_report\n_optimize_ram\n_if_hosted_sys\n_verify_boa_keys\n_print_env \"multiback_init\"\n\n[ -e \"/root/.pause_heavy_tasks_maint.cnf\" ] && exit 0\n\n# New OpenSSL 3.x version is required\nif [ ! -x \"/usr/local/ssl3/bin/openssl\" ]; then\n echo \"New OpenSSL 3.x version is required\"\n exit 1\nfi\n\n# Function to notify about still running backup\n_waiting_notify() {\n local _templog=\"/var/backups/multiback_waiting_queue.log\"\n cat /root/.remote_backups/schedule/backup_schedule.txt > ${_templog}\n ps axf | grep multiback >> ${_templog}\n ps axf | grep duplicity >> ${_templog}\n ls -la /tmp/duplicity-*-tempdir >> ${_templog}\n tree /root/.cache/duplicity >> ${_templog}\n ls -laR /root/.cache/duplicity >> ${_templog}\n grep \"Out of memory: Killed process.*duplicity\" /var/log/iptables.log >> ${_templog}\n boa info >> ${_templog}\n if [ -n \"${_MY_EMAIL}\" ] && [ \"${_INCIDENT_REPORT}\" = \"ALL\" ]; then\n s-nail -s \"Multiback Waiting Report for [${_hName}] on $(date)\" ${_MY_EMAIL} < ${_templog}\n fi\n}\n\n_CNT=$(pgrep -fc duplicity)\nif (( _CNT > 0 )); then\n echo \"[$(date)] Active duplicity process detected, will try again later...\" >> /var/log/mybackup_waiting_queue.log\n _waiting_notify\n exit 1\nfi\n\n# Function to display usage information\n_usage() {\n echo \"Usage: $0 {backup|cleanup|restore} [RESTORE_TARGET] [RESTORE_PATH] [RESTORE_TIME]\"\n echo\n echo \"Example commands:\"\n echo \" Backup:\"\n echo \" $0 backup aws john\"\n echo \" $0 backup b2 jane\"\n echo\n echo \" Cleanup:\"\n echo \" $0 cleanup aws john\"\n echo \" $0 cleanup gcs jane\"\n echo\n echo \" Restore:\"\n echo \" $0 restore aws john /restore/target /specific/path 1D\"\n echo \" $0 restore b2 jane /restore/target /another/path 2W\"\n echo\n echo \"Supported services:\"\n echo \" aws, aws_one_zone, aws_standard_ia, azure, b2, cloudflare, do_spaces, gcs, ibm, linode, wasabi\"\n echo\n echo \"NOTE: [RESTORE_PATH] must be an absolute path (no leading slash) of the file or directory to restore\"\n echo\n exit 1\n}\n\n# Function to create PID file\n_create_pid_file() {\n local _pidfile=$1\n if [ -e \"${_pidfile}\" ]; then\n echo \"Process already running with PID file ${_pidfile}\"\n exit 1\n else\n echo $$ > \"${_pidfile}\"\n fi\n}\n\n# Function to remove PID file\n_remove_pid_file() {\n local _pidfile=$1\n if [ -f \"${_pidfile}\" ]; then\n rm -f \"${_pidfile}\" || {\n echo \"Warning: Failed to remove PID file: ${_pidfile}\"\n }\n fi\n}\n\n# Function to remove stale multiback PID file\n_remove_stale_multiback_pid() {\n local _service=$1\n local _user=$2\n _multiback_pidfile=\"/run/duplicity_${_service}_${_user}.pid\"\n if [ -f \"${_multiback_pidfile}\" ]; then\n _old_pid=$(cat \"${_multiback_pidfile}\")\n if [ -n \"${_old_pid}\" ] && ! kill -0 \"${_old_pid}\" 2>/dev/null; then\n echo \"Stale multiback PID file detected: ${_multiback_pidfile}. Removing it.\"\n rm -f \"${_multiback_pidfile}\"\n fi\n fi\n}\n\n# Function to log validation issues\n_log_issue() {\n local _type=$1\n local _file=$2\n local _message=$3\n echo \"[$(date)] Validation issue type: [${_type}] in file: [${_file}] with error: ${_message}\" >> \"${_VALIDATION_LOG_FILE}\"\n if [ -n \"${_MY_EMAIL}\" ] && [ \"${_INCIDENT_REPORT}\" = \"ALL\" ]; then\n # Alert the admin\n boa info >> ${_LOGFILE}\n echo \"Sending Backup Validation Alert to ${_MY_EMAIL} on $(date)\" >> ${_LOGFILE}\n s-nail -s \"Backup Validation Alert for [$(hostname)] on $(date)\" ${_MY_EMAIL} < ${_LOGFILE}\n fi\n}\n\n# Helper function to URL-encode using jq\n_url_encode() {\n echo -n \"$1\" | jq -s -R -r @uri\n}\n\n# Function to escape values\n_escape_value() {\n printf '%q' \"$1\"\n}\n\n# Function to sanitize and validate credentials file\n_validate_credentials() {\n local _cred_file=\"$1\"\n local _service=\"$2\"\n local _line_number=0\n\n while IFS= read -r _line || [ -n \"${_line}\" ]; do\n _line_number=$(( _line_number + 1 ))\n\n # Trim leading and trailing whitespace\n _line=\"${_line#\"${_line%%[![:space:]]*}\"}\"\n _line=\"${_line%\"${_line##*[![:space:]]}\"}\"\n\n # Skip empty lines immediately\n if [[ -z \"${_line}\" ]]; then\n continue\n fi\n\n # Remove full-line comments: lines that *start* with '#'\n if [[ \"${_line}\" == \\#* ]]; then\n continue\n fi\n\n # Remove anything after (and including) the first '#' for inline comments\n # (This is a naive approach that does not consider # within quotes)\n if [[ \"${_line}\" == *\"#\"* ]]; then\n _line=\"${_line%%#*}\"\n # Re-trim after removing the comment\n _line=\"${_line#\"${_line%%[![:space:]]*}\"}\"\n _line=\"${_line%\"${_line##*[![:space:]]}\"}\"\n fi\n\n # Skip if there's nothing left after stripping inline comment\n if [[ -z \"${_line}\" ]]; then\n continue\n fi\n\n # Remove 'export ' prefix if present\n _line=\"${_line#export }\"\n\n # Validate the variable assignment (key=value)\n if [[ \"${_line}\" =~ ^([A-Za-z_][A-Za-z0-9_]*)=(\\\".*\\\"|'.*'|[^[:space:]]+)$ ]]; then\n export _varname=\"${BASH_REMATCH[1]}\"\n export _value=\"${BASH_REMATCH[2]}\"\n\n # Remove surrounding quotes if present\n if [[ \"${_value}\" =~ ^\\\".*\\\"$ || \"${_value}\" =~ ^\\'.*\\'$ ]]; then\n export _value=\"${_value:1:-1}\"\n fi\n\n # Check for forbidden characters in value\n if echo \"${_value}\" | grep -q -E '[$`(){};&|<>]'; then\n _log_issue \"credentials\" \"${_cred_file}\" \\\n \"Forbidden characters in value at line ${_line_number}: ${_line}\"\n continue\n fi\n\n # Safely export the variable (URL-encode if needed)\n if [ \"${_service}\" = \"b2\" ]; then\n export ${_varname}=$(_url_encode \"${_value}\")\n else\n export ${_varname}=\"${_value}\"\n fi\n else\n _log_issue \"credentials\" \"${_cred_file}\" \\\n \"Invalid syntax at line ${_line_number}: ${_line}\"\n fi\n done < \"${_cred_file}\"\n\n _print_env \"multiback_validate_credentials\"\n}\n\n# Function to load credentials\n_load_credentials() {\n local _service=\"$1\"\n local _user=\"$2\"\n if [ \"${_user}\" != \"arch\" ] \\\n && [ \"${_user}\" != \"data\" ] \\\n && [ \"${_user}\" != \"global\" ] \\\n && [ \"${_user}\" != \"static\" ] \\\n && [ \"${_user}\" != \"custom\" ]; then\n local _cred_file=\"/data/disk/${_user}/static/control/remote_backups/credentials/${_service}.txt\"\n local _secret_file=\"/data/disk/${_user}/remote_backups/.secret.txt\"\n fi\n if [ \"${_user}\" = \"global\" ] || [ \"${_user}\" = \"data\" ] || [ \"${_user}\" = \"custom\" ]; then\n local _cred_file=\"/root/.remote_backups/credentials/${_service}.txt\"\n local _secret_file=\"/root/.remote_backups/.secret.txt\"\n fi\n\n if [ -s \"${_secret_file}\" ]; then\n export PASSPHRASE=$(cat \"${_secret_file}\")\n else\n echo \"Secret file ${_secret_file} not found. Unable to proceed.\"\n exit 1\n fi\n\n if [ ! -s \"${_cred_file}\" ]; then\n echo \"Error: Credentials file '${_cred_file}' not found.\"\n exit 1\n fi\n\n _validate_credentials \"${_cred_file}\" \"${_service}\"\n _print_env \"multiback_load_credentials\"\n}\n\n# Function to load paths configuration\n_load_paths() {\n local _user=\"$1\"\n if [ \"${_user}\" != \"arch\" ] \\\n && [ \"${_user}\" != \"data\" ] \\\n && [ \"${_user}\" != \"global\" ] \\\n && [ \"${_user}\" != \"static\" ] \\\n && [ \"${_user}\" != \"custom\" ]; then\n local _paths_file=\"/data/disk/${_user}/remote_backups/paths/paths.txt\"\n elif [ \"${_user}\" = \"global\" ] || [ \"${_user}\" = \"data\" ] || [ \"${_user}\" = \"custom\" ]; then\n local _paths_file=\"/root/.remote_backups/paths/${_user}_paths.txt\"\n fi\n\n if [ ! -f \"${_paths_file}\" ]; then\n echo \"Error: Paths configuration file '${_paths_file}' not found.\"\n exit 1\n fi\n\n if [ \"${_user}\" != \"arch\" ]; then\n source \"${_paths_file}\"\n fi\n _print_env \"multiback_load_paths\"\n}\n\n# Function to validate duration format and fallback to default\n_validate_or_default_duration() {\n local _value=$1\n local _var_name=$2\n local _default=$3\n\n # Supported formats: number followed by D (days), W (weeks), M (months), Y (years)\n if [[ ! \"${_value}\" =~ ^[0-9]+[DWMY]$ ]] || [[ \"${_value}\" =~ ^[0][DWMY]$ ]]; then\n echo \"Warning: Invalid value '${_value}' for ${_var_name}. Using default '${_default}'.\"\n eval \"${_var_name}='${_default}'\"\n _print_env \"multiback_validate_or_default_duration\"\n fi\n\n # Enforced min value for KEEP_WITHIN (1M)\n if [ \"${_var_name}\" = \"KEEP_WITHIN\" ] && [[ ! \"${_value}\" =~ ^[0-9]+[MY]$ ]]; then\n echo \"Warning: Invalid value '${_value}' for ${_var_name}. It must be at least 1M. Using default '${_default}'.\"\n eval \"${_var_name}='${_default}'\"\n _print_env \"multiback_validate_or_default_duration_keep\"\n fi\n\n # Enforced min and max value for FULL_BACKUP_FREQUENCY (7D to 60D)\n if [ \"${_var_name}\" = \"FULL_BACKUP_FREQUENCY\" ] && [[ ! \"${_value}\" =~ ^([7-9]|[1-5][0-9]|60)D$ ]]; then\n echo \"Warning: Invalid value '${_value}' for ${_var_name}. It must be between 7D and 60D. Using default '${_default}'.\"\n eval \"${_var_name}='${_default}'\"\n _print_env \"multiback_validate_or_default_duration_freq\"\n fi\n}\n\n# Function to construct _BUCKET_NAME\n_construct_bucket_name() {\n local _service_abbr=$1\n local _user=$2\n _service_dash=$(echo -n ${_service_abbr} | tr _ -)\n _hst_dash=$(echo -n ${_hName} | tr . -)\n export _BUCKET_NAME=\"back-to-${_user}-${_hst_dash}-${_service_dash}\"\n export _NAME=\"${_user}-${_service_dash}\"\n export _LOGFILE=\"${_LOGPTH}/${_BUCKET_NAME}.log\"\n _print_env \"multiback_construct_bucket_name\"\n}\n\n# Function to generate duplicity-compatible include directives\n_generate_include_directives() {\n local _source=$1\n local _include=\"\"\n for _cdir in ${_source}; do\n _include=\"${_include} --include ${_cdir}\"\n done\n echo \"${_include}\"\n}\n\n# Function to prepare backup directives\n_backup_prepare() {\n if [ -e \"/root/.cache/duplicity/${_NAME}\" ]; then\n _CacheTest=$(find /root/.cache/duplicity/${_NAME} \\\n -maxdepth 1 \\\n -mindepth 1 \\\n -type f \\\n | sort 2>&1)\n if [[ \"${_CacheTest}\" =~ \"No such file or directory\" ]] \\\n || [ -z \"${_CacheTest}\" ]; then\n export _cached=NO\n else\n export _cached=YES\n fi\n fi\n # Generate include directives dynamically\n [ -n \"${_SOURCE}\" ] && _SRC_INCLUDE=$(_generate_include_directives \"${_SOURCE}\")\n #\n [ -n \"${_INCLUDE_PATHS}\" ] && _MERGED_ALL_INCLUDE=\"${_INCLUDE_PATHS}\"\n [ -n \"${_EXCLUDE_PATHS}\" ] && _MERGED_ALL_EXCLUDE=\"${_EXCLUDE_PATHS}\"\n #\n [ -n \"${_USER_INCLUDE_PATHS}\" ] && _USER_MERGED_ALL_INCLUDE=\"${_USER_INCLUDE_PATHS}\"\n [ -n \"${_USER_EXCLUDE_PATHS}\" ] && _USER_MERGED_ALL_EXCLUDE=\"${_USER_EXCLUDE_PATHS}\"\n #\n [ -s \"${_INCLUDE_LIST}\" ] && _LST_INCLUDE=\"--include-filelist ${_INCLUDE_LIST}\"\n [ -s \"${_EXCLUDE_LIST}\" ] && _LST_EXCLUDE=\"--exclude-filelist ${_EXCLUDE_LIST}\"\n ###\n [ -n \"${_MERGED_ALL_INCLUDE}\" ] && _BATCH_INCLUDE=\"${_MERGED_ALL_INCLUDE}\"\n [ -n \"${_USER_MERGED_ALL_INCLUDE}\" ] && _BATCH_INCLUDE=\"${_USER_MERGED_ALL_INCLUDE}\"\n [ -n \"${_LST_INCLUDE}\" ] && _BATCH_INCLUDE=\"${_BATCH_INCLUDE} ${_LST_INCLUDE}\"\n [ -n \"${_SRC_INCLUDE}\" ] && _BATCH_INCLUDE=\"${_BATCH_INCLUDE} ${_SRC_INCLUDE}\"\n #\n [ -n \"${_MERGED_ALL_EXCLUDE}\" ] && _BATCH_EXCLUDE=\"${_MERGED_ALL_EXCLUDE}\"\n [ -n \"${_USER_MERGED_ALL_EXCLUDE}\" ] && _BATCH_EXCLUDE=\"${_USER_MERGED_ALL_EXCLUDE}\"\n [ -n \"${_LST_EXCLUDE}\" ] && _BATCH_EXCLUDE=\"${_BATCH_EXCLUDE} ${_LST_EXCLUDE}\"\n #\n export _BATCH_INCLUDE\n export _BATCH_EXCLUDE\n\n _print_env \"multiback_backup_prepare\"\n}\n\n\n# Function to set backup mode\n_set_mode() {\n local _user=\"${_USER}\"\n [ -z \"${_MODE}\" ] && _MODE=\"backup\"\n if [ -e \"${_LOGPTH}/${_BUCKET_NAME}.archive.log\" ] && [ \"${_cached}\" = \"YES\" ]; then\n export _MODE=\"incremental\"\n else\n [ ! -e \"${_LOGPTH}/${_BUCKET_NAME}.${_TODAY}.full.log\" ] && export _MODE=\"full\"\n fi\n [ -e \"/root/.dev.server.cnf\" ] && echo \"The _MODE has been set to (${_MODE}) in _set_mode for ${_BUCKET_NAME} on $(date)\" >> ${_LOGFILE}\n if [ \"${_hostedSys}\" = \"YES\" ]; then\n if [ \"${_user}\" = \"global\" ] || [ \"${_user}\" = \"data\" ] || [ \"${_user}\" = \"custom\" ]; then\n if [ \"${_DOM}\" = 1 ] && [ ! -e \"${_LOGPTH}/${_BUCKET_NAME}.${_TODAY}.full.log\" ]; then\n _MODE=\"full\"\n echo \"The _MODE has been re-set to (${_MODE}) in _set_mode for ${_BUCKET_NAME} on $(date)\" >> ${_LOGFILE}\n fi\n fi\n else\n [ -e \"/root/.dev.server.cnf\" ] && echo \"The FULL_BACKUP_FREQUENCY is (${FULL_BACKUP_FREQUENCY}) for ${_BUCKET_NAME}\" >> ${_LOGFILE}\n fi\n export _MODE\n _print_env \"multiback_set_mode\"\n}\n\n# Function to construct backup command\n_set_cmd() {\n local _user=\"${_USER}\"\n if [ -z \"${KEEP_WITHIN}\" ] && [ -n \"${_AWS_TTL}\" ]; then\n export KEEP_WITHIN=\"${_AWS_TTL}\"\n fi\n if [ -z \"${FULL_BACKUP_FREQUENCY}\" ] && [ -n \"${_AWS_FLC}\" ]; then\n export FULL_BACKUP_FREQUENCY=\"${_AWS_FLC}\"\n fi\n\n # Validate or set default for KEEP_WITHIN\n _validate_or_default_duration \"${KEEP_WITHIN}\" \"KEEP_WITHIN\" \"${_DEFAULT_KEEP_WITHIN}\"\n\n # Validate or set default for FULL_BACKUP_FREQUENCY\n _validate_or_default_duration \"${FULL_BACKUP_FREQUENCY}\" \"FULL_BACKUP_FREQUENCY\" \"${_DEFAULT_FULL_BACKUP_FREQUENCY}\"\n\n ### Default backup command with encryption\n export _DCY_BUP_CMD=\"/usr/local/bin/duplicity ${_MODE} \\\n -v ${_AWS_VLV} \\\n --name=${_NAME} \\\n --allow-source-mismatch \\\n --concurrency ${_useCpu} \\\n --copy-links \\\n --full-if-older-than ${FULL_BACKUP_FREQUENCY} \\\n --volsize 300\"\n\n ### Default utility command with encryption\n export _DCY_UTL_CMD=\"/usr/local/bin/duplicity \\\n -v ${_AWS_VLV} \\\n --name=${_NAME} \\\n --allow-source-mismatch \\\n --concurrency ${_useCpu}\"\n\n ### Custom backup command with encryption and enforced own FULL_BACKUP_FREQUENCY\n export _FBF_BUP_CMD=\"/usr/local/bin/duplicity ${_MODE} \\\n -v ${_AWS_VLV} \\\n --name=${_NAME} \\\n --allow-source-mismatch \\\n --concurrency ${_useCpu} \\\n --copy-links \\\n --volsize 300\"\n\n ### Custom backup command without encryption and enforced own FULL_BACKUP_FREQUENCY\n export _NOE_BUP_CMD=\"/usr/local/bin/duplicity ${_MODE} \\\n -v ${_AWS_VLV} \\\n --name=${_NAME} \\\n --allow-source-mismatch \\\n --concurrency ${_useCpu} \\\n --no-encryption \\\n --volsize 300\"\n\n ### Custom utility command without encryption\n export _NOE_UTL_CMD=\"/usr/local/bin/duplicity \\\n -v ${_AWS_VLV} \\\n --name=${_NAME} \\\n --allow-source-mismatch \\\n --no-encryption \\\n --concurrency ${_useCpu}\"\n\n if [ \"${_hostedSys}\" = \"YES\" ]; then\n if [ \"${_user}\" = \"global\" ] || [ \"${_user}\" = \"data\" ]; then\n export _DCY_BUP_CMD=\"${_FBF_BUP_CMD}\"\n elif [ \"${_user}\" = \"custom\" ]; then\n export _DCY_BUP_CMD=\"${_NOE_BUP_CMD}\"\n export _DCY_UTL_CMD=\"${_NOE_UTL_CMD}\"\n fi\n fi\n\n _print_env \"multiback_set_cmd\"\n}\n\n_test() {\n local _mode=\"$1\"\n if [ \"${_mode}\" != \"only\" ]; then\n _set_mode\n _set_cmd\n fi\n echo \"Running ${_BUCKET_NAME} connection test, please wait...\"\n echo \"Command is ${_DCY_UTL_CMD} cleanup --dry-run --timeout 8 ${_BACKUP_TARGET}\"\n _ConnTest=$(${_DCY_UTL_CMD} cleanup --dry-run --timeout 8 ${_BACKUP_TARGET} 2>&1)\n if [[ \"${_ConnTest}\" =~ \"No connection to backend\" ]] \\\n || [[ \"${_ConnTest}\" =~ \"does not exist\" ]] \\\n || [[ \"${_ConnTest}\" =~ \"IllegalLocationConstraintException\" ]]; then\n echo \"Sorry, I can't connect to ${_BUCKET_NAME}\"\n echo >> ${_LOGFILE}\n echo \"Sorry, I can't connect to ${_BUCKET_NAME}\" >> ${_LOGFILE}\n echo \"Please check if the bucket has expected name:\" >> ${_LOGFILE}\n echo \" ${_BUCKET_NAME}\" >> ${_LOGFILE}\n echo \"This bucket must exist in the specified ${_SERVICE} region\" >> ${_LOGFILE}\n echo >> ${_LOGFILE}\n else\n echo \"OK, I can connect to ${_BUCKET_NAME}\"\n fi\n}\n\n# Function to check collection-status only\n_status() {\n echo \"Command is ${_DCY_UTL_CMD} collection-status ${_BACKUP_TARGET}\"\n ${_DCY_UTL_CMD} collection-status ${_BACKUP_TARGET}\n wait\n}\n\n# Function to list-current-files only\n_list() {\n echo \"Command is ${_DCY_UTL_CMD} list-current-files ${_BACKUP_TARGET}\"\n ${_DCY_UTL_CMD} list-current-files ${_BACKUP_TARGET}\n wait\n}\n\n_remove_older_than() {\n echo \"Running remove-older-than ${KEEP_WITHIN} for ${_BUCKET_NAME} on $(date)\" >> ${_LOGFILE}\n echo \"Command is ${_DCY_UTL_CMD} remove-older-than ${KEEP_WITHIN} --force ${_BACKUP_TARGET}\"\n ${_DCY_UTL_CMD} remove-older-than ${KEEP_WITHIN} --force ${_BACKUP_TARGET} >> ${_LOGFILE}\n wait\n}\n\n_collection_status() {\n echo \"Running collection-status for ${_BUCKET_NAME} on $(date)\" >> ${_LOGFILE}\n echo \"Command is ${_DCY_UTL_CMD} collection-status ${_BACKUP_TARGET}\"\n ${_DCY_UTL_CMD} collection-status ${_BACKUP_TARGET} >> ${_LOGFILE}\n wait\n}\n\n# Function to only repair incomplete backup sets\n_repair_only() {\n echo \"Running repair via cleanup --force for ${_BUCKET_NAME} on $(date)\" >> ${_LOGFILE}\n echo \"Command is ${_DCY_UTL_CMD} cleanup --force ${_BACKUP_TARGET}\"\n ${_DCY_UTL_CMD} cleanup --force ${_BACKUP_TARGET} >> ${_LOGFILE}\n wait\n}\n\n# Function to repair incomplete backup sets\n_repair() {\n _repair_only\n _collection_status\n}\n\n# Function to check if repair incomplete backup sets is needed\n_check_if_repair() {\n if grep -q \"found incomplete backup sets\" \"${_LOGFILE}\"; then\n _repair_only\n fi\n}\n\n# Function to check if backup worked cleanly or log the errors\n_check_if_worked_cleanly_or_log_err() {\n if [ \"${_user}\" = \"global\" ] || [ \"${_user}\" = \"data\" ] || [ \"${_user}\" = \"custom\" ]; then\n local _logs_dir=\"/root/.remote_backups/logs\"\n else\n local _logs_dir=\"/data/disk/${_user}/static/control/remote_backups/logs\"\n fi\n if grep -q \"Backup Statistics\" \"${_LOGFILE}\"; then\n [ ! -e \"${_logs_dir}\" ] && mkdir -p ${_logs_dir}\n cp -af \"${_LOGFILE}\" \"${_logs_dir}/OK-${_BUCKET_NAME}.log\"\n else\n [ ! -e \"${_logs_dir}\" ] && mkdir -p ${_logs_dir}\n cp -af \"${_LOGFILE}\" \"${_logs_dir}/ERR-${_BUCKET_NAME}.log\"\n fi\n}\n\n# Function to wipe the bucket completely\n_wipe() {\n echo \"Running wipe via remove-all-but-n-full 0 --force for ${_BUCKET_NAME} on $(date)\" >> ${_LOGFILE}\n echo \"Command is ${_DCY_UTL_CMD} remove-all-but-n-full 0 --force ${_BACKUP_TARGET}\"\n ${_DCY_UTL_CMD} remove-all-but-n-full 0 --force ${_BACKUP_TARGET} >> ${_LOGFILE}\n wait\n}\n\n# Function to purge all backup sets\n_purge() {\n _repair_only\n _wipe\n _collection_status\n}\n\n# Function to run weekly cleanup\n_weekly_cleanup() {\n if [ -e \"${_LOGPTH}/${_BUCKET_NAME}.archive.log\" ] \\\n && [ ! -e \"${_LOGPTH}/${_BUCKET_NAME}.${_TODAY}.cleanup.log\" ] \\\n && [ \"${_DOW}\" = 7 ] \\\n && [ \"${_cached}\" = \"YES\" ]; then\n _test \"only\"\n _remove_older_than\n echo \"$(date)\" >> ${_LOGPTH}/${_BUCKET_NAME}.${_TODAY}.cleanup.log\n else\n _test \"only\"\n fi\n}\n\n# Function to clean up old backups\n_cleanup() {\n _remove_older_than\n _collection_status\n}\n\n# Function to perform backup\n_run_backup() {\n export _FULL_BACK_CMD=\"${_DCY_BUP_CMD} ${_BATCH_EXCLUDE} ${_BATCH_INCLUDE} --exclude '**' / ${_BACKUP_TARGET}\"\n echo \"Running in ${_MODE} mode for ${_BUCKET_NAME} on $(date)\" >> ${_LOGFILE}\n echo \"$(date)\" >> ${_LOGPTH}/${_BUCKET_NAME}.${_TODAY}.${_MODE}.log\n ${_DCY_BUP_CMD} ${_BATCH_EXCLUDE} ${_BATCH_INCLUDE} --exclude '**' / ${_BACKUP_TARGET} >> ${_LOGFILE}\n wait\n _print_env \"multiback_run_backup\"\n}\n\n# Function to prepare backup\n_backup() {\n _backup_prepare\n _set_mode\n _set_cmd\n _run_backup\n _check_if_repair\n _weekly_cleanup\n _check_if_worked_cleanly_or_log_err\n if [ -n \"${_MY_EMAIL}\" ] && [ \"${_INCIDENT_REPORT}\" != \"OFF\" ]; then\n boa info >> ${_LOGFILE}\n echo \"Sending email report on $(date)\" >> ${_LOGFILE}\n echo >> ${_LOGFILE}\n s-nail -s \"Backup report (${_MODE}) for ${_BUCKET_NAME} on $(date)\" ${_MY_EMAIL} < ${_LOGFILE}\n fi\n cat ${_LOGFILE} >> ${_LOGPTH}/${_BUCKET_NAME}.archive.log\n rm -f ${_LOGFILE}\n _print_env \"multiback_backup\"\n}\n\n### Legacy procedure for reference\n#\n# Note: Be careful while restoring not to prepend a slash to the path!\n#\n# $ backboa restore file [time] destination\n#\n# Restoring a single file to tmp/\n# $ backboa restore data/disk/o1/backups/foo.tar.gz tmp/foo.tar.gz\n#\n# Restoring an older version of a directory to tmp/ - interval or full date\n# $ backboa restore data/disk/o1/backups 7D8h8s tmp/backups\n# $ backboa restore data/disk/o1/backups 2014/11/11 tmp/backups\n#\n# _restore() {\n# if [ $# = 2 ]; then\n# echo \"Command is ${_DCY_UTL_CMD} restore --path-to-restore $1 ${_BACKUP_TARGET} $2\"\n# ${_DCY_UTL_CMD} restore --path-to-restore $1 ${_BACKUP_TARGET} $2\n# else\n# echo \"Command is ${_DCY_UTL_CMD} restore --path-to-restore $1 --time $2 ${_BACKUP_TARGET} $3\"\n# ${_DCY_UTL_CMD} restore --path-to-restore $1 --time $2 ${_BACKUP_TARGET} $3\n# fi\n# }\n#\n### Legacy procedure for reference\n\n### Duplicity man page https://duplicity.gitlab.io/devel/duplicity.1.html#name\n#\n# duplicity [backup|full|incremental] [options] source_directory target_url\n# duplicity verify [options] [--compare-data] [--path-to-restore ] [--time time] source_url target_directory\n# duplicity collection-status [options] [--file-changed ] [--show-changes-in-set ] [--jsonstat]] target_url\n# duplicity list-current-files [options] [--time time] target_url\n# duplicity [restore] [options] [--path-to-restore ] [--time time] source_url target_directory\n# duplicity remove-older-than